WO2024154251A1 - 車両の制御システム - Google Patents

車両の制御システム Download PDF

Info

Publication number
WO2024154251A1
WO2024154251A1 PCT/JP2023/001327 JP2023001327W WO2024154251A1 WO 2024154251 A1 WO2024154251 A1 WO 2024154251A1 JP 2023001327 W JP2023001327 W JP 2023001327W WO 2024154251 A1 WO2024154251 A1 WO 2024154251A1
Authority
WO
WIPO (PCT)
Prior art keywords
control
vehicle
server device
information
driving
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/JP2023/001327
Other languages
English (en)
French (fr)
Japanese (ja)
Inventor
史人 山口
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Subaru Corp
Original Assignee
Subaru Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Subaru Corp filed Critical Subaru Corp
Priority to PCT/JP2023/001327 priority Critical patent/WO2024154251A1/ja
Priority to CN202380014254.6A priority patent/CN118679090A/zh
Priority to DE112023005596.3T priority patent/DE112023005596T5/de
Priority to JP2024517139A priority patent/JP7652989B2/ja
Publication of WO2024154251A1 publication Critical patent/WO2024154251A1/ja
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05D—SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES
    • G05D1/00—Control of position, course, altitude or attitude of land, water, air or space vehicles, e.g. using automatic pilots
    • G05D1/20—Control system inputs
    • G05D1/22—Command input arrangements
    • G05D1/221—Remote-control arrangements
    • G05D1/226—Communication links with the remote-control arrangements

Definitions

  • the present invention relates to a vehicle control system.
  • Patent Document 1 The use of a server device for driving control of vehicles such as automobiles has been proposed.
  • the traffic control system when attempting to control vehicle travel using a server device in this manner, the traffic control system basically executes the following control.
  • the server device acquires driving information about the plurality of vehicles, generates individual control information for each of the plurality of vehicles based on the acquired information, and transmits each individual control information to each of the plurality of vehicles.
  • each automobile receives the individual control information addressed to its own automobile, it uses the individual control information to generate control values to be actually used for driving control of its own automobile, and executes driving control using the generated control values. It is expected that by repeatedly executing the control of the server device and the control of each of the multiple vehicles, each vehicle will be able to drive with improved safety, etc. under the control of the server device.
  • a malfunction may occur in the server device while a plurality of vehicles are controlling their respective driving under the control of such a server device.
  • a server device it is generally considered that there is a non-zero possibility that inconsistencies will occur in the programs used on the server device.
  • inconsistencies between programs will occur on the server device due to program bugs or program updates.
  • the server device must be connected to a communication network. As a result, the server device may be subject to unauthorized access from outside. There is also a possibility that the server device may be hijacked and programs may be rewritten. Even if such a problem occurs in the server device, vehicles that are actually traveling on the road are required to travel safely. Also, each vehicle is required to travel in a manner that does not impede the travel of other vehicles.
  • the vehicle control system includes a plurality of vehicles each having a driving control unit capable of generating a control value for controlling the driving of the vehicle itself, and a server device that generates an individual remote control value for each of the plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control value to the plurality of vehicles.
  • the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle itself using the individual remote control value addressed to the vehicle itself received from the server device.
  • the driving control unit of each of the plurality of vehicles determines whether or not there is a malfunction in the server device, and if it is determined that there is no malfunction in the server device, executes a subordinate driving control that generates the control value using the individual remote control value received from the server device together with information from the vehicle's sensor, and if it is determined that there is a malfunction in the server device, executes an autonomous driving control that generates the control value using information from the vehicle's sensor or information obtained by manual operation, without using the individual remote control value received from the server device.
  • a driving control unit capable of generating a control value for controlling the driving of the vehicle judges whether or not there is a malfunction in the server device. If it is not judged that there is a malfunction in the server device, the driving control unit executes a subordinate driving control to generate a control value using information from the vehicle sensor and an individual remote control value received from the server device. This allows each vehicle to drive according to the individual remote control value of the server device that is not judged to have a malfunction. Moreover, when the driving control unit determines that the server device is defective, the driving control unit executes autonomous driving control to generate a control value using information from the vehicle's own sensor or information from manual operation. At this time, the driving control unit generates the control value without using the individual remote control value received from the server device determined to be defective. This allows each vehicle to not drive according to the individual remote control value of the server device determined to be defective.
  • each vehicle in a vehicle control system that uses a server device for vehicle driving control can respond if there is a malfunction in the server device.
  • FIG. 1 is a configuration diagram of an automobile control system according to an embodiment of the present invention.
  • FIG. 2 is an explanatory diagram of a control system of the automobile of FIG.
  • FIG. 3 is an explanatory diagram of a basic hardware configuration of the vehicle driving control device of FIG.
  • FIG. 4 is a basic flow chart of autonomous driving control by the vehicle driving control device of FIG.
  • FIG. 5 is a diagram showing the hardware configuration of the server device of FIG.
  • FIG. 6 is a basic timing chart for individual control of a plurality of automobiles in the control system of FIG.
  • FIG. 7 is a basic flow chart of the control selection control by the vehicle driving control device of FIG. FIG.
  • FIG. 8 is a flowchart of the control of determining whether or not there is a malfunction in the server device, which is performed by the vehicle driving control device of FIG.
  • FIG. 9 is a flowchart showing basic remote control information transmission control by the server device of FIG.
  • FIG. 10 is an explanatory diagram of a method for determining whether a malfunction has occurred in a server device by a driving control device of an automobile.
  • FIG. 11 is an explanatory diagram of a method for determining whether a malfunction has occurred in a server device by a driving control device of an automobile.
  • FIG. 1 is a configuration diagram of a control system 1 for an automobile 2 according to an embodiment of the present invention.
  • the control system 1 in FIG. 1 includes a plurality of automobiles 2 traveling on a road 90 , and a server device 3 that transmits and receives information to and from the plurality of automobiles 2 via a communication system 6 .
  • automobile 2 is an example of a vehicle.
  • Other examples of vehicles include trucks, buses, motorcycles, and personal mobility vehicles.
  • FIG. 1 multiple automobiles 2 are traveling in sequence on road 90. Also, some of the automobiles 2 are parked in a parking lot 95 facing road 90.
  • the communication system 6 has a plurality of base stations 7 arranged along a road 90, and a communication network 8 to which the plurality of base stations 7 are connected.
  • the base stations 7 may be, for example, commercial 5G base stations or base stations for advanced transportation systems such as ADAS (Advanced Driver Assistance Systems).
  • the communication network 8 may be composed of a carrier communication network that provides 5G base stations, the Internet connected to the carrier communication network, and the like.
  • the server device 3 has a server body 4 connected to the communication network 8 of the communication system 6, and a server DB 5 connected to the server body 4. Basically, the server device 3 only needs to be connected to the Internet of the communication system 6, but may also be connected to a carrier communication network.
  • the server device 3 may be configured not with one server body 4, but with multiple server bodies 4 that cooperate with each other to execute distributed control.
  • the multiple server bodies 4 may be arranged in a hierarchy, for example.
  • the multiple server bodies 4 at the lowest level in the hierarchy may be connected to the carrier communication network in a distributed manner according to the region, etc.
  • Such a server body 4 may be realized in a control device of a base station for 5G, etc.
  • the server device 3 in FIG. 1 executes individual control for a plurality of automobiles 2 that are within the communication range of the communication system 6 that is constituted by the zones of at least three base stations 7 in the figure. 1 also shows a Global Navigation Satellite System (GNSS) satellite 110.
  • the GNSS satellite 110 broadcasts signals including its position and time information to the ground.
  • the GNSS receiver can obtain information on the position and time where the GNSS receiver is located by receiving signals from multiple GNSS satellites 110.
  • the position and time of each GNSS receiver can be used as likely values that are unlikely to cause errors compared to the positions and times of other GNSS receivers.
  • FIG. 2 is an explanatory diagram of the control system 10 of the automobile 2 of FIG.
  • Each of the multiple automobiles 2 shown in FIG. 1 may be equipped with the control system 10 shown in FIG.
  • the control system 10 of the automobile 2 in FIG. 2 has a vehicle network 19 and multiple control devices connected thereto.
  • examples of the multiple control devices include a sensor control device 11, a driving control device 12, a drive control device 13, a steering control device 14, a braking control device 15, and an external vehicle communication control device 16.
  • the control system 10 of the automobile 2 may also include other control devices, such as an operation control device that acquires information on manual driving operations by the occupants.
  • the vehicle network 19 may be, for example, a vehicle network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN).
  • vehicle network 19 may also include a commonly used network such as IEEE (Institute of Electrical and Electronics Engineers) 802.3 or IEEE 802.11.
  • IEEE Institute of Electrical and Electronics Engineers
  • each control device can input and output information between other control devices through the vehicle network 19.
  • the sensor control device 11 controls the operation of various vehicle sensors provided in the automobile 2, and outputs detection information or processed information of the various vehicle sensors to other control devices via the vehicle network 19.
  • a GNSS receiver 21, an outside vehicle camera 22, and an acceleration sensor 23 are connected to the sensor control device 11 as examples of vehicle sensors.
  • a vehicle speed sensor, steering sensor, etc. may also be connected to the sensor control device 11.
  • the GNSS receiver 21 generates information on the position and time of the automobile 2.
  • the exterior camera 22 captures images of the surroundings of the automobile 2 traveling on a road 90 or the like.
  • the exterior camera 22 may be a monocular camera, a compound eye camera, or a 360-degree camera. It is preferable that the exterior camera 22 be capable of capturing images of at least the front of the traveling automobile 2.
  • the sensor control device 11 may generate information on the relative distance and direction of other automobiles around the vehicle based on the images captured by the exterior camera 22.
  • the acceleration sensor 23 detects the acceleration of the automobile 2. By using a sensor that detects acceleration in three axial directions as the acceleration sensor 23, the sensor control device 11 can generate information on the angular acceleration of the automobile 2 in each of the yaw, pitch, and roll directions.
  • the vehicle speed sensor detects the speed of the automobile 2 .
  • the steering sensor detects the steering angle of a steering wheel (not shown) of the automobile 2 .
  • a vehicle communication device 29 provided in the automobile 2 is connected to the exterior communication control device 16.
  • the vehicle communication device 29 establishes a wireless communication path with a base station 7 with which communication is possible.
  • the exterior communication control device 16 controls the operation of the vehicle communication device 29 and transmits and receives information to and from the server device 3 via the vehicle communication device 29 and the base station 7.
  • the exterior communication control device 16 outputs information that the vehicle communication device 29 receives from the server device 3 or the base station 7 to other control devices via the vehicle network 19.
  • the exterior communication control device 16 transmits information input from other control devices via the vehicle network 19 to the server device 3 via the vehicle communication device 29 and the base station 7.
  • the drive control device 13 is connected to drive system components installed in the automobile 2, such as an engine that uses gasoline or hydrogen as fuel to generate drive force, a motor that generates drive force using electricity, and a transmission.
  • the drive control device 13 controls the operation of these drive system components using control values obtained through the vehicle network 19.
  • the steering control device 14 is connected to, for example, a steering device provided in the automobile 2.
  • the steering control device 14 controls the operation of the steering device using control values acquired through the vehicle network 19.
  • the braking control device 15 is connected to the braking device provided in the automobile 2.
  • the braking control device 15 controls the operation of the braking device using control values acquired through the vehicle network 19.
  • the driving control device 12 controls the driving of the automobile 2.
  • the driving control device 12 acquires information on the driving state of the own vehicle and information on the surroundings of the own vehicle from the sensor control device 11, and generates a control value according to the information.
  • the driving control device 12 determines, for example, based on the latest image captured by the exterior camera 22, that another moving object is approaching in front of the vehicle, it generates a control value for the braking control device 15 to slow down or stop the vehicle.
  • the cruise control device 12 When it is determined based on the latest image captured by the exterior camera 22 that the stopped vehicle is ready to start, the cruise control device 12 generates a control value for the drive control device 13 to accelerate the vehicle.
  • the cruise control device 12 If the latest image captured by the exterior camera 22 indicates that the vehicle is likely to deviate from the lane in which it is traveling, the cruise control device 12 generates a control value for the steering control device 14 to change the direction of travel of the vehicle. In addition, when the position of the GNSS receiver 21 is compared with the high-precision map data and it is determined that the vehicle needs to turn right, turn left, or change lanes, the driving control device 12 generates a control value for the steering control device 14 to change the direction of travel of the vehicle. In this way, the driving control device 12 can cause the automobile 2 to drive autonomously through autonomous decision control based on detection by the vehicle's own sensor.
  • FIG. 3 is an explanatory diagram of a basic hardware configuration of the driving control device 12 of the automobile 2 of FIG. 3 includes a vehicle CPU (Central Processing Unit) 73, a vehicle memory 72, an input/output device 71 connected to the vehicle network 19, and a vehicle internal bus 79 to which these are connected. A timer or the like may be further connected to the vehicle internal bus 79.
  • a vehicle CPU Central Processing Unit
  • the input/output device 71 inputs and outputs information to and from other control devices via the vehicle network 19. This allows the driving control device 12 to obtain information to be used for its control.
  • the vehicle memory 72 records programs for driving control, settings, detection values, etc.
  • FIG. 3 shows an example of high-precision map data 74 recorded in the vehicle memory 72.
  • the vehicle memory 72 may be composed of, for example, a semiconductor memory, a HDD (Hard Disk Drive), etc.
  • the vehicle CPU 73 reads and executes programs from the vehicle memory 72. This realizes a control unit in the driving control device 12.
  • FIG. 4 is a basic flowchart of autonomous driving control by the driving control device 12 of the automobile 2 of FIG.
  • the vehicle CPU 73 of the driving control device 12 repeatedly executes the autonomous driving control of FIG.
  • the vehicle CPU 73 of the driving control device 12 collects and acquires vehicle information such as information indicating the driving state of the vehicle and information about the driving environment around the vehicle from the sensor control device 11 of the vehicle.
  • the information acquired from the sensor control device 11 of the vehicle may be acquired in advance and recorded in the vehicle memory 72 of the driving control device 12.
  • the vehicle information may include information such as the position, direction, speed, acceleration, and direction of travel of the vehicle and other automobiles around the vehicle contained in the image captured by the in-vehicle camera.
  • the vehicle CPU 73 may process the information acquired from the sensor control device 11 and generate this information.
  • the vehicle information may also include information indicating the operating state, control contents, and control results of the drive control device 13, steering control device 14, braking control device 15, etc.
  • the vehicle information may also include time information generated by the GNSS receiver 21.
  • step ST2 the vehicle CPU 73 of the driving control device 12 generates a control value for autonomously controlling the driving of the host vehicle, based on the information acquired in step ST1.
  • the vehicle CPU 73 generates a control value for controlling the running of the vehicle in response to the vehicle information so as to suppress interference with other automobiles and the like.
  • the vehicle CPU 73 generates, for example, a control value for accelerating the automobile 2, a control value for maintaining the speed, a control value for decelerating, a control value for stopping, a control value for maintaining the speed, a steering control value for maintaining the lane, and a steering control value for changing the lane.
  • step ST3 the vehicle CPU 73 of the driving control device 12 outputs the control value generated in step ST2 to each control device that executes driving control of the vehicle through the vehicle network 19.
  • the drive control device 13 executes control to set the drive output to the control value.
  • the steering control device 14 executes control so that the steering angle including the steering direction becomes the control value.
  • the braking control device 15 executes control to set the braking force to the control value.
  • the automobile 2 can run according to the autonomous driving control by the driving control device 12. Thereafter, the vehicle CPU 73 of the driving control device 12 ends this control.
  • each of the multiple automobiles 2 can generate control values for controlling the driving of its own vehicle through autonomous driving control by its driving control device 12.
  • FIG. 5 is a diagram showing the hardware configuration of the server device 3 of FIG.
  • the server apparatus 3 in FIG. 5 includes a server communication device 31, a server GNSS receiver 32, a server DB (server database) 5, a server memory 33, a server CPU 34, and a server internal bus 39 to which these are connected.
  • the server communication device 31 is connected to the communication network 8 of the communication system 6.
  • the server communication device 31 transmits and receives information to and from the vehicle communication device 29 provided in the automobile 2.
  • the server communication device 31 may receive driving information from each of the multiple automobiles 2.
  • the server GNSS receiver 32 generates information on the position and time of the server device 3.
  • the time generated by the server GNSS receiver 32 can match with high accuracy the time generated by the GNSS receiver 21 of each vehicle 2.
  • the server DB5 accumulates and records various data used by the server device 3 for individual control of multiple automobiles 2. Such data includes, for example, driving information of each automobile 2.
  • the server DB5 may include, for example, high-precision map data, a road regulation DB (road regulation database), a vehicle position behavior DB (vehicle position behavior database), and the like.
  • the server memory 33 stores data such as programs executed by the server CPU 34.
  • the server CPU 34 reads and executes the programs recorded in the server memory 33. This realizes a control unit that controls the operation of the server device 3.
  • the control unit generates individual control information, such as individual remote control values and individual control information used for driving control in each automobile 2, to individually control the driving of each automobile 2, and transmits it to each automobile 2.
  • the individual remote control values are the same as the control values generated by the driving control device 12 of each automobile 2, and may be values that can be directly given to the control devices that execute control in each automobile 2, such as the drive control device 13.
  • Such individual remote control values are the control values generated in the autonomous driving control of Fig. 4 described above, which are generated by the server device 3 and transmitted to each automobile 2. In this case, each automobile 2 will travel by remote control in accordance with the server device 3.
  • the individual control information may indicate requests for the driving control device 12 of each vehicle 2 to generate control values.
  • Such individual control information may include information indicating requests regarding acceleration/deceleration, steering, lane changes, etc.
  • each vehicle 2 generates control values in response to requests from the server device 3 and travels under the control of the server device 3.
  • the server CPU 34 may switch the individual control information generated for each automobile 2 between individual remote control values and individual control information depending on the driving state of each automobile 2, etc. For example, when the automobile 2 continues to travel along the road 90 in FIG. 1, the server CPU 34 may generate individual control information as the individual control information for the automobile 2. On the other hand, when the automobile 2 travels from the road 90 in FIG. 1 to enter the parking lot 95, the server CPU 34 may generate an individual remote control value as the individual control information for the automobile 2. As a result, when the automobile 2 continues to travel along the road 90 in FIG. 1, it can generate control values suitable for continuing to travel along the road 90 in accordance with the individual control information, while also using detection information from the automobile's own vehicle sensor. In addition, when the automobile 2 travels from the road 90 in FIG.
  • the automobile 2 can generate a control value according to an individual remote control value from a server device that is aware of the status of the parking lot 95, and travel toward the parking lot 95.
  • the automobile 2 is able to travel safely according to instructions from the server device 3 based on information beyond the range that can be detected by the automobile's own vehicle sensors.
  • Fig. 6 is a basic timing chart of the individual control of a plurality of automobiles 2 in the control system 1 of Fig. 1.
  • Fig. 6 shows only one automobile 2.
  • FIG. 6 shows an example in which each automobile 2 travels under the secondary travel control (step ST20) in accordance with the individual remote control value of the server device 3.
  • the driving control device 12 of the automobile 2 first collects and acquires vehicle information of the automobile in step ST71, and then transmits the driving information of the automobile to the server device 3 (step ST72).
  • driving information of multiple automobiles 2 is collected in the server device 3.
  • the driving information may basically be composed of information necessary for processing by the server device 3.
  • the driving information may be the vehicle information itself, or a part of the vehicle information.
  • it is desirable that the driving information includes at least information indicating the position, speed, etc. of the automobile 2.
  • the server CPU 34 of the server device 3 When the server CPU 34 of the server device 3 receives the driving information from the automobile 2, it calculates the position of the automobile 2 (vehicle S position) based on the received driving information (step ST81).
  • the vehicle S position may indicate, for example, the lane of the road 90 on which the automobile 2 is driving and its position on that lane, using high-precision map data. This allows the server device 3 to map each automobile 2 to high-precision map data, etc. The driving positions and driving conditions of multiple automobiles 2 will be mapped onto the high-precision map data, etc.
  • the server CPU 34 of the server device 3 judges the possibility of future interference between the multiple automobiles 2 (step ST82). For example, if the speed of the automobile 2 traveling behind is faster than that of the automobile 2 traveling in front of it in the same lane, the server CPU 34 of the server device 3 judges that there is a possibility that those automobiles 2 will interfere with each other in the future.
  • the server CPU 34 of the server device 3 generates individual control information for each of the multiple automobiles 2 (step ST83) and transmits it to each automobile 2 (step ST84).
  • the server CPU 34 When remote control is to be performed, the server CPU 34 generates individual remote control values as the individual control information.
  • management control is to be performed, the server CPU 34 generates individual management information as the individual control information.
  • the driving control device 12 of the automobile 2 Upon receiving the individual control information from the server device 3, the driving control device 12 of the automobile 2 generates a control value to be output to each control device that executes driving control in the host vehicle based on the individual control information received from the server device 3 (step ST73).
  • the driving control device 12 then outputs the generated control value to the drive control device 13, the steering control device 14, or the braking control device 15.
  • the drive control device 13 executes control to set the drive output to the control value.
  • the steering control device 14 executes control to set the steering angle including the steering direction to the control value.
  • the braking control device 15 executes control to set the braking force to the control value.
  • each driving control device 12 of the multiple automobiles 2 receives an individual remote control value from the server device 3, the driving control device 12 can use the individual remote control value as it is as a control value.
  • the driving control device 12 of the present embodiment generates a control value that suppresses changes in driving compared to the individual remote control value received from the server device 3.
  • the automobile 2 can travel under the individual control of the server device 3 and in accordance with the individual control information generated by the server device 3 .
  • the server device 3 can generate individual control information, such as individual remote control values for each of the multiple automobiles 2 , based on the driving information for the multiple automobiles 2 , and transmit the individual control information to the multiple automobiles 2 .
  • each driving control device 12 of the multiple automobiles 2 can generate control values for driving control of its own vehicle using the latest individual control information addressed to its own vehicle received from the server device 3.
  • the multiple automobiles 2 are individually controlled by the server device 3 and basically execute driving control in accordance with instructions from the server device 3, thereby enabling the automobiles 2 to drive safely without interfering with each other.
  • the server device 3 needs to be connected to a communication network 8 such as the Internet. As a result, the server device 3 may be subject to unauthorized access from outside. There is also a possibility that the server device 3 may be hijacked and programs may be rewritten. Even if such a malfunction occurs in the server device 3, each vehicle 2 that is actually traveling on the road is required to travel safely. Also, each vehicle 2 is required to travel in a manner that does not impede the travel of other vehicles.
  • FIG. 7 is a basic flow chart of the control selection control by the driving control device 12 of the automobile 2 of FIG.
  • the vehicle CPU 73 of the driving control device 12 repeatedly executes the control for control selection in FIG. 7 in order to dynamically switch the driving control of the vehicle between the autonomous driving control in FIG. 4 described above and the slave driving control in FIG. 6 .
  • the server device 3 when it is necessary to force each vehicle 2 to perform remote control, the server device 3 repeatedly transmits remote control information including significant forcing information to each vehicle 2. Furthermore, as will be described later in FIG. 9, when the server device 3 recommends remote control for each vehicle 2, it repeatedly transmits remote control information including significant recommended information to each vehicle 2. In the remote control information, at most only one of the compulsory information and the recommended information can be considered significant.
  • the compulsory information is information by which the server device 3 requests each vehicle 2 to follow the individual remote control values.
  • the recommended information is information by which the server device 3 recommends each vehicle 2 to follow the individual remote control values. Basically, the server device 3 may make the compulsory information significant when an emergency occurs, and make the recommended information significant when the vehicle 2 is traveling in the parking lot 95.
  • the server device 3 determines that there is a problem with its own control, it sends a notification of the problem to each vehicle 2.
  • step S11 the vehicle CPU 73 of the driving control device 12 determines whether the vehicle communication device 29 has received a malfunction notification from the server device 3. If a malfunction notification has been received from the server device 3, the vehicle CPU 73 advances the process to step ST16 to execute autonomous driving control. In this case, the vehicle CPU 73 advances the process to step ST16 without determining by itself in step ST15 that there is a malfunction in the server device 3. If a malfunction notification has not been received from the server device 3, the vehicle CPU 73 advances the process to step ST12.
  • step S12 the vehicle CPU 73 of the driving control device 12 diagnoses the operation of its own driving control device 12 and determines for itself whether or not there is a malfunction in its own autonomous driving control.
  • the vehicle CPU 73 may determine that there is a malfunction in its own autonomous driving control when it cannot obtain periodic control values from its own autonomous driving control that is constantly operating.
  • the vehicle CPU 73 may also determine that there is a malfunction in its own driving control when a watchdog timer that is reset in its own autonomous driving control has timed out. If it determines that there is a malfunction in its own driving control, the vehicle CPU 73 proceeds to step ST20 to execute secondary driving control. If it does not determine that there is a malfunction in its own driving control, the vehicle CPU 73 proceeds to step ST13.
  • step S13 the vehicle CPU 73 of the driving control device 12 determines whether or not a collision of the vehicle is predicted based on images captured by the exterior camera 22, etc. For example, the vehicle CPU 73 may predict the possibility of a collision with another vehicle, etc., based on detection information from the vehicle sensor, such as an image of the driving direction. If a collision of the vehicle is predicted, the vehicle CPU 73 advances the process to step ST16 to execute autonomous driving control to deal with the collision. If a collision of the vehicle is not predicted, the vehicle CPU 73 advances the process to step ST14.
  • step S14 the vehicle CPU 73 of the driving control device 12 determines whether or not there is a malfunction in the server device 3. Details of the determination will be described later.
  • step S15 the vehicle CPU 73 of the driving control device 12 determines whether or not there is a malfunction in the server device 3 based on the determination result in step S14. If it is determined that there is no malfunction in the server device 3, the vehicle CPU 73 advances the process to step ST20 to execute secondary driving control. If it is determined that there is a malfunction in the server device 3, the vehicle CPU 73 advances the process to step ST16.
  • step S16 the vehicle CPU 73 of the driving control device 12 starts autonomous driving control.
  • the vehicle CPU 73 first obtains the latest remote control information obtained from the server device 3. As described above, in the remote control information, only one of the mandatory information and the recommended information can be set to be significant.
  • step S17 the vehicle CPU 73 of the driving control device 12 determines whether the compulsory information is deemed significant in the remote control information acquired in step S16. If the compulsory information is deemed significant, the vehicle CPU 73 advances the process to step ST19. If the compulsory information is not deemed significant, the vehicle CPU 73 advances the process to step ST18.
  • step S18 since the compulsory information is not significant, the vehicle CPU 73 of the driving control device 12 executes autonomous driving control using the detection information of the vehicle sensor so as to continue the current driving. After that, the vehicle CPU 73 ends this control. In this way, the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3, and if the remote control recommendation information in the remote control information received from the server device 3 is significant, it can cause the vehicle to continue driving through autonomous driving control. When the vehicle CPU 73 determines that there is a malfunction in the server device 3, the vehicle CPU 73 executes autonomous driving control to generate a control value using information from the vehicle's own sensor, without using the individual remote control value received as individual control information from the server device 3. The vehicle CPU 73 may also generate a control value using information obtained by manual operation by an occupant of the vehicle.
  • step S19 since the compulsory information is determined to be significant, the vehicle CPU 73 of the driving control device 12 executes autonomous driving control using the detection information of the vehicle sensor so as to bring the vehicle to an emergency stop. After that, the vehicle CPU 73 ends this control. In this way, the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3, and if the forced remote control information in the remote control information received from the server device 3 is significant, it can bring the vehicle to an emergency stop through autonomous driving control. When the vehicle CPU 73 determines that there is a malfunction in the server device 3, it performs autonomous driving control in which a control value is generated using information from the vehicle's own vehicle sensors, without using the individual remote control values received as individual control information from the server device 3.
  • step S20 the vehicle CPU 73 of the driving control device 12 executes a secondary driving control for generating a control value using the information of the host vehicle sensor and the individual remote control value received from the server device 3. Thereafter, the vehicle CPU 73 ends this control.
  • the vehicle CPU 73 of the driving control device 12 does not determine that there is a malfunction in the server device 3, it can generate a control value using the individual remote control value by the secondary driving control.
  • the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in its own autonomous driving control, it can generate a control value using an individual remote control value through secondary driving control, even if it does not determine that there is a malfunction in the server device 3.
  • FIG. 8 is a flowchart of a process for determining whether or not there is a malfunction in the server device 3, which is performed by the driving control device 12 of the automobile 2 shown in FIG.
  • the vehicle CPU 73 of the driving control device 12 executes control for determining whether or not there is a malfunction in the server device 3 of FIG.
  • the judgment control of Figure 8 judges a malfunction of the server device 3 based on a comparison between the envelope of multiple individual remote control values received from the server device 3 and the envelope of multiple control values generated by the autonomous driving control in the vehicle, as illustrated in Figures 10 and 11 described later.
  • the vehicle CPU 73 may also execute a determination control other than that shown in FIG. 8 in step ST14 of FIG.
  • step S31 the vehicle CPU 73 of the driving control device 12 plots the multiple individual remote control values received by the vehicle communication device 29 during a predetermined period on a graph such as that shown in Figures 10 and 11 described below. Each individual remote control value may be plotted on the graph based on its value and time.
  • step S32 the vehicle CPU 73 of the driving control device 12 generates an envelope for each of the individual remote control values and counts the waveform features contained in the envelope.
  • the waveform features may be, for example, the number of changes in the waveform slope in the envelope or the number of poles of the waveform contained in the envelope.
  • step S33 the vehicle CPU 73 of the driving control device 12 plots a number of control values (hereinafter referred to as autonomous control values) that the autonomous driving control generates based only on the detection values of the vehicle's own sensor during the above-mentioned predetermined period on a graph such as that shown in Figures 10 and 11 described below.
  • Each autonomous control value may be plotted on the graph based on its value and time.
  • step S34 the vehicle CPU 73 of the driving control device 12 generates an envelope for the multiple autonomous control values and counts the waveform characteristics contained in the envelope.
  • the waveform characteristics are the same as those used for the individual remote control values.
  • step S35 the vehicle CPU 73 of the driving control device 12 calculates the difference between the count value for the individual remote control value in step ST32 and the count value for the autonomous control value in step ST34.
  • step S36 the vehicle CPU 73 of the driving control device 12 acquires the latest remote control information received from the server device 3.
  • the remote control information only one of the mandatory information and the recommended information can be set to be significant.
  • step S37 the vehicle CPU 73 of the driving control device 12 reads a threshold value corresponding to the significant value in the remote control information acquired in step S36. For example, when recommendation information is significant in the remote control information, the vehicle CPU 73 reads the first threshold value corresponding to the recommendation information. On the other hand, when the compulsion information in the remote control information is significant, the vehicle CPU 73 reads the second threshold value corresponding to the compulsion information.
  • the first threshold value and the second threshold value may be recorded in the vehicle memory 72.
  • the second threshold may be a value greater than the first threshold. For example, if the first threshold is 3, the second threshold may be a value greater than 3, such as 5.
  • the first threshold and the second threshold may be natural numbers less than or equal to 10.
  • step S38 the vehicle CPU 73 of the driving control device 12 compares the difference in the count values of the waveform features calculated in step ST35 with the threshold value acquired in step ST37. Then, if the difference between the count values of the waveform features is equal to or greater than the threshold value, the vehicle CPU 73 proceeds to step ST39. On the other hand, if the difference between the count values of the waveform features is smaller than the threshold value, the vehicle CPU 73 proceeds to step ST40. In this case, when the vehicle CPU 73 receives significant forced remote control information from the server device 3, it uses a second threshold value that is greater than the first threshold value when significant recommended remote control information is received from the server device 3 as the threshold value to be compared with the difference in the count values of the waveform features.
  • step S39 the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3 because the difference in the count values of the waveform features is equal to or greater than the threshold value. The vehicle CPU 73 then ends this control and returns the process to FIG. 7.
  • step S40 the vehicle CPU 73 of the driving control device 12 determines that there is no malfunction in the server device 3 because the difference in the count values of the waveform features is smaller than the threshold value. The vehicle CPU 73 then ends this control and returns the process to FIG. 7.
  • the vehicle CPU 73 of the driving control device 12 can determine whether or not there is a malfunction in the server device 3 by comparing the individual remote control values received from the server device 3 with the control values generated by the autonomous driving control in the vehicle. Furthermore, if it is determined that there is a malfunction in the server device 3, it can further determine this in step ST15 of FIG. 7 and switch the driving control of the vehicle from secondary driving control to autonomous driving control.
  • FIG. 9 is a flowchart showing basic remote control information transmission control by the server device 3 of FIG.
  • the server CPU 34 of the server device 3 repeatedly executes the remote control information transmission control of FIG. 9 in order to generate the remote control information. Furthermore, as a result of the remote control information transmission control of FIG. 9, the server CPU 34 switches the individual control information to be transmitted to each automobile 2 between the individual remote control value and the individual control information.
  • step S51 the server CPU 34 of the server device 3 generates a communication reliability value with the automobile 2 from which it is receiving driving information.
  • the communication reliability value may have an initial value of 100, for example, and be subtracted if there is a loss of communication or a large delay, and be returned to the initial value when there are no more loss of communication or large delays.
  • step S52 the server CPU 34 of the server device 3 determines whether the communication reliability value updated in step S51 is equal to or greater than a threshold value. If the communication reliability value is equal to or greater than the threshold value, the communication state is good. In this case, the server CPU 34 advances the process to step ST53. If the communication reliability value is not equal to or greater than the threshold value, the server CPU 34 advances the process to step ST57, since the communication state may not be suitable for continuing to transmit individual remote control values.
  • step S53 the server CPU 34 of the server device 3 judges whether or not a server malfunction determination notification has been received from the automobile 2.
  • the driving control device 12 of the automobile 2 judges that there is a malfunction in the server device 3 in step ST15 of FIG. 7, for example, when transmitting driving information in step ST72 of FIG. 6, the driving control device 12 adds information indicating that the vehicle has judged that there is a malfunction in the server device 3 and transmits the information to the server device 3.
  • the server CPU 34 may judge whether or not a server malfunction determination notification has been received based on whether such additional information is included in the driving information. If a server malfunction determination notification has not been received, the server CPU 34 proceeds to step ST54. If a server malfunction determination notification has been received, the server CPU 34 proceeds to step ST57 to generate individual control information instead of individual remote control values.
  • step S54 the server CPU 34 of the server device 3 determines whether or not there is a malfunction in the automobile 2. If a malfunction occurs in the automobile 2, the driving control device 12 of the automobile 2 includes this information in the driving information and transmits it. The server CPU 34 may determine whether or not there is a malfunction in the automobile 2 based on whether or not such information is included in the driving information. If there is a malfunction in the automobile 2, the server CPU 34 advances the process to step ST60 to suppress the execution of autonomous driving control of the automobile 2. If there is no malfunction in the automobile 2, the server CPU 34 advances the process to step ST55.
  • step S55 the server CPU 34 of the server device 3 determines whether or not it is necessary to enforce remote control in the individual control of the automobile 2.
  • the server CPU 34 may determine that it is necessary to enforce remote control, for example, when it is necessary to accommodate the passing of an emergency vehicle. If it is necessary to enforce remote control, the server CPU 34 advances the process to step ST60 to prevent the automobile 2 from executing autonomous driving control. If it is not necessary to enforce remote control, the server CPU 34 advances the process to step ST56.
  • step S56 the server CPU 34 of the server device 3 determines whether or not a recommendation of remote control is necessary in the individual control of the automobile 2.
  • the server CPU 34 may determine that a recommendation of remote control is necessary, for example, when the automobile 2 is parked in a parking lot 95. If a recommendation of remote control is necessary, the server CPU 34 advances the process to step ST62 to suppress the execution of the autonomous driving control of the automobile 2. If a recommendation of remote control is not necessary, the server CPU 34 advances the process to step ST57 to cause the automobile 2 to execute subordinate driving control under the individual control information.
  • step S57 the server CPU 34 of the server device 3 does not make the compulsory information and recommended information included in the remote control information significant.
  • the remote control information does not include significant information.
  • step S58 the server CPU 34 of the server device 3 generates individual control information.
  • step S59 the server CPU 34 of the server device 3 transmits the information generated for individual control to the corresponding vehicle 2.
  • step S58 the server CPU 34 transmits the individual control information together with the remote control information that does not contain any significant information. Thereafter, the server CPU 34 ends this control.
  • step S60 the server CPU 34 of the server device 3 sets the forced information included in the remote control information to be significant, and sets the recommended information to be insignificant.
  • the remote control information includes significant forced information.
  • step S61 the server CPU 34 of the server device 3 generates an individual remote control value.
  • step S59 the server CPU 34 transmits the individual remote control value together with the remote control information in which the forced information has been made significant. Thereafter, the server CPU 34 ends this control.
  • step S62 the server CPU 34 of the server device 3 sets the recommendation information to be included in the remote control information as significant, and sets the forced information as insignificant.
  • the remote control information includes significant recommendation information.
  • step S63 the server CPU 34 of the server device 3 generates an individual remote control value.
  • step S59 the server CPU 34 transmits the individual remote control value together with the remote control information in which the recommendation information has been made significant. Thereafter, the server CPU 34 ends this control.
  • the server device 3 determines whether or not emergency response is necessary for each of the multiple automobiles 2, and for the automobiles 2 for which it determines that emergency response is necessary, it can send remote control information in which the remote control forced information is made significant in addition to the individual remote control value.
  • the server device 3 can switch the information for driving control to be sent to the malfunction-determined vehicle from individual remote control values that can be used directly for driving control in the malfunction-determined vehicle to individual control information that includes a request for driving control of the vehicle 2.
  • FIG. 10 and 11 are explanatory diagrams of a method for determining whether or not there is a malfunction in the server device 3 by the driving control device 12 of the automobile 2.
  • FIG. 10 shows an example of a case where it is not determined that there is a malfunction in the server device 3.
  • FIG. 11 shows an example of a case where it is determined that there is a malfunction in the server device 3.
  • the horizontal axis is time and the vertical axis is value.
  • Reference numeral 51 denotes a plurality of individual remote control values transmitted by the server device 3 to each vehicle 2.
  • Reference numeral 52 denotes an envelope of the individual remote control values based on the plurality of individual remote control values 51.
  • Reference numeral 53 denotes a plurality of autonomous control values generated by the autonomous driving control based on the detection of the vehicle sensor.
  • the driving control device 12 may, for example, constantly and repeatedly execute the autonomous driving control of Fig. 4 to repeatedly generate autonomous control values based on the detection of the vehicle sensor together with control values to be actually used for control.
  • Reference numeral 52 denotes an envelope of the autonomous control values based on the plurality of autonomous control values.
  • the envelope 52 based on the multiple individual remote control values 51 has a waveform having three poles.
  • the envelope 54 based on the plurality of autonomous control values 53 has a waveform having one pole.
  • the driving control device 12 determines in step ST38 that the difference in the number of waveform features is smaller than the threshold value, and proceeds to step ST40. Thereafter, the driving control device 12 determines in step ST15 of FIG. 7 that there is no malfunction in the server device 3, and executes the secondary driving control in step ST20.
  • the envelope 52 based on the multiple individual remote control values 51 has a waveform having seven poles.
  • the envelope 54 of the plurality of autonomous control values 53 has a waveform having two poles.
  • the driving control device 12 determines in step ST38 that the difference in the number of waveform features is equal to or greater than the threshold value, and proceeds to the process in step ST39. Thereafter, the driving control device 12 determines in step ST15 of FIG. 7 that there is a malfunction in the server device 3, and executes the autonomous driving control in step ST18 or step ST19.
  • the driving control device 12 capable of generating control values for controlling the driving of the host vehicle judges whether or not there is a malfunction in the server device 3. Then, when it is judged that there is no malfunction in the server device 3, the driving control device 12 executes a secondary driving control for generating a control value using information from the host vehicle sensor of the host vehicle as well as the individual remote control value received from the server device 3. This allows each automobile 2 to drive according to the individual remote control value of the server device 3 that is not judged to have a malfunction. Moreover, when the driving control device 12 determines that the server device 3 is defective, it executes autonomous driving control to generate a control value using information from the vehicle's own vehicle sensor or information from manual operation. At this time, the driving control device 12 generates the control value without using the individual remote control value received from the server device 3 that has been determined to be defective. This allows each automobile 2 to not drive according to the individual remote control value of the server device 3 that has been determined to be defective.
  • each automobile 2 in the automobile 2 control system 1 that uses the server device 3 for driving control of the automobile 2 can respond to any malfunctions in the server device 3.
  • autonomous control value 54... envelope based on a plurality of autonomous control values, 71... input/output device, 72... vehicle memory, 73... vehicle CPU, 74... high-precision map data, 79... vehicle internal bus, 90... road, 95... parking lot, 110... GNSS satellite

Landscapes

  • Engineering & Computer Science (AREA)
  • Aviation & Aerospace Engineering (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Remote Sensing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Traffic Control Systems (AREA)
  • Control Of Driving Devices And Active Controlling Of Vehicle (AREA)
PCT/JP2023/001327 2023-01-18 2023-01-18 車両の制御システム Ceased WO2024154251A1 (ja)

Priority Applications (4)

Application Number Priority Date Filing Date Title
PCT/JP2023/001327 WO2024154251A1 (ja) 2023-01-18 2023-01-18 車両の制御システム
CN202380014254.6A CN118679090A (zh) 2023-01-18 2023-01-18 车辆的控制系统
DE112023005596.3T DE112023005596T5 (de) 2023-01-18 2023-01-18 Fahrzeugsteuerungssystem
JP2024517139A JP7652989B2 (ja) 2023-01-18 2023-01-18 車両の制御システム

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2023/001327 WO2024154251A1 (ja) 2023-01-18 2023-01-18 車両の制御システム

Publications (1)

Publication Number Publication Date
WO2024154251A1 true WO2024154251A1 (ja) 2024-07-25

Family

ID=91955744

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2023/001327 Ceased WO2024154251A1 (ja) 2023-01-18 2023-01-18 車両の制御システム

Country Status (4)

Country Link
JP (1) JP7652989B2 (https=)
CN (1) CN118679090A (https=)
DE (1) DE112023005596T5 (https=)
WO (1) WO2024154251A1 (https=)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120986435A (zh) * 2025-10-21 2025-11-21 大众汽车(中国)科技有限公司 用于控制车辆的方法、装置、设备和介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002323551A (ja) * 2001-04-27 2002-11-08 Fujitsu Ten Ltd ナビゲーション装置
JP2004318238A (ja) * 2003-04-11 2004-11-11 Honda Motor Co Ltd 車両共同利用システム
JP2011035721A (ja) * 2009-08-03 2011-02-17 Toyota Infotechnology Center Co Ltd 路車間通信システムおよび路側通信装置
WO2021038741A1 (ja) * 2019-08-28 2021-03-04 三菱電機株式会社 車線変更経路指示装置及び車線変更経路指示システム

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2019172219A (ja) 2018-03-29 2019-10-10 トヨタ自動車株式会社 車両走行管理システム
JP2022175060A (ja) 2021-05-12 2022-11-25 株式会社日立製作所 移動体管制システム、攻撃通知方法
JP7570971B2 (ja) 2021-05-26 2024-10-22 株式会社日立製作所 安全管理システム、および、自律制御システム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002323551A (ja) * 2001-04-27 2002-11-08 Fujitsu Ten Ltd ナビゲーション装置
JP2004318238A (ja) * 2003-04-11 2004-11-11 Honda Motor Co Ltd 車両共同利用システム
JP2011035721A (ja) * 2009-08-03 2011-02-17 Toyota Infotechnology Center Co Ltd 路車間通信システムおよび路側通信装置
WO2021038741A1 (ja) * 2019-08-28 2021-03-04 三菱電機株式会社 車線変更経路指示装置及び車線変更経路指示システム

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120986435A (zh) * 2025-10-21 2025-11-21 大众汽车(中国)科技有限公司 用于控制车辆的方法、装置、设备和介质

Also Published As

Publication number Publication date
JP7652989B2 (ja) 2025-03-27
JPWO2024154251A1 (https=) 2024-07-25
DE112023005596T5 (de) 2026-02-26
CN118679090A (zh) 2024-09-20

Similar Documents

Publication Publication Date Title
US20210107521A1 (en) Vehicle control system
CN110320904A (zh) 控制装置、非暂时性记录介质、以及控制方法
US20180281775A1 (en) Hybrid vehicle and method of controlling charge mode therefor
JP2018203032A (ja) 自動運転システム
WO2017086087A1 (ja) 処理装置および車両制御システム
CN111008121A (zh) 车辆软件检查
CN113479202B (zh) 行驶控制装置、车辆、行驶控制方法以及存储介质
WO2019116871A1 (ja) 車両並びにその制御システム及び制御方法
US20210229667A1 (en) Vehicle control apparatus and vehicle control method
CN116762058A (zh) 车载型计算机系统和自动驾驶辅助系统
JP7652989B2 (ja) 車両の制御システム
KR20240064959A (ko) 운전자 보조 장치 및 그를 가지는 차량
KR20230173213A (ko) 자동 운전 조작을 하도록 구성된 차량을 조작하는 방법
CN110893881A (zh) 车辆用控制系统及车辆的控制方法
JP7646280B2 (ja) 車両の管制制御システム
CN112660152B (zh) 车辆控制系统
JP7646279B2 (ja) 車両の管制制御システム
US20210105321A1 (en) Vehicle software check
JP2017047795A (ja) 車両走行制御装置
US11220178B2 (en) Vehicle speed regulation incorporating driver wishes under cornering
JP7646281B2 (ja) 車両の管制制御システム
US20260084698A1 (en) Vehicle driving support device
EP4603967A1 (en) Information processing device and information processing method
US20240326735A1 (en) Control device for vehicle, control method, and storage medium
US20240224359A1 (en) Communication device, communication method, and vehicle

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2024517139

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 202380014254.6

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 18719150

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23917465

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 112023005596

Country of ref document: DE

122 Ep: pct application non-entry in european phase

Ref document number: 23917465

Country of ref document: EP

Kind code of ref document: A1

WWP Wipo information: published in national office

Ref document number: 112023005596

Country of ref document: DE