WO2020158342A1

WO2020158342A1 - Vehicle control device and vehicle control system

Info

Publication number: WO2020158342A1
Application number: PCT/JP2020/000573
Authority: WO
Inventors: 敏史大塚
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2019-01-31
Filing date: 2020-01-10
Publication date: 2020-08-06
Also published as: DE112020000166T5; JP2020123264A; JP7223585B2

Abstract

The objective of the present invention is to construct a vehicle control device and a vehicle control system for which the reuse of a driving assistance system or an automatic driving system and the switching of automatic driving control is simplified. From the viewpoint of safety, which is particularly critical in an automatic driving system or a driving assistance system, it is critical to ensure safety even when an error occurs in an automatic driving system process. A vehicle control device has: an automatic driving control module 601 that uses input information from a recognition device 6 and/or a communication device 3 to generate trajectory information; and a predicted safety module 602 that is independent from the automatic driving control module 601, and carries out a safety determination on the basis of the trajectory information generated by the automatic driving control module 601 and a predicted safety map resulting from when the input information from the recognition device 6 and/or the communication device 3 is used to predict a behavior of a peripheral object. The predicted safety module outputs the trajectory information when the result of the safety determination is a safe result, and outputs predicted safe trajectory information, which is trajectory information generated on the basis of the predicted safety map and the input information from the recognition device 6 and/or the communication device 3, when the result of the safety determination is an unsafe result. In addition, a safety condition module 603 is provided for outputting a signal for carrying out a vehicle control in accordance with a prescribed safety condition determination which is based on the trajectory information output by the predicted safety module 602 and the input information from the recognition device 6.

Description

Vehicle control device and vehicle control system

The present invention relates to a vehicle control device and a vehicle control system.

As background art of this technical field, there is JP-A-2018-62244 (Patent Document 1). In Patent Document 1, the problem is "calculate an ideal travel route that is more excellent in running efficiency and comfort in automatic driving or driving assistance." As a solution, "the vehicle control device 10 is a vehicle The vehicle control device 10 includes a left/right boundary line generation unit 100 that calculates left/right boundary lines LB and RB in a traveling path on which the vehicle 11 travels. Further, the vehicle control device 10 sets a constraint point X through which the vehicle 11 travels in the range of the left and right boundary lines LB and RB, and further, with the constraint point X as a constraint condition, the difference between the curvature, the traveling distance, and the center line is set. It has an ideal travel route generation unit 110 that calculates the minimum ideal travel route IDR.” A vehicle control device is disclosed.

Japanese Patent Laid-Open No. 2018-62244

The above-mentioned conventional technology does not describe a method of enhancing the reusability of the system by making each of the logical architecture structures of the hierarchical automated driving system independently operable.

Safety perspective is especially important for automated driving systems and driving support systems, and it is important to reuse safety-related modules among multiple products, reduce development costs, and improve reliability based on operational results.

Also, since the control process of the automatic driving system is complicated, there is a possibility that it may include an error, and it is important to ensure safety even if such an error occurs.

The present invention has been made in view of the above circumstances, and an object of the present invention is to ensure the safety of an automatic driving system and to enable the construction of an automatic driving system that facilitates reuse. And to provide a vehicle control system.

In order to solve the above problems, one embodiment of the present invention may use the technical idea described in the claims, for example. That is, one embodiment of the present invention is a vehicle control device for controlling a vehicle, which includes a recognition device configured by a sensor provided in a vehicle and a communication device that communicates with the outside. An automatic driving control module that generates trajectory information using input information of at least one of a recognition device and the communication device, trajectory information generated by the automatic driving control module, and input of at least one of the recognition device and the communication device The safety judgment is performed based on the predicted safety map of the result of behavior prediction of the surrounding objects using the information, and when the result of the safety judgment is safe, the trajectory information is output, and the result of the safety judgment Is not safe, the predictive safety independent of the automatic driving control module, which outputs predictive safe trajectory information which is trajectory information generated based on the input information of at least one of the recognition device or the communication device and the predictive safety map. And a module.

According to the present invention, with respect to the logical architecture, an automatic driving control module that outputs trajectory information for performing automatic driving, an independent behavior of the automatic driving control module, predict behavior of an object, and output the automatic driving control module. Predictive safety module that determines the safety of orbit information or user operation information, and a configuration that combines a safety condition determination module that performs safety condition determination on the trajectory information output from the predictive safety module and outputs trajectory information Therefore, it becomes possible to construct an automatic driving system that is easy to reuse and can provide the safety of the automatic driving system as needed.

The problems, configurations and effects other than those described above will be clarified by the following description of the embodiments.

It is an example of a vehicle system. 1 is an example of a physical architecture of a vehicle control system. It is an example of composition of ECU. It is an example of composition of a software component. 1 is an example of a logical architecture of a vehicle control system. (A) is an example of external world recognition, (b) is an example of an external world recognition map. It is an example of orbital information. (A) is an example of track information, (b) is an example of travel guidance area information and track information. It is an example of external recognition. It is an example of a prediction safety map. It is an example of predicted safe trajectory information. It is an example of the flowchart of a prediction safety judgment part. It is an example of a logical architecture of a vehicle control system based on a modification of the module configuration. 6 is another example of the logical architecture of the vehicle control system based on the modification of the module configuration. (A), (b) is an example of arrangement of the logical architecture of the vehicle control system to the physical architecture. 6 is an example of a logical architecture of a vehicle control system according to a second embodiment.

Hereinafter, an example (example) of a preferred embodiment of the present invention will be described with reference to the drawings. The present embodiment mainly describes an evaluation device for a vehicle control system, and is suitable for implementation in evaluation of a vehicle system equipped with the vehicle control system, but it does not prevent application to other applications.

[Example 1]
<Vehicle control system configuration>
1 shows the configuration of a vehicle control system (vehicle control device) for evaluation. FIG. 1 is an outline of a vehicle system having a vehicle control system (vehicle control device) according to this embodiment.

Reference numeral 1 is a vehicle system having a vehicle control system inside such as an automobile, and 2 is, for example, an in-vehicle network (CAN: Controller Area Network, CANFD: CAN with Flexible Data-rate, Ethernet (registered trademark), etc.) and a controller (ECU: A vehicle control system 3 configured by an Electronic Control Unit, etc., wirelessly communicates with the outside of the vehicle system 1 (that is, the own vehicle) (for example, mobile phone communication, wireless LAN, WAN, C2X (CartoX: vehicle pair). Communication using a protocol such as vehicle or vehicle-to-infrastructure communication), or communication using GPS (Global Positioning System) and GNSS (Global Navigation Satellite System), and information on the outside world (infrastructure, other vehicles, maps) or self Wireless communication for acquiring/transmitting information about the vehicle), or having a diagnostic terminal (OBD), Ethernet terminal, external recording medium (for example, USB memory, SD card, etc.) terminal, and communicating with the vehicle control system 2. The communication device 4 for implementing the above is, for example, a vehicle control system which is different from the vehicle control system 2 or is configured by a network using the same protocol, and 5 is a machine for controlling the vehicle motion under the control of the vehicle control system 2. And a driving device such as an actuator for driving an electric device (for example, an engine, a transmission, a wheel, a brake, a steering device, etc.), 6 outputs information for acquiring information input from the outside and generating the information. , A camera, a radar, an LIDAR (Light Detection and Ranging), an external sensor such as an ultrasonic sensor, and a mechanical sensor for recognizing the state of the vehicle system 1 (motion state, position information, acceleration, wheel speed, etc.). The recognition device 7, which is connected to the network system by wire or wirelessly, receives data transmitted from the network system, and displays or outputs necessary information such as message information (eg, video, sound), liquid crystal display, warning The output device 8 such as a lamp and a speaker, 8 is, for example, a steering wheel, a pedal, a button, a lever, a touch panel, or the like for generating an input signal for the user to input an operation intention or an instruction to the vehicle control system 2. The input device 9 is a vehicle system 1 for the outside world. It shows a notification device such as a lamp, an LED, a speaker or the like for notifying both states and the like.

The vehicle control system 2 includes other vehicle control systems 4 provided in the vehicle system 1 (that is, the own vehicle), a communication device 3, a drive device 5, a recognition device 6, an output device 7, an input device 8, a notification device 9, and the like. It is connected to and sends and receives information.

<Physical architecture>
FIG. 2 shows an example of the physical architecture of the vehicle control system 2. The physical architecture 300 is also called an H/W (Hardware) configuration.

Reference numeral 301 is a network link connecting network devices on the vehicle-mounted network, for example, a network link such as a CAN bus, 302 is a network link 301 and network links other than the driving device 5, the recognition device 6, and the network link 301 (dedicated line ECU) which is connected to (including) and controls the drive device 5 and the recognition device 6, acquires information, and transmits/receives data to/from the network. The ECU also plays a role of a gateway (hereinafter referred to as GW) that connects a plurality of network links 301 and transmits/receives data to/from each network link.

Examples of the network topology include, in addition to the bus type example in which a plurality of ECUs are connected to the two buses shown in FIG. 2, a star type in which a plurality of ECUs are directly connected to the GW, or an ECU in a series of links. There are a link type connected in a ring shape, a mixed type in which each type is mixed and a plurality of networks are combined, and the like. The ECU 302 controls output of control signals to the drive device 5, acquisition of information from the recognition device 6, output of control signals and information to the network, change of internal state, etc. based on data received from the network. Perform processing.

FIG. 3 shows an example of the internal configuration of the ECU 302. Reference numeral 401 denotes a processor such as a CPU that has a storage element such as a cache or a register and executes control, and 402 denotes data for the drive device 5 and/or the recognition device 6 connected to the network link 301 or the network or a dedicated line. I/O (Input/Output) that transmits and receives data, 403 is a timer that manages time and time using a clock (not shown), and 404 is a ROM (Read Only Memory) that stores programs and nonvolatile data. ), 405 is a RAM (Random Access Memory) for storing programs and volatile data, and 406 is an internal bus used for communication inside the ECU 302. The logical functions described below are executed by the processor 401.

Next, FIG. 4 shows the configuration of software components operating in the processor 401. A communication management unit 502 manages the operation and status of the I/O 402, and issues an instruction to the I/O 402 via the internal bus 406. A time management 503 manages the timer 403 and acquires and controls time information. Reference numeral 501 denotes a control unit that analyzes data acquired from the I/O 402 and controls the entire software component. 504 denotes a data table that holds information such as an external world recognition map described later. 505 denotes temporary data. Represents a buffer that holds.

The configuration of these FIG. 4 shows the operation concept on the processor 401, and the information necessary for the operation is appropriately acquired from the ROM 404 and the RAM 405 or is appropriately written to the ROM 404 and the RAM 405 to operate.

Each function of the vehicle control system 2 described later is executed by the control unit 501.

<Logical architecture>
An example of the logical architecture of the vehicle control system 2 is shown in FIG. FIG. 5 shows a case where the vehicle control system 2 has three layers, which are modules that can operate independently of each other, which are an automatic driving control module, a predictive safety module, and a safety condition determination module, which will be described later.

Reference numeral 600 denotes the entire logical architecture related to this embodiment of the vehicle control system 2. An automatic driving control module 601 acquires information (input information) from one or a plurality of recognition devices 6 and/or communication devices 3 and generates orbit information (orbit information for automatic driving) described later. Obtains information (input information) from one or a plurality of recognition devices 6 and/or communication devices 3, and further, the automatic driving control module 601 or a user operation (a user operation will be described in detail later with reference to FIG. 13). ), the predictive safety module for inputting the orbital information according to ), determining the predictive safety described later, and outputting the orbital information (predictive safe orbital information), 603 is provided from one or more recognition devices 6 and/or the communication device 3. The information (input information) is acquired, and the trajectory information by the predictive safety module 602 or the user operation (the user operation will be described later in detail with reference to FIG. 14) is input, and the conditional safety determination described below is performed to obtain the trajectory information. The safety condition determination module 604 outputs a motion control value from the trajectory information from the safety condition determination module 603 and the vehicle motion information from the recognition device 6, and controls the drive device 5 to drive the vehicle. 2 shows a vehicle motion control unit that outputs information.

Further, the automatic driving control module 601 acquires information from the recognition device 6 and/or the communication device 3, performs a peripheral recognition process described below, and outputs a peripheral recognition information described below, a peripheral recognition unit 611 and a peripheral recognition unit. The external world recognition information from 611 is acquired, the recognition processing described below is performed, and the external world recognition map from the recognition processing unit 612 and the recognition processing unit 612 that outputs the external world recognition map described below is acquired, and trajectory information is generated and predicted. It is configured by a trajectory generation unit 613 which outputs the safety judgment unit 623.

In addition, the predictive safety module 602 acquires information from the recognition device 6 and/or the communication device 3, performs peripheral recognition processing, and outputs external world recognition information from the predictive safety recognition unit 621 and the predictive safety recognition unit 621. A predictive safety planning unit 622 that acquires the external environment recognition information that is output and outputs a predictive safety map and predictive safe trajectory information described below, a predictive safety map and predictive safety trajectory information from the predictive safety planning unit 622, and the trajectory generation. The orbit information output by the unit 613 or the orbit information by the user operation (the user operation will be described later in detail with reference to FIG. 13) is received, the prediction safety determination described below is performed, and appropriate trajectory information is determined as the safety condition determination unit. It is constituted by the predictive safety judgment unit 623, which outputs to 633 and the like.

The safety condition determination module 603 acquires information from the recognition device 6 and/or the communication device 3, performs peripheral recognition processing, and outputs external environment recognition information. The safety condition recognition unit 631 and the safety condition recognition unit 631. Is output from the safety condition planning unit 632 and the safety condition planning unit 632 that obtains the external environment recognition information output by and outputs the safety condition control trajectory information described below for performing the control according to the determination of the safety condition described below. The safety condition control trajectory information and the trajectory information output by the predictive safety control unit 623 or the trajectory information by the user operation (the user operation will be described in detail later with reference to FIG. 14) are received, and the safety condition determination described below is performed. The safety condition determining unit 633 is configured to output appropriate trajectory information to the vehicle motion control unit 604 and the like.

<Peripheral recognition (peripheral recognition unit 611, predictive safety recognition unit 621, safety condition recognition unit 631)>
The type of the recognition device 6 provided in the vehicle system 1 is as described in the configuration of the vehicle control system 2, and the external world recognition information to be described later is acquired by the operation principle according to the type of each recognition device. For example, the outside world (surroundings) is measured using a sensor included in the recognition device 6, and a specific algorithm (for example, an image recognition algorithm for the acquired image) is applied to the measured value to acquire the outside world recognition information.

For each recognition device, the measurable range is determined in advance (for example, if it is a camera, the shooting direction and vertical/horizontal angle, the recognition limit of the far distance by the number of pixels, if it is a radar, the radio wave emission angle and reception The angle (distance) or the change according to the environment is adjusted (calibration) to measure and determine the measurable range. The surrounding situation of the vehicle system 1 can be confirmed by combining the external world recognition information acquired by each recognition device.

Fig. 6(a) shows an example of external recognition. Here, an example is shown in which the recognition device 6 of the vehicle system 1 acquires the external world information. The external world recognition information output from the recognition device 6 makes it possible to confirm what kind of object exists in the vicinity.

It is possible to obtain the external environment recognition information from the communication device 3 provided in the vehicle system 1 as well. From the communication device 3, it is possible to obtain the external world recognition information of the object which is not observable by the recognition device 6 and which exists on the other side of the shield such as the shadow together with the position information, and the position of the object can be confirmed.

In addition, the outside world recognition information acquired by the communication device 3 includes surrounding map information (topography, roads, lane information), road traffic conditions (traffic density, under construction, etc.), other objects calculate themselves, or other It also includes trajectory information of other objects calculated by the object.

<Outside world recognition information (periphery recognition unit 611, predicted safety recognition unit 621, safety condition recognition unit 631)>
The external world recognition information is information representing an object observed by the recognition device 6 or an object received by the communication device 3. Examples of external world recognition information include object type (stationary object (wall, white line, signal, lane, tree, etc.), dynamic object (pedestrian, car, two-wheeled vehicle, bicycle, etc.), traveling (area intrusion) Or other attribute information), relative position information (direction/distance) of the object, absolute position information (coordinates, etc.) of the object and itself, speed, direction (moving direction, face direction), acceleration, existence probability (certain) Likeness), map information, road traffic conditions, time when external environment recognition information was measured, ID of the recognition device that performed the measurement, trajectory assumed by the object, and the like.

<Cognitive processing (cognitive processing unit 612)>
The cognitive processing unit 612 performs behavior prediction, which will be described later, based on the external world recognition information, and generates an external world recognition map.

<Action prediction (cognitive processing unit 612)>
The external world recognition map described later can be created not only by using the currently recognized external world recognition information, but also by predicting (action prediction) from past external world recognition information. For example, after a certain period of time, if it is a stationary object, it is highly likely that it is present at the same position (not the position relative to the vehicle, but the same position on the road surface). It is possible to predict the position after a certain period of time from the acceleration, etc. The recognition processing unit 612 thus predicts the behavior of the object by using the outside world recognition information.

<Outside world recognition map (cognition processing unit 612)>
Information obtained by integrating the external world recognition information output by a plurality of recognition devices is called an external world recognition map. An example of the external world recognition map will be described with reference to FIG. Here, FIG. 6B shows an example in which the object information is arranged for each area with respect to the orthogonal coordinate system (grid) (see FIG. 6A). The object information is, for example, the content obtained by removing the position information from the example of the outside world recognition information, and is arranged in each grid. By recording the information of the objects existing in each grid, it becomes possible to reproduce the present situation of the outside world or the future situation based on the behavior prediction from the outside world recognition map.

<Orbit information (orbit generation unit 613)>
The track information is information representing a track, and the track is represented by, for example, a set of coordinates of the vehicle position at fixed time intervals. In another example, the trajectory is a set of motion control values (target acceleration/yaw rate) at fixed time intervals, a vector value (direction/speed) of the host vehicle at fixed time intervals, and a time for traveling a fixed distance. It can be represented by an interval or the like. An example of the trajectory is shown in FIG. Here, reference numeral 801 denotes a track, and shows a set of (future) coordinates of the own vehicle position at constant time intervals when the vehicle system 1 which is the own vehicle changes the lane to the right lane.

<Trajectory information generation without using travel guidance area information (trajectory generation unit 613)>
Hereinafter, a process for generating a trajectory (information) will be described.

The trajectory generation unit 613 generates trajectory information using the external world recognition map output from the recognition processing unit 612. A method of generating orbit information based on the external world recognition map will be described. The trajectory has safety restrictions such that the vehicle system 1 which is the own vehicle can travel safely (for example, the possibility of collision with other obstacles is low), acceleration/deceleration that can be realized by the vehicle system 1, yaw rate, etc. To satisfy the motion constraint of.

An example of trajectory generation in which the own vehicle moves to the right lane will be described with reference to FIG. Here, an example is shown in which the lane is changed to the right lane. First, the host vehicle satisfies the motion constraint and generates a trajectory (801 in FIG. 7) that moves to the right lane. Then, for the generated trajectory, calculate whether or not a collision will occur based on the predicted trajectory of other dynamic objects (for example, the current velocity and the position after a certain time at the assumed acceleration) and the trajectory of the own vehicle. Generate trajectories and compute safety constraints as well.

As for the method of calculating the safety constraint, in addition to the method of setting the area assumed from the current speed and the assumed acceleration/deceleration of the dynamic object as the entry prohibited area (entry prohibited area method) as described above, the type/speed/ There is a method (potential method) in which a high potential (in this case, a risk value) is given to the traveling direction, a map (potential map) in which the risk value is gradually reduced is generated, and the risk value is calculated. When the potential method is used, a trajectory that has the lowest potential in the generated potential map and that does not enter the potential area above a certain value and that satisfies the motion constraint of the own vehicle is called the generated trajectory. To do.

-For the prohibited area, it is necessary to predict the behavior of the dynamic object. Regarding behavior prediction, there is a method of setting a certain area centered on the point moved at the current speed/acceleration and direction as the entry prohibited area. By thus setting the certain area as the entry prohibition area, calculation by complicated prediction becomes unnecessary.

In this way, the trajectory is created based on the moving direction of the vehicle, the motion constraint, and the safety constraint, and the safety condition determination unit 633 transmits the generated trajectory to the vehicle motion control unit 604 (described later).

<Trajection determination using travel guidance area information (trajectory generation unit 613)>
Next, the processing of the trajectory determination using the travel guidance area information will be described.

The travel guidance area information is information on the area in which the vehicle should travel. For example, if there is lane information or an obstacle from the travel route information such as what route the vehicle travels from the current location to the destination location. It is a traveling area (for example, a traveling lane) that is determined based on information such as lane regulations, traffic jams, and traveling vehicles.

The trajectory generation unit 613 receives the travel guidance region information as a result created by the recognition processing unit 612 from the external world recognition map, or from another control system (not shown), and the received travel guidance region information and the recognition processing unit. The external world recognition map output from 612 is used to generate a trajectory.

Here, the processing when the travel guidance area is a travelable area will be described. First, it is assumed that, in a situation including a track 901 as shown in FIG. 8A, the travel guidance region information is given as a travel guidance region as shown at 903 in FIG. 8B.

In such a situation, the trajectory generation unit 613 performs processing so that the generated trajectory enters the travel guidance area 903. For example, a plurality of trajectory candidates are generated forward, and among them, a trajectory that does not collide with the object in the external world recognition map and exists in the travel guidance area 903 is selected (902 in FIG. 8B). The contents other than the determination of the travel guidance area are the same as the case of the trajectory determination that does not use the travel guidance area information. The track generation unit 613 thus generates track information using the travel guidance area information.

∙ Since there is no information on the driving guidance area in the trajectory determination that does not use the driving guidance area information, basically it is a basic operation to go straight in the lane while avoiding obstacles around it. On the other hand, by using the traveling guidance area information, it is possible to perform advanced control such as changing lanes or traveling in a lane that is easy to move to the destination.

<Predictive Safety Recognition (Predictive Safety Recognition Unit 621)>
The predictive safety recognizing unit 621 outputs the external world recognition information similarly to the surrounding recognition unit 611. The predictive safety recognizing unit 621 acquires and outputs information such as the type, position, orientation, speed, acceleration, etc. of the object, as the information particularly necessary for predicting the behavior of the object. In addition, the trajectory of the object (scheduled future position) may be acquired (received) via the communication device 3.

Fig. 9 shows an example of the external world recognition information output here. Here, the position and direction of the vehicle system 1 which is the own vehicle, the other vehicle 1002, and the pedestrian 1003, and the speed are indicated by arrows, and the predicted safety recognition unit 621 transfers these external world recognition information to the predicted safety planning unit 622. Send.

<Predictive Safety Plan (Predictive Safety Planning Department 622)>
The predicted safety planning unit 622 creates a predicted safety map and predicted safety trajectory information using the external world recognition information output from the predicted safety recognition unit 621.

<Predictive Safety Map (Predictive Safety Planning Department 622)>
The predictive safety map is a map in which the result of the behavior prediction of the object using the external world recognition information is integrated in the same format as the external world recognition map. An example of the predictive safety map is shown in FIG. Here, based on information such as the type, position, orientation, speed, acceleration, etc. of the object, it is shown as a map that predicts where each object is located after a certain period of time. Here, a dark-colored portion is an area in which each object is highly likely to exist after a lapse of a certain time, and a light-colored area is less likely to be present in a certain time. By making a prediction and creating a prediction safety map in this way, it is possible to determine the risk that the vehicle system 1 will approach each object after a certain period of time.

Regarding the prediction of the object, in addition to the method described in the behavior prediction, for example, a method of predicting the position of each object by using the potential method to predict that the object moves to a position with a low potential, or a current position・For linear prediction from direction, speed, and acceleration, a method of predicting with a certain range including the amount of change as an error, or according to each situation (situation), if it is a pedestrian, use a sidewalk or pedestrian crossing. There are methods, such as a method of predicting an action to be performed, by understanding a situation such as continuous walking, changing the lane because the vehicle lights the blinker, and the like.

Regarding the contents to be calculated here, as compared with the contents to be calculated by the recognition processing unit 612, only the information for determining the risk value as the information related to safety needs to be calculated, in other words, the surroundings here. In the behavior prediction of the object, only the behavior prediction necessary for the determination regarding safety needs to be performed as compared with the behavior prediction of the surrounding objects in the recognition processing unit 612. For example, the detailed classification of the object (vehicle type, etc.) and the information of the traveling lane. It is not necessary to process the type of stationary object. By doing so, the operation can be simplified, a relatively simple system with few errors can be constructed, and the reliability can be improved.

Here, the predicted safety map after a lapse of a certain fixed time is shown, but for example, a map after a lapse of a fixed time from the present is every time (for example, when the current time is t=0, t=t1, t2, t3,...・It may be held as a predictive safety map at regular intervals. By doing so, it becomes easy to make a determination at each time together with the position of the own vehicle derived from the track.

Regarding the existing position of an object after a certain time has passed, position information after a certain time such as a trajectory may be acquired from the object or another system via the communication device 3. By doing so, it is possible to improve the prediction accuracy of the future position of the object.

<Predictive safety trajectory information (Predictive Safety Planning Department 622)>
The predicted safety trajectory information is information indicating a trajectory with a low risk that the vehicle system 1 approaches an object with respect to the predicted safety map. An example of the predicted safe trajectory is shown at 1202 in FIG. The predictive safety planning unit 622 generates a trajectory (predictive safety trajectory) so as not to approach the object determined by the predictive safety map, for example, in the direction following the lane. The trajectory generated here is, for example, a trajectory that decelerates the host vehicle so as not to be too close to another object. By doing so, it becomes possible to generate a trajectory that is not close to the predicted behavior of the object.

<Predictive Safety Judgment (Predictive Safety Judgment Unit 623)>
Next, the processing (safety determination) in the predictive safety determination unit 623 will be described using the flowchart in FIG. The predicted safety determination unit 623 receives the trajectory information from the trajectory generation unit 613 of the automatic driving control module 601, and receives the predicted safety map and the predicted safety trajectory information from the predicted safety planning unit 622 (S101). Then, it is determined whether the control based on the received orbit information is predictively safe (S102).

As a specific method of determination, when the vehicle is controlled by the trajectory information and the risk of being close to the object in the predicted safety map is a certain value or more (distance is less than a certain value), it is not safe. judge.

If the result of determination is that it is not safe (No in S102), the predicted safety trajectory information calculated by the predicted safety planning unit 622 is output (S103). When it is determined that the vehicle is safe (Yes in S102), the trajectory information received from the automatic driving control module 601 is output (S104).

In this way, the predictive safety determination unit 623 can output the trajectory information that is determined to be safe in the predictive safety map of the result of predicting the behavior of the object.

In addition, regarding the judgment that it is not safe by the predictive safety map, in addition to the judgment that the risk that the object approaches is a certain value or more, for example, an event such as a violation of the Road Traffic Law (for example, a violation of a driving zone, a prohibited area) It is also possible to judge whether the vehicle is approaching or the speed exceeds the upper and lower limits. For that purpose, the predicted safety recognition unit 621 acquires information about the road traffic law as external information, notifies the predicted safety planning unit 622 and the predicted safety determination unit 623, and the track violates the information about the road traffic law. Determine if there is not. By doing so, it becomes possible to make a safer determination according to the surrounding conditions such as the Road Traffic Law.

Further, as a result of the predictive safety judgment, when it is determined that the orbit information received from the automatic driving control module 601 is not safe, an abnormality may occur in the automatic driving control module 601. Therefore, the orbit information is safe. The warning which is not present is notified to the user via the output device 7, another vehicle via the notification device 9, or another system via the communication device 3. Alternatively, the other vehicle control system 4 is notified, and another safety control (for example, shift to degeneration control) or recording of an operation log is performed.

In this way, it is possible to take measures other than the control based on the predicted safe trajectory information when an abnormality occurs in the vehicle control system 2.

Since the process of the predictive safety module 602 is only the process of determining the safety of the input trajectory information, the input and output trajectories have the same structure (trajectory density, time from start end to end end, etc.). Is. That is, the trajectory information output by the predictive safety module 602 has the same structure as the trajectory information generated by the automatic driving control module 601 which is the input information. The predictive safety module 602 is different only in the portion that determines the safety of the input trajectory information and outputs the trajectory information.

In addition, the predictive safety determination unit 623 may output the trajectory information received from the automatic driving control module 601 in a corrected form when determining that the trajectory information received from the automatic driving control module 601 is not safe. .. For example, when the current track is too close to the preceding vehicle, the position of the track point is corrected to a decelerating track, and the track received from the automatic driving control module 601 in a direction in which no risk occurs in the predicted safety map. May be corrected. By doing so, it is possible to reduce the amount of calculation for separately calculating the predicted safe trajectory information while improving safety.

<Safety condition recognition (safety condition recognition unit 631)>
The safety condition recognition unit 631 performs the same process as the surrounding recognition unit 611 and outputs the external world recognition information.

Since the outside world recognition information output by this safety condition recognition is information used for a safety condition plan and a safety condition determination described later, the information amount and the calculation are larger than the information processed by the peripheral recognition unit 611 and the predicted safety recognition unit 621. The amount is small (for example, a process that uses only the input information of the recognition device 6 and does not use the input information of the communication device 3), the process is simplified, and the mounting error is small, and highly reliable mounting is possible.

<Safety condition plan (Safety condition planning unit 632)>
The safety condition planning unit 632 uses the external environment recognition information output by the safety condition recognizing unit 631 to plan a control that satisfies the safety condition.

Specifically, the distance to the front and surrounding objects included in the outside world recognition information, the speed and acceleration of the opponent vehicle and the own vehicle, the assumed maximum and minimum speeds, acceleration, and acceleration/deceleration when necessary. Using the reaction time (idling time), it is determined whether or not the host vehicle collides with an object in the vicinity or approaches a near distance when the control is continued in the current situation.

After that, when it is determined that the above approach will occur, the trajectory that accelerates in the opposite direction to the approaching direction is output as safety condition control trajectory information.

<Safety condition determination (safety condition determination unit 633)>
When the safety condition planning unit 632 outputs the safety condition control trajectory information, the safety condition determination unit 633 determines that the current traveling state is in a risky state by the determination based on the safety condition, and the safety condition control trajectory information is obtained. Output to the vehicle motion control unit 604. Further, when the safety condition planning unit 632 does not output the safety condition control trajectory information, it is determined that the current traveling state is a risk-free state by the determination based on the safety condition, and the trajectory output by the predictive safety determination unit 623. The information is output to the vehicle motion control unit 604. In this way, the safety condition determination unit 633 outputs trajectory information that satisfies the safety condition (that is, trajectory information corresponding to a signal for performing vehicle control according to the safety condition determination).

<Control based on orbit information>
The vehicle motion control unit 604 controls the drive device 5 so as to realize the trajectory information output by the safety condition determination unit 633. In the control by the trajectory information, the target state and the yaw rate of the vehicle system 1 are calculated by reflecting the system state (current speed, acceleration, yaw rate, etc.) of the vehicle system 1 acquired from the recognition device 6 so that the trajectory can be followed. To do. In order to realize these target speed and yaw rate, necessary control of the drive device 5 is performed. For example, increasing the output of engine torque or motor torque, controlling the brakes to decelerate, steering the steer to achieve the target yaw rate, or braking individual wheels so that the wheel speeds are uneven.・Control acceleration. As a result, the vehicle control system 2 of the vehicle system 1 realizes vehicle control capable of following the target trajectory.

<Change of module configuration>
Next, an example of the logical architecture of the vehicle control system 2 when the predictive safety module 602 and the safety condition determination module 603 are used without using the automatic driving control module 601 will be described.

FIG. 13 shows an example in which the predictive safety module 602 and the safety condition determination module 603 are combined and used as, for example, a driving support system, and FIG. 14 shows an example in which only the safety condition determination module 603 is used as a driving support system. ing.

When the predictive safety module 602 and the safety condition determining module 603 of FIG. 13 are used in combination, unlike the case where the trajectory information is input to the predictive safety determining unit 623 of the predictive safety module 602 described above, the vehicle system is the own vehicle. The operation of the user driving No. 1 is input to the predicted safety determination unit 623 from the input device 8. The trajectory is the position of the own vehicle in the future, but since it is an operation input in the case of a user operation, the position of the own vehicle in the future is predicted from the operation input (for example, the current steering angle and the change amount of the steering angle in the lateral direction). The amount of change in the vertical direction is predicted from the amount of depression of the accelerator pedal or brake pedal and the amount of change in the amount of depression, and the position of the host vehicle after a certain time has elapsed is predicted. Makes a decision (approximating as a trajectory). The other processes are the same as those in the above example.

Similarly, when only the safety condition determination module 603 of FIG. 14 is used, the input of the safety condition determination unit 633 of the safety condition determination module 603 becomes the operation input of the user from the input device 8. In this case as well, the position of the future own vehicle is predicted from the user's operation instead of the trajectory, and is used as an approximate trajectory.

By doing so, when the automatic driving control module 601 (orbit information output by the) is used, it can be used as a module that makes automatic driving safe, and also as a driving support system when the user drives. The same safety control can be performed, and the predictive safety module 602 can be further combined to perform processing depending on whether or not predictive safety is required, and a system that can be easily expanded and reused can be constructed. It will be possible.

The conversion from the user operation input to the trajectory may not be performed by the predictive safety determination unit 623 and the safety condition determination unit 633, but may be performed outside each of them. By doing so, it is not necessary to change the predictive safety determination unit 623 and the safety condition determination unit 633, and the reuse becomes easier.

In addition, switching between these modules is not only performed in another product, but also in one product in automatic operation mode (system performs operation control) and driving support mode (user performs operation control). You may use it. By doing so, the processes of the predictive safety module 602 and the safety condition determination module 603 are made common in each mode, and it is possible to improve the reliability of the system by the ease of switching and the commonization.

<Layout of logical architecture to physical architecture>
The logical architecture 600 described above is composed of a plurality of functions, and there are a plurality of patterns in the function layout to the H/W shown in FIG. An example of the arrangement is shown in FIGS. 15(a) and 15(b). FIG. 15A shows an arrangement example (see also FIG. 5) when the vehicle control system 2 has all three layers of the automatic driving control module 601, the predictive safety module 602, and the safety condition determination module 603, and FIG. b) shows an arrangement example (see also FIG. 13) when the vehicle control system 2 has the predictive safety module 602 and the safety condition determination module 603. The arrangement of the functions is not limited to this, and the respective functions may be arranged in ECUs different from those described.

In addition, not all functions of each module are arranged in one ECU. For example, the peripheral recognition unit 611, the recognition processing unit 612, and the trajectory generation unit 613 of the automatic driving control module 601 are arranged in different ECUs. May be. Conversely, a plurality of modules may be arranged in the same ECU, for example, the predictive safety module 602 and the safety condition determination module 603 may be arranged in the same ECU.

However, the safety condition recognition unit 631, the safety condition planning unit 632, and the safety condition determination unit 633 are arranged in the same ECU as the safety condition determination module 603 in the example of FIGS. 15A and 15B. As a result, the configurations of the ECU and the module are the same in the cases of FIG. 15(a) and FIG. 15(b), and reuse is easier.

Further, since the safety of the trajectory information generated by the automatic driving control module 601 is determined by the predictive safety module 602 and the safety condition determination module 603, the automatic driving control module 601 and the automatic driving control module 601 are provided so as not to cause a failure due to a common cause. The predictive safety module 602 and the safety condition determination module 603 are preferably arranged in different ECUs or processors, or designed so as not to depend on each other inside the processor.

Particularly, the predictive safety module 602 can be used as a module for independently determining the safety because it inputs the trajectory information and outputs the trajectory information for which the safety is determined. For example, by connecting an ECU having the predictive safety module 602 and inputting and outputting the trajectory information generated by another automatic driving control module 601 to the ECU, it is possible to additionally determine the safety.

<Module reliability>
The safety condition determination module 603 imparts higher reliability than the other predictive safety module 602 and the automatic driving control module 601, or the same reliability as the predictive safety module 602 and higher reliability than the automatic driving control module 601, and thus the safety of the entire system. It is useful to use as a mechanism. Thereby, for example, the safety condition determination module 603 prevents an unsafe event from occurring due to the determination of the safety condition determination module 603 even when the predictive safety module 602 or the automatic driving control module 601 performs an erroneous process. It will be possible.

Furthermore, the predictive safety module 602 can deal with an error of the automatic driving control module 601 including the behavior prediction of the object which is difficult to prevent only by the safety condition determination module 603. Therefore, it is useful that the predictive safety module 602 secures safety with higher reliability than the automatic driving control module 601 while performing complicated processing with reliability not higher than the safety condition determination module 603.

With this, even if the automatic operation control module 601 has a relatively low reliability, it is possible to design without impairing the reliability of the entire system, and it is possible to achieve high reliability and low cost of the entire system.

[Example 2]
Next, FIG. 16 is used for an example (Embodiment 2) in which the predictive safety planning unit 622 of the predictive safety module 602 and the trajectory generation unit 613 of the automatic driving control module 601 grasp the judgment conditions of the respective modules and make a plan. Explain. FIG. 16 shows an example of the logical architecture of the vehicle control system 2 according to the second embodiment. In the second embodiment, the same components as those in the first embodiment are designated by the same reference numerals and detailed description thereof will be omitted.

The first example is an example in which the predictive safety planning unit 622 of the predictive safety module 602 grasps the determination conditions of the safety condition determining unit 633 and makes a plan. In this case, the predicted safety planning unit 622 recognizes under what conditions the safety condition determining unit 633 determines the safety. Specifically, it is under what conditions the distance, speed, and acceleration with respect to the preceding vehicle are controlled for deceleration. By grasping this determination condition, the predicted safety planning unit 622 generates predicted safety trajectory information that is not determined to be unsafe according to the determination condition.

Similarly, the trajectory generation unit 613 of the automatic driving control module 601 grasps the determination content of the predicted safety determination unit 623 and the determination content of the safety condition determination unit 633, and obtains the trajectory information that each determination unit does not determine to be unsafe. To generate. The determination of the determination condition by the safety condition determination unit 633 is as described above. In order to understand the judgment content of the predictive safety judgment unit 623, first, the predictive safety map output by the predictive safety planning unit 622 is received, and the judgment content (the threshold value of the predictive safety map etc.) of the predictive safety judgment unit 623 is acquired. It is determined in advance whether or not the generated trajectory information is determined to be unsafe according to the determination content of the predictive safety determination unit 623.

By doing so, the predictive safety module 602 generates trajectory information that does not satisfy the determination condition of the safety condition determining module 603, and the automatic driving control module 601 causes the predictive safety module 602 and the safety condition determining module 603 to operate. The trajectory information that does not satisfy the determination condition is generated, and the vehicle system 1 becomes in a state in which the control cannot be performed as expected due to, for example, unexpected control (unnecessary avoidance cannot be performed, control becomes unstable due to unexpected braking, etc.). ) Can be prevented.

Regarding the acquisition of the above information, not only the information may be directly acquired from each of the judgment units, but also the communication may be acquired from the outside that separately grasps the information.

[Operational effects of Examples 1 and 2]
According to the embodiments described above, the safety of the orbit information is determined based on the information of the automatic operation control module 601 that generates the orbit information and the behavior of surrounding objects, and if necessary. Predictive safety module 602 that outputs predicted safety trajectory information, and safety condition determination module 603 that determines safety conditions and outputs safety condition control trajectory information when it is determined to be unsafe by the safety condition determination module 603. Therefore, the vehicle control system 2 can be constructed in such a manner that each property can be secured and each can be reused.

In particular, the predictive safety module 602 makes a determination using the predictive safety map obtained as a result of the safety prediction of the surrounding objects with respect to the input trajectory information, and the safe trajectory information (input trajectory information, or By outputting the generated predicted safe trajectory information), even if the automatic driving control module 601 generates erroneous trajectory information, it is possible to continue the control safely and detect an abnormality. With this configuration, reuse becomes easy.

In addition, the predictive safety module 602, which is relatively simple in processing, is used for the automatic driving control module 601 to determine the safety, so that a simple structure is provided for simple processing, and high reliability is facilitated. .. This allows the automatic operation control module 601 to execute complicated processing. The same applies to the predicted safety module 602 and the safety condition determination module 603.

When constructing a driving support system using the predictive safety module 602 and the safety condition determination module 603, the predictive safety module 602 and the safety condition determination module are approximated by approximating the operation of the user driving the own vehicle to the trajectory. It becomes easy to construct the vehicle control system 2 by reusing the 603.

In another embodiment, the automatic driving control module 601, the predictive safety module 602, and the safety condition determination module 603, which are each independently operable, generate trajectory information after grasping mutual determination conditions. It is also possible to avoid destabilization of control due to inconsistency of each state.

As described above, the vehicle control system (vehicle control device) 2 according to the present embodiment includes the automatic driving control module 601 that generates the trajectory information by using the input information of at least one of the recognition device 6 and the communication device 3, and the automatic driving. The safety determination is performed based on the trajectory information generated by the control module 601 and the predicted safety map of the result of behavior prediction of the surrounding objects using the input information of at least one of the recognition device 6 and the communication device 3, and When the result of the safety judgment is safe, the trajectory information is output, and when the result of the safety judgment is not safe, the input information of at least one of the recognition device 6 and the communication device 3 and the predicted safety map. And a predictive safety module 602 independent of the automatic driving control module 601 for outputting predictive safe trajectory information which is trajectory information generated based on the above. Further, it further comprises a safety condition determination module 603 that outputs a signal for performing vehicle control according to a predetermined safety condition determination from the trajectory information output by the predictive safety module 602 and the input information of the recognition device 6. is there.

According to the present embodiment configured as described above, for the logical architecture 600, an automatic operation control module 601 that outputs trajectory information for performing automatic operation, and independent of the automatic operation control module 601, perform behavior prediction of an object, A predictive safety module 602 that determines the safety of the trajectory information or user operation information output by the automatic driving control module 601, and a safety condition determination is performed on the trajectory information output from the predictive safety module 602, and trajectory information is output. With the configuration in which the safety condition determination module 603 is combined, it is possible to construct an automatic driving system that is easy to reuse and can provide the safety of the automatic driving system as needed.

It should be noted that the present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail for the purpose of explaining the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of a certain embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of a certain embodiment. Further, with respect to a part of the configuration of each embodiment, other configurations can be added/deleted/replaced.

Also, each of the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them with, for example, an integrated circuit. Further, each of the above-described configurations, functions, and the like may be realized by software by a processor interpreting and executing a program that realizes each function. Information such as programs, tables, and files for realizing each function can be stored in a memory, a storage device such as a hard disk, SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

Also, the control lines and information lines are shown to be necessary for explanation, and not all control lines and information lines are shown on the product. In practice, it may be considered that almost all configurations are connected to each other.

1 Vehicle system 2 Vehicle control system (vehicle control device)
3 Communication Device 4 Vehicle Control System 5 Drive Device 6 Recognition Device 7 Output Device 8 Input Device 9 Notification Device 300 Physical Architecture 301 Network Link 302 ECU
401 processor 402 I/O
403 Timer 404 ROM
405 RAM
406 Internal bus 501 Control unit 502 Communication supervision unit 503 Time management unit 504 Data table 505 Buffer 600 Logical architecture 601 Automatic driving control module 602 Predictive safety module 603 Safety condition determination module 604 Vehicle motion control unit 611 Peripheral recognition unit 612 Cognitive processing unit 613 Trajectory generation unit 621 Predicted safety recognition unit 622 Predicted safety planning unit 623 Predicted safety judgment unit 631 Safety condition recognition unit 632 Safety condition planning unit 633 Safety condition judgment unit 801 Track 901 Track 902 Track 903 Driving guidance area 1002 Other vehicle 1003 Pedestrian 1202 Predicted safe orbit 1301 orbit

Claims

A vehicle control device for controlling a vehicle equipped with a recognition device configured by a sensor provided in the own vehicle and a communication device for communicating with the outside,
An automatic driving control module that generates trajectory information using input information of at least one of the recognition device or the communication device,
Trajectory information generated by the automatic driving control module, and performs safety determination based on a predicted safety map of the result of behavior prediction of surrounding objects using the input information of at least one of the recognition device or the communication device, If the result of the safety judgment is safe, the trajectory information is output, and if the result of the safety judgment is not safe, based on the input information of at least one of the recognition device or the communication device and the predicted safety map. A vehicle control device comprising: a predicted safety module that is independent of the automatic driving control module and outputs predicted safety trajectory information that is generated trajectory information.
The vehicle control device according to claim 1,
Vehicle control further comprising a safety condition determination module that outputs a signal for performing vehicle control according to a predetermined safety condition determination from the trajectory information output from the predictive safety module and the input information from the recognition device. apparatus.
The vehicle control device according to claim 1,
The vehicle control device, wherein the behavior prediction of the surrounding objects by the predictive safety module performs only the behavior prediction necessary for the determination regarding safety as compared with the behavior prediction of the surrounding objects in the automatic driving control module.
The vehicle control device according to claim 1,
In the behavior prediction of the surrounding objects by the predictive safety module, the trajectory information of the objects received via the communication device is used.
The vehicle control device according to claim 1,
The vehicle control device is characterized in that the track information generated by the automatic driving control module and the track information output by the predictive safety module have the same structure.
The vehicle control device according to claim 1,
The predictive safety module approximates and uses an operation of a user who drives the vehicle as a trajectory.
The vehicle control device according to claim 1,
The vehicle control device, wherein the predictive safety module has higher reliability than the automatic driving control module.
The vehicle control device according to claim 2,
The predictive safety module has a reliability higher than that of the automatic driving control module and lower than or equal to that of the safety condition determination module.
The vehicle control device according to claim 2,
The vehicle control device, wherein the automatic driving control module generates trajectory information by using at least one of the determination conditions of the predictive safety module and the safety condition determination module.
The vehicle control device according to claim 2,
The vehicle control device, wherein the predictive safety module generates trajectory information using the determination condition of the safety condition determination module.
A vehicle control system for controlling a vehicle equipped with a recognition device configured by a sensor provided in a vehicle and a communication device for performing communication with the outside,
An automatic driving control module that generates trajectory information using input information of at least one of the recognition device or the communication device,
Trajectory information generated by the automatic driving control module, and performs safety determination based on a predicted safety map of the result of behavior prediction of surrounding objects using the input information of at least one of the recognition device or the communication device, If the result of the safety judgment is safe, the trajectory information is output, and if the result of the safety judgment is not safe, based on the input information of at least one of the recognition device or the communication device and the predicted safety map. Outputting predicted safety trajectory information that is generated trajectory information, a prediction safety module independent of the automatic driving control module,
A vehicle including a safety condition determination module that outputs a signal for performing vehicle control according to a predetermined safety condition determination from the trajectory information output from the predictive safety module and the input information of the recognition device. Control system.