JP2024045477A - vehicle - Google Patents

Abstract

To provide a vehicle configured so that some or all of various types of driving control that are necessary in travelling can be automatically executed without requiring operation by a driver, which enables some or all of driving control in automatic execution to be forcibly stopped at an appropriate timing.SOLUTION: An automatic driving control device, which is mounted on a vehicle, comprises a driving mode setting part and an automatic control part. The driving mode setting part sets a driving mode of the vehicle to either of an advanced automatization mode or a basic mode. When the driving mode is set to the advanced automatization mode, the automatic control part automatically executes automatic driving operation which is driving operation set to be automatically executed, and when a predetermined event requiring cancellation occurs, stops at least one of the automatic driving operation in execution.SELECTED DRAWING: Figure 6

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This international application claims priority based on Japanese Patent Application No. 2014-234665 filed with the Japan Patent Office on November 19, 2014, and is based on Japanese Patent Application No. 2014-234665. The entire contents are incorporated by reference into this international application.

This disclosure relates to an automatic driving control device that can automatically perform at least some of the various driving actions required for driving a vehicle, such as various decisions and operations by the driver, without the need for operation by the driver.

Various technologies have been proposed to realize autonomous driving of vehicles, some of which have been put to practical use. The following Patent Document 1 discloses an autonomous vehicle that can drive autonomously according to a preset driving plan.

JP2012-59274A

One of the ultimate goals of autonomous driving technology is to enable a vehicle to reach its destination simply by setting the destination, without the driver having to be involved in the driving. However, the current situation is that we have not yet reached a level of reliability that would make this possible.

Furthermore, as autonomous driving technology becomes more sophisticated, it is desirable to be able to take appropriate responses to abnormalities in the in-vehicle computer that enables autonomous driving. Specifically, when adopting autonomous driving technology, it is necessary to disable at least part of the automatic control and leave it to the driver, or to force the vehicle's behavior in a safe direction. It is desirable to be able to control the

In one aspect of the present disclosure, in a vehicle that is capable of automatically executing at least some of the various driving controls required for driving without the need for driver operation, it is desirable to be able to forcibly stop at least some of the controls that are being automatically executed at an appropriate time.

An automatic driving control device according to one aspect of the present disclosure is mounted on a vehicle and includes a surrounding information acquisition section, a driving mode setting section, an automatic control section, and a canceling event determination section.
The surrounding information acquisition unit obtains surrounding information that is information about the surroundings of the vehicle. More specifically, surrounding information is information that indicates the state of the surroundings of the vehicle, and is used to automatically execute multiple types of driving operations necessary for driving the vehicle without requiring any operation by the driver. This is necessary information.

The driving mode setting section sets the driving mode of the vehicle to either a highly automated mode or a basic mode. The highly automated mode is a driving mode in which at least some of the plurality of types of driving operations necessary for driving the vehicle are automatically executed based on surrounding information. The basic mode is a driving mode in which the number of types of automatic driving operations that are automatically executed is fewer than in the highly automated mode or zero.

The automatic control unit executes the automatic driving operation set in the driving mode based on the driving mode set by the driving mode setting unit. The cancellation-required event determination unit determines whether or not a specified cancellation-required event has occurred, at least when the driving mode is the highly automated mode. A cancellation-required event is a specified event that requires cancellation (stopping execution) of at least one of the automatic driving operations that are set to be executed.

When the driving mode is set to at least the highly automated mode, if the cancellation-required event determination unit determines that a cancellation-required event has occurred, the automatic control unit stops the execution of at least one of the automatic driving operations that are set to be executed.

According to the automatic driving control device configured in this way, when the driving mode is set to at least the highly automated mode (that is, when at least one automatic driving operation is set to be executed), the required When a cancellation event occurs, at least one of the automatic driving operations that should originally be executed is canceled from the execution target and is no longer executed by the automatic control unit.

Therefore, even if a disabling event occurs that may cause the automatic driving operation to not be performed normally, it is possible to prevent the vehicle's driving from becoming unintentionally unstable.
When the driving mode is set to a driving mode having at least one automatic driving operation to be executed, if the cancellation event determination unit determines that a cancellation event has occurred, the automatic control unit may stop all automatic driving operations to be executed in that driving mode. In other words, if a cancellation event occurs, the automatic control unit does not perform the automatic driving operation. In this way, even if a cancellation event occurs that may cause the automatic driving operation to be unable to be performed normally, it is possible to more reliably prevent the vehicle's running from becoming unintentionally unstable.

Here, the system may include a notification unit and a release permission determination unit. When the release event determination unit determines that a release event has occurred, the notification unit notifies the vehicle occupant that a release event has occurred. The release permission determination unit determines whether or not a specific release permission action has been performed by the vehicle occupant after the notification by the notification unit. When the release permission determination unit determines that a release permission action has been performed, the automatic control unit may stop the execution of an automatic driving action that should be stopped. Then, when the release permission determination unit does not determine that a release permission action has been performed, the automatic control unit may execute a predetermined automatic stop process to stop the traveling of the vehicle.

In an automatic driving control device configured in this manner, when a cancellation event occurs, the automatic driving operation is not stopped unconditionally, but an alert is issued in advance. Then, if the vehicle occupant expresses their intention in response to the alert, the automatic driving operation is stopped. In this manner, it is possible to prevent the vehicle's driving state from becoming unstable due to the stopping of the automatic driving operation.

FIG. 1A is a side view of a vehicle according to an embodiment, and FIG. 1B is a top view of the vehicle according to the embodiment. 1 is a block diagram showing an electrical configuration of a vehicle according to a first embodiment; FIG. 3A is an explanatory diagram showing the automatic driving level of each driving mode, and FIG. 3B is an explanatory diagram showing that the control contents at each automatic driving level may be set arbitrarily. FIG. 2 is an explanatory diagram for explaining an overview of automatic driving. 4 is a flowchart of an autonomous driving level setting process. 6 is a flowchart showing details of automatic operation cancellation confirmation processing in the automatic operation level setting process of FIG. 5. FIG. 7 is a flowchart showing details of a system monitoring process in the automatic driving cancellation confirmation process of FIG. 6 . 7 is a flowchart showing details of internal and external behavior monitoring processing in the automatic driving cancellation confirmation processing of FIG. 6; 7 is a flowchart showing details of an environment monitoring process in the automatic driving cancellation confirmation process of FIG. 6 . FIG. 10A is a flowchart of the driving history recording process, and FIG. 10B is a flowchart showing details of the self-diagnosis process in the automatic driving cancellation confirmation process of FIG. 6 . FIG. 2 is a block diagram showing the electrical configuration of a vehicle according to a second embodiment. It is a flowchart of control state monitoring processing of a 2nd embodiment.

Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.
[First embodiment]
(1) Configuration of vehicle 1 Fig. 1A shows a side view of the vehicle 1 of this embodiment, and Fig. 1B shows a top view of the vehicle 1. However, Fig. 1A and Fig. 1B show a simplified illustration of the arrangement of various cameras, radars, sensors, etc. in the vehicle 1, mainly for the purpose of clearly showing the arrangement of these devices.

As shown in FIGS. 1A and 1B, the vehicle 1 includes at least a front camera 2, a rear camera 3, a left side camera 4, a right side camera 5, and an indoor camera as cameras for photographing the inside and outside of the vehicle 1. It is equipped with 6. Each of the cameras 2 to 6 is a camera that can take color images and videos. Each of the cameras 2 to 6 may be a monocular camera, or may be a stereo camera that is equipped with a plurality of lenses and can also acquire information in the depth direction.

The front camera 2 is provided on the front end side of the ceiling in the vehicle interior so as to face forward. This front camera 2 can photograph the front of the vehicle 1 over a wide range. The rear camera 3 is provided on the rear end side of the ceiling in the vehicle interior so as to face rearward. This rear camera 3 can photograph the rear of the vehicle 1 in a wide range.

The left side camera 4 is mounted on the left side of the vehicle 1 facing left. This left side camera 4 can capture a wide range of images of the left side of the vehicle 1. The right side camera 5 is mounted on the right side of the vehicle 1 facing right. This right side camera 5 can capture a wide range of images of the right side of the vehicle 1.

The interior camera 6 is installed at the front end of the ceiling inside the vehicle cabin so as to face rearward (inside the vehicle cabin). This interior camera 6 can capture images of at least the upper body of the driver inside the vehicle cabin.

The vehicle 1 also includes a front radar device 11, a rear radar device 12, a left radar device 13, and a right radar device 14, as shown in FIGS. 1A and 1B. Each radar device 11 to 14 is a millimeter wave radar in this embodiment. As is well known, millimeter wave radar transmits millimeter wave radio waves and receives the reflected waves using multiple receiving antennas. This radar is capable of detecting target object information regarding targets around the vehicle 1. Target information that can be detected by each radar device 11 to 14 includes the presence or absence of a target in the detection direction, the distance to the target, the direction of the target with respect to vehicle 1, and the moving speed of the target (relative to vehicle 1). relative velocity).

Specifically, the forward radar device 11 is provided at the front end of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to and from the front of the vehicle 1. With this forward radar device 11, target information regarding targets in front of the vehicle 1 can be acquired. The rear radar device 12 is provided at the rear end of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the rear of the vehicle 1. This rear radar device 12 makes it possible to acquire target object information regarding targets behind the vehicle 1 . The left side radar device 13 is provided on the left side of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the left side of the vehicle 1. This left side radar device 13 can acquire target object information regarding a target on the left side of the vehicle 1. The right side radar device 14 is provided on the right side of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the right side of the vehicle 1. This right side radar device 14 can acquire target object information regarding a target on the right side of the vehicle 1.

As shown in Figures 1A and 1B, the vehicle 1 is also equipped with a solar radiation sensor 16 and a rainfall sensor 17. The solar radiation sensor 16 is installed at the bottom of the windshield 9 at the front of the vehicle interior. This solar radiation sensor 16 is capable of detecting the amount of solar radiation on the vehicle 1, and therefore the brightness around the vehicle 1. The rainfall sensor 17 is installed at the top of the windshield 9 on the inside of the vehicle interior. This rainfall sensor 17 is capable of detecting the presence or absence of rainfall and the amount of rainfall.

(2) Electrical Configuration of Vehicle 1 The electrical configuration of the vehicle 1 will be specifically described with reference to FIG. 2. As shown in FIG. 2, the vehicle 1 is equipped with an automatic driving control device 30. The automatic driving control device 30 mainly has a mode switching function and an automatic driving function. The mode switching function is a function for setting the driving mode of the vehicle 1 to either a highly automated mode or a basic mode. The automatic driving function is a function for executing automatic driving according to the automatic driving level (see FIG. 3A. Details will be described later) of the set driving mode. As will be described later, the automatic driving control device 30 appropriately switches the driving mode of the vehicle 1 according to various factors such as the running state of the vehicle 1, the surrounding conditions of the vehicle 1, and the state of the driver of the vehicle 1.

Types of autonomous driving for vehicles include partial autonomous driving and fully autonomous driving. Partial autonomous driving is a form of autonomous driving in which some of the various driving actions required by the driver to drive the vehicle are automated. Note that automation here means that the vehicle can be executed without the need for driver operation. Fully autonomous driving is a form of autonomous driving in which driving to a set destination is fully automated without the need for driver operation. Hereinafter, the parameter indicating the degree of the types and number of driving actions that are automated in autonomous driving will be referred to as the autonomous driving level. Fully autonomous driving is a higher level of autonomous driving than partial autonomous driving. There are also various levels of partial autonomous driving depending on the types and number of driving actions that are automated.

The vehicle 1 of this embodiment is configured to be capable of partial autonomous driving as well as fully autonomous driving by the autonomous driving control device 30. In this embodiment, the driver can freely change the autonomous driving level, that is, which of the various driving operations required for driving are automated and which are performed by the driver.

More specifically, in this embodiment, there are seven main automatic control functions for achieving fully automated driving: automatic start/stop control, lane keeping control, vehicle distance control, lane change control, right/left turn control, collision prevention control, and parking control. The automated driving control device 30 is capable of executing these seven types of automatic control functions, and fully automated driving can be achieved by executing all seven types of automatic control functions.

Conversely, partial automated driving can be achieved by executing any six or fewer of the seven types of automatic control functions. In this embodiment, it is possible to arbitrarily set which of the seven types of automatic control functions are to be executed in the highly automated mode.

The specific contents of the seven types of automatic control functions will be explained in detail later.
The more of the seven types of automatic control functions that are executed, the higher the level of automatic driving becomes. Specifically, when none of the seven types of automatic control functions are executed, the level of automatic driving is level 0. When n types of the seven types of automatic control functions are executed, the level of automatic driving is level n. Therefore, in the level 0 driving mode, the driver is required to determine and operate the control operations corresponding to the seven types of automatic control functions. On the other hand, the driving modes of levels 1 to 6 are driving modes in which partial automatic driving is performed. The driving mode of level 7 is a driving mode in which fully automatic driving is performed.

In this embodiment, the highly automated mode is a driving mode in which automatic driving is performed at an automatic driving level of level 1 or higher. On the other hand, the basic mode is a driving mode in which the automatic driving level is relatively low compared to the highly automated mode. For example, when the advanced automation mode is level n, the basic mode can be set to any one of levels n-1 to level 0.

In this embodiment, for the purpose of simplifying the explanation and making it easier to understand, the basic mode will be explained assuming that the automatic driving level is set to level 0. Level 0 is a level in which all of the seven types of automatic control functions described above are not executed, and the driver is required to perform most of the various driving operations necessary for driving.

The automatic driving control device 30 has a control unit 30a and a memory 30b. More specifically, the memory 30b includes a ROM, a RAM, and various other storage media (e.g., an EEPROM, a flash memory). The control unit 30a executes various programs stored in the memory 30b to realize various functions including the mode switching function and the automatic driving function described above. The control unit 30a includes at least a CPU.

The various programs stored in the memory 30b include a program (so-called security software) capable of detecting external unauthorized operations, computer viruses, unauthorized software and data, etc. (hereinafter collectively referred to as "unauthorized factors"). The control unit 30a monitors the presence or absence of unauthorized factors at all times by having this security software resident during startup. If an unauthorized factor occurs, various unauthorized response processes are executed. The unauthorized response processes include a process of forcibly setting the automatic driving level to level 0 so that the automatic control function is not operated at all. There are various other possible specific contents of the unauthorized response processes. For example, a warning may be output to the driver by voice or the like, or the vehicle 1 may be forcibly decelerated or stopped. In addition, the connection between the control unit 30a and each communication unit 31 to 35 may be physically cut off so that the automatic driving control device 30 cannot be accessed from the outside via wireless communication.

The cameras 2-6, radar devices 11-14, and sensors 21-23 shown in Figures 1A and 1B are connected to the automatic driving control device 30. The control unit 30a of the automatic driving control device 30 individually controls the operation of each of the cameras 2-6, and acquires the photographing results (image data) from each of the cameras 2-6 and stores them in memory 30b. The acquisition and storage of image data is repeated at predetermined time intervals.

The control unit 30a can recognize various situations inside and outside the vehicle based on image data from each of the cameras 2 to 6. For example, from the image data of the indoor camera 6, it is possible to recognize the movements, facial expressions, line of sight, and eye conditions of the occupant (mainly the driver).

Thereby, the control unit 30a can determine whether the driver is exhibiting abnormal behavior based on the image data of the indoor camera 6. Abnormal behavior of the driver here refers to a situation in which the driver himself or herself may not be able to operate the vehicle 1 normally, or a situation in which the driver feels uneasy about the operation of the vehicle 1 due to the automatic driving function not operating normally. It means being in one of the following states. Examples of the former include being too distracted, falling asleep, or fainting. A specific example of the latter is the driver's expression of surprise, worry, or fear.

Based on the image data from the forward camera 2, the control unit 30a can also use various image recognition processes to recognize vehicles ahead, oncoming vehicles, vehicles in adjacent lanes traveling diagonally ahead, lane markings, crosswalks, pedestrians, intersections, other vehicles entering crossroads at intersections, the contents of road signs, traffic lights, and billboards in the direction of travel, rainfall conditions, snowfall conditions, fog conditions, ambient brightness, and other objects around the vehicle. Note that recognizable road signs also include letters and marks painted on the road surface.

This allows the control unit 30a to recognize pedestrian behavior, pedestrian behavior and line of sight, whether or not oncoming vehicles are flashing their lights, weather conditions, and the like, based on image data from the front camera 2. More specifically, weather conditions can be recognized as being whether a certain amount of rain or snow is falling, the occurrence of dense fog, and the like. From pedestrian behavior, it can be recognized whether or not the pedestrian feels uneasy about the vehicle 1. More specifically, if a pedestrian is looking at the vehicle 1 and their facial expression expresses a specific emotion such as surprise, worry, or fear, it can be determined that the pedestrian feels uneasy about the vehicle 1. In addition, if the gazes of a certain number or more pedestrians are directed at the vehicle 1, it can be recognized that the vehicle 1 may not be operating normally.

The control unit 30a also recognizes the distance and relative speed to the vehicle in front, the driving condition of the own vehicle with respect to the road, and the contents of road signs and billboards based on the image data of the front camera 2. can be recognized. Therefore, based on the recognition results of the contents of road signs and billboards, it is possible to recognize various sign information such as speed limits, whether or not a temporary stop is required, and whether or not parking is permitted. For example, it is also possible to recognize that the area is an accident-prone area, a school zone, or other specific environment (for example, an area where animals frequently appear).

In addition, based on the image data from the rear camera 3, the control unit 30a can recognize rear vehicles, vehicles in adjacent lanes traveling diagonally rearward, the surrounding brightness, pedestrians, sign information painted on the road surface, and other objects around the vehicle through various types of image recognition processing.

Thereby, the control unit 30a can recognize, for example, the relative distance and relative speed between the host vehicle and the rear vehicle, and the presence or absence of passing from the rear vehicle, based on the image data of the rear camera 3. Furthermore, similar to the image data from the front camera 2, the image data from the rear camera 3 can also be used to recognize pedestrian behavior, pedestrian behavior and line of sight, weather conditions, and the like.

In addition, based on image data from the left side camera 4 and the right side camera 5, the control unit 30a can recognize vehicles to the sides of the vehicle (including vehicles on the front left, rear left, front right, and rear right), road signs on the side of the road on which the vehicle is traveling, lane markings, pedestrians, the surrounding brightness, and other objects around the vehicle through various types of image recognition processing.

This allows the control unit 30a to recognize, for example, the relative distance and relative speed between the vehicle and the vehicle on the side based on the image data of each of the side cameras 4 and 5. In addition, like the image data of the front camera 2, the image data of each of the side cameras 4 and 5 can also be used to recognize pedestrian behavior, pedestrian behavior and line of sight, weather conditions, and the like.

Further, the control unit 30a of the automatic driving control device 30 individually controls each of the radar devices 11 to 14, and acquires target detection results from each of the radar devices 11 to 14 and stores them in the memory 30b. Acquisition and storage of detection results from each radar device 11 to 14 is repeated at predetermined time intervals. The control unit 30a calculates and obtains the presence or absence of a target, the distance to the target, the direction of the target, the relative speed of the target as seen from the vehicle 1, etc. based on the detection results of each radar device 11 to 14. be able to.

The detection results of the front radar device 11 mainly provide information on targets in front of the vehicle (including diagonally forward to the left and right). The detection results of the rear radar device 12 mainly provide information on targets behind the vehicle (including diagonally backward to the left and right). The detection results of the left side radar device 13 mainly provide information on targets on the left side of the vehicle (including the front left and rear left). The detection results of the right side radar device 14 mainly provide information on targets on the right side of the vehicle (including the front right and rear right).

Furthermore, the control unit 30a of the automatic driving control device 30 determines the brightness of the driving environment based on the detection signal from the solar radiation sensor 16, and determines the brightness of the driving environment at night or in a similar situation (hereinafter simply referred to as "nighttime"). You can determine whether there is. Note that the vehicle 1 includes headlights (not shown). The headlights can be turned on and off by the driver's operation, and can also be turned on and off automatically by setting the light mode to auto mode. When the light mode is set to auto mode, the control unit 30a automatically turns on the headlights when it is determined that it is nighttime, based on the detection signal from the solar radiation sensor 16, and turns on the headlights when it is not nighttime. Turn off the headlights automatically. Further, in this embodiment, when the driving mode is set to the highly automated mode, the light mode is forcibly set to the auto mode.

Further, the control unit 30a of the automatic driving control device 30 can determine the presence or absence of rain and the amount of rainfall based on the detection signal from the rain sensor 17.
In addition, the vehicle 1 includes, as shown in FIG. 2, wheel speed sensors 18, current sensors 19, steering amount sensors 20, interior contact sensors 21, and engine room temperature sensors 22 as components connected to the automatic driving control device 30. , an engine room sound sensor 23, a tire air pressure sensor 24, a suspension sensor 25, an external sound sensor 26, and an impact sensor 27.

The wheel speed sensors 18 are provided on the four wheels on the front, rear, left and right sides of the vehicle 1, and output detection signals (wheel speed signals) that indicate the rotational speed of the corresponding wheels. The wheel speed signals from each wheel speed sensor 18 are input to the automatic driving control device 30.

The control unit 30a can detect the rotational speed of each wheel based on the wheel speed signal from each wheel speed sensor 18. Then, from the detection result, it can detect, for example, whether or not slipping is occurring.

The current sensor 19 is provided for one or more of the many electrical wirings provided in the vehicle 1, and outputs a detection signal (current detection signal) indicating the current flowing through the electrical wiring. A current detection signal from the current sensor 19 is input to the automatic operation control device 30.

The control unit 30a can detect the current of the corresponding electrical wiring based on the current detection signal from the current sensor 19. Then, from the detection result, it is possible to detect, for example, whether or not an overcurrent is flowing in a specific electrical wiring. The overcurrent referred to here is a large current that theoretically does not flow when the vehicle 1 is operating normally, and may include, for example, a large current or surge current that may be caused by a lightning strike.

The current sensor 19 may be provided on the body of the vehicle 1 so as to detect the current flowing through the body. In this way, when the vehicle 1 is struck by lightning, it is possible to detect a large current flowing through the vehicle 1 to the ground. Where and how the current sensor 19 is installed may be appropriately determined so as to be able to detect that the vehicle 1 has been struck by lightning.

The steering amount sensor 20 is provided to directly or indirectly detect the steering amount of the steered wheels. The steering amount sensor 20 may be provided, for example, on a column shaft that connects the steering wheel 10 (see FIGS. 1A and 1B) and the steering mechanism. However, the vehicle 1 according to the present embodiment is equipped with an electric power steering device that can control the steering of the steering wheel by a motor, and the rotation for detecting the rotational position (and thus the steering state) of the motor for steering control. Equipped with a sensor. Therefore, the rotation sensor may be used as the steering amount sensor 20 without providing the steering amount sensor 20 alone. That is, the specific configuration and installation location of the steering amount sensor 20 may be determined as appropriate so that the steering amount can be detected.

The control unit 30a can detect the steering amount of the steering wheel based on the detection signal from the steering amount sensor 20. Then, from the detection result, for example, the change state and change rate of the steering amount can be detected. This makes it possible to determine whether the automatic steering control is being performed properly when the driving level is set so that steering is performed automatically (i.e., when the driving level is set so that at least one of lane keeping control, lane change control, and right/left turn control is executed). Specifically, for example, when the change rate of the steering amount is equal to or greater than a predetermined value (i.e., when the change rate is excessive), it can be determined that the automatic steering control is not being performed normally. Alternatively, it can be determined that the automatic steering control is not being performed normally when the vehicle is not traveling along the lane (for example, going beyond the lane markings) or when the vehicle goes straight when it should turn right or left.

The in-vehicle contact sensor 21 is a sensor for detecting that the occupant of the vehicle 1 has touched a specific part inside the vehicle, and is provided at the specific part (hereinafter also referred to as "in-vehicle specific contact part"). The specific contact area in the vehicle can be determined as appropriate, and may be, for example, a specific area on the driver's seat, the steering wheel 10, or the vicinity thereof.

As described below, the in-vehicle contact sensor 21 is provided so that the driver can quickly (emergently) cancel the autonomous driving when the autonomous driving level of the vehicle 1 is set to level 1 or higher. In other words, when the autonomous driving level is level 1 or higher and the driver wishes to cancel the autonomous driving for some reason, the autonomous driving is forcibly canceled if the driver touches a specific contact part in the vehicle. Therefore, the specific configuration and installation location of the in-vehicle contact sensor 21 may be appropriately determined so as to detect that the driver has touched a specific contact part in the vehicle.

Note that in this embodiment, "cancellation" of automatic driving means setting the automatic driving level to level 0. However, this is just an example. For example, "cancellation" of automatic operation may be defined as stopping at least one of the automatic control functions currently being executed. For example, if a certain automatic control function is operating and the driver senses that the automatic control function may not be working properly and touches a specific contact area inside the vehicle, at least one of the automatic control functions including that automatic control function or Forcibly stopping multiple automatic control functions may be defined as "cancellation" of automatic driving.

The engine room temperature sensor 22 is provided in a predetermined location in or near the engine room of the vehicle 1, and outputs a detection signal corresponding to the temperature of the engine room. The control unit 30a can detect the temperature of the engine room based on the detection signal from the engine room temperature sensor 22. If the detected temperature of the engine room is excessive (for example, if it is equal to or higher than a predetermined temperature threshold), it can determine that some abnormality has occurred in the engine or its surroundings.

The engine room sound sensor 23 is installed at a predetermined location within the engine room of the vehicle 1 or near the engine room for the purpose of mainly detecting sounds generated within the engine room. Outputs the detected signal. The control unit 30a can detect the sound occurring in the engine room based on the detection signal from the engine room sound sensor 23. If the detected sound in the engine room is excessive (eg, greater than a predetermined volume threshold), it can be determined that some kind of abnormality has occurred in the engine or its surroundings.

The tire pressure sensors 24 are provided on the front, rear, left and right wheels of the vehicle 1, and output detection signals (air pressure signals) indicating the air pressure of the tires of the corresponding wheels. The air pressure signals from each tire pressure sensor 24 are input to the automatic driving control device 30.

The control unit 30a can detect the tire air pressure of each wheel based on the air pressure signal from each tire air pressure sensor 24. Then, from the detection result, it is possible to detect, for example, whether or not an abnormality (for example, a puncture) has occurred in any tire.

The suspension sensor 25 outputs a detection signal indicating the amount of expansion and contraction of the suspension of the vehicle 1 (for example, the amount of expansion and contraction of a shock absorber or a spring). The control unit 30a can detect the behavior of the vehicle 1 (mainly the behavior in the vertical direction) based on the detection signal from the suspension sensor 25. If the automatic driving level of the vehicle 1 is set to level 1 or higher and the automatic control function to be executed is not operating normally, the behavior of the vehicle 1 may become unstable. For example, unstable behavior such as sudden starts, sudden stops, and sudden turns may occur automatically. Such unstable behavior appears as suspension behavior. Therefore, the control unit 30a can determine the stability of the behavior of the vehicle 1 based on the detection signal from the suspension sensor 25 (that is, based on the amount of expansion and contraction of the suspension itself or the rate of change thereof), and in turn, the automatic control function can be adjusted. If the automatic control function is in operation, it can be determined whether the automatic control function is operating normally.

The vehicle external sound sensor 26 is provided mainly for the purpose of detecting sounds generated around the vehicle 1. The control unit 30a can detect the type and volume of sounds occurring around the vehicle 1 based on the detection signal from the vehicle external sound sensor 26. For example, if another car is honking its horn, it can be detected.

When an impact is applied to the vehicle 1 from outside the vehicle 1, the impact sensor 27 outputs a detection signal according to the level of the impact. The control unit 30a can detect the presence or absence and level of an external impact on the vehicle 1 based on the detection signal from the impact sensor 27. Note that the impacts that can be detected by the impact sensor 27 include a wide range of levels of impact, from relatively large levels of impact, such as a collision with another vehicle or a road structure, to relatively low levels of impact, such as an impact caused by a person outside the vehicle 1 hitting the vehicle 1.

The vehicle 1 also includes, as components connected to the automatic driving control device 30, a GPS communication unit 31, a vehicle-to-vehicle communication unit 32, a road-to-vehicle communication unit 33, a pedestrian-to-vehicle communication unit 34, and an LTE communication unit 35, as shown in FIG. 2.

The GPS communication unit 31 receives radio waves from multiple GPS (Global Positioning System) satellites and outputs information contained in the received radio waves (GPS information) to the automatic driving control device 30. The control unit 30a of the automatic driving control device 30 can calculate the current position of the vehicle 1 based on the information received by the GPS communication unit 31.

The automatic driving control device 30 also includes a route guidance function, which is one of various elemental functions for realizing the automatic driving function. The route guidance function calculates an appropriate route from the current position to the destination based on the current position of the vehicle 1 calculated based on GPS information and the destination set by the driver, and the vehicle 1 follows that route. This function guides and controls the vehicle 1 so that it travels along the route to the destination.

The route guidance function includes a function to recognize the road conditions around the vehicle 1 (e.g., the shape of the route to the destination and the vehicle width), and a function to recognize the presence and operation status of infrastructure in the direction of travel (e.g., the status of traffic lights in the direction of travel, the presence or absence of intersections, the presence or absence of pedestrian crossings, speed limits, regulatory information, etc.). The control unit 30a uses these various recognition results to realize the above guidance control.

The content of the guidance control of the vehicle 1 in the route guidance function varies depending on the autonomous driving level. For example, when the autonomous driving level is set to fully autonomous driving level 7, the guidance control is to provide route information (information on which direction and which route the vehicle should travel) necessary to execute the multiple types of automatic control functions (seven types as described above in this embodiment) required to achieve fully autonomous driving. Also, for example, when the autonomous driving level is set to a predetermined level 1 to 6 (partially autonomous driving) that is lower than fully autonomous driving, the guidance control is to provide route information for the automatic control functions necessary for partial autonomous driving out of the multiple types of automatic control functions, and to guide the driver on the driving route (for example, voice guidance) as necessary.

When the automatic driving level is set to any one of levels 1 to 6, that is, when one or more of the seven automatic control functions is set to be executed, the control unit 30a performs guidance control. , at least provides the information necessary for the automatic control function that is set.

Map data and other various data required for the route guidance function are stored in memory 30b. The control unit 30a executes the program for the route guidance function stored in memory 30b while referring to the various data, thereby realizing the route guidance function (i.e., the above-mentioned guidance control).

The vehicle-to-vehicle communication unit 32 is a communication module for wirelessly transmitting and receiving various data to and from other vehicles other than the vehicle itself. The control unit 30a of the automatic driving control device 30 can obtain information about other vehicles in the vicinity (e.g., driving direction, driving speed, position, etc.) via the vehicle-to-vehicle communication unit 32. Conversely, information about the vehicle itself 1 can also be transmitted to other vehicles.

The control unit 30a can also know the relative relationship between the host vehicle and the amount of other vehicles by acquiring the position and driving state of the other vehicle through vehicle-to-vehicle communication. For example, it is also possible to detect the relative distance and relative speed between the own vehicle and other vehicles.

Further, as information that can be sent and received through vehicle-to-vehicle communication, there is information regarding driving modes. The control unit 30a can also send and receive information regarding whether the driving mode is set to highly automated mode or basic mode, and what level of automatic driving is in the set driving mode.

The road-to-vehicle communication unit 33 is a communication module for receiving various information wirelessly transmitted from a road communication device 81 (see FIG. 4) installed on the road (ground side). The various information received by the road-to-vehicle communication unit 33 is input to the automatic driving control device 30.

The road communication device 81 is connected to a server (not shown), receives various information from the server, and wirelessly transmits the information within a predetermined surrounding area. The server collects various types of road traffic information, such as various types of infrastructure information (e.g., traffic light information, road regulation information, and other types of information related to the roadway) and information on the presence of other vehicles and pedestrians. The server transmits individual road information related to each road communication device 81 based on the collected road traffic information. The individual road information is information for vehicles traveling within the communication area of the road communication device 81, and includes various types of road traffic information within the communication area and various types of concurrent traffic information ahead of the area (in the direction of travel). Each road communication device 81 wirelessly transmits the individual road information transmitted from the server within a predetermined communication area.

The control unit 30a of the automatic driving control device 30 can acquire various road traffic information related to the surroundings of the vehicle and the road in the traveling direction via the road-vehicle communication unit 33. Information that the control unit 30a can acquire via the road-vehicle communication unit 33 includes section information related to driving sections where caution is required when driving, such as accident-prone areas, school zones, areas where animals are lurking, etc. (hereinafter also referred to as "cautionary sections"). By linking the acquired section information with the route guidance function, the control unit 30a can recognize the relative relationship between the cautionary section and the vehicle 1, such as whether the vehicle 1 is traveling in the cautionary section indicated by the section information, and how much further it will travel before entering the cautionary section. Information related to other sections or points other than the cautionary section may be acquired as section information.

Each roadside communication device 81 illustrated in FIG. 4 is equipped with a camera 82. Each camera 82 captures images of the road and transmits the captured image data to a server via a network.

The server can obtain road traffic information around each camera 82 from the image data transmitted from that camera. Specifically, the server can recognize the shape of the road, the lanes, and the status of the traffic lights from the image data. The server can also recognize the driving status and license plate number of a vehicle that is currently in motion. The server can also determine whether or not a vehicle in the image data is driving normally based on the image data. For example, if a vehicle passes through a traffic light that is red without stopping, it can be determined that the vehicle is not driving normally.

Further, the vehicle 1 can also transmit various information regarding the state of the vehicle 1 via the road-to-vehicle communication unit 33. Transmission information transmitted from the vehicle 1 is received by the roadside communication device 81 and aggregated by the server. The server can individually recognize and manage the states of a plurality of vehicles including the vehicle 1, and can also notify a specific vehicle of the states of other vehicles other than that vehicle, if necessary. Therefore, for example, it is possible to know information such as what level of automatic driving is set for other vehicles around the own vehicle, that is, to what extent the automatic control function is activated in other vehicles around the vehicle.

The pedestrian-to-vehicle communication unit 34 is a communication module for performing wireless communication with a communication terminal (for example, a mobile phone or a smartphone) carried by a pedestrian on the ground side. Terminal location information transmitted from a communication terminal carried by a pedestrian when the communication terminal is configured to be able to wirelessly transmit terminal location information indicating the location of the communication terminal (i.e., the location of the pedestrian) can be received by the pedestrian communication unit 34. The terminal position information received by the pedestrian communication unit 34 is input to the automatic driving control device 30. Note that the automatic driving control device 30 can notify the pedestrian of the position information of the vehicle 1 and the like by wirelessly transmitting various information such as the position information of the vehicle 1 from the pedestrian-to-pedestrian communication unit 34 to the communication terminal of the pedestrian. You can also do it.

The control unit 30a of the automatic driving control device 30 can know the position and movement of the pedestrian based on the terminal position information received via the pedestrian-to-vehicle communication unit 34. The presence and movement of pedestrians can be detected by the cameras and radar devices described above, but in addition, information obtained through the pedestrian-to-vehicle communication unit 34 can also be used to detect the presence or absence of pedestrians and the movement of pedestrians. can be detected.

The LTE communication unit 35 is a communication module for realizing wireless communication by LTE, which is a well-known mobile phone communication standard. The control unit 30a can obtain various information necessary for autonomous driving of the vehicle 1 and update existing information (e.g., update map data) via the LTE communication unit 35 (i.e., by LTE wireless communication). Note that it is not essential to obtain or update such various information by LTE wireless communication, and other wireless communication may be used.

The vehicle 1 also includes, as components connected to the automatic driving control device 30, an operation unit 36, a display unit 37, a speaker 38, an automatic driving switch 41, a level setting operation unit 42, an emergency stop lever 43, and a release reset switch 44, as shown in FIG. 2.

The operation unit 36 is an input interface for accepting various input operations for the vehicle 1 by the occupants of the vehicle 1, including the driver. The display unit 37 is an output interface for visually providing various information to the occupants of the vehicle 1, including the driver. Various information, including map information in the route guidance function, is also displayed on the display unit 37. The speaker 38 outputs audio based on various audio signals output from the automatic driving control device 30.

The automatic driving switch 41 is a switch for setting the driving mode of the vehicle 1 to a highly automated mode. The driver of the vehicle 1 needs to switch the automatic driving switch 41 to the on side in order to set the driving mode to the highly automated mode and execute automatic driving. On the other hand, when the automatic operation switch 41 is turned off, the operation mode is set to the basic mode.

The emergency stop lever 43 is an operating means for forcibly canceling autonomous driving when the autonomous driving level of the vehicle 1 is level 1 or higher (i.e., forcibly switching the autonomous driving level to level 0), and is provided in a specified location inside the vehicle cabin (e.g., on the ceiling). When the emergency stop lever 43 is operated while the autonomous driving level of the vehicle 1 is set to level 1 or higher, autonomous driving is forcibly canceled. If the driver recognizes that a fraudulent factor such as a computer virus or unauthorized operation has occurred, or that the automatic control function is not working properly, the driver can forcibly cancel autonomous driving by operating the emergency stop lever 43, and drive the vehicle 1 under the driver's own driving operations.

The level setting operation unit 42 is a user interface for accepting an operation by the driver to set the autonomous driving level (details will be described later).
The release reset switch 44 is a switch for resetting the released state after autonomous driving is forcibly released and the autonomous driving level is forcibly set to level 0. In this embodiment, as described below, when the autonomous driving level is set to level 1 or higher, if a predetermined event requiring release that should release the autonomous driving occurs, the autonomous driving is forcibly released. Specifically, an autonomous driving release flag, described below, is set.

When automatic operation is forcibly canceled, the canceled state is maintained in principle (the automatic operation cancellation flag remains set); however, by pressing the cancellation reset switch 44, the canceled state can be canceled. It is possible to reset (reset the automatic operation cancellation flag). When the release state is reset, the driving mode is set to a mode corresponding to the operating state of the automatic driving switch, and the automatic driving level is set to a level corresponding to the set driving mode (set by the level setting operation section 42). level).

The vehicle 1 also includes, as components connected to the automatic driving control device 30, a traveling drive control section 46, a brake control section 47, and a steering control section 48, as shown in FIG.

The travel drive control unit 46 controls an engine and a transmission (not shown) based on various information such as the amount of depression of an accelerator pedal (not shown), the operation position of a shift lever (not shown), vehicle speed, and engine rotational speed. By doing so, the running of the vehicle 1 is controlled.

On the other hand, when the automatic driving level is set to level 1 or higher, that is, when any of the seven types of automatic control functions is executed, the automatic driving control device 30 outputs control information necessary to realize the automatic control function to be executed to the driving control unit 46. In this case, the driving control unit 46 automatically controls the engine and the transmission in accordance with the control information from the automatic driving control device 30 even if the accelerator pedal is not depressed. Note that the vehicle 1 of this embodiment is equipped with an engine as a driving source for driving, but the automatic driving control device of the present disclosure can also be applied to a vehicle equipped with a driving source for driving other than an engine (e.g., an electric motor). In that case, the driving control unit 46 shown in FIG. 2 has the function of controlling the driving source for driving of the vehicle. In addition, when a driving source for driving other than an engine is included, the above-mentioned engine room temperature sensor 22 and engine room sound sensor 23 may be installed for the purpose of detecting the temperature and sound of the driving source for driving or its surroundings, respectively.

The brake control unit 47 controls a brake device (not shown) based on the amount of depression of a brake pedal (not shown). On the other hand, when the automatic driving level is set to level 1 or higher, that is, when any of the seven automatic control functions described above is executed, the automatic driving control device 30 realizes the automatic control function to be executed. The control information necessary for this purpose is output to the traveling drive control section 46. In this case, the brake control unit 47 automatically controls the brake device according to the control information from the automatic driving control device 30 even if the brake pedal is not depressed.

The steering control unit 48 has two main functions. One is a so-called electric power steering function. In other words, it assists the driver in operating the steering wheel 10 by using a motor. The other is an automatic steering function that automatically steers the steering wheels (e.g., the front wheels) of the vehicle 1 without the driver's operation. The steering of the steering wheels is basically performed by the driver operating the steering wheel 10, but when at least any of the seven types of automatic control functions described above, except for automatic start/stop control and following distance control, is executed, the steering control unit 48 automatically controls the steering of the steering wheels by controlling the motor according to control information from the automatic driving control device 30, even if the driver is not operating the steering wheel 10.

(3) Description of Autonomous Driving Function In the vehicle 1 of this embodiment, the automatic driving control device 30 can acquire and detect various pieces of information necessary to realize the automatic driving function described above.

Information that can be used to realize the autonomous driving function includes, first, information such as the vehicle's position and speed (vehicle information). The vehicle's position can be obtained by calculation based on GPS information. The vehicle's speed can be obtained by calculation based on a vehicle speed signal from a vehicle speed sensor (not shown), a detection signal from the steering amount sensor 20, a yaw rate signal from a yaw rate sensor (not shown), and the like. The vehicle's speed can also be calculated from the rate of change of the vehicle's position.

Information that can be used to realize an autonomous driving function also includes information about surrounding objects, specifically, information about the relative positions, distances, and speeds of various objects (including people and animals) around the vehicle, such as vehicles ahead, behind, to the side, oncoming vehicles, vehicles crossing the intersection ahead, pedestrians, bicycles, road structures and fixed installations, and obstacles.

Information about these surrounding objects can be obtained based on the image capture data from each of the cameras 2 to 5 and the detection results from each of the radar devices 11 to 14. Various technologies for recognizing surrounding objects based on image capture data and the detection results from radar devices have been proposed and put to practical use, so a description of them will be omitted here.

Information regarding surrounding objects can also be obtained through vehicle-to-vehicle communication, road-to-vehicle communication, and pedestrian-to-vehicle communication. For example, by performing vehicle-to-vehicle communication with surrounding vehicles, it is possible to recognize not only the surrounding vehicles that can be seen from the own vehicle, but also the positions and movements of surrounding vehicles that are in blind spots and cannot be directly seen from the own vehicle. . In road-to-vehicle communication, as described above, presence information of surrounding vehicles, pedestrians, etc. can be acquired. In the pedestrian-to-vehicle communication, as described above, the position and movement of the pedestrian can be known based on the terminal position information received via the pedestrian-to-vehicle communication unit 34.

Through one or more of vehicle-to-vehicle communication, road-to-vehicle communication, and pedestrian-to-vehicle communication, for example, information on oncoming vehicles can be acquired during normal driving (especially around curves) or when turning right in order to prevent head-on collisions with oncoming vehicles. It is possible to acquire information on motorcycles on the left side and rear in order to prevent motorcycles from getting involved when turning left, to acquire information on vehicles on the side (rear and side) when changing lanes, and to prevent rear-end collisions or to suppress rear-end collisions. Obtains vehicle information, obtains information on other vehicles traveling on the side of the intersection to prevent head-to-head collisions at intersections, and obtains information on pedestrians to prevent collisions with pedestrians, etc. You can

Information that can be used to implement automated driving functions also includes information on various road markings drawn directly on the road, such as lane markings (including parking markings), crosswalks, and stop lines. The information regarding the road display includes the location and contents of the road display. Information regarding these road displays can be obtained based on the photographic data of each of the cameras 2 to 6. Since various techniques for recognizing road markings from photographic data have been proposed and put into practical use, their explanations will be omitted here.

Information regarding road markings in the direction of travel can also be obtained through road-to-vehicle communication. Note that although the vehicle 1 of this embodiment does not have one, it is also possible to acquire information regarding various road displays using a laser radar.

In addition, information that can be used to realize automatic driving functions includes information on traffic lights, railroad crossings, signs (including billboards), intersections, merging/diverging points, sidewalks, obstacles, dangerous areas, and other ground structures (hereinafter referred to as " (collectively referred to as "infrastructure-related information"). In addition to the presence and location of the various objects mentioned above, infrastructure-related information also includes information on the color of traffic lights, the operating status of railroad crossings, and the display content of signs and billboards. . Infrastructure-related information can also be recognized and acquired based on the photographed data of each camera 2 to 6, and can also be acquired through road-to-vehicle communication. Furthermore, various infrastructure information can be acquired from the route guidance function described above based on GPS information, map data, and the like.

In addition, regulation information can also be used to realize autonomous driving functions. For example, if there are driving restrictions in place in the direction of travel due to construction, accidents, natural disasters, etc., this regulation information can be obtained through road-to-vehicle communication.

Various types of information necessary to realize automatic driving functions (in this embodiment, realize the seven types of automatic control functions described above), such as information regarding surrounding objects, information regarding road displays, infrastructure-related information, and regulatory information described above. Among them, information regarding the surroundings of the vehicle 1 in particular corresponds to an example of the surrounding information of the present disclosure.

The automatic driving control device 30 can realize automatic driving by acquiring the various information described above and controlling the driving control unit 46, the brake control unit 47, the steering control unit 48, and other necessary in-vehicle devices based on that information. Specifically, it can execute the seven types of automatic control functions described above. As described above, the seven types of automatic control functions in this embodiment are automatic start/stop control, lane keeping control, vehicle distance control, lane change control, right/left turn control, collision prevention control, and parking control.

The automatic start/stop control is a control that automatically stops the vehicle 1 when a condition for stopping is met while driving, and automatically starts the vehicle 1 when the condition for stopping is canceled after stopping. be. This control is performed using, in addition to own vehicle information, information regarding surrounding objects obtained from each camera 2 to 5 and each radar sensor 11 to 14, infrastructure related information and regulation information obtained through road-to-vehicle communication, and the like. With this automatic start/stop control, for example, if the traffic light at an intersection is green, it will continue to run, but if it is red or yellow, it will stop, or it will recognize a railroad crossing ahead and detect that the barrier is down. If the vehicle is recognized, the vehicle is stopped, and if the barrier has not been lowered, the vehicle is stopped and then started again. It will also automatically stop if it recognizes an obstacle in front of it.

Lane maintenance control is a control configured to automatically steer the steered wheels so that the own vehicle travels along the lane without deviating from the lane markings. This control is performed in cooperation with the route guidance function using information on road markings (particularly vehicle markings) obtained from each of the cameras 2 to 5 and each radar sensor 11 to 14 in addition to own vehicle information.

Inter-vehicle distance control controls the speed so that when another vehicle is driving in front of the vehicle, the distance between the vehicle and the other vehicle is maintained at a certain distance, and when there is no other vehicle in front of the vehicle, the vehicle speed is maintained at the set vehicle speed. This is control to make the vehicle run. This control is performed using information regarding surrounding objects (especially the vehicle ahead) obtained from each of the cameras 2 to 5 and each of the radar sensors 11 to 14, in addition to the own vehicle information.

Lane change control is a control that, when a lane change (steering to change lanes) is necessary, detects other vehicles in the adjacent lane to which the lane is to be changed, and automatically changes lanes while controlling the driving force, braking force, and steering to avoid colliding with other vehicles depending on the presence, position, and speed of other vehicles. This control is performed using information about the vehicle itself, as well as information about surrounding objects (particularly other vehicles in adjacent lanes), information about lane dividing lines, and information about other vehicles (vehicles traveling in adjacent lanes) obtained from each of the cameras 2-5 and each of the radar sensors 11-14, as well as information about lane dividing lines, and information about other vehicles obtained through vehicle-to-vehicle communication.

Right/left turn control is a control that automatically turns right or left when a right or left turn is required, without colliding with oncoming vehicles, vehicles running at intersections, other vehicles around the vehicle, pedestrians, etc. It is. This control includes information on surrounding objects obtained from each camera 2 to 5 and each radar sensor 11 to 14, information on other vehicles obtained through vehicle-to-vehicle communication, pedestrian information obtained through pedestrian-to-vehicle communication, etc., in addition to own vehicle information. This is done using information such as

Collision prevention control is control for automatically steering, braking, stopping, etc. the vehicle to avoid colliding with the obstacle when an obstacle is present on the road in the direction in which the vehicle is traveling. This is done using information regarding surrounding objects obtained from each camera 2 to 5 and each radar sensor 11 to 14, infrastructure related information and regulation information obtained by road-to-vehicle communication, and the like.

Parking control calculates a driving trajectory to the target parking position when a specific target parking position (for example, within a parking lot of a specific parking lot) is set as a destination, and drives the vehicle along that driving trajectory. This is a control that automatically parks the vehicle by controlling force, braking force, and steering.

The driver or the like can set which of the seven types of control functions will be executed, i.e., the autonomous driving level, at his/her discretion. Specifically, as shown in FIG. 3A, the autonomous driving level can be set at will in both the highly automated mode and the basic mode. However, in the basic mode, level 7 cannot be set, and any of levels 0 to 6 can be set. On the other hand, in the highly automated mode, level 0 cannot be set, and any of levels 1 to 7 can be set. Furthermore, the basic mode level can be set within a range lower than the highly automated mode level. Conversely, the highly automated mode level can be set within a range higher than the basic mode level.

In this embodiment, as shown in FIG. 3A, control A (for example, lane keeping control) is executed at level 1. At level 2, control B (for example, inter-vehicle distance control) is executed in addition to control A. At level 3, control C (for example, automatic start/stop control) is executed in addition to controls A and B. At level 4, in addition to controls A, B, and C, control D (for example, collision prevention control) is executed. At level 5, in addition to controls A, B, C, and D, control E (for example, lane change control) is executed. At level 6, in addition to controls A, B, C, D, and E, control F (for example, right/left turn control) is executed. At level 7, in addition to controls A, B, C, D, E, and F, control G (for example, parking control) is executed. In other words, the higher the level, the more types of automatic control functions are executed, and at level 7, it becomes fully automatic operation.

The level setting for each driving mode can be performed by operating the level setting operation unit 42 provided near the driver's seat for each driving mode individually. In this embodiment, the autonomous driving level of the basic mode is set to level 0 by default, and the autonomous driving level of the highly automated mode is set to level 1 by default. The currently set autonomous driving level can be changed arbitrarily for each driving mode. For example, if the basic mode is set to level 0, the highly automated mode can be changed arbitrarily between levels 1 to 7. For example, if the basic mode is set to level 1, the highly automated mode can be changed arbitrarily between levels 2 to 7. For example, if the highly automated mode is set to level 4, the basic mode can be changed arbitrarily between levels 0 to 3.

Note that which automatic control function is executed at which level is not limited to the content illustrated in FIG. 3A. For example, it is not essential that the number of automatic control functions executed increases by one each time the level increases. Which automatic control function is to be executed at which level may be determined as appropriate.

In addition, while assuming that the number of automatic control functions executed increases by one each time the level increases by one, as shown in FIG. 3A, the contents of Control A to Control G may be set by the driver or other person as desired, as shown in FIG. 3B.

In the vehicle 1 of this embodiment, when the automatic driving switch 41 is turned off, the driving mode is set to the basic mode. On the other hand, when the automatic driving switch 41 is turned on, the driving mode becomes the highly automated mode under certain conditions. Note that when lane change control, right/left turn control, and parking control are set, it is necessary to set a destination (target parking position in the case of parking control). Specifically, the route guidance function is started and the destination is input via the touch panel. When a destination is set, automatic driving is basically performed along the calculated route to the destination while checking the position of the vehicle in cooperation with the route guidance function.

Various control examples in the highly automated mode when the automated driving level of the highly automated mode is set to level 7 will be described with reference to FIG. 4. Each of the vehicles 61 to 67 shown in FIG. 4 has the same configuration as the vehicle 1 shown in FIG. 1 and FIG. 2. A vehicle traveling within the communication area of the road communication device 81 can receive individual road information from the road communication device 81. At least four of the vehicles in FIG. 4 (61, 65, 66, 67) can receive individual road information from at least two road communication devices 81a, 81b in their vicinity. Specifically, they can obtain information on the traffic light 71 ahead, information on the oncoming vehicle 62, information on pedestrians 76, etc.

In addition, at least the vehicle 63 can receive individual road information from at least the roadside communication device 81c in its vicinity. Specifically, it can obtain information such as the presence of a stop sign 73 (i.e., that the vehicle should stop), and that another vehicle 64 is approaching from the right.

In addition, at least vehicle 64 can receive individual road information from at least the roadside communication device 81d in its vicinity. Specifically, it can obtain information such as that another vehicle 63 is approaching from the left side.

In addition, at least the vehicle 62 can receive individual road information from at least the roadside communication device 81e in its vicinity. Specifically, it can obtain information such as information about the traffic light 72 ahead, the presence of an oncoming vehicle 61 about to turn right, the presence of a pedestrian crossing in the direction of the left turn, and the presence of a pedestrian 76 at the crossing.

In addition, each vehicle 61 to 66 can obtain various information from its own cameras 2 to 6 and radar devices 11 to 14, and can also obtain various information through vehicle-to-vehicle communication and vehicle-to-vehicle communication. Can be done. For example, the vehicle 65 can detect the vehicle 67 ahead or the vehicle 66 on the right side using a camera or radar device, and thereby can drive while maintaining an appropriate distance from the vehicle 67 ahead or change lanes. If necessary, it is possible to change lanes at an appropriate timing while taking into consideration the positional relationship with the vehicle 66 on the right side. Furthermore, the vehicle 65 can also detect the pedestrian 77 running out using a camera or radar device, and in that case, the vehicle 65 takes appropriate deceleration to avoid colliding with the pedestrian 77 while taking into account the distance to the vehicle 65 behind. can be controlled.

As a result, each of the vehicles 61 to 66 can appropriately automatically travel the travel route to the destination using various information such as various information obtained from the own vehicle and various information obtained from the roadside. Can be done. Specifically, each of the vehicles 61 to 66 automatically controls the drive control unit 46, brake control unit 47, and steering control unit 48 to keep the vehicles along the travel route while avoiding other vehicles, pedestrians, and other vehicles. It is possible to appropriately drive automatically so as not to come into contact with road structures and to obey traffic lights and traffic rules.

(4) Autonomous driving level setting process Next, the autonomous driving level setting process executed by the control unit 30a of the autonomous driving control device 30 will be described with reference to Fig. 5. The autonomous driving level setting process in Fig. 5 is a process for switching the driving mode of the vehicle 1 to either the highly automated mode or the basic mode, and forcibly setting the autonomous driving level to level 0 if it is determined that the autonomous driving should be cancelled when the autonomous driving level is level 1 or higher.

When the control unit 30a is started by turning on a power switch (e.g., an ignition switch) (not shown) of the vehicle 1, the control unit 30a reads the program for the autonomous driving level setting process shown in FIG. 5 from the memory 30b and executes it repeatedly at a predetermined control period.

When the control unit 30a starts the automatic driving level setting process of FIG. 5, it determines in S10 whether the automatic driving cancellation flag is set. The automatic operation cancellation flag is a flag that is set when it is determined that automatic operation should be canceled, and specifically, it is set in S119 of FIG. 6, which will be described later.

If the automatic operation cancellation flag is set (S10: YES), the automatic operation level is set to level 0 in S70. That is, regardless of whether the driving mode is set to highly automated mode or basic mode, the automatic driving level is forcibly set to level 0, and all of the seven types of automatic control functions described above are not executed. Then, in S80, a predetermined error notification is performed to notify the occupants of the vehicle 1 that automatic driving has been forcibly canceled, and the automatic driving level setting process is ended.

While this automatic operation cancellation flag is set, all seven types of automatic control functions do not operate, so driving operations corresponding to the seven types of automatic control functions (each automatic control function can be executed automatically) All driving operations must be performed by the driver himself. Note that the automatic operation cancellation flag can be reset by pressing the cancellation reset switch 44, as described above.

If the automatic operation cancellation flag is not set in S10 (S10: NO), it is determined in S20 whether the emergency stop flag is set. The emergency stop flag is a flag that is set when it is determined that the vehicle 1 should be stopped urgently, and specifically, it is a flag that is set in S120 of FIG. 6, which will be described later.

If the emergency stop flag is set (S20: YES), emergency stop processing is executed in S90. The emergency stop process is a process for stopping the vehicle 1 as quickly as possible while maintaining safety. The specific contents of the emergency stop process may be determined as appropriate so that the vehicle can be stopped as quickly as possible while maintaining safety. For example, the process of decelerating the vehicle 1, pulling it to the shoulder of the road, and stopping the vehicle while monitoring it with cameras and radar devices to avoid contact with objects outside the vehicle (including other vehicles, pedestrians, etc.) The content can be considered.

If the emergency stop flag is not set in S20 (S20: NO), then in S30 it is determined whether the automatic driving switch 41 is on. If the automatic driving switch 41 is on (S30: YES), then in S40 the driving mode is set to the highly automated mode, and the process proceeds to S60. If the automatic driving switch 41 is off (S30: NO), then in S50 the driving mode is set to the basic mode, and the process proceeds to S60.

When the driving mode is set to the high automation mode in S40, the control unit 30a executes an automatic control function based on the automatic driving level set as the high automation mode in S55. For example, when level 6 is set as the advanced automation mode, six types of automatic control functions, controls A to F (see FIG. 3A) are executed. Further, for example, when level 7 is set as the advanced automation mode, complete automatic operation is realized by executing all seven types of automatic control functions of controls A to G. Furthermore, the automatic control function in S55 is executed based on various kinds of information, including the above-mentioned surrounding information, while being acquired as necessary.

When the driving mode is set to the basic mode in S50, the control unit 30a executes the automatic control function based on the automatic driving level set as the basic mode in S50. For example, when level 1 is set as the basic mode, the automatic control function of control A (see FIG. 3A) is executed. In this case, the automatic control function is also executed based on various information acquired as necessary, including the above-mentioned surrounding information. However, when level 0 is set as the basic mode, none of the automatic control functions are executed.

In S60, an autonomous driving cancellation confirmation process is executed. This autonomous driving cancellation confirmation process has two main purposes. One is to determine whether or not it is necessary to forcibly set the autonomous driving level to level 0 when the autonomous driving level is set to level 1 or higher, and to set an autonomous driving cancellation flag if it is necessary to forcibly set it to level 0. The other is to determine whether or not it is necessary to make an emergency stop of vehicle 1 when the autonomous driving level is set to level 1 or higher, and to set an emergency stop flag if it is necessary to make an emergency stop.

Details of the automatic operation cancellation confirmation process in S60 are as shown in FIG. When the control unit 30a proceeds to the automatic driving cancellation confirmation process in S60, as shown in FIG. 6, in S111, the control unit 30a determines whether the automatic driving level set in the current driving mode is level 1 or higher. If the automatic driving level is not level 1 or higher (that is, level 0) (S111: NO), the automatic driving cancellation confirmation process of FIG. 6 is ended, and thereby the automatic driving level setting process of FIG. 5 is ended.

If the automatic driving level set in the current driving mode is 1 or higher (S111: YES), a system monitoring process is executed in S112. The system monitoring process in S112 monitors the operating state of the vehicle 1 (including the execution state of the automatic control function) and determines whether a predetermined event (cancellation required event) has occurred that should forcefully switch the automatic driving level to level 0. This is a process for determining whether or not. Details of the system monitoring process in S112 will be described later using FIG. 7.

In S113, the inside/outside behavior monitoring process is executed. The inside/outside behavior monitoring process in S113 is a process for monitoring the behavior of vehicle occupants in the cabin of vehicle 1, the behavior of pedestrians and other vehicles outside vehicle 1, and the like, to determine whether a cancellation event has occurred that requires the autonomous driving level to be forcibly switched to level 0. The details of the inside/outside behavior monitoring process in S113 will be described later in detail with reference to FIG. 8.

In S114, environment monitoring processing is executed. The environment monitoring process in S114 is a process for monitoring the environment around the vehicle 1 and determining whether a cancellation-requiring event that should forcefully switch the automatic driving level to level 0 has occurred. Details of the environment monitoring process in S114 will be described later using FIG. 9.

In S115, a self-diagnosis process is executed. The self-diagnosis process in S115 is a process for self-diagnosing whether the execution state of the automatic control function by the control unit 30a itself is normal or not by comparing it with the past execution result. The details of the self-diagnosis process in S115 will be described later with reference to FIG. 10B.

In S116, as a result of each process in S112 to S115, it is determined whether or not a cancellation-required event has occurred in any one of the processes. If it is determined that no event requiring cancellation has occurred (S116: NO), the automatic operation cancellation confirmation process of FIG. 6 is ended. If it is determined that a cancellation-requiring event has occurred in any one of the processes in S112 to S115 (S116: YES), in S117, an automatic driving cancellation advance notice is given to the occupants of the vehicle 1. . This notification is based on the occurrence of a cancellation-requiring event that should cancel automatic driving, and is a notification for notifying the occupant in advance of canceling automatic driving. This notification may be performed by various methods that allow the occupants of the vehicle 1 to recognize that a cancellation-requiring event has occurred and the state in which automatic driving should be canceled has occurred. Specific notification methods include, for example, generating a predetermined message by voice, visually transmitting a message to the occupants using the display unit 37, or vibrating the seat. You may.

In S118, it is determined whether the automatic driving can be cancelled. In other words, this determination is a process for determining whether the driver can perform the driving operation by himself when the driving operation that was performed automatically until then is no longer performed automatically due to the cancellation of the automatic driving. The basis for determining whether the automatic driving can be cancelled may be determined appropriately. For example, the determination may be made based on whether a specific cancellation permission operation is performed by the driver based on the state and behavior of the driver. The cancellation permission operation is an operation that indicates that the driver is in a state where he or she can perform the driving operation by himself or herself. The cancellation permission operation also includes a stationary state in which the driver is stationary in a specific state. As the cancellation permission operation, for example, at least one of a plurality of operations and states such as the driver gripping the steering wheel 10 with at least one hand, the driver gripping the steering wheel 10 with both hands, the driver's eyes are open, the driver's gaze is directed toward the front of the vehicle, and the driver's behavior is normal (for example, a state that is determined to be positive in the determination process of S204 described later) may be set. The control unit 30a may determine whether the cancellation permission operation is performed based on image data of the interior camera 6, for example.

If it is determined that automatic operation can be canceled (S118: YES), an automatic operation cancellation flag is set in S119. As a result, when the determination process of S10 in FIG. 5 is executed next, an affirmative determination is made and the process proceeds to S70, where the automatic driving level is forcibly set to level 0.

If it is determined in S118 that automatic operation cannot be canceled (S118: NO), an emergency stop flag is set in S120. As a result, when the determination process of S20 in FIG. 5 is executed next, an affirmative determination is made and the process proceeds to S90, where the emergency stop process is executed.

Next, the system monitoring process of S112 in the autonomous driving cancellation confirmation process of FIG. 6 will be specifically explained using FIG. 7. When the process proceeds to the system monitoring process of S112, as shown in FIG. 7, in S161, it is determined whether the distance to the other vehicle is normal. The distance to the other vehicle can be detected based on the detection results of other vehicles around the vehicle by each of the cameras 2-5 and each of the radar devices 11-14. It can also be detected based on the position information of other vehicles and the vehicle's position information obtained via vehicle-to-vehicle communication.

To determine whether the distance to the other vehicle is normal, for example, a distance threshold may be set, and the distance to the other vehicle may be determined to be normal if the distance is equal to or greater than the threshold. In this case, the threshold value may be set individually depending on the position of the other vehicle relative to the own vehicle (for example, whether it is in front of, behind, or to the side of the own vehicle). Of course, a method other than the above example may be used to determine whether the distance to another vehicle is normal.

If the distance to the other vehicle is not normal (S161: NO), the process advances to S169. If the distance to another vehicle is not normal, the risk of collision with another vehicle increases. A possible cause of this may be that the automatic control function is not operating properly. Therefore, if the distance to the other vehicle is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave the driving operation of the vehicle 1 to the driver himself. In other words, the fact that the distance to another vehicle is not normal is one of the events that require cancellation.

If the distance to the other vehicle is normal (S161: YES), it is determined in S162 whether the relative speed to the other vehicle is normal. Similarly to the distance to other vehicles, the relative speed with respect to other vehicles can also be detected based on the detection results of other vehicles around the own vehicle by each of the cameras 2 to 5 and each of the radar devices 11 to 14.

To determine whether or not the relative speed with respect to other vehicles is normal, for example, a relative speed threshold may be set and the relative speed with other vehicles may be determined to be normal if it is less than or equal to the threshold. . In this case, the threshold value may be set individually depending on the position of the other vehicle relative to the own vehicle (for example, whether it is in front of, behind, or to the side of the own vehicle). Of course, a method other than the above example may be used to determine whether the relative speed with respect to another vehicle is normal.

If the relative speed with respect to other vehicles is not normal (S162: NO), the process advances to S169. If the relative speed with respect to other vehicles is not normal, there is a possibility of a collision with another vehicle. It is also possible that the vehicle is not following the flow of traffic around it. A possible cause of this may be that the automatic control function is not operating properly. Therefore, if the relative speed with respect to other vehicles is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave the driving operation of the vehicle 1 to the driver himself. In other words, the fact that the relative speed with respect to other vehicles is not normal is one of the events that require cancellation.

If the relative speed with respect to the other vehicle is normal (S162: YES), it is determined in S163 whether the behavior of the suspension is normal. The behavior of the suspension can be detected based on the detection results of the suspension sensor 25.

To determine whether the behavior of the suspension is normal, for example, a threshold may be set for the amount of expansion and contraction of the suspension, and the behavior may be determined to be normal when the amount of expansion and contraction is equal to or less than the threshold. Further, for example, a threshold value may be set for the rate of change in the amount of expansion and contraction, and when the rate of change in the amount of expansion and contraction is equal to or less than the threshold value, it may be determined to be normal. Note that when a plurality of suspension sensors 25 are provided, how to comprehensively judge based on the detection results from the plurality of suspension sensors 25 may be determined as appropriate. For example, if the amount of expansion or contraction of even one of the plurality of suspension sensors 25 exceeds a threshold value, it may be determined that the behavior of the suspension is abnormal.

If the behavior of the suspension is not normal (S163: NO), the process advances to S169. If the suspension does not behave normally, the possible cause may be that the automatic control function is not operating properly. That is, if the automatic control function is not operating normally, unstable behavior such as sudden starts, sudden stops, and sharp turns may occur, which may cause the suspension to expand or contract significantly. Therefore, if the behavior of the suspension is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave the driving operation of the vehicle 1 to the driver himself. In other words, abnormal behavior of the suspension is one of the events that require cancellation.

If the behavior of the suspension is normal (S163: YES), it is determined in S164 whether or not the engine room is normal. Specifically, it is determined whether the condition in the engine room is such that the temperature in the engine room is normal and no abnormal noise is generated. The temperature in the engine room can be detected based on the detection result of the engine room temperature sensor 22, and the sound generated from the engine room can be detected based on the detection result of the engine room sound sensor 23.

Whether the engine room is normal or not may be determined, for example, by setting a temperature threshold for the temperature in the engine room and a volume threshold for the sound in the engine room, and determining that the engine room is normal if the temperature in the engine room is below the temperature threshold and the sound in the engine room is below the volume threshold. The sound quality of the engine room sound may be analyzed, and if sound quality equivalent to that which may occur when an abnormality occurs is detected, the engine room may be determined to be abnormal.

If the engine room is not normal (S164: NO), proceed to S169. If the engine room is not normal, it is possible that the automatic control function is not working properly. That is, if the automatic control function is not working properly, the automatic driving control device 30 is unable to control the driving control unit 46 properly, which may result in the driving control unit 46 being unable to control the engine, transmission, etc. properly. Therefore, if the engine room is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, an engine room that is not normal is one of the cancellation-requiring events.

If the engine room is normal (S164: YES), it is determined in S165 whether abnormal current is occurring. The abnormal current here means the above-mentioned overcurrent (for example, an excessive current that may occur during a lightning strike). A determination as to whether an abnormal current is occurring can be made based on the detection result of the current sensor 19. For example, a threshold value may be set for the current to be detected, and when the detected current is greater than or equal to the threshold value, it may be determined that an abnormal current has occurred.

If an abnormal current is occurring (S165: YES), proceed to S169. If an abnormal current is occurring, the automatic control function may not operate normally due to the abnormal current. Therefore, if an abnormal current occurs, it is determined in S169 that a deactivation event has occurred in order to forcibly deactivate automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, the occurrence of an abnormal current due to various factors such as a lightning strike is one type of deactivation event.

If no abnormal current is occurring (S165: NO), it is determined in S166 whether or not a tire puncture has occurred. Whether or not a tire is punctured can be detected based on the detection result of the tire air pressure sensor 24.

To determine whether a tire has a puncture, for example, a threshold value may be set for the air pressure, and if the air pressure of any one of the four tires is below the threshold value, it may be determined that a puncture has occurred.

If a flat tire has occurred (S166: YES), the process proceeds to S169. If a flat tire has occurred, the flat tire may cause the automatic control function to be unable to control the vehicle 1 normally. Therefore, if a flat tire has occurred, a determination is made in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, a flat tire is one of the cancellation-requiring events.

If a tire puncture has not occurred (S166: NO), it is determined in S167 whether or not a slip has occurred. Whether or not slipping has occurred can be detected based on the detection results of the wheel speed sensors 18 of each wheel. For example, the detection results of each wheel speed sensor 18 may be compared, and if the difference between the highest and lowest wheel speeds is equal to or greater than a predetermined threshold, it may be determined that a slip has occurred.

If slippage occurs (S167: YES), proceed to S169. If slippage occurs, there is a possibility that the automatic control function will not be able to control vehicle 1 normally due to the slippage. Therefore, if slippage occurs, in order to forcibly cancel automatic driving and leave driving operation of vehicle 1 to the driver himself, it is determined in S169 that a cancellation-requiring event has occurred. In other words, the occurrence of slippage is one of the cancellation-requiring events.

If no slip has occurred (S167: NO), it is determined in S168 whether the steering condition is normal. The steering state can be detected based on the detection result of the steering amount sensor 20. To determine whether the steering condition is normal, for example, a threshold value may be set for the amount of steering relative to the neutral position, and the steering condition may be determined to be normal if the amount of steering from the neutral position is less than or equal to the threshold. good. Alternatively, for example, a threshold value may be set for the rate of change in the amount of steering, and the system may be determined to be normal when the rate of change in the amount of steering is less than or equal to the threshold value.

If the steering condition is not normal (S163: NO), the process advances to S169. If the steering condition is not normal, the possible cause may be that the automatic control function is not operating normally. Therefore, if the steering state is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave the driving operation of the vehicle 1 to the driver himself. In other words, the fact that the steering condition is not normal is one of the events that require cancellation.

If the steering state is normal (S168: YES), the system monitoring process in FIG. 7 (i.e., the process of S112 in FIG. 6) ends.
Next, the interior/exterior behavior monitoring process of S113 in the autonomous driving cancellation confirmation process of Fig. 6 will be specifically described with reference to Fig. 8. When the process proceeds to the interior/exterior behavior monitoring process of S113, as shown in Fig. 8, it is determined in S201 whether or not contact with a specific contact part in the vehicle interior by an occupant of the vehicle 1 has been detected. The presence or absence of contact with the specific contact part in the vehicle interior can be determined based on the detection result of the interior contact sensor 21.

If contact with the specific contact area inside the vehicle is detected (S201: YES), the process advances to S210. In the instruction manual of the vehicle 1 of this embodiment, if you feel that the operating state of the automatic control function is abnormal or feel uneasy, you should touch a specific contact area in the vehicle or operate the emergency stop lever 43. It is explained that automatic driving can be forcibly canceled. Therefore, the detection of contact with a specific contact area within the vehicle can be determined to indicate that the occupant of the vehicle 1 has expressed a desire to forcibly cancel automatic driving.

Therefore, if contact with a specific contact part inside the vehicle is detected, it is determined in S210 that a cancellation-requiring event has occurred in order to forcibly cancel the automated driving and leave driving operation of the vehicle 1 to the driver himself. In other words, the detection of contact with a specific contact part inside the vehicle is one of the cancellation-requiring events.

If no contact with a specific contact area inside the vehicle is detected (S201: NO), in S202, it is determined whether the emergency stop lever 43 has been operated. If the emergency stop lever 43 has been operated (S202: YES), the process proceeds to S210. When the emergency stop lever 43 has been operated, it can be determined that an occupant of the vehicle 1 has expressed an intention to forcibly cancel the automatic driving.

Therefore, if the emergency stop lever 43 is operated, it is determined in S210 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic operation and leave the driving operation of the vehicle 1 to the driver himself. In other words, operating the emergency stop lever 43 is one of the events that require cancellation.

If the emergency stop lever 43 has not been operated (S202: NO), in S203, it is determined whether or not an external impact has been detected. As described above, an external impact here includes a large impact such as a collision with another vehicle, and a small impact such as an external person such as a pedestrian hitting the vehicle 1.

The presence or absence of an external impact can be determined based on the detection result of the impact sensor 27. If an external impact is detected (S203: YES), the process advances to S210. If an external impact has been detected, there is a possibility that damage has occurred to the vehicle 1 and the vehicle 1 is no longer able to run normally. In addition, if the automatic control function of vehicle 1 does not work properly and vehicle 1 behaves abnormally, or if a person outside the vehicle notices that something has happened to the driver of vehicle 1, a person outside the vehicle may It is also possible that the occupants of the vehicle 1 are alerted by hitting the vehicle 1 or the like.

Therefore, if an external impact is detected, it is determined in S210 that an event requiring cancellation has occurred in order to forcibly cancel the automatic driving and leave the driving operation of the vehicle 1 to the driver himself. In other words, detection of an external impact is one of the events that require cancellation.

If no external impact has been detected (S203: NO), it is determined in S204 whether the driver's behavior is normal. The driver's behavior can be recognized by analyzing the data captured by the indoor camera 6. For example, if the driver looks aside for a certain amount of time, if the driver's eyes are closed for more than a certain amount of time, or if the driver has an expression of surprise, worry, or fear, the driver's behavior becomes abnormal. It can be determined that Of course, it is also possible to determine whether the driver's behavior is normal based on other criteria.

If it is determined that the driver's behavior is not normal (S204: YES), proceed to S210. If it is determined that the driver's behavior is not normal, it may be possible that something unusual has happened to the driver, or that the automatic control function of the vehicle 1 is not working properly, etc.

Therefore, if it is determined that the driver's behavior is not normal, in order to forcibly cancel automatic driving and leave the driving operation of the vehicle 1 to the driver himself or to make an emergency stop of the vehicle 1, in S210, an event that requires cancellation is detected. It is determined that this has occurred. In other words, determining that the driver's behavior is not normal is one of the events that require cancellation.

If the driver's behavior is judged to be normal (S204: NO), in S205 it is judged whether or not the pedestrian is looking at the vehicle. As mentioned above, whether or not the pedestrian is looking at the vehicle can be judged by analyzing the image data from each of the cameras 2 to 5.

If pedestrians are looking at the vehicle (S205: YES), S208 determines whether a predetermined number of pedestrians or more are looking at the vehicle (i.e., whether the vehicle is attracting a lot of attention from pedestrians). If the number of pedestrians looking at the vehicle is less than the predetermined number (i.e., the vehicle is not attracting a lot of attention) (S208: NO), the process proceeds to S209.

In S209, it is determined whether the behavior of the pedestrian who is directing his or her eyes toward the own vehicle is normal. The criterion for determining whether or not the behavior of a pedestrian looking toward the own vehicle is normal may be determined as appropriate. For example, if the pedestrian has a specific facial expression or behavior such as surprise, worry, or fear, the pedestrian's behavior may be determined to be abnormal.

If it is determined in S208 that a predetermined number of pedestrians or more are directing their gaze toward the own vehicle (S208: YES), and in S209 it is determined that the behavior of the pedestrians who are directing their gaze toward the own vehicle is not normal. If so (S209: NO), the process advances to S210.

The fact that many pedestrians are focusing their gazes on the vehicle itself may indicate that the automatic control function of vehicle 1 is not functioning properly, causing vehicle 1 to behave abnormally, or that something unusual is happening to the driver of vehicle 1. Even if the number of pedestrians looking at the vehicle itself is small, if the pedestrians' behavior is abnormal, it may indicate that the automatic control function of vehicle 1 is not functioning properly, causing vehicle 1 to behave abnormally, or that something unusual is happening to the driver of vehicle 1.

Therefore, if the gazes of many pedestrians are concentrated at the same time, or if the pedestrians who are looking at the vehicle behave abnormally, the system determines in S210 that an event requiring cancellation has occurred, so that the system can either forcibly cancel the automated driving and leave vehicle 1 operation to the driver himself, or perform an emergency stop of vehicle 1. In other words, the gazes of many pedestrians are concentrated at the same time, or the behavior of the pedestrians who are looking at the vehicle are abnormal, both of which are types of events requiring cancellation.

( S209: YES), proceed to S206.

In S206, it is determined whether or not another vehicle (mainly an oncoming vehicle or a vehicle behind) has flashed its light. Whether or not another vehicle has flashed its light can be determined mainly by analyzing the image data captured by the front camera 2 and the rear camera 3. If another vehicle has flashed its light (S206: YES), the process proceeds to S210.

Being passed by another vehicle means that the automatic control function of vehicle 1 is not working properly and vehicle 1 is behaving abnormally, and the driver of the other vehicle notices this abnormal behavior and alerts the driver. I can think of a possibility. Therefore, in the case of being passed by another vehicle, it is determined in S210 that an event requiring cancellation has occurred in order to forcibly cancel automatic driving and leave the driving operation of vehicle 1 to the driver himself, or to bring vehicle 1 to an emergency stop. do. In other words, being passed by another vehicle is one of the events that require cancellation.

If the other vehicle has not honked its horn (S206: NO), the process proceeds to S207 to determine whether the other vehicle has honked its horn. Whether the other vehicle has honked its horn can be determined mainly based on the detection results of the external sound sensor 26. If the other vehicle has honked its horn (S207: YES), the process proceeds to S210.

When another vehicle honks its horn, it is possible that the automatic control function of vehicle 1 has stopped working properly, causing vehicle 1 to behave abnormally, and that the driver of the other vehicle has noticed this abnormal behavior and alerted the driver. Therefore, when another vehicle honks its horn, it is determined in S210 that an event requiring deactivation has occurred, so that the automatic driving is forcibly deactivated and vehicle 1 is left to the driver to drive, or vehicle 1 is brought to an emergency stop. In other words, when another vehicle honks its horn, this is one type of event requiring deactivation.

Next, the environmental monitoring process of S114 in the automatic driving cancellation confirmation process of FIG. 6 will be specifically described with reference to FIG. 9. When proceeding to the environmental monitoring process of S114, as shown in FIG. 9, in S251, it is determined whether the weather around the vehicle 1 is in a heavy rain state. The heavy rain state can be determined based on the detection signal from the rainfall sensor 17, for example, by setting a threshold value for the amount of detection and comparing it with the threshold value. Of course, heavy rain state may be determined by other methods. For example, the amount of rain may be analyzed from the image data captured by each of the cameras 2 to 5 to determine the heavy rain state.

If it is determined that the rain is heavy (S251: YES), the process proceeds to S256. If it is not determined that the rain is heavy (S251: NO), the process proceeds to S252.
In S252, it is determined whether or not the weather around the vehicle 1 is in a heavy snow condition. The determination of whether or not the weather is in a heavy snow condition may be made, for example, by analyzing the amount of snowfall from the photographic data of each of the cameras 2 to 5. Of course, the determination of whether or not the weather is in a heavy snow condition may be made by other methods.

If it is determined that the snow is heavy (S252: YES), the process proceeds to S256. If it is not determined that the snow is heavy (S252: NO), the process proceeds to S253.
In S253, it is determined whether or not the area around the vehicle 1 is in a dense fog state. The determination of whether or not the area is in a dense fog state may be performed in the same manner as the method of determining whether or not the area is in a heavy snow state, for example, by analyzing the fog generation state from the photographic data of each of the cameras 2 to 5. Of course, the determination of whether or not the area is in a dense fog state may be performed in other ways.

If it is determined that the vehicle is in a dense fog state (S253: YES), the process proceeds to S256. If it is not determined that the vehicle is in a dense fog state (S253: NO), the process proceeds to S254.
When it is determined that the weather is heavy rain, heavy snow, or thick fog (hereinafter collectively referred to as "bad weather"), visibility ahead of the vehicle is poor, and the automatic control function may not operate normally. Therefore, in the case of bad weather, it is determined in S256 that a cancellation event has occurred in order to forcibly cancel the automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, bad weather is one of the cancellation events.

In S254, it is determined whether the vehicle 1 is traveling through a caution section. In this embodiment, caution sections include at least accident-prone areas, school zones, areas where animals are likely to appear, etc., as described above. The determination of whether the vehicle 1 is traveling through a caution section can be made based on section information obtained via road-to-vehicle communication. Alternatively, if the image data captured by the front camera 2 includes signs or road signs indicating the caution section, the determination can also be made based on that.

If it is determined that the vehicle 1 is traveling in the caution area (S254: YES), the process proceeds to S256. When the vehicle 1 is traveling in a caution area, it may be preferable for the driver himself to perform driving operations while paying attention to the direction of travel, rather than relying on the automatic control function. Therefore, if the vehicle 1 is traveling in the caution area, it is determined in S256 that an event requiring cancellation has occurred in order to forcibly cancel automatic driving and leave the driving operation of the vehicle 1 to the driver himself. In other words, the fact that the vehicle 1 is traveling in a caution area is one of the events that require cancellation.

If the vehicle 1 is not traveling in the caution area (S254: NO), the process advances to S255. In S255, it is determined whether the average value of the automatic driving levels of other surrounding vehicles (hereinafter referred to as "surrounding average level") is below a predetermined level (eg, level 1 or below). If the surrounding average level is higher than the predetermined level (S255: NO), the environment monitoring process is ended. On the other hand, if the surrounding average level is below the predetermined level (S255: YES), the process proceeds to S256.

The surrounding average level can be derived by acquiring the automatic driving levels set in each of the other vehicles traveling around the host vehicle, and calculating the average of the acquired automatic driving levels. The automatic driving levels of other vehicles around the vehicle can be directly acquired through vehicle-to-vehicle communication, or indirectly through road-to-vehicle communication.

If the surrounding average level is below the predetermined level, it means that most of the other vehicles in the vicinity are keeping their automatic driving level low. In other words, it can be said that there is a high possibility that many drivers of other vehicles are driving by their own driving operations without relying on the automatic control function. The fact that many drivers around you are driving without relying on the automatic control function means that for some reason the area in which you are currently driving is preferable to driving by the driver's own control rather than automatic driving. I can think of something.

Therefore, when the surrounding average level is equal to or lower than a predetermined level, it is determined in S256 that an event requiring cancellation has occurred in order to forcibly cancel the automated driving and leave the driver to drive the vehicle 1. In other words, the surrounding average level being equal to or lower than a predetermined level is one of the events requiring cancellation.

Next, we will explain the self-diagnosis process of S115 in the automatic driving cancellation confirmation process in Figure 6. However, before explaining the self-diagnosis process, we will first explain the driving history recording process shown in Figure 10A.

The driving history recording process in FIG. 10A links various specific control actions performed while the vehicle 1 is running (control actions automatically performed by the automatic control function) with the position where the specific control action was performed. This is a process that is stored as a history. The type and number of specific control operations to be stored as history may be determined as appropriate. For example, the specific control action may be an action to temporarily stop while driving, an action to decelerate even though there is no other vehicle in front of the vehicle, or the like.

If the automatic control function is working properly, vehicle 1 should automatically stop where there is a stop road sign or stop line. It should also slow down for safety before a pedestrian crossing even if there is no vehicle ahead. On the other hand, if the automatic control function is not working properly, the vehicle may pass through a stop road sign without stopping, or pass through a pedestrian crossing without slowing down. In other words, if the automatic control function is not working properly, the vehicle may drive differently than before, even when driving through the same place it has driven through before.

Therefore, in this embodiment, the past driving history is stored in association with the position, and the next time the same place is traveled, it is compared with the past operating state, and if the driving action is different from the past (for example, If the automatic control function is not working properly and the automatic operation should be canceled if the automatic control function is not working properly (if the automatic control function has stopped temporarily in the past, but this time it passes by without any problem), the system determines that the automatic control function is not working properly and that automatic operation should be canceled.

When the control unit 30a starts operation, it executes the driving history recording process of FIG. 10A in parallel with the autonomous driving level setting process of FIG. 5. When the control unit 30a starts the driving history recording process of FIG. 10A, it determines in S301 whether the vehicle 1 has traveled a certain distance. It continues the determination in S301 until the certain distance has been traveled. If the certain distance has been traveled (S301: YES), it proceeds to S302.

In S302, the specific control operation performed in the travel section of the certain distance is stored as specific control information together with the position information where the specific control operation was performed. Note that if a specific control operation at the same position is already stored, the stored contents are updated. After storing the specific control information performed in the travel section of the certain distance, the process returns to S301. In this way, each time the vehicle travels a certain distance, storage processing of specific control information is performed for the travel section of the certain distance.

Next, the self-diagnosis process of S115 in FIG. 6 will be explained using FIG. 10B. Proceeding to the self-diagnosis process in S115, as shown in FIG. 10B, in S351 it is determined whether the current traveling position has been traveled in the past. This determination can be made by comparing the current location based on the GPS information and the location information linked to the specific control information stored in the memory 30b.

If the current driving position is not linked to any of the specific control information stored in memory 30b, the current driving position is deemed to have not been traveled to in the past (S351: NO), and the self-diagnosis process ends. If the current driving position matches or is close to position information linked to any of the specific control information stored in memory 30b, the current driving position is deemed to have been traveled to in the past (S351: YES), and the process proceeds to S352.

In S352, past specific control information corresponding to the current driving position is read from memory 30b. In other words, it is confirmed whether or not any specific control operation has been performed in the past at the current driving location. In S353, it is determined whether or not the current driving state is different from the past. More specifically, it is determined whether or not a specific control operation that was performed in the past at the same location has been performed this time. If the driving state is different from the past, that is, if a specific control operation that was performed in the past at the same location was not performed this time (S353: YES), proceed to S354 and determine that a release-required event has occurred. If the driving state is not different from the past, that is, if a specific control operation that was performed in the past at the same location was performed this time (S353: NO), the self-diagnosis process ends.

(5) Effects of the First Embodiment According to the vehicle 1 of the present embodiment described above, when the autonomous driving level is level 1 or higher (i.e., when the automatic control function is operating), it is determined whether or not a cancellation event that requires cancellation of the autonomous driving has occurred (S112 to S115 in FIG. 6). If a cancellation event occurs, the autonomous driving level is forcibly set to level 0. In other words, if a cancellation event occurs, regardless of the setting state of the driving mode, the operation of all automatic control functions is stopped and driving operation of the vehicle 1 is left to the driver.

Therefore, when a cancellation-requiring event occurs, the vehicle 1 can be driven by the driver's own driving operation. Thereby, it is possible to suppress the occurrence of unstable operation of the vehicle 1 due to malfunction of the automatic control function or the like.

In addition, in this embodiment, a large number of events are assumed that may be considered as events requiring release, and a determination is made for each event one by one.
Specifically, as shown in S161 of Fig. 7, the distance to another vehicle is judged, and if the distance to the other vehicle is not normal, the automatic driving is forcibly cancelled. Therefore, even if the vehicle 1 is about to collide with another vehicle due to a malfunction of the automatic control function, the driver can avoid this by operating the vehicle himself.

Also, as shown in S162 of FIG. 7, the relative speed with other vehicles is judged, and if the relative speed with other vehicles is not normal, automatic driving is forcibly cancelled. Therefore, even if vehicle 1 is on the verge of colliding with another vehicle due to a malfunction of the automatic control function or the like, this can be avoided by the driver's own driving operation. Also, even if the driving speed of vehicle 1 is different from the speed of many surrounding vehicles due to a malfunction of the automatic control function or the like, and is not following the flow of surrounding traffic, this can be avoided by the driver's own driving operation.

In addition, as shown in S163 of FIG. 7, the behavior of the suspension is judged, and if the behavior is not normal, the automatic driving is forcibly cancelled. Therefore, even if the vehicle 1 starts to exhibit abnormal behavior due to a malfunction of the automatic control function, etc., it is possible for the driver to avoid this by operating the vehicle himself.

Also, as shown in S164 of FIG. 7, the condition of the engine room (temperature and sound) is judged, and if it is not normal, the automatic driving is forcibly cancelled. Therefore, if an abnormality occurs in the engine room due to a malfunction of the automatic control function, the driver can minimize the impact by operating the vehicle himself.

7, the automatic driving is forcibly cancelled when an abnormal current is generated in the electric wiring in the vehicle 1 (however, in the electric wiring where the current sensor 19 is provided), so that even if an excessive current flows due to a lightning strike or the like, it is possible to prevent the automatic control function from malfunctioning and the running state of the vehicle 1 from becoming unstable.

In addition, as shown in S166 and S167 of FIG. 7, if a tire goes flat or a slip occurs, the automatic driving is forcibly cancelled. Therefore, if the reliability of driving under the automatic control function is reduced due to a tire going flat or a slip, the driver can operate the vehicle 1 appropriately by his/her own driving operation (for example, slowly decelerate to a stop, or smoothly recover from a slip state).

Furthermore, as shown in S168 in FIG. 7, if the steering state of the steered wheels is not normal, automatic operation is forcibly canceled. Therefore, even if the steered wheels of the vehicle 1 exhibit abnormal behavior due to malfunction of the automatic control function or the like, this can be avoided by the driver's own driving operation.

In addition, as shown in S201 and S202 in FIG. 8, if a contact with a specific contact area inside the vehicle is detected by an occupant, or if an emergency stop lever is operated by an occupant, automatic driving is forcibly canceled. That's what I do. Therefore, if a situation arises in which the driver wants to cancel automatic driving, such as when the behavior of the vehicle 1 becomes unstable, for example, the driver can quickly cancel automatic driving of his or her own will.

Furthermore, as shown in S203 in FIG. 8, automatic operation is forcibly canceled when an external impact is detected. Therefore, even if there is a possibility that the automatic control function may not operate normally due to an external impact, the vehicle 1 can be operated appropriately by the driver's own driving operation.

In addition, as shown in S204 of FIG. 8, if the driver's behavior is not normal (for example, if the driver has a look of surprise or fear), the automatic driving is forcibly cancelled. Therefore, even if the driving state of the vehicle 1 becomes unstable to the extent that the driver shows a look of surprise or fear due to a malfunction of the automatic control function, the driver can quickly avoid this by operating the vehicle himself.

Additionally, as shown in S205, S206, and S207 in FIG. The system forces the driver to disable autonomous driving if another vehicle honks at him or passes him by. This is because if a pedestrian or another vehicle takes some kind of action against your vehicle, it may mean that your vehicle's driving condition is unstable, and the cause may be an issue with the automatic control function. This is because malfunction etc. may occur.

In addition, as shown in S251 to S253 in FIG. 9, the automatic driving is forcibly cancelled in bad weather such as heavy rain, heavy snow, and dense fog. Therefore, even if the automatic control function does not operate normally due to bad weather and the running of the vehicle 1 may become unstable, the automatic driving is forcibly cancelled, so that the driver can drive the vehicle 1 appropriately by operating the vehicle himself.

In addition, as shown in S254 of FIG. 9, when the vehicle 1 is traveling in a caution section, the automatic driving is forcibly cancelled. This allows the driver to drive the vehicle appropriately through the caution section by operating the vehicle himself, without relying on the automatic control function.

Furthermore, as shown in Figure 10B, when you drive again in a place where you have traveled in the past, if the specific control action that was performed in the past is not performed this time, the automatic control function will not operate normally. The system assumes that the vehicle is not operating properly and forcibly disables autonomous driving. Therefore, problems that may occur due to malfunction of the automatic control function can be suppressed.

In addition, in this embodiment, when an event requiring cancellation occurs, the autonomous driving is not cancelled unconditionally, but the occupant is notified that the autonomous driving is cancelled (S117 in FIG. 6). Then, when it is confirmed that the autonomous driving can be cancelled, such as when there is a predetermined reaction from the occupant (YES in S118 in FIG. 6), the autonomous driving is cancelled. Therefore, the autonomous driving can be cancelled smoothly and appropriately, allowing the driver to take over driving operations.

On the other hand, even if the occupant is informed that the automatic driving will be canceled, if the occupant does not respond in a predetermined manner (NO in S118), the vehicle 1 is automatically brought to an emergency stop. Therefore, if it becomes difficult for the driver to drive the vehicle 1 due to, for example, the driver dozing off or fainting, the vehicle 1 can be stopped quickly and appropriately to prevent unforeseen situations from occurring. Can be suppressed.

Note that the control unit 30a corresponds to an example of a surrounding information acquisition unit, an operation mode setting unit, an automatic control unit, a cancellation required event determination unit, a notification unit, and a cancellation permission determination unit. Further, the processes of S40 and S50 in FIG. 5 correspond to an example of the process of the driving mode setting section. Further, the process of S55 in FIG. 5 corresponds to an example of the process of the surrounding information acquisition unit. Further, the processes in S55 in FIG. 5 and S118 to S120 in FIG. 6 correspond to an example of the process of the automatic control unit. Further, the process of S120 in FIG. 6 corresponds to an example of an automatic stop process among the processes of the automatic control unit. Further, the processes of S112, S113, S114, and S115 in FIG. 6 correspond to an example of the process of the cancellation-required event determination unit. Further, the process of S117 in FIG. 6 corresponds to an example of the process of the notification unit, and the process of S118 of FIG. 6 corresponds to an example of the process of the cancellation permission determination unit.

[Second embodiment]
The electrical configuration of the vehicle of the second embodiment is shown in Fig. 11. In Fig. 11, the same components as those of the vehicle 1 of the first embodiment are denoted by the same reference numerals as those of the first embodiment, and detailed description thereof will be omitted.

As shown in FIG. 11, the vehicle of the second embodiment includes an automatic driving control device 101 and a monitoring device 102. Except for the automatic driving control device 101 having a function for performing data communication with the monitoring device 102 via a network 100, the automatic driving control device 101 has basically the same configuration as the automatic driving control device 101 of the first embodiment and operates in the same manner. That is, the control unit 101a of the automatic driving control device 101 executes the automatic driving level setting process (see FIG. 5) in accordance with various programs stored in the memory 101b, similar to the vehicle 1 of the first embodiment. It also executes an automatic control function based on the set automatic driving level.

In addition, in FIG. 11, each camera 2 to 6, each radar device 11 to 14, and each sensor 16 to 27 in the vehicle 1 of the first embodiment shown in FIG. 2 is collectively illustrated as a detection means group 111. ing. Further, in FIG. 11, the communication units 31 to 35 in the vehicle 1 of the first embodiment shown in FIG. 2 are collectively illustrated as a communication means group 112.

The autonomous driving control device 101 of this embodiment further transmits the execution state of the automatic control function corresponding to the autonomous driving level (the result of the control calculation) as one piece of control information to the monitoring device 102 via the network 100 periodically. In addition, if a cancellation event occurs as a result of the autonomous driving level setting process, the autonomous driving control device 101 transmits at least that fact (the fact that a cancellation event has occurred) as one piece of control information to the monitoring device 102 via the network 100 periodically.

The monitoring device 102 is provided to monitor whether various controls by the automatic operation control device 101 are operating normally. That is, the monitoring device 102 basically has the same configuration as the automatic driving control device 101, and like the automatic driving control device 101, the control unit 102a performs automatic control based on the set automatic driving level. Executes control calculations for functions.

That is, although the monitoring device 102 does not actually execute an automatic control function, it performs control calculations for the automatic control function in the same way as the automatic operation control device 101. That is, both the automatic driving control device 101 and the monitoring device 102 execute control calculations necessary to realize automatic control functions according to the set automatic driving level.

Therefore, on the premise that the operation of the monitoring device is normal, if the automatic driving control device 101 is normal, the results of the control calculations for both should be the same. On the other hand, if an abnormality occurs in the automatic driving control device 101 and the automatic control function does not operate normally, the control calculation results for both will be different (as a result of the calculation result of the automatic driving control device 101 being abnormal). ) is possible.

Therefore, the monitoring device 102 compares its own control calculation result with the control calculation result by the automatic driving control device 101, and if the two do not match, it forcibly cancels the automatic control function by the automatic driving control device 101. Specifically, the control unit 102a of the monitoring device 102 executes the control state monitoring process shown in FIG. 12.

When the control unit 102a of the monitoring device 102 starts the control state monitoring process shown in FIG. 12, in S501, it executes the calculation process of the automatic control function corresponding to the set automatic driving level. In S502, the calculation result of the control calculation of the automatic control function in the automatic driving control device 101 is acquired from the automatic driving control device 101 via the network 100.

In S503, the own calculation result calculated in S501 is compared with the calculation result in the automatic driving control device 101 obtained in S502, and it is determined whether the two match. If the two do not match (S503: NO), it is determined that the calculation result by the automatic driving control device 101 is not normal, and in S508, a forced cancellation is performed to forcibly cancel the automatic control function by the automatic driving control device 101. Execute processing.

There are various possible specifics for the forced release process of S508. For example, the monitoring device 102 may instruct the travel drive control unit 46, the brake control unit 47, and the steering control unit 48 to ignore control commands from the automatic driving control device 101, so that each of these control units 46 to 48 operates independently of the automatic driving control device 101 (i.e., automatic driving is released).

For example, the automatic driving control device 101 may be forced to cancel automatic driving by transmitting, via the network 100, determination information indicating that the calculation results do not match.

In addition, for example, switches for connecting and disconnecting the electrical connection between the automatic driving control device 101 and the driving control unit 46, between the automatic driving control device 101 and the brake control unit 47, and between the automatic driving control device 101 and the steering control unit 48 may be provided. Then, by turning off at least one of the switches (i.e., disconnecting the electrical connection), it may be possible to prevent control from the automatic driving control device 101.

Further, it is also possible that the automatic driving control device 101 is being illegally accessed from the outside as a reason why the calculation result by the automatic driving control device 101 is not normal. Therefore, a switch is provided between the communication means group 112 and the automatic operation control device 101 to conduct/break the electrical connection between the two, and this switch is turned off (that is, the electrical connection is cut off). It may also be possible to prevent physical access from the outside.

If the calculation results match in S503 (S503: YES), then in S504 it is determined whether or not a cancellation-requiring event has occurred. Specifically, the occurrence of a cancellation-requiring event is determined by performing processes identical to those in S112 to S115 in the automatic driving cancellation confirmation process of the first embodiment shown in FIG. 6.

In S505, it is determined whether or not a cancellation-requiring event has occurred based on the determination result in S504. If a cancellation-requiring event has not occurred (S505: NO), the control state monitoring process is terminated. If a cancellation-requiring event has occurred (S505: YES), in S506, the determination result of the presence or absence of a cancellation-requiring event in the automatic driving control device 101 is obtained from the automatic driving control device 101 via the network 100.

In S507, based on the obtained result in S506, it is determined whether the automatic driving control device 101 has also determined that a cancellation-required event has occurred. If the automatic operation control device 101 also determines that a release event has occurred, it is determined that the automatic operation control device 101 is operating normally, and the control state monitoring process is ended. On the other hand, if the automatic driving control device 101 does not determine that a cancellation-requiring event has occurred, it determines that the automatic driving control device 101 is not operating normally due to some factor, and proceeds to S508, where the forced cancellation is performed as described above. Execute processing.

According to the vehicle of the second embodiment described above, in addition to the effects of the first embodiment, the following effects can be obtained. That is, in the second embodiment, a monitoring device 102 is provided separately from the automatic operation control device 101. The monitoring device 102 also performs almost the same control calculations as the automatic driving control device 101, and compares the calculation results with the calculation results of the automatic driving control device 101 to determine whether or not the two match. Accordingly, it is determined whether the automatic operation control device 101 is operating normally.

In other words, by having two independent computers execute the same control calculations and checking whether their calculation results match, it is possible to determine whether the operation of one computer (in this case, the automatic driving control device 101) is normal or not. I try to judge.

If the two calculation results do not match, the monitoring device 102 executes forced cancellation processing (S508 in FIG. 12) to forcefully cancel the automatic operation. Note that, as in the first embodiment, the automatic operation control device 101 cancels automatic operation by itself when a cancellation-required event occurs. In the second embodiment, in addition, the monitoring device 102 also performs forced cancellation processing for canceling automatic operation. Therefore, when a situation arises in which automatic driving should be canceled, automatic driving can be canceled more reliably.

[Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above embodiments and can take various forms.

(1) The specific examples of events requiring cancellation shown in each of the above embodiments are merely examples. It is also possible to determine whether other events that are considered to require cancellation of autonomous driving have occurred, and to cancel autonomous driving if they have occurred.

For example, in the first embodiment, an example was shown in which autonomous driving was cancelled when the driver behaved abnormally, but autonomous driving may also be cancelled based on the behaviour of passengers other than the driver.

Furthermore, it may be determined whether or not automatic driving should be canceled based not only on the behavior of the occupants (including the driver) but also on the content of what the occupants say. For example, if someone says, "An ambulance is approaching from behind!", automatic driving may be canceled and the vehicle will be left to the driver's control. In other words, automatic driving may be canceled in response to a specific phrase or sentence.

The infrastructure may also monitor the vehicle's driving condition, and if the driving condition is unstable (i.e., if there is a possibility that the automatic control function is not operating normally), notify the vehicle of this via road-to-vehicle communication or the like. Then, if the vehicle receives the notification from the infrastructure, it may forcibly cancel the automatic driving.

(2) In the above embodiment, the automatic driving level is forcibly set to level 0 when some cancellation required event occurs when the automatic driving level is level 1 or higher. The automatic driving level may be set to 0 if a cancellation-required event occurs when the level is higher than or equal to level n (in other words, it may be ignored if the level is lower than n). Alternatively, if the driving mode is in advanced automation mode and an event that requires cancellation occurs, the automatic driving level is forcibly set to level 0, and if the driving mode is basic mode, even if the event that requires cancellation occurs, the basic mode is set. may be maintained.

In addition, it is not necessary to set the autonomous driving level to level 0 when a deactivation event occurs, and the autonomous driving level may be lowered to at least a level lower than the current autonomous driving level. For example, if a deactivation event occurs while in the highly automated mode, the mode may be switched to the basic mode.

(3) Cameras and radar devices necessary to realize automatic driving may be provided anywhere in the vehicle 1, and any number of cameras and radar devices may be provided. The installation location and number of cameras and radar devices may be determined as appropriate so as to realize the desired automatic control function. Further, the on-vehicle equipment necessary to realize automatic driving is not limited to the various equipment shown in FIGS. 1 and 2.

(4) In addition, the function of one component in the above embodiment may be distributed as multiple components, or the functions of multiple components may be integrated into one component. Further, at least a part of the configuration of the above embodiment may be replaced with a known configuration having a similar function. Further, a part of the configuration of the above embodiment may be omitted. Further, at least a part of the configuration of the above embodiment may be added to or replaced with the configuration of other embodiments. Note that all aspects included in the technical idea specified only by the words described in the claims are embodiments of the present disclosure.

[Technical thought understood from the embodiment]
From the various embodiments detailed above, at least the following technical ideas can be understood.
(A) An automatic driving control device installed in a vehicle,
a surrounding information acquisition unit that obtains surrounding information that is information about the surroundings of the vehicle;
The driving mode of the vehicle is a highly automated mode in which at least a portion of a plurality of types of driving operations necessary for driving the vehicle are automatically executed based on the surrounding information, and the driving operation is automatically executed. an operation mode setting unit that sets the type of automatic operation to any one of a basic mode in which the types of automatic operation operations are fewer than the highly automated mode or zero;
an automatic control unit that executes the automatic driving operation set in the driving mode based on the driving mode set by the driving mode setting unit;
When the driving mode is set to a driving mode having at least one automatic driving operation to be executed, a predetermined requirement to cancel at least one of the automatic driving operations set in that driving mode. a cancellation event determination unit that determines whether a cancellation event has occurred;
Equipped with
The automatic control unit is configured to determine that the cancellation-required event has occurred by the cancellation-required event determination unit when the operation mode is set to an operation mode having at least one automatic operation operation to be executed. If so, stop the execution of at least one of the set automatic operation operations,
Automatic driving control device.

In the automatic driving control device with the above configuration, when the driving mode is set to the advanced automation mode, the cancellation-required event determination section judges whether a cancellation-required event has occurred, and also when the driving mode is set to the basic mode. Even if the basic mode is set to execute at least one of multiple types of automatic driving operations, the cancellation-required event determination unit will not be able to determine whether or not a cancellation-required event has occurred. be exposed.

In other words, regardless of the type of operating mode that is set, if at least one of multiple types of automatic driving operations is set to be executed, the cancellation-required event determination unit determines whether or not a cancellation-required event has occurred. A judgment is made. If it is determined that a cancellation-required event has occurred, at least one of the automatic driving operations to be executed is stopped.

An event that requires cancellation is an event that may occur due to the automated driving operation being executed not being executed normally, or an event that may occur even though the automated driving operation is currently being executed normally. This is an event that may hinder the execution of automated driving operations.

One or more cancellation-requiring events may be set in advance. When multiple cancellation-requiring events are set, the cancellation-requiring event determination unit may determine whether or not each of the multiple cancellation-requiring events has occurred, or may determine whether or not some of the multiple cancellation-requiring events have occurred. In the latter case, it may be determined as appropriate which of the multiple cancellation-requiring events are to be the subject of determination. For example, at least one of a cancellation-requiring event that occurs when an automatic driving operation that is set to be executed in the current driving mode is no longer executed normally, and a cancellation-requiring event that may interfere with the automatic driving operation may be included in the determination target.

In addition, the timing at which the release-required event determination unit determines whether or not a release-required event has occurred may be determined as appropriate, other than the above. For example, depending on the number and type of automatic driving operations set to be executed in the current driving mode, it may be determined whether or not the release-required event determination unit should determine whether or not a release-required event has occurred, and if so, at what specific timing the determination should be made.
(B) In the above (A),
The automatic driving control device is set such that the event requiring deactivation is at least one of the following operating states: at least one operating state that may occur when the automatic driving operation set as the target for execution may not be executed normally; and at least one operating state in which the automatic driving operation set as the target for execution may not be executed normally.

In this way, by appropriately setting the vehicle's operating state in which the autonomous driving operation is not being performed normally (or may not be performed normally) as an event that requires cancellation, it is possible to appropriately determine whether or not the autonomous driving operation currently being performed should be stopped.
(C) In the above (A) or (B),
An automatic driving control device in which the event requiring deactivation is set to at least one of the following: an occupant of the vehicle exhibiting a specific first behavior, a person around the vehicle exhibiting a specific second behavior, and another vehicle around the vehicle performing a specific third action.

If an automated driving operation is not executed normally, the effect will be reflected in the operating state of the vehicle, and the vehicle occupants may exhibit certain behaviors (for example, facial expressions of surprise or anxiety) or the surroundings of the vehicle may be affected. If a person behaves in a certain way (for example, a lot of people are looking at each other or pointing at the vehicle), or if another vehicle (or more specifically, the occupants of another vehicle) There is a possibility that specific actions (for example, honking or passing) may be performed in response to the vehicle. Therefore, by setting at least one of the first behavior, the second behavior, and the third behavior as a cancellation-required event, it is possible to appropriately judge whether or not to stop the automatic driving operation in progress. Can be done.
(D) In any one of the above (A) to (C),
An automatic driving control device in which an environment surrounding the vehicle is set as a predetermined specific environment as the cancellation-required event.

A specific environment refers to an environment in which the autonomous driving operation currently being performed may not be performed normally, or an environment in which one or more specific autonomous driving operations should not be performed. Examples of this include bad weather such as heavy rain or thick fog. Another example would be when the vehicle is traveling in an area where it is considered preferable to leave driving operations to the driver's own discretion rather than autonomous driving, such as a school zone or an area with a high incidence of accidents.

By setting the presence of a vehicle in such a specific environment as a cancellation-required event, it is possible to appropriately determine whether or not the automatic driving operation in progress should be stopped.

1...vehicle, 2...front camera, 3...rear camera, 4...left side camera, 5...right side camera, 6...interior camera, 9...front window, 10...steering wheel, 11...front radar device, 12...rear radar device, 13...left side radar device, 14...right side radar device, 16...sun radiation sensor, 17...rainfall sensor, 18...wheel speed sensor, 19...current sensor, 20...steering amount sensor, 21...interior contact sensor, 22...engine room temperature sensor, 23...engine room sound sensor, 24...tire pressure sensor, 25...suspension sensor, 26...exterior sound sensor, 27...impact sensor, 30, 101...auto Automatic driving control device, 30a, 101a, 102a...control unit, 30b, 101b, 102b...memory, 31...GPS communication unit, 32...vehicle-to-vehicle communication unit, 33...road-to-vehicle communication unit, 34...pedestrian-to-vehicle communication unit, 35...LTE communication unit, 36...operation unit, 37...display unit, 38...speaker, 41...automatic driving switch, 42...level setting operation unit, 43...emergency stop lever, 44...release reset switch, 46...travel drive control unit, 47...brake control unit, 48...steering control unit, 81...road communication device, 82...camera, 100...network, 102...monitoring device, 111...detection means group, 112...communication means group.

Claims (3)

An automatic driving control device mounted on a vehicle,
A surrounding information acquisition unit configured to acquire surrounding information that is information about the surroundings of the vehicle;
A driving mode setting unit configured to set a driving mode of the vehicle to either a highly automated mode in which at least a part of a plurality of types of driving operations required for driving the vehicle is automatically executed based on the surrounding information, or a basic mode in which the types of automatic driving operations, which are the driving operations to be automatically executed, are fewer than those in the highly automated mode or are zero;
an automatic control unit configured to execute the automatic driving operation set in the driving mode based on the driving mode set by the driving mode setting unit;
A cancellation-required event determination unit configured to determine whether or not a predetermined cancellation-required event has occurred that should cancel at least one of the automated driving operations set in the highly automated mode, at least when the driving mode is the highly automated mode;
Equipped with
The automatic control unit is configured to stop execution of at least one of the automatic driving operations that are set to be executed when the operation mode is set to at least the highly automated mode and the cancellation-required event determination unit determines that the cancellation-required event has occurred.
Automatic driving control device. The automatic operation control device according to claim 1,
The automatic control unit is configured to determine that the cancellation-required event has occurred by the cancellation-required event determination unit when the operation mode is set to an operation mode having at least one automatic operation operation to be executed. is configured to stop all the automatic driving operations to be executed in that driving mode if
Automatic driving control device. The automatic driving control device according to claim 1 or 2,
a notification unit configured to, when the cancellation-required event determination unit determines that the cancellation-required event has occurred, notify an occupant of the vehicle of the occurrence of the cancellation-required event;
a release permission determination unit configured to determine whether or not a specific release permission operation is performed by an occupant of the vehicle after the notification by the notification unit;
Equipped with
The automatic control unit is configured to stop the execution of the automatic driving operation that should be stopped when the cancellation permission determination unit determines that the cancellation permission operation has been performed, and to execute a predetermined automatic stop process to stop the traveling of the vehicle when the cancellation permission determination unit does not determine that the cancellation permission operation has been performed.
Automatic driving control device.