WO2020235317A1 - Control device - Google Patents

Control device Download PDF

Info

Publication number
WO2020235317A1
WO2020235317A1 PCT/JP2020/018069 JP2020018069W WO2020235317A1 WO 2020235317 A1 WO2020235317 A1 WO 2020235317A1 JP 2020018069 W JP2020018069 W JP 2020018069W WO 2020235317 A1 WO2020235317 A1 WO 2020235317A1
Authority
WO
WIPO (PCT)
Prior art keywords
safety
area data
control
control output
output
Prior art date
Application number
PCT/JP2020/018069
Other languages
French (fr)
Japanese (ja)
Inventor
金川　信康
中川　慎二
朋仁 蛯名
一 芹沢
Original Assignee
日立オートモティブシステムズ株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 日立オートモティブシステムズ株式会社 filed Critical 日立オートモティブシステムズ株式会社
Publication of WO2020235317A1 publication Critical patent/WO2020235317A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B13/00—Adaptive control systems, i.e. systems automatically adjusting themselves to have a performance which is optimum according to some preassigned criterion
    • G05B13/02—Adaptive control systems, i.e. systems automatically adjusting themselves to have a performance which is optimum according to some preassigned criterion electric
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B9/00—Safety arrangements
    • G05B9/02—Safety arrangements electric

Definitions

  • the present invention relates to a control device.
  • Patent Document 1 proposes a technique for ensuring the safety of control by artificial intelligence by adding a safety verification function to the control operation candidates by artificial intelligence.
  • the operation is permitted only when the safety of the control operation candidate is confirmed based on the actual operation results, or only when the safety is limited to the confirmed range. By doing so, the safety of operation of the control system can be guaranteed.
  • the present invention has been made in view of the above points, and an object of the present invention is to provide a control device capable of ensuring the safety of control operation candidates even under conditions where there is no actual operation record. That is.
  • the control device of the present invention that solves the above problems includes an intelligent control unit that generates a control output based on a predetermined input, and safety that determines whether or not the control output is within preset safety area data.
  • the verification unit allows control by the control output when the control output is within the safety area data, and prohibits control by the control output when the control output is outside the safety area data, or the control output. Is provided with an output control unit that limits and controls the data in the safety area data, and the safety verification unit is characterized in that the safety area data is changed according to the operating conditions of the control target.
  • the control output under other operating conditions is obtained from the safe operating record data of the control device collected under specific conditions.
  • a safety limit output can be generated. Therefore, it is possible to ensure the safety of the control operation candidate even under the condition that there is no operation record.
  • the block diagram of the control device in 1st Embodiment The figure explaining the method of scaling the safety area data by the operating condition.
  • the figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 2 was scaled by the friction coefficient ⁇ .
  • the figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 8 was scaled with a double depth 2Do.
  • the figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 8 was scaled with 3 times the depth 3Do.
  • the figure which shows the safety area data which confirmed the safety when the bending angle ⁇ of an intersection is 90 degrees.
  • the figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 11 was scaled by the bending angle ⁇ of an intersection 120 degrees.
  • FIG. 5 is a diagram showing safety region data shown in FIG. 5 in which safety region data for which safety has been confirmed is scaled at a vehicle speed of 3 Vo, and the safety region data after scaling is corrected by the amount of tire slide (oversteer, understeer).
  • FIG. 4 is a block diagram illustrating another embodiment of the control device corresponding to FIG.
  • FIG. 9 is a block diagram illustrating another embodiment of the control device corresponding to FIG.
  • control device of the present invention is applied to the automatic driving control of the vehicle
  • the present invention is not limited to this, and the control device may be used for other moving bodies.
  • FIG. 1A is a block diagram of the control device according to the first embodiment
  • FIG. 1B is a diagram illustrating a method of scaling (enlarging or reducing) the safety region data according to operating conditions.
  • the control device 2 of the present embodiment is connected to an operation interface unit (not shown) by wire or wirelessly, and is a safety control output for controlling a control target (not shown) based on the operation amount information input from the operation interface unit. Generate 50.
  • the control device 2 includes an automatic control unit 20 that generates an automatic control output, a safety verification unit 30 that verifies the safety of the automatic control output, and an AND gate 40 that constitutes the output control unit 3.
  • To verify the safety of the automatic control output is to determine whether the control target operates safely when the automatic control output is input from the output control unit 3 to a control target (not shown).
  • the control device 2 has a configuration in which the automatic control output of the automatic control unit 20 is output when the safety can be ensured by the safety verification unit 30, and the output of the automatic control output is restricted when the safety cannot be ensured.
  • the control device 2 is expected to realize control performance beyond human knowledge by introducing artificial intelligence such as deep learning or machine learning by the automatic control unit 20 which is an intelligent control unit. However, it is desirable to improve the accountability (accountability, accountability) related to safety because it exceeds human knowledge.
  • the safety verification unit 30 can ensure the safety of the control device 2 even in advanced control beyond human intelligence by artificial intelligence.
  • the safety verification unit 30 has a determination circuit 301 in which a predetermined input 4 and an automatic control output 21 are input and a verification output (verification result) corresponding to those values 4 and 21 is output.
  • the verification result which is the confirmation result of safety, is output as either "OK" (with safety) or "NG” (without safety).
  • the safety verification unit 30 is not limited to the current input 4 and the current automatic control output 21, but can also use the transition state from the past value. When paying attention to the state transition from the past value (with transition check 302), the input 4 one sample before (Z -1 ) and the automatic control output 21 are also input to the determination circuit 301A.
  • the determination circuit 301 is based on the current predetermined input 4 and the current automatic control output 21, and the predetermined input 4 one sample before and the automatic control output 21 (that is, the past input 4 and the past automatic control output 21). Then, the verification result with safety (OK) or without safety (NG) is output.
  • the safety verification unit 30 When the verification result of the determination circuit 301 is "OK" (safety), the safety verification unit 30 outputs a signal to the AND gate 40 of the output control unit 3, and the AND gate 40 automatically controls the automatic control unit 20. The control output 21 can be output. On the other hand, when the verification result of the determination circuit 301 is "NG" (no safety), the safety verification unit 30 outputs a signal to the AND gate 40 and outputs the output of the automatic control output 21 to the AND gate 40. Try to block or limit. When the verification result of the safety verification unit 30 is NG, the output control unit 3 prohibits the control by the automatic control output 21, or limits the automatic control output 21 to the safety area data and controls it. Since the safety verification unit 30 monitors the safety of the automatic control output 21 from the automatic control unit 20, the control device 2 can guarantee the safe operation of the controlled object.
  • the safety verification unit 30 is provided with a safety area database that stores the range in which the automatic control output 21 has experienced safe control results in the past as safety area data.
  • the safety verification unit 30 collects operation record data whose control output is safe under a specific operating condition i, acquires safety area data which is a safe control output range, and stores it in the safety area database. Then, as shown in FIG. 1B, by scaling the safety area data under the specific operating condition i based on the operating condition, the safety area data under the specific operating condition i is different from the specific operating condition i. Generates safe area data where the control output is safe under other operating conditions.
  • the safety verification unit 30 of the present embodiment changes the safety area data acquired under the specific operating condition i by scaling the operating conditions, and the safety area data corresponding to the conditions 1 to n (n is an integer). To generate.
  • the safety verification unit 30 actually operates the simulation or the actual machine, verifies whether the operation result of the control output using the safety area data generated by scaling is safe, and uses the data confirmed to be safe as the safety area. Get as data.
  • the control device 2 of the present embodiment collects safe operation record data (safety area data) of the control device 2 under specific operating conditions. Then, the relationship between the operating condition and the boundary value of the safe operation record data of the control device (particularly, the proportional relationship and the inverse proportional relationship) is analyzed. Then, by scaling based on the relationship, the safety area data of the control device 2 under different operating conditions is generated.
  • the safe area data has at least one dimension (the number of variables to be combined), and scaling is performed by scaling the safe area data on the axis of a specific dimension or multiplying it by a coefficient in a specific dimension. Will be.
  • the safety area data is acquired for a specific operating condition i
  • the safety area data is scaled according to the conditions, so that the safety area data corresponding to the conditions 1 to n that have no operation record is obtained. Can be obtained. Therefore, it is not necessary to acquire the operation record data under the conditions 1 to n, and the time for acquiring these safety area data can be significantly shortened.
  • the combination of the speed command value and the steering angle command value is used as the safety region data in the automatic driving control of the vehicle, and the operating condition is the friction coefficient of the road surface on which the moving vehicle travels. ..
  • FIGS. 2 and 3 are diagrams for explaining the contents of the control device of the second embodiment
  • FIG. 2 is a diagram showing safety-confirmed safety region data defined by a speed command value and a steering angle command value
  • FIG. 3 is a diagram showing the safety region data after scaling of the safety region data whose safety has been confirmed shown in FIG. 2 by the friction coefficient ⁇ .
  • the upper and lower straight lines (boundary A) shown in FIGS. 2 and 3 are the maximum steering angles determined by the structure of the steering mechanism, and the upper right and lower right curved parts (boundary B) shown are centrifugal forces. This is an area constrained by tire grip.
  • the safety verification unit 30 acquires safety region data (Sa in FIG. 2) from operation record data when the friction coefficient ⁇ of the road surface is 1.0 (condition i), and obtains the safety region data as friction coefficient ⁇ or friction coefficient ⁇ .
  • the coefficient of friction ⁇ of any road surface including the safety region data (Sa in FIG. 3) when the coefficient of friction ⁇ of the road surface is 0.5 Safe area data can be generated.
  • the limit velocity v is obtained as follows, and is proportional to the friction coefficient ⁇ when the TTC (Time to collision) is constant, that is, when the stop time is constant, and when the stop distance is constant, the friction coefficient is constant. It is proportional to the square root of ⁇ .
  • ⁇ Third Embodiment> when controlling the vehicle, the combination of the elapsed time after entering the intersection and the steering angle command value is used as the safety region data.
  • FIG. 4 and 5 are diagrams for explaining the contents of the control device of the third embodiment
  • FIG. 4 is a diagram showing an example of the feature amount of the shape of the intersection
  • FIG. 5 is a diagram showing safety at a vehicle speed Vo. It is a figure which shows the safety area data which confirmed sex.
  • the road 400 has a so-called four-forked road shape in which two straight roads 401 and 402 intersect at substantially right angles.
  • the own vehicle 200 is automatically controlled to go straight on one straight road 401, enter the intersection 403 from the intersection entrance 411, turn right at the intersection 403, and follow the route traveling on the other straight road 402.
  • the intersection 403 can be represented by the size of the intersection and the bending rotation angle as the feature amount of the shape.
  • the size of the intersection can be expressed by the distance D of the depth from the entrance of the intersection.
  • the straight line distance from the intersection entrance 411 to the intersection exit on one straight road 401 is the depth D
  • the right turn angle from the intersection entrance 411 on one straight road 401 to the intersection exit 412 on the other straight road 402 is.
  • the angle ⁇ is the angle ⁇ .
  • the safety verification unit 30 acquires safety area data capable of safely turning right at the intersection 403 at vehicle speed Vo from the operation record data, and generates safety area data Sa for which safety has been confirmed.
  • the safety area data Sa is defined by a combination of the elapsed time t after entering the intersection 403 and the steering angle command value ⁇ when the intersection 403 is turned right.
  • the area outside the safety area data Sa is the attention area Sb that pays attention to driving.
  • the safety verification unit 30 scales the safety area data Sa according to the depth D representing the feature amount of the shape of the intersection, the angle ⁇ , and the speed (vehicle speed) V of the moving body.
  • FIG. 6 is a diagram showing the safety region data after scaling of the safety confirmed safety region data shown in FIG. 5 at a vehicle speed of 2 Vo
  • FIG. 7 is a diagram showing the safety region data after scaling shown in FIG. It is a figure which shows the safety area data after scaling by scaling the data at 3 times the vehicle speed 3Vo.
  • the safety region data Sa after scaling which is obtained by scaling the safety region data for which safety has been confirmed shown in FIG. 5 at a vehicle speed of 2 Vo, reduces the elapsed time t to half the size as shown in FIG. Has a large size.
  • the safety area data after scaling which is obtained by scaling the safety confirmed safety area data shown in FIG. 5 at a vehicle speed of 3 Vo, reduced the elapsed time t to one-third of the size as shown in FIG. It has a size.
  • the elapsed time t after entering the intersection 403 is scaled in inverse proportion to the speed (vehicle speed) V of the moving body. Therefore, for example, if the safety area data whose safety has been confirmed is obtained from the operation record data of the speed Vo, the safety area data corresponding to an arbitrary speed V can be obtained by scaling.
  • FIG. 8 is a diagram showing the safety area data for which the safety has been confirmed at the depth Do of the intersection
  • FIG. 9 shows the safety area data for which the safety has been confirmed shown in FIG. 8 after scaling with a double depth of 2 Do
  • FIG. 10 is a diagram showing the safety area data of FIG. 10, which is a diagram showing the safety area data after scaling by scaling the safety area data of the safety confirmed shown in FIG. 8 with a depth of 3 Do.
  • the safety region data Sa after scaling which is obtained by scaling the safety region data whose safety has been confirmed in FIG. 8 with a double depth of 2 Do, reduces the steering angle command value ⁇ to a predetermined size as shown in FIG. It has a size.
  • FIG. 9 shows the safety region data Sa after scaling
  • the safety region data Sa after scaling which is obtained by scaling the safety region data whose safety has been confirmed in FIG. 8 with a depth of 3 Do, has a steering angle command value ⁇ further than that in the case of a depth of 2 Do. It has a reduced size.
  • the steering angle command value ⁇ is scaled in proportion to sin -1 (L / D). Therefore, for example, if the safety-confirmed safety area data is acquired from the operation record data of the depth Do, the safety area data corresponding to an arbitrary depth D can be obtained by scaling.
  • FIG. 11 is a diagram showing safety-confirmed safety area data when the bending angle ⁇ of the intersection is 90 degrees
  • FIG. 12 is a diagram showing safety-confirmed safety area data shown in FIG. 11 with the bending angle ⁇ of the intersection.
  • FIG. 13 shows the safety area data after scaling obtained by scaling the safety confirmed safety area data shown in FIG. 11 at an intersection bending angle ⁇ of 45 degrees
  • FIG. 14 is a diagram showing the safety area data after scaling of the safety confirmed safety area data shown in FIG. 11 by scaling the intersection bending angle ⁇ at 30 degrees.
  • FIG. 15 is a diagram showing safety region data in which the safety-confirmed safety region data shown in FIG. 2 is corrected by the amount of tire slide (understeer, oversteer), and
  • FIG. 16 is a diagram showing safety-confirmed safety region data shown in FIG. It is a figure which shows the safety area data which scaled the safety area data at 3 times the vehicle speed 3V, and corrected the safety area data after scaling by the slide amount (oversteer, understeer) of a tire.
  • the safety area data Sa defined by the speed command value and the steering angle command value also considers the safety area data Sc and Sd that allow tire slide (oversteer, understeer) in the area constrained by centrifugal force and tire grip force. Can be set. In this case, as shown in FIG. 16, the safety region data Sa of the steering angle command value is also set in consideration of the tire slide (oversteer, understeer).
  • FIG. 17 is a block diagram of the control device according to the fifth embodiment
  • FIG. 18 is an explanatory diagram of the operation of the safety verification unit.
  • the same components as those in the above-described embodiment are designated by the same reference numerals, and detailed description thereof will be omitted.
  • the safety verification unit 30A of the control device 2A has a determination circuit 301A and a transition check 302. As shown in FIG. 17, the determination circuit 301A of the safety verification unit 30 has the current predetermined input 4 and the current automatic control output 21, and the predetermined input 4 one sample before and the automatic control output 21 (that is, the past input). Based on 4 and the past automatic control output 21), the verification result with safety (OK) or without safety (NG) is output.
  • the operation of the safety verification unit 30A can be defined by using, for example, CAM (Content Addressable Memory, associative memory) or the like.
  • CAM Content Addressable Memory, associative memory
  • a combination of a predetermined input 4 and an automatic control output 21 and a past predetermined input 4 and a past automatic control output 21 in the case of having a transition check 302 is set as an entry, and a verification output corresponding to them is input. (OK / NG) is preset.
  • This embodiment configured in this way also has the same effect as that of the first embodiment. Further, the safety verification unit 30A of the present embodiment can determine whether the automatic control output 21 is safe in consideration of the past input 4 and the past automatic control output 21. As a result, safety can be verified more efficiently and with high reliability.
  • FIG. 19 is a block diagram of the control device according to the sixth embodiment
  • FIG. 20 is an explanatory diagram of the operation of the safety verification unit.
  • the same components as those in the above-described embodiment are designated by the same reference numerals, and detailed description thereof will be omitted.
  • the control device 2B can output the automatic control output 21 so as to be within a predetermined range determined by a predetermined control output upper limit value and a predetermined control output lower limit value.
  • the control device 2B includes an automatic control unit 20, a safety verification unit 30B, and a limit value selection circuit 41.
  • the determination circuit 301B of the safety verification unit 30B When the current predetermined input 4 and the current automatic control output 21 are input, the determination circuit 301B of the safety verification unit 30B outputs the control output upper limit and the control output lower limit corresponding to them.
  • the safety verification unit 30B can pay attention to the state transition from the past value as in each of the above-described embodiments. That is, in addition to the current input 4 and the current automatic control output 21, the safety verification unit 30B also inputs the past input 4 one sample before (Z -1 ) and the past automatic control output 21.
  • the determination circuit 301B of the safety verification unit 30B outputs the control output upper limit and the control output lower limit corresponding to the current and past information.
  • the limit value selection circuit 41 When the input automatic control output 21 is between the control output upper limit and the control output lower limit, the limit value selection circuit 41 outputs the automatic control output 21 as the safety limit output 50. When the input automatic control output 21 exceeds the control output upper limit, the limit value selection circuit 41 outputs a value obtained by limiting the automatic control output 21 to the control output upper limit as the safety limit output 50. When the input automatic control output 21 is lower than the control output lower limit, the limit value selection circuit 41 outputs a value obtained by limiting the automatic control output 21 to the control output lower limit as the safety limit output 50.
  • the limit value selection circuit 41 can also output the safety verification result as the status 51.
  • the status of the safety verification result is divided into a plurality of stages of, for example, "OK”, “OK w / limit”, and "NG".
  • the status "OK” is when the automatic control output 21 is within the range of the control output lower limit and the control output upper limit.
  • the status "OK w / limit” is when the automatic control output 21 exists outside the range between the control output lower limit and the control output upper limit, but can be corrected to a value between the control output lower limit and the control output upper limit. is there. That is, it is a case where the automatic control output 21 can be corrected within the range of the control output lower limit and the control output upper limit.
  • the status “NG” means that the automatic control output 21 does not exist within the range between the control output lower limit and the control output upper limit, and the value in the range between the control output lower limit and the control output upper limit cannot be taken (control output). Lower limit ⁇ when the upper limit of control output does not hold).
  • FIG. 20 shows the operation of the safety verification unit 30B in this embodiment. Similar to that described in FIG. 18, the safety verification unit 30B can be configured equivalent to CAM. When the combination of the current predetermined input 4 and the past predetermined input 4 and the past automatic control output 21 is input in the case of the transition check, the safety verification unit 30B corresponds to the control output upper limit. And output the lower limit of control output.
  • the safety verification unit 30B outputs the limit output lower limit and the limit output upper limit, and the limit value selection circuit 41 safety limits the automatic control output 21 so as to be within the range between the limit output lower limit and the limit output upper limit. Output as output 50. Further, the safety verification unit 30B of this embodiment can output the status of the safety verification result in a plurality of stages of "OK", "OK w / limit", and "NG”. Therefore, according to this embodiment, the safety limit output 50 can be obtained more flexibly and safely by using the automatic control output 21.
  • FIGS. 17 and 22 are block diagrams illustrating another embodiment of the control device corresponding to FIGS. 17 and 19.
  • the control device 2A'shown in FIG. 21 and the control device 2B'shown in FIG. 22 are safety-verified in the configurations of the control device 2A of the fifth embodiment shown in FIG. 17 and the control device 2B of the sixth embodiment shown in FIG. It has a configuration in which coefficient units 100 to 102 for multiplying the input / output of units 30A and 30B by a coefficient for scaling are added.
  • the method of preliminarily creating the safety area data of a plurality of conditions from the safety area data based on one operation record data has a huge amount of data.
  • one data can correspond to various operating conditions, and the amount of data can be significantly reduced.
  • the present invention is not limited to the above-described embodiments, and various designs are designed without departing from the spirit of the present invention described in the claims. You can make changes.
  • the above-described embodiment has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations.
  • it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment and it is also possible to add the configuration of another embodiment to the configuration of one embodiment.
  • Control device 3 Output control unit 4: Input 20: Automatic control unit (intelligent control unit) 21: Automatic control output 30, 30A, 30B: Safety verification unit 40: AND gate 50: Safety limit output 100 to 102: Coefficient unit 200: Own vehicle 301, 301A, 301B: Judgment circuit 302: Transition check

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Artificial Intelligence (AREA)
  • Health & Medical Sciences (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Software Systems (AREA)
  • Feedback Control In General (AREA)
  • Safety Devices In Control Systems (AREA)
  • Traffic Control Systems (AREA)

Abstract

The purpose of the present invention is to convert safe operation achievement data of a control system collected under a specific condition into safe operation achievement data of the control system under as many other conditions as possible. A control device 2 according to the present invention is characterized by being provided with: an automatic control unit 20 that generates a control output 21 on the basis of a prescribed input; a safety verification unit 30 that determines whether the control output 21 is within preset safe area data Sa; and an output control unit 3 that performs control by permitting control based on the control output 21 when the control output 21 is within the safe area data Sa, and inhibiting the control based on the control output 21 or limiting the control output 21 within the safe area data Sa when the control output 21 is outside the safe area data Sa, wherein the safety verification unit 30 changes the safe area data Sa in accordance with an operation condition of an subject to be controlled.

Description

制御装置Control device
　本発明は、制御装置に関する。 The present invention relates to a control device.
　自動運転を初めとする制御の全自動化は、人為的操作を不用とし、人為的誤りに起因する事故の確率を低減し、安全性を向上させることを可能とする。自動運転においては特に推論機能により安全性が低下する状態の発生を予測してそれを回避させる、人間にたとえればいわゆる「かもしれない運転」のために、人工知能の活用が有効な面がある。 Full automation of control such as automatic driving eliminates the need for human operation, reduces the probability of accidents caused by human error, and makes it possible to improve safety. In autonomous driving, the use of artificial intelligence is effective, especially for so-called "potential driving" in which humans can predict the occurrence of a state in which safety is reduced by the inference function and avoid it. ..
　しかしその一方で、そのままでは人工知能の制御による動作の安全性の保証が無く、誤った推論結果により安全性が低下する状態を発生させる、いわゆる「だろう運転」の可能性を否定できない。そこで、本発明者らは、人工知能による制御操作候補に安全検証機能を付加して、人工知能による制御の安全性を確保する技術を既に出願している（特許文献１）。 However, on the other hand, there is no guarantee of operational safety by controlling artificial intelligence as it is, and the possibility of so-called "probable driving" that causes a state in which safety is reduced due to incorrect inference results cannot be denied. Therefore, the present inventors have already applied for a technique for ensuring the safety of control by artificial intelligence by adding a safety verification function to the control operation candidates by artificial intelligence (Patent Document 1).
特開2018-185746号公報JP-A-2018-185746
　本発明者らによる先願によれば、特に実際の動作実績に基づいて、制御操作候補の安全性が確認された場合のみ、または安全性が確認された範囲に制限した場合のみ、動作を許可することにより、制御システムの動作の安全性を保証することができる。 According to the prior application by the present inventors, the operation is permitted only when the safety of the control operation candidate is confirmed based on the actual operation results, or only when the safety is limited to the confirmed range. By doing so, the safety of operation of the control system can be guaranteed.
　しかしその反面、動作実績のない条件下での制御操作候補の安全性を確認することは困難である。あらゆる条件下での制御操作候補の安全性を確認することを可能とするためには、あらゆる条件下での制御システムの安全な動作実績データの収集が必要となる。したがって、データを取得するために長時間を要することになり、データ量も膨大なものとなる。 However, on the other hand, it is difficult to confirm the safety of control operation candidates under conditions where there is no operation record. In order to be able to confirm the safety of control operation candidates under all conditions, it is necessary to collect safe operation record data of the control system under all conditions. Therefore, it takes a long time to acquire the data, and the amount of data becomes enormous.
　本発明は、上記の点に鑑みてなされたものであり、その目的とするところは、動作実績のない条件下であっても制御操作候補の安全性を確保することができる制御装置を提供することである。 The present invention has been made in view of the above points, and an object of the present invention is to provide a control device capable of ensuring the safety of control operation candidates even under conditions where there is no actual operation record. That is.
　上記課題を解決する本発明の制御装置は、所定の入力に基づいて制御出力を生成する知能化制御部と、前記制御出力が予め設定された安全領域データ内にあるか否かを判定する安全検証部と、前記制御出力が前記安全領域データ内にある場合には前記制御出力による制御を許可し、前記安全領域データ外にある場合には前記制御出力による制御を禁止、または、前記制御出力を前記安全領域データ内に制限して制御する出力制御部と、を備え、前記安全検証部は、前記安全領域データを制御対象の動作条件に応じて変化させることを特徴とする。 The control device of the present invention that solves the above problems includes an intelligent control unit that generates a control output based on a predetermined input, and safety that determines whether or not the control output is within preset safety area data. The verification unit allows control by the control output when the control output is within the safety area data, and prohibits control by the control output when the control output is outside the safety area data, or the control output. Is provided with an output control unit that limits and controls the data in the safety area data, and the safety verification unit is characterized in that the safety area data is changed according to the operating conditions of the control target.
　本発明によれば、安全領域データを制御対象の動作条件に応じて変化させるので、特定の条件下で収集された制御装置の安全な動作実績データから、他の動作条件下での制御出力の安全制限出力を生成することができる。したがって、動作実績のない条件下であっても制御操作候補の安全性を確保することが可能となる。 According to the present invention, since the safety area data is changed according to the operating conditions of the controlled object, the control output under other operating conditions is obtained from the safe operating record data of the control device collected under specific conditions. A safety limit output can be generated. Therefore, it is possible to ensure the safety of the control operation candidate even under the condition that there is no operation record.
　本発明に関連する更なる特徴は、本明細書の記述、添付図面から明らかになるものである。また、上記した以外の、課題、構成及び効果は、以下の実施形態の説明により明らかにされる。 Further features related to the present invention will be clarified from the description of the present specification and the accompanying drawings. In addition, problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.
第１実施形態における制御装置のブロック図。The block diagram of the control device in 1st Embodiment. 動作条件によって安全領域データをスケーリングする方法について説明する図。The figure explaining the method of scaling the safety area data by the operating condition. 速度指令値と操舵角指令値により規定される安全性確認済の安全領域データを示す図。The figure which shows the safety area data which confirmed the safety defined by the speed command value and the steering angle command value. 図２に示す安全性確認済の安全領域データを摩擦係数μでスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 2 was scaled by the friction coefficient μ. 交差点の形状の特徴量についての一例を示す図。The figure which shows an example about the feature amount of the shape of an intersection. 車速Ｖｏのときの安全性確認済の安全領域データを示す図。The figure which shows the safety area data which confirmed the safety at the time of a vehicle speed Vo. 図５に示す安全性確認済の安全領域データを２倍の車速２Ｖｏでスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which scaled the safety area data which confirmed the safety shown in FIG. 5 at a vehicle speed 2V which doubled. 図５に示す安全性確認済の安全領域データを３倍の車速３Ｖｏでスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 5 was scaled at 3 times a vehicle speed 3Vo. 交差点の奥行きＤｏのときの安全性確認済の安全領域データを示す図。The figure which shows the safety area data which confirmed the safety at the depth Do of an intersection. 図８に示す安全性確認済の安全領域データを２倍の奥行き２Ｄｏでスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 8 was scaled with a double depth 2Do. 図８に示す安全性確認済の安全領域データを３倍の奥行き３Ｄｏでスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 8 was scaled with 3 times the depth 3Do. 交差点の曲がる角度αが９０度のときの安全性確認済の安全領域データを示す図。The figure which shows the safety area data which confirmed the safety when the bending angle α of an intersection is 90 degrees. 図１１に示す安全性確認済の安全領域データを交差点の曲がる角度αが１２０度でスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 11 was scaled by the bending angle α of an intersection 120 degrees. 図１１に示す安全性確認済の安全領域データを交差点の曲がる角度αが４５度でスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 11 was scaled by the bending angle α of an intersection of 45 degrees. 図１１に示す安全性確認済の安全領域データを交差点の曲がる角度αが３０度でスケーリングしたスケーリング後の安全領域データを示す図。The figure which shows the safety area data after scaling which the safety confirmed safety area data shown in FIG. 11 was scaled by the bending angle α of an intersection of 30 degrees. 図２に示す安全性確認済の安全領域データをタイヤのスライド量（アンダーステア、オーバーステア）で補正した安全領域データを示す図。The figure which shows the safety area data which corrected the safety area data which confirmed the safety shown in FIG. 2 by the slide amount (understeer, oversteer) of a tire. 図５に示す安全性確認済の安全領域データを３倍の車速３Ｖｏでスケーリングし、スケーリング後の安全領域データをタイヤのスライド量（オーバーステア、アンダーステア）で補正した安全領域データを示す図。FIG. 5 is a diagram showing safety region data shown in FIG. 5 in which safety region data for which safety has been confirmed is scaled at a vehicle speed of 3 Vo, and the safety region data after scaling is corrected by the amount of tire slide (oversteer, understeer). 第５実施形態における制御装置のブロック図。The block diagram of the control device in 5th Embodiment. 安全検証部の動作の説明図。An explanatory diagram of the operation of the safety verification unit. 第６実施形態における制御装置のブロック図。The block diagram of the control device in the sixth embodiment. 安全検証部の動作の説明図。An explanatory diagram of the operation of the safety verification unit. 図１７に対応する制御装置の他の実施例を説明するブロック図。FIG. 4 is a block diagram illustrating another embodiment of the control device corresponding to FIG. 図１９に対応する制御装置の他の実施例を説明するブロック図。FIG. 9 is a block diagram illustrating another embodiment of the control device corresponding to FIG.
　以下に、本発明の実施形態について図面を用いて説明する。なお、以下の各実施形態では、本発明の制御装置を車両の自動運転制御に適用した場合を例に説明するが、これに限定されるものではなく、他の移動体に用いてもよい。 Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each of the following embodiments, the case where the control device of the present invention is applied to the automatic driving control of the vehicle will be described as an example, but the present invention is not limited to this, and the control device may be used for other moving bodies.
＜第１実施形態＞
　図１Ａは、第１実施形態における制御装置のブロック図、図１Ｂは、動作条件によって安全領域データをスケーリング（拡大または縮小）する方法について説明する図である。 <First Embodiment>
FIG. 1A is a block diagram of the control device according to the first embodiment, and FIG. 1B is a diagram illustrating a method of scaling (enlarging or reducing) the safety region data according to operating conditions.
　本実施形態の制御装置２は、不図示の操作インタフェース部に有線または無線で接続され、操作インタフェース部から入力される操作量情報に基づいて、図外の制御対象を制御するための安全制御出力５０を生成する。制御装置２は、自動制御出力を生成する自動制御部２０と、自動制御出力の安全性を検証する安全検証部３０と、出力制御部３を構成するＡＮＤゲート４０を備える。自動制御出力の安全性を検証するとは、自動制御出力が出力制御部３から図外の制御対象に入力された場合に、制御対象が安全に動作するかを判定することである。制御装置２は、安全検証部３０によって安全性が確保できる場合に、自動制御部２０の自動制御出力を出力し、安全性が確保できない場合には自動制御出力の出力を制限する構成を有する。 The control device 2 of the present embodiment is connected to an operation interface unit (not shown) by wire or wirelessly, and is a safety control output for controlling a control target (not shown) based on the operation amount information input from the operation interface unit. Generate 50. The control device 2 includes an automatic control unit 20 that generates an automatic control output, a safety verification unit 30 that verifies the safety of the automatic control output, and an AND gate 40 that constitutes the output control unit 3. To verify the safety of the automatic control output is to determine whether the control target operates safely when the automatic control output is input from the output control unit 3 to a control target (not shown). The control device 2 has a configuration in which the automatic control output of the automatic control unit 20 is output when the safety can be ensured by the safety verification unit 30, and the output of the automatic control output is restricted when the safety cannot be ensured.
　制御装置２は、知能化制御部である自動制御部２０により深層学習または機械学習などの人工知能を導入することにより、人知を超えた制御性能を実現することが期待されている。しかし、人知を超えるがゆえに、安全に関するアカウンタビリティ（説明責任、説明性）の向上が望ましい。制御装置２は、安全検証部３０によって、人工知能による人知を超えた高度な制御においても安全性を確保することができる。 The control device 2 is expected to realize control performance beyond human knowledge by introducing artificial intelligence such as deep learning or machine learning by the automatic control unit 20 which is an intelligent control unit. However, it is desirable to improve the accountability (accountability, accountability) related to safety because it exceeds human knowledge. The safety verification unit 30 can ensure the safety of the control device 2 even in advanced control beyond human intelligence by artificial intelligence.
　安全検証部３０は、所定の入力４と自動制御出力２１とが入力され、それらの値４、２１に対応する検証出力（検証結果）を出力する判定回路３０１を有する。安全性の確認結果である検証結果は、「ＯＫ」（安全性あり）または「ＮＧ」（安全性なし）のいずかで出力される。安全検証部３０は、現在の入力４および現在の自動制御出力２１に限らず、過去の値からの遷移状態を利用することもできる。過去の値からの状態遷移にも着目する場合（遷移チェック３０２付き）、１サンプル前（Ｚ－１）の入力４および自動制御出力２１も判定回路３０１Ａへ入力される。 The safety verification unit 30 has a determination circuit 301 in which a predetermined input 4 and an automatic control output 21 are input and a verification output (verification result) corresponding to those values 4 and 21 is output. The verification result, which is the confirmation result of safety, is output as either "OK" (with safety) or "NG" (without safety). The safety verification unit 30 is not limited to the current input 4 and the current automatic control output 21, but can also use the transition state from the past value. When paying attention to the state transition from the past value (with transition check 302), the input 4 one sample before (Z -1 ) and the automatic control output 21 are also input to the determination circuit 301A.
  判定回路３０１は、現在の所定の入力４および現在の自動制御出力２１と、１サンプル前の所定の入力４および自動制御出力２１（すなわち過去の入力４および過去の自動制御出力２１）とに基づいて、安全性あり（ＯＫ）または安全性なし（ＮＧ）の検証結果を出力する。 The determination circuit 301 is based on the current predetermined input 4 and the current automatic control output 21, and the predetermined input 4 one sample before and the automatic control output 21 (that is, the past input 4 and the past automatic control output 21). Then, the verification result with safety (OK) or without safety (NG) is output.
　安全検証部３０は、判定回路３０１の検証結果が「ＯＫ」（安全性あり）である場合、出力制御部３のＡＮＤゲート４０に信号を出力して、ＡＮＤゲート４０が自動制御部２０の自動制御出力２１を出力できるようにする。これに対し、安全検証部３０は、判定回路３０１の検証結果が「ＮＧ」（安全性なし）である場合、ＡＮＤゲート４０に信号を出力して、ＡＮＤゲート４０に自動制御出力２１の出力を遮断または制限させるようにする。出力制御部３は、安全検証部３０の検証結果がＮＧの場合、自動制御出力２１による制御を禁止、または、自動制御出力２１を安全領域データ内に制限して制御する。制御装置２は、安全検証部３０によって、自動制御部２０からの自動制御出力２１の安全性を監視するため、制御対象の安全な動作を保証できる。 When the verification result of the determination circuit 301 is "OK" (safety), the safety verification unit 30 outputs a signal to the AND gate 40 of the output control unit 3, and the AND gate 40 automatically controls the automatic control unit 20. The control output 21 can be output. On the other hand, when the verification result of the determination circuit 301 is "NG" (no safety), the safety verification unit 30 outputs a signal to the AND gate 40 and outputs the output of the automatic control output 21 to the AND gate 40. Try to block or limit. When the verification result of the safety verification unit 30 is NG, the output control unit 3 prohibits the control by the automatic control output 21, or limits the automatic control output 21 to the safety area data and controls it. Since the safety verification unit 30 monitors the safety of the automatic control output 21 from the automatic control unit 20, the control device 2 can guarantee the safe operation of the controlled object.
　安全検証部３０は、自動制御出力２１が過去に安全な制御結果を経験した範囲を安全領域データとして記憶する安全領域データベースを備えている。安全検証部３０は、特定の動作条件ｉ下で制御出力が安全な動作実績データを収集して安全な制御出力範囲である安全領域データを取得し、安全領域データベースに記憶する。そして、図１Ｂに示すように、特定の動作条件ｉ下の安全領域データを動作条件に基づいてスケーリングすることによって、特定の動作条件ｉ下の安全領域データから、特定の動作条件ｉとは異なる他の動作条件下でも制御出力が安全であるとされる安全領域データを生成する。 The safety verification unit 30 is provided with a safety area database that stores the range in which the automatic control output 21 has experienced safe control results in the past as safety area data. The safety verification unit 30 collects operation record data whose control output is safe under a specific operating condition i, acquires safety area data which is a safe control output range, and stores it in the safety area database. Then, as shown in FIG. 1B, by scaling the safety area data under the specific operating condition i based on the operating condition, the safety area data under the specific operating condition i is different from the specific operating condition i. Generates safe area data where the control output is safe under other operating conditions.
　本実施形態の安全検証部３０は、特定の動作条件ｉ下で取得した安全領域データを動作条件でスケーリングすることにより変化させて、条件１～条件ｎ（ｎは整数）に対応する安全領域データを生成する。安全検証部３０は、シミュレーションまたは実機を実際に動作させて、スケーリングにより生成された安全領域データを用いた制御出力の動作結果が安全であったかどうかを検証し、安全が確認されたデータを安全領域データとして取得する。 The safety verification unit 30 of the present embodiment changes the safety area data acquired under the specific operating condition i by scaling the operating conditions, and the safety area data corresponding to the conditions 1 to n (n is an integer). To generate. The safety verification unit 30 actually operates the simulation or the actual machine, verifies whether the operation result of the control output using the safety area data generated by scaling is safe, and uses the data confirmed to be safe as the safety area. Get as data.
　本実施形態の制御装置２は、特定の動作条件下での制御装置２の安全な動作実績データ（安全領域データ）を収集する。そして、その動作条件と、制御装置の安全な動作実績データの境界値の関係(特に、比例関係、反比例関係）を分析する。それから、その関係に基づいて、スケーリングを行うことにより、異なる動作条件下での制御装置２の安全領域データを生成する。安全領域データは、少なくとも一つ以上の次元（組み合わせる変数の数）を持ち、スケーリングは、安全領域データを特定の次元の軸において拡大縮小させること、或いは、特定の次元において係数を乗じることにより行われる。 The control device 2 of the present embodiment collects safe operation record data (safety area data) of the control device 2 under specific operating conditions. Then, the relationship between the operating condition and the boundary value of the safe operation record data of the control device (particularly, the proportional relationship and the inverse proportional relationship) is analyzed. Then, by scaling based on the relationship, the safety area data of the control device 2 under different operating conditions is generated. The safe area data has at least one dimension (the number of variables to be combined), and scaling is performed by scaling the safe area data on the axis of a specific dimension or multiplying it by a coefficient in a specific dimension. Will be.
　本実施例によれば、特定の動作条件ｉについて安全領域データを取得すれば、その安全領域データを条件に応じてスケーリングすることによって、動作実績のない条件１～条件ｎに対応する安全領域データを得ることができる。したがって、条件１～条件ｎにおいて動作実績データを取得する必要がなく、これらの安全領域データを取得するための時間を大幅に短縮することが可能となる。 According to this embodiment, if the safety area data is acquired for a specific operating condition i, the safety area data is scaled according to the conditions, so that the safety area data corresponding to the conditions 1 to n that have no operation record is obtained. Can be obtained. Therefore, it is not necessary to acquire the operation record data under the conditions 1 to n, and the time for acquiring these safety area data can be significantly shortened.
＜第２実施形態＞
　本実施形態は、車両の自動運転制御に際して、速度指令値と操舵角指令値の組み合わせを安全領域データとしたものであり、動作条件は、移動体である車両が走行する路面の摩擦係数である。 <Second Embodiment>
In the present embodiment, the combination of the speed command value and the steering angle command value is used as the safety region data in the automatic driving control of the vehicle, and the operating condition is the friction coefficient of the road surface on which the moving vehicle travels. ..
　図２と図３は、第２実施形態の制御装置の内容を説明する図であり、図２は、速度指令値と操舵角指令値により規定される安全性確認済の安全領域データを示す図、図３は、図２に示す安全性確認済の安全領域データを摩擦係数μでスケーリングしたスケーリング後の安全領域データを示す図である。図２および図３において図示される上下の直線部分（境界Ａ）は、操舵機構の構造で決まる最大操舵角であり、図示される右上、右下の曲線部分（境界Ｂ）は、遠心力とタイヤグリップ力で制約される領域である。 2 and 3 are diagrams for explaining the contents of the control device of the second embodiment, and FIG. 2 is a diagram showing safety-confirmed safety region data defined by a speed command value and a steering angle command value. , FIG. 3 is a diagram showing the safety region data after scaling of the safety region data whose safety has been confirmed shown in FIG. 2 by the friction coefficient μ. The upper and lower straight lines (boundary A) shown in FIGS. 2 and 3 are the maximum steering angles determined by the structure of the steering mechanism, and the upper right and lower right curved parts (boundary B) shown are centrifugal forces. This is an area constrained by tire grip.
　車体の遠心力は、
　F=mv^2 /R　（但し、F:遠心力、m: 車体重量、v: 速度、R: 旋回半径）・・・(1)
と表され、旋回半径Ｒは、
　R = L /(sinθ)　（但し、L: ホイールベースの長さ、θ: 操舵角）・・・(2)
であるから式(2)を式(1)に代入すると、
　F = m・sinθ・v^2 /L　・・・(3)
となる。
　タイヤの摩擦力は、
　F = mμ　・・・(4)
であるから、式(3)＝式(4)とおくと、
　m・sinθ・v^2 /L　= mμ
となり、即ち、
　v = SQRT(μ・L /( sinθ))
となる。 The centrifugal force of the car body is
F = mv ^ 2 / R (However, F: centrifugal force, m: vehicle weight, v: speed, R: turning radius) ・ ・ ・ (1)
The turning radius R is
R = L / (sin θ) (However, L: wheelbase length, θ: steering angle) ・ ・ ・ (2)
Therefore, when Eq. (2) is substituted into Eq. (1),
F = m ・ sinθ ・ v ^ 2 / L ・ ・ ・ (3)
Will be.
The frictional force of the tire is
F = mμ ・ ・ ・ (4)
Therefore, if Eq. (3) = Eq. (4),
m ・ sinθ ・ v ^ 2 / L = mμ
That is,
v = SQRT (μ ・ L / (sin θ))
Will be.
　安全検証部３０は、例えば路面の摩擦係数μが1.0（条件ｉ）のときの動作実績データから安全領域データ（図２のＳａ）を取得し、その安全領域データを摩擦係数μまたは摩擦係数μの平方根に比例して拡大縮小（他の条件でスケーリング）することにより、路面の摩擦係数μが0.5のときの安全領域データ（図３のＳａ）をはじめとして、任意の路面の摩擦係数μについて安全領域データを生成することができる。 For example, the safety verification unit 30 acquires safety region data (Sa in FIG. 2) from operation record data when the friction coefficient μ of the road surface is 1.0 (condition i), and obtains the safety region data as friction coefficient μ or friction coefficient μ. By scaling in proportion to the square root of (scaling under other conditions), the coefficient of friction μ of any road surface, including the safety region data (Sa in FIG. 3) when the coefficient of friction μ of the road surface is 0.5 Safe area data can be generated.
　限界となる速度vは、以下のように求められ、TTC(Time to collision)一定、すなわち停止時間一定と仮定した場合には摩擦係数μに比例し、停止距離一定と仮定した場合には摩擦係数μの平方根に比例する。 The limit velocity v is obtained as follows, and is proportional to the friction coefficient μ when the TTC (Time to collision) is constant, that is, when the stop time is constant, and when the stop distance is constant, the friction coefficient is constant. It is proportional to the square root of μ.
　まず、TTC(Time to collision)一定、すなわち停止時間一定と仮定した場合に限界となる速度vを求める。
　v=at（但し、v: 速度、a: 加速度、t: 時間）　・・・(5)
であるから、時間tの間に速度vから速度0に減速するために必要な減速度は、
　a = v/t
となる。ここで、tを一定と仮定すると、
　v ∝ a
となる。さらに、
　a ∝ μ
であるから、
　v ∝ μ
となる。 First, the speed v, which is the limit when the TTC (Time to collision) is constant, that is, the stop time is assumed to be constant, is obtained.
v = at (however, v: velocity, a: acceleration, t: time) ・ ・ ・ (5)
So the deceleration required to slow down from velocity v to velocity 0 during time t is
a = v / t
Will be. Here, assuming that t is constant,
v ∝ a
Will be. further,
a ∝ μ
Because it is
v ∝ μ
Will be.
　続いて、停止距離を一定と仮定した場合に限界となる速度を求める。
　y = at^2 /2（但し、y: 距離）　・・・(6)
であるから、停止距離を一定と仮定すると、式(5)より、
　t = v/a　・・・(7)
である。したがって、式(6)に式(7)を代入すると、
　y = v^2 /(2a)
となる。 Then, the speed that becomes the limit when the stopping distance is assumed to be constant is obtained.
y = at ^ 2/2 (however, y: distance) ・ ・ ・ (6)
Therefore, assuming that the stopping distance is constant, from equation (5),
t = v / a ・ ・ ・ (7)
Is. Therefore, substituting Eq. (7) into Eq. (6),
y = v ^ 2 / (2a)
Will be.
　ここで、yを一定と仮定すると、
　v^2 ∝ a
となる。同様にして、
　a ∝ μ
であるから、
　v ∝ SQRT(μ)
となる。 Here, assuming that y is constant,
v ^ 2 ∝ a
Will be. Similarly,
a ∝ μ
Because it is
v ∝ SQRT (μ)
Will be.
　また、大型車両においては、車重や積載量等の条件を変更することにより速度指令値と操舵角指令値の安全領域データをスケーリングすることも可能である。 Further, in a large vehicle, it is possible to scale the safety area data of the speed command value and the steering angle command value by changing the conditions such as the vehicle weight and the load capacity.
＜第３実施形態＞
　本実施形態は、車両の制御に際して、交差点に進入してからの経過時間と操舵角指令値の組み合わせを安全領域データとしたものである。 <Third Embodiment>
In the present embodiment, when controlling the vehicle, the combination of the elapsed time after entering the intersection and the steering angle command value is used as the safety region data.
　図４と図５は、第３実施形態の制御装置の内容を説明する図であり、図４は、交差点の形状の特徴量についての一例を示す図、図５は、車速Ｖｏのときの安全性確認済の安全領域データを示す図である。 4 and 5 are diagrams for explaining the contents of the control device of the third embodiment, FIG. 4 is a diagram showing an example of the feature amount of the shape of the intersection, and FIG. 5 is a diagram showing safety at a vehicle speed Vo. It is a figure which shows the safety area data which confirmed sex.
　本実施形態では、移動体である自車両２００が交差点４０３を通過する場合を例に説明する。なお、本実施形態は、左側通行の場合を例に説明するが、本発明は、右側通行の場合にも同様に適用することができる。 In the present embodiment, a case where the own vehicle 200, which is a moving body, passes through the intersection 403 will be described as an example. Although the present embodiment will be described by taking the case of left-hand traffic as an example, the present invention can be similarly applied to the case of right-hand traffic.
　道路４００は、図４に示すように、２本の直線路４０１、４０２がほぼ直角に交わる、いわゆる四叉路の道路形状を有している。自車両２００は、一方の直線路４０１を直進して、交差点入り口４１１から交差点４０３に進入し、交差点４０３で右折して他方の直線路４０２を走行する経路を辿る自動運転制御がなされる。 As shown in FIG. 4, the road 400 has a so-called four-forked road shape in which two straight roads 401 and 402 intersect at substantially right angles. The own vehicle 200 is automatically controlled to go straight on one straight road 401, enter the intersection 403 from the intersection entrance 411, turn right at the intersection 403, and follow the route traveling on the other straight road 402.
　交差点４０３は、その形状の特徴量として、交差点の大きさと、曲がる回転角度で表すことができる。交差点の大きさは、交差点の入り口から奥行きの距離Ｄで表すことができる。交差点４０３は、一方の直線路４０１における交差点入り口４１１から交差点出口までの直線距離が奥行きＤであり、一方の直線路４０１の交差点入り口４１１から他方の直線路４０２の交差点出口４１２までの右折角度が角度αである。 The intersection 403 can be represented by the size of the intersection and the bending rotation angle as the feature amount of the shape. The size of the intersection can be expressed by the distance D of the depth from the entrance of the intersection. At the intersection 403, the straight line distance from the intersection entrance 411 to the intersection exit on one straight road 401 is the depth D, and the right turn angle from the intersection entrance 411 on one straight road 401 to the intersection exit 412 on the other straight road 402 is. The angle α.
　安全検証部３０は、動作実績データから車速Ｖｏで交差点４０３を安全に右折することができる安全領域データを取得して安全確認済の安全領域データＳａを生成する。安全領域データＳａは、交差点４０３に進入してからの経過時間ｔと、交差点４０３を右折した際の操舵角指令値θとの組み合わせによって規定される。安全領域データＳａ外の領域は、走行に注意を有する注意領域Ｓｂとなる。安全検証部３０は、交差点の形状の特徴量を表す奥行きＤ、角度α、および、移動体の速度（車速）Ｖにより安全領域データＳａをスケーリングする。 The safety verification unit 30 acquires safety area data capable of safely turning right at the intersection 403 at vehicle speed Vo from the operation record data, and generates safety area data Sa for which safety has been confirmed. The safety area data Sa is defined by a combination of the elapsed time t after entering the intersection 403 and the steering angle command value θ when the intersection 403 is turned right. The area outside the safety area data Sa is the attention area Sb that pays attention to driving. The safety verification unit 30 scales the safety area data Sa according to the depth D representing the feature amount of the shape of the intersection, the angle α, and the speed (vehicle speed) V of the moving body.
　図６は、図５に示す安全性確認済の安全領域データを２倍の車速２Ｖｏでスケーリングしたスケーリング後の安全領域データを示す図、図７は、図５に示す安全性確認済の安全領域データを３倍の車速３Ｖｏでスケーリングしたスケーリング後の安全領域データを示す図である。 FIG. 6 is a diagram showing the safety region data after scaling of the safety confirmed safety region data shown in FIG. 5 at a vehicle speed of 2 Vo, and FIG. 7 is a diagram showing the safety region data after scaling shown in FIG. It is a figure which shows the safety area data after scaling by scaling the data at 3 times the vehicle speed 3Vo.
　図５に示す安全性確認済の安全領域データを２倍の車速２Ｖｏでスケーリングしたスケーリング後の安全領域データＳａは、図６に示すように、経過時間ｔを２分の１の大きさに縮小した大きさを有している。図５に示す安全性確認済の安全領域データを３倍の車速３Ｖｏでスケーリングしたスケーリング後の安全領域データは、図７に示すように、経過時間ｔを３分の１の大きさに縮小した大きさを有している。 As shown in FIG. 6, the safety region data Sa after scaling, which is obtained by scaling the safety region data for which safety has been confirmed shown in FIG. 5 at a vehicle speed of 2 Vo, reduces the elapsed time t to half the size as shown in FIG. Has a large size. As shown in FIG. 7, the safety area data after scaling, which is obtained by scaling the safety confirmed safety area data shown in FIG. 5 at a vehicle speed of 3 Vo, reduced the elapsed time t to one-third of the size as shown in FIG. It has a size.
　移動体の速度（車速）Ｖについては、図５－図７に示すように、交差点４０３に進入してからの経過時間ｔが移動体の速度（車速）Ｖに反比例してスケーリングされる。したがって、例えば速度Ｖｏの動作実績データから安全性確認済の安全領域データを所得すれば、スケーリングによって任意の速度Ｖに対応する安全領域データを得ることができる。 Regarding the speed (vehicle speed) V of the moving body, as shown in FIGS. 5 to 7, the elapsed time t after entering the intersection 403 is scaled in inverse proportion to the speed (vehicle speed) V of the moving body. Therefore, for example, if the safety area data whose safety has been confirmed is obtained from the operation record data of the speed Vo, the safety area data corresponding to an arbitrary speed V can be obtained by scaling.
　次に、交差点の奥行きＤについて考える。
　車両のホイールベースをＬ、前輪の旋回半径をＲ、操舵角をθとすると、
　Ｌ＝Ｒ・ｓｉｎ θ
となる。従って操舵角θは、
　θ＝ｓｉｎ－１（Ｌ／Ｒ）
となる。
　通常は、Ｒ＝Ｄであるから、
　θ＝ｓｉｎ－１（Ｌ／Ｄ）
となる。 Next, consider the depth D of the intersection.
Assuming that the wheelbase of the vehicle is L, the turning radius of the front wheels is R, and the steering angle is θ,
L = R · sin θ
Will be. Therefore, the steering angle θ is
θ = sin -1 (L / R)
Will be.
Normally, R = D, so
θ = sin -1 (L / D)
Will be.
　図８は、交差点の奥行きＤｏのときの安全性確認済の安全領域データを示す図、図９は、図８に示す安全性確認済の安全領域データを２倍の奥行き２Ｄｏでスケーリングしたスケーリング後の安全領域データを示す図、図１０は、図８に示す安全性確認済の安全領域データを３倍の奥行き３Ｄｏでスケーリングしたスケーリング後の安全領域データを示す図である。図８に示す安全性確認済の安全領域データを２倍の奥行き２Ｄｏでスケーリングしたスケーリング後の安全領域データＳａは、図９に示すように、操舵角指令値θを所定の大きさに縮小した大きさを有している。図８に示す安全性確認済の安全領域データを３倍の奥行き３Ｄｏでスケーリングしたスケーリング後の安全領域データＳａは、図１０に示すように、操舵角指令値θを奥行き２Ｄｏの場合よりも更に縮小した大きさを有している。 FIG. 8 is a diagram showing the safety area data for which the safety has been confirmed at the depth Do of the intersection, and FIG. 9 shows the safety area data for which the safety has been confirmed shown in FIG. 8 after scaling with a double depth of 2 Do. FIG. 10 is a diagram showing the safety area data of FIG. 10, which is a diagram showing the safety area data after scaling by scaling the safety area data of the safety confirmed shown in FIG. 8 with a depth of 3 Do. As shown in FIG. 9, the safety region data Sa after scaling, which is obtained by scaling the safety region data whose safety has been confirmed in FIG. 8 with a double depth of 2 Do, reduces the steering angle command value θ to a predetermined size as shown in FIG. It has a size. As shown in FIG. 10, the safety region data Sa after scaling, which is obtained by scaling the safety region data whose safety has been confirmed in FIG. 8 with a depth of 3 Do, has a steering angle command value θ further than that in the case of a depth of 2 Do. It has a reduced size.
　交差点４０３の奥行きＤについては、図８－図１０に示すように、操舵角指令値θがｓｉｎ－１（Ｌ／Ｄ）に比例してスケーリングされる。したがって、例えば奥行きＤｏの動作実績データから安全確認済の安全領域データを取得すれば、スケーリングによって任意の奥行きＤに対応する安全領域データを得ることができる。 As for the depth D of the intersection 403, as shown in FIGS. 8 to 10, the steering angle command value θ is scaled in proportion to sin -1 (L / D). Therefore, for example, if the safety-confirmed safety area data is acquired from the operation record data of the depth Do, the safety area data corresponding to an arbitrary depth D can be obtained by scaling.
　次に、交差点の入り口と出口とのなす角αについて考える。
　図１１は、交差点の曲がる角度αが９０度のときの安全性確認済の安全領域データを示す図、図１２は、図１１に示す安全性確認済の安全領域データを交差点の曲がる角度αが１２０度でスケーリングしたスケーリング後の安全領域データを示す図、図１３は、図１１に示す安全性確認済の安全領域データを交差点の曲がる角度αが４５度でスケーリングしたスケーリング後の安全領域データを示す図、図１４は、図１１に示す安全性確認済の安全領域データを交差点の曲がる角度αが３０度でスケーリングしたスケーリング後の安全領域データを示す図である。 Next, consider the angle α between the entrance and exit of the intersection.
FIG. 11 is a diagram showing safety-confirmed safety area data when the bending angle α of the intersection is 90 degrees, and FIG. 12 is a diagram showing safety-confirmed safety area data shown in FIG. 11 with the bending angle α of the intersection. The figure showing the safety area data after scaling scaled at 120 degrees, FIG. 13 shows the safety area data after scaling obtained by scaling the safety confirmed safety area data shown in FIG. 11 at an intersection bending angle α of 45 degrees. FIG. 14 is a diagram showing the safety area data after scaling of the safety confirmed safety area data shown in FIG. 11 by scaling the intersection bending angle α at 30 degrees.
　入り口と出口のなす角αについては、図１１－図１４に示すように交差点に進入してからの経過時間が入り口と出口のなす角αに比例してスケーリングされる。したがって、例えば交差点の曲がる角度αが９０度（α＝９０度）の動作実績データから安全確認済の安全領域データを取得すれば、スケーリングによって任意の角度αに対応する安全領域データを得ることができる。 As for the angle α formed by the entrance and the exit, as shown in FIGS. 11-14, the elapsed time after entering the intersection is scaled in proportion to the angle α formed by the entrance and the exit. Therefore, for example, if the safety area data for which safety has been confirmed is acquired from the operation record data in which the bending angle α of the intersection is 90 degrees (α = 90 degrees), the safety area data corresponding to an arbitrary angle α can be obtained by scaling. it can.
＜第４実施形態＞
　図１５は、図２に示す安全性確認済の安全領域データをタイヤのスライド量（アンダーステア、オーバーステア）で補正した安全領域データを示す図、図１６は、図５に示す安全性確認済の安全領域データを３倍の車速３Ｖｏでスケーリングし、スケーリング後の安全領域データをタイヤのスライド量（オーバーステア、アンダーステア）で補正した安全領域データを示す図である。 <Fourth Embodiment>
FIG. 15 is a diagram showing safety region data in which the safety-confirmed safety region data shown in FIG. 2 is corrected by the amount of tire slide (understeer, oversteer), and FIG. 16 is a diagram showing safety-confirmed safety region data shown in FIG. It is a figure which shows the safety area data which scaled the safety area data at 3 times the vehicle speed 3V, and corrected the safety area data after scaling by the slide amount (oversteer, understeer) of a tire.
　速度指令値と操舵角指令値により規定される安全領域データＳａに、遠心力とタイヤグリップ力で制約される領域でタイヤのスライド（オーバーステア、アンダーステア）を許容する安全領域データＳｃ、Ｓｄも考慮して設定することができる。なお、この場合、図１６に示すように、操舵角指令値の安全領域データＳａもタイヤのスライド（オーバーステア、アンダーステア）を考慮して設定される。 The safety area data Sa defined by the speed command value and the steering angle command value also considers the safety area data Sc and Sd that allow tire slide (oversteer, understeer) in the area constrained by centrifugal force and tire grip force. Can be set. In this case, as shown in FIG. 16, the safety region data Sa of the steering angle command value is also set in consideration of the tire slide (oversteer, understeer).
＜第５実施形態＞
　図１７は、第５実施形態における制御装置のブロック図、図１８は、安全検証部の動作の説明図である。上述の実施形態と同様の構成要素には同一の符号を付することでその詳細な説明を省略する。 <Fifth Embodiment>
FIG. 17 is a block diagram of the control device according to the fifth embodiment, and FIG. 18 is an explanatory diagram of the operation of the safety verification unit. The same components as those in the above-described embodiment are designated by the same reference numerals, and detailed description thereof will be omitted.
　制御装置２Ａの安全検証部３０Ａは、判定回路３０１Ａと、遷移チェック３０２を有する。安全検証部３０の判定回路３０１Ａは、図１７に示すように、現在の所定の入力４および現在の自動制御出力２１と、１サンプル前の所定の入力４および自動制御出力２１（すなわち過去の入力４および過去の自動制御出力２１）とに基づいて、安全性あり（ＯＫ）または安全性なし（ＮＧ）の検証結果を出力する。 The safety verification unit 30A of the control device 2A has a determination circuit 301A and a transition check 302. As shown in FIG. 17, the determination circuit 301A of the safety verification unit 30 has the current predetermined input 4 and the current automatic control output 21, and the predetermined input 4 one sample before and the automatic control output 21 (that is, the past input). Based on 4 and the past automatic control output 21), the verification result with safety (OK) or without safety (NG) is output.
　安全検証部３０Ａの動作は、図１８に示すように、例えばＣＡＭ（Content Addressable Memory、連想記憶メモリ）等を用いて定義することができる。例えばＣＡＭには、所定の入力４および自動制御出力２１と、遷移チェック３０２付きの場合には過去の所定の入力４および過去の自動制御出力２１との組み合わせをエントリーとして、それらに対応した検証出力（ＯＫ／ＮＧ）が予め設定されている。 As shown in FIG. 18, the operation of the safety verification unit 30A can be defined by using, for example, CAM (Content Addressable Memory, associative memory) or the like. For example, in the CAM, a combination of a predetermined input 4 and an automatic control output 21 and a past predetermined input 4 and a past automatic control output 21 in the case of having a transition check 302 is set as an entry, and a verification output corresponding to them is input. (OK / NG) is preset.
  このように構成される本実施形態も第１実施形態と同様の作用効果を奏する。さらに本実施例の安全検証部３０Ａは、過去の入力４および過去の自動制御出力２１も考慮して、自動制御出力２１が安全であるか判定することができる。これにより、より効率的にかつ高い信頼性をもって安全性を検証することができる。 This embodiment configured in this way also has the same effect as that of the first embodiment. Further, the safety verification unit 30A of the present embodiment can determine whether the automatic control output 21 is safe in consideration of the past input 4 and the past automatic control output 21. As a result, safety can be verified more efficiently and with high reliability.
＜第６実施形態＞
　図１９は、第６実施形態における制御装置のブロック図、図２０は、安全検証部の動作の説明図である。上述の実施形態と同様の構成要素には同一の符号を付することでその詳細な説明を省略する。
　制御装置２Ｂは、自動制御出力２１を所定の制御出力上限値と所定の制御出力下限値とで定まる所定の範囲内に収まるように出力することができる。制御装置２Ｂは、自動制御部２０と、安全検証部３０Ｂと、制限値選択回路４１とを含む。 <Sixth Embodiment>
FIG. 19 is a block diagram of the control device according to the sixth embodiment, and FIG. 20 is an explanatory diagram of the operation of the safety verification unit. The same components as those in the above-described embodiment are designated by the same reference numerals, and detailed description thereof will be omitted.
The control device 2B can output the automatic control output 21 so as to be within a predetermined range determined by a predetermined control output upper limit value and a predetermined control output lower limit value. The control device 2B includes an automatic control unit 20, a safety verification unit 30B, and a limit value selection circuit 41.
  安全検証部３０Ｂの判定回路３０１Ｂは、現在の所定の入力４および現在の自動制御出力２１が入力されると、それらに対応する制御出力上限および制御出力下限を出力する。安全検証部３０Ｂは、上述の各実施形態と同様に、過去の値からの状態遷移にも着目することができる。すなわち、安全検証部３０Ｂには、現在の入力４および現在の自動制御出力２１に加えて、１サンプル前（Ｚ－１）の過去の入力４および過去の自動制御出力２１も入力される。安全検証部３０Ｂの判定回路３０１Ｂは、それら現在および過去の情報に対応する制御出力上限および制御出力下限を出力する。 When the current predetermined input 4 and the current automatic control output 21 are input, the determination circuit 301B of the safety verification unit 30B outputs the control output upper limit and the control output lower limit corresponding to them. The safety verification unit 30B can pay attention to the state transition from the past value as in each of the above-described embodiments. That is, in addition to the current input 4 and the current automatic control output 21, the safety verification unit 30B also inputs the past input 4 one sample before (Z -1 ) and the past automatic control output 21. The determination circuit 301B of the safety verification unit 30B outputs the control output upper limit and the control output lower limit corresponding to the current and past information.
  制限値選択回路４１は、入力された自動制御出力２１が制御出力上限と制御出力下限の間にある場合は、その自動制御出力２１を安全制限出力５０として出力する。制限値選択回路４１は、入力された自動制御出力２１が制御出力上限を上回る場合は、自動制御出力２１を制御出力上限に制限した値を安全制限出力５０として出力する。制限値選択回路４１は、入力された自動制御出力２１が制御出力下限を下回る場合は、自動制御出力２１を制御出力下限に制限した値を安全制限出力５０として出力する。 When the input automatic control output 21 is between the control output upper limit and the control output lower limit, the limit value selection circuit 41 outputs the automatic control output 21 as the safety limit output 50. When the input automatic control output 21 exceeds the control output upper limit, the limit value selection circuit 41 outputs a value obtained by limiting the automatic control output 21 to the control output upper limit as the safety limit output 50. When the input automatic control output 21 is lower than the control output lower limit, the limit value selection circuit 41 outputs a value obtained by limiting the automatic control output 21 to the control output lower limit as the safety limit output 50.
  さらに、制限値選択回路４１は、安全検証結果をステータス５１として出力することもできる。安全検証結果のステータスは、例えば、「ＯＫ」「ＯＫ  ｗ／ｌｉｍｉｔ」「ＮＧ」の複数段階に分けられている。 Further, the limit value selection circuit 41 can also output the safety verification result as the status 51. The status of the safety verification result is divided into a plurality of stages of, for example, "OK", "OK w / limit", and "NG".
  ステータス「ＯＫ」とは、自動制御出力２１が制御出力下限と制御出力上限の範囲内にある場合である。ステータス「ＯＫ  ｗ／ｌｉｍｉｔ」とは、自動制御出力２１が制御出力下限と制御出力上限との範囲の外に存在するが、制御出力下限と制御出力上限との間の値に補正しうる場合である。つまり、自動制御出力２１を制御出力下限と制御出力上限との範囲内に補正可能な場合である。ステータス「ＮＧ」とは、自動制御出力２１が制御出力下限と制御出力上限との範囲内に存在せず、制御出力下限と制御出力上限の間の範囲の値を取ることのできない場合（制御出力下限＜制御出力上限が成り立たない場合）である。 The status "OK" is when the automatic control output 21 is within the range of the control output lower limit and the control output upper limit. The status "OK w / limit" is when the automatic control output 21 exists outside the range between the control output lower limit and the control output upper limit, but can be corrected to a value between the control output lower limit and the control output upper limit. is there. That is, it is a case where the automatic control output 21 can be corrected within the range of the control output lower limit and the control output upper limit. The status "NG" means that the automatic control output 21 does not exist within the range between the control output lower limit and the control output upper limit, and the value in the range between the control output lower limit and the control output upper limit cannot be taken (control output). Lower limit <when the upper limit of control output does not hold).
  図２０は、本実施形態における安全検証部３０Ｂの動作を示す。図１８で述べたと同様に、安全検証部３０ＢはＣＡＭと等価に構成することができる。安全検証部３０Ｂは、現在の所定の入力４と、遷移チェック付きの場合には過去の所定の入力４および過去の自動制御出力２１との組み合わせが入力されると、それらに対応した制御出力上限および制御出力下限を出力する。 FIG. 20 shows the operation of the safety verification unit 30B in this embodiment. Similar to that described in FIG. 18, the safety verification unit 30B can be configured equivalent to CAM. When the combination of the current predetermined input 4 and the past predetermined input 4 and the past automatic control output 21 is input in the case of the transition check, the safety verification unit 30B corresponds to the control output upper limit. And output the lower limit of control output.
  このように構成される本実施例も第５実施形態と同様の作用効果を奏する。さらに本実施形態では、安全検証部３０Ｂが制限出力下限および制限出力上限を出力し、制限値選択回路４１は制限出力下限と制限出力上限との範囲内に収まるように自動制御出力２１を安全制限出力５０として出力する。さらに、本実施例の安全検証部３０Ｂは、安全検証結果のステータスを「ＯＫ」「ＯＫ  ｗ／ｌｉｍｉｔ」「ＮＧ」の複数段階で出力することができる。したがって、本実施例によれば、より柔軟かつ安全に、自動制御出力２１を用いて安全制限出力５０を得ることができる。 This embodiment configured in this way also has the same effect as that of the fifth embodiment. Further, in the present embodiment, the safety verification unit 30B outputs the limit output lower limit and the limit output upper limit, and the limit value selection circuit 41 safety limits the automatic control output 21 so as to be within the range between the limit output lower limit and the limit output upper limit. Output as output 50. Further, the safety verification unit 30B of this embodiment can output the status of the safety verification result in a plurality of stages of "OK", "OK w / limit", and "NG". Therefore, according to this embodiment, the safety limit output 50 can be obtained more flexibly and safely by using the automatic control output 21.
　図２１と図２２は、図１７と図１９に対応する制御装置の他の実施例を説明するブロック図である。図２１に示す制御装置２Ａ’および図２２に示す制御装置２Ｂ’は、図１７に示す第５実施形態の制御装置２Ａおよび図１９に示す第６実施形態の制御装置２Ｂの構成において、安全検証部３０Ａ、３０Ｂの入出力に、スケーリングのための係数を乗じる係数部１００～１０２を付加した構成を有する。図１に示す第１実施形態の構成のように、１つの動作実績データによる安全領域データから複数の条件の安全領域データを予め作成する方法では、データ量が膨大なものとなる。これに対し、本実施形態では、１つのデータで様々な動作条件に対応することができ、データ量を大幅に削減することができる。 21 and 22 are block diagrams illustrating another embodiment of the control device corresponding to FIGS. 17 and 19. The control device 2A'shown in FIG. 21 and the control device 2B'shown in FIG. 22 are safety-verified in the configurations of the control device 2A of the fifth embodiment shown in FIG. 17 and the control device 2B of the sixth embodiment shown in FIG. It has a configuration in which coefficient units 100 to 102 for multiplying the input / output of units 30A and 30B by a coefficient for scaling are added. As in the configuration of the first embodiment shown in FIG. 1, the method of preliminarily creating the safety area data of a plurality of conditions from the safety area data based on one operation record data has a huge amount of data. On the other hand, in the present embodiment, one data can correspond to various operating conditions, and the amount of data can be significantly reduced.
　以上、本発明の実施形態について詳述したが、本発明は、前記の実施形態に限定されるものではなく、特許請求の範囲に記載された本発明の精神を逸脱しない範囲で、種々の設計変更を行うことができるものである。例えば、前記した実施の形態は本発明を分かりやすく説明するために詳細に説明したものであり、必ずしも説明した全ての構成を備えるものに限定されるものではない。また、ある実施形態の構成の一部を他の実施形態の構成に置き換えることが可能であり、また、ある実施形態の構成に他の実施形態の構成を加えることも可能である。さらに、各実施形態の構成の一部について、他の構成の追加・削除・置換をすることが可能である。 Although the embodiments of the present invention have been described in detail above, the present invention is not limited to the above-described embodiments, and various designs are designed without departing from the spirit of the present invention described in the claims. You can make changes. For example, the above-described embodiment has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations. Further, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Further, it is possible to add / delete / replace a part of the configuration of each embodiment with another configuration.
２、２Ａ、２Ｂ：制御装置
３：出力制御部
４：入力
２０：自動制御部（知能化制御部）
２１：自動制御出力
３０、３０Ａ、３０Ｂ：安全検証部
４０：ＡＮＤゲート
５０：安全制限出力
１００～１０２：係数部
２００：自車両
３０１、３０１Ａ、３０１Ｂ：判定回路
３０２：遷移チェック 2, 2A, 2B: Control device 3: Output control unit 4: Input 20: Automatic control unit (intelligent control unit)
21: Automatic control output 30, 30A, 30B: Safety verification unit 40: AND gate 50: Safety limit output 100 to 102: Coefficient unit 200: Own vehicle 301, 301A, 301B: Judgment circuit 302: Transition check

Claims (10)

  1. 　所定の入力に基づいて制御出力を生成する知能化制御部と、
    　前記制御出力が予め設定された安全領域データ内にあるか否かを判定する安全検証部と、
    　前記制御出力が前記安全領域データ内にある場合には前記制御出力による制御を許可し、前記安全領域データ外にある場合には前記制御出力による制御を禁止、または、前記制御出力を前記安全領域データ内に制限して制御する出力制御部と、
    　を備え、
    　前記安全検証部は、前記安全領域データを制御対象の動作条件に応じて変化させること
    を特徴とする制御装置。     An intelligent control unit that generates a control output based on a predetermined input,
    A safety verification unit that determines whether or not the control output is within the preset safety area data,
    When the control output is in the safety area data, control by the control output is permitted, and when it is outside the safety area data, control by the control output is prohibited, or the control output is set to the safety area. An output control unit that limits and controls the data,
    With
    The safety verification unit is a control device characterized in that the safety area data is changed according to operating conditions of a controlled object.
  2. 　前記安全検証部は、特定の動作条件下で収集した動作実績データから前記安全領域データを生成し、該動作条件と、前記安全領域データの境界値との関係に基づき、前記安全領域データを変化させて、前記特定の動作条件下とは異なる他の動作条件下での前記制御出力の安全領域データを生成することを特徴とする請求項１に記載の制御装置。 The safety verification unit generates the safety area data from the operation record data collected under specific operation conditions, and changes the safety area data based on the relationship between the operation conditions and the boundary value of the safety area data. The control device according to claim 1, wherein the safety area data of the control output is generated under other operating conditions different from the specific operating conditions.
  3. 　前記制御出力が過去に安全な制御結果を経験した範囲を前記安全領域データとして記憶するデータベースを備え、
    　前記安全検証部は、過去の入力および過去の制御出力に基づいて前記制御出力が前記安全領域データ内にあるか否かを判定することを特徴とする請求項１に記載の制御装置。     It is provided with a database that stores the range in which the control output has experienced a safe control result in the past as the safe area data.
    The control device according to claim 1, wherein the safety verification unit determines whether or not the control output is within the safety area data based on a past input and a past control output.
  4. 　前記安全領域データは、少なくとも１つ以上の次元を持ち、前記変化は特定の次元において係数を乗じることにより行われることを特徴とする請求項１に記載の制御装置。 The control device according to claim 1, wherein the safety area data has at least one dimension, and the change is performed by multiplying a coefficient in a specific dimension.
  5. 　前記安全領域データは、少なくとも１つ以上の次元を持ち、前記変化は特定の次元の軸において拡大縮小させることにより行われることを特徴とする請求項１に記載の制御装置。 The control device according to claim 1, wherein the safety area data has at least one dimension, and the change is performed by scaling on an axis of a specific dimension.
  6. 　前記動作条件は、前記制御対象である移動体の速度であることを特徴とする請求項１に記載の制御装置。 The control device according to claim 1, wherein the operating condition is the speed of the moving body to be controlled.
  7. 　前記動作条件は、前記制御対象である移動体が走行する路面の摩擦係数であることを特徴とする請求項１に記載の制御装置。 The control device according to claim 1, wherein the operating condition is a friction coefficient of a road surface on which the moving body to be controlled travels.
  8. 　前記動作条件は、交差点の形状の特徴量であることを特徴とする請求項１に記載の制御装置。 The control device according to claim 1, wherein the operating condition is a feature amount of the shape of an intersection.
  9. 　前記交差点の形状の特徴量は、前記交差点の大きさであることを特徴とする請求項８に記載の制御装置。 The control device according to claim 8, wherein the feature amount of the shape of the intersection is the size of the intersection.
  10. 　前記交差点の形状の特徴量は、前記交差点の回転角度であることを特徴とする請求項８に記載の制御装置。 The control device according to claim 8, wherein the feature amount of the shape of the intersection is a rotation angle of the intersection.
PCT/JP2020/018069 2019-05-17 2020-04-28 Control device WO2020235317A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2019093837A JP7250613B2 (en) 2019-05-17 2019-05-17 Control device
JP2019-093837 2019-05-17

Publications (1)

Publication Number Publication Date
WO2020235317A1 true WO2020235317A1 (en) 2020-11-26

Family

ID=73222830

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2020/018069 WO2020235317A1 (en) 2019-05-17 2020-04-28 Control device

Country Status (2)

Country Link
JP (1) JP7250613B2 (en)
WO (1) WO2020235317A1 (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000034093A (en) * 1998-07-21 2000-02-02 Kobe Steel Ltd Slewing type working machinery and its safety working area and setting method of rated load
JP2000338004A (en) * 1999-05-31 2000-12-08 Horiba Ltd Travelling performance learning method for motor- vehicle drive system, motor-vehicle drive system, and recording medium to record travelling performance learning program
JP2003098047A (en) * 2001-09-26 2003-04-03 Horiba Ltd Automobile automatic operation system
JP2010023657A (en) * 2008-07-18 2010-02-04 Jtekt Corp Electric power steering device
JP2018185746A (en) * 2017-04-27 2018-11-22 株式会社日立製作所 Control system and control method

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000034093A (en) * 1998-07-21 2000-02-02 Kobe Steel Ltd Slewing type working machinery and its safety working area and setting method of rated load
JP2000338004A (en) * 1999-05-31 2000-12-08 Horiba Ltd Travelling performance learning method for motor- vehicle drive system, motor-vehicle drive system, and recording medium to record travelling performance learning program
JP2003098047A (en) * 2001-09-26 2003-04-03 Horiba Ltd Automobile automatic operation system
JP2010023657A (en) * 2008-07-18 2010-02-04 Jtekt Corp Electric power steering device
JP2018185746A (en) * 2017-04-27 2018-11-22 株式会社日立製作所 Control system and control method

Also Published As

Publication number Publication date
JP7250613B2 (en) 2023-04-03
JP2020187709A (en) 2020-11-19

Similar Documents

Publication Publication Date Title
Gerdes et al. Implementable ethics for autonomous vehicles
EP3588226B1 (en) Method and arrangement for generating control commands for an autonomous road vehicle
Du et al. A cooperative control framework for CAV lane change in a mixed traffic environment
Tehrani et al. General behavior and motion model for automated lane change
CN109791051A (en) Vehicle-mounted interface device, judgment method, program and storage medium
Horst et al. Trajectory generation for an on-road autonomous vehicle
Kamran et al. Minimizing safety interference for safe and comfortable automated driving with distributional reinforcement learning
Liu et al. The robustly-safe automated driving system for enhanced active safety
CN113200054B (en) Path planning method and system for automatic driving take-over
Liu et al. Moving horizon shared steering strategy for intelligent vehicle based on potential‐hazard analysis
WO2020235317A1 (en) Control device
Saparia et al. Active safety system for semi-autonomous teleoperated vehicles
JP2021057012A (en) Method, device and apparatus for controlling vehicle, and storage medium
CN112141073A (en) Method for controlling a vehicle
US20210061303A1 (en) Monitor assignment system and method
Pek et al. Enhancing motion safety by identifying safety-critical passageways
CN115123217B (en) Mine obstacle vehicle driving track generation method and device and computer equipment
Cheng et al. A hierarchical driver model
Geyer Maneuver-based vehicle guidance based on the Conduct-by-Wire principle
Wei et al. Driver-centred autonomous vehicle motion control within a blended corridor
Yan et al. Application of fuzzy control under time-varying universe in unmanned vehicles
Ito The uncertainty that the autonomous car faces and predictability analysis for evaluation
Faruffini et al. Vehicle autonomous navigation with context awareness
Yuan et al. Scalable Game-Theoretic Decision-Making for Self-Driving Cars at Unsignalized Intersections
Rasekhipour Prioritized Obstacle Avoidance in Motion Planning of Autonomous Vehicles

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20810154

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20810154

Country of ref document: EP

Kind code of ref document: A1