Vehicle control system

A vehicle control system capable of ensuring safety at a low cost even when a control device fails, includes a first control device that implements at least two automatic driving-related functions based on information from external sensors and/or information from a map database, a second control device that implements fewer automatic driving-related functions than the first control device based on the information from the sensors and/or the map database, and a vehicle motion control device that automatically controls a driving state of a host vehicle based on a function planned by the first or second control device including: a backup determination unit that determines whether the future function planned by the first or second control device is backed up by the second control device; and an interface that notifies a driver that system responsibility is switched to the driver, when the backup is not available.

TECHNICAL FIELD

The present invention relates to a vehicle control system.

BACKGROUND ART

PTL 1 discloses an automatic driving control device including a precautionary safety system performing automatic driving control at an automation level 2 and an automatic driving system performing automatic driving control at an automation level 3, wherein the precautionary safety system and the automatic driving system are configured as independent processing systems from each other. In the automatic driving control device described in PTL 1, if the precautionary safety system fails while the automatic driving control is performed by the precautionary safety system, the automatic driving control is shifted to that performed by the automatic driving system. If the automatic driving system fails while the automatic driving control is performed by the automatic driving system, the automatic driving control is shifted to that performed by the precautionary safety system. In other words, rather than a full-dual system configuration, the relatively high-cost automatic driving system is backed up by the relatively low-cost precautionary safety system to ensure safety while suppressing an increase in cost.

CITATION LIST

Patent Literature

SUMMARY OF INVENTION

Technical Problem

Meanwhile, if hardware for mounting the automatic driving system, which is a main system, has different specifications from that for mounting the precautionary safety system, which is a sub-system, driving functions that can be implemented by the respective systems are different. However, since the conventional technique described in PTL 1 does not consider what functions can be backed up by the precautionary safety system, it cannot be said all the functions of the automatic driving system can be backed up by the precautionary safety system. That is, in the event that the automatic driving system cannot be backed up by the precautionary safety system when the automatic driving system fails, a driver may suddenly have to take over driving.

Under the aforementioned circumstances, an object of the present invention is to provide a vehicle control system capable of improving the safety of the automatic driving system.

Solution to Problem

One of preferred modes of the present invention for solving the aforementioned problems is as follows. A vehicle control system including a first control device that implements at least two automatic driving-related functions, a second control device that implements fewer automatic driving-related functions than the first control device, and a vehicle motion control device that automatically controls a driving state of a host vehicle based on a function planned by the first or second control device according to the preferred mode of the invention includes: a backup determination unit that determines whether or not the future function planned by the first or second control device is backed up by the second control device; and a notification unit that notifies a driver that system responsibility is switched to driver responsibility, when the backup determination unit determines that the backup is not available.

Advantageous Effects of Invention

According to the present invention, it is determined whether or not a future automatic driving function can be backed up by the second control device, and it is notified, when it is determined that the backup is not available, that system responsibility will be switched to driver responsibility without continuing system-responsible automatic driving. As a result, the driver can take a standby state before the function that cannot be backed up by the second control device is executed. Therefore, even if a failure occurs in the first control device during the execution of the function, the driver is not suddenly required to operate a steering wheel from a system-responsible driving state. That is, the safety of the automatic driving system can be improved.

Other problems, configurations, and effects that are not described above will be apparent from the following description of embodiments.

DESCRIPTION OF EMBODIMENTS

Hereinafter, embodiments of vehicle control systems according to the present invention will be described with reference to the drawings.

First Embodiment

FIG.1is a system configuration diagram illustrating a hardware configuration of a vehicle control system100. It should be noted that, in the drawing, wheel FL refers to a left-front wheel, wheel FR refers to a right-front wheel, wheel RL refers to a left-rear wheel, and wheel RR refers to a right-rear wheel.

The vehicle control system100includes: sensors2,3,4, and5mounted, for example, on a vehicle such as an automobile and basically sensing an external field; a global navigation satellite system (GNSS)27detecting an absolute position of the host vehicle; a first control device calculating target tracks for a plurality of automatic driving functions (automatic driving-related functions), such as automatic driving in a lane of the host vehicle, automatic lane change, automatic driving into a lane-merging section, and automatic driving into a lane-branched section, based on information of the sensors2,3,4, and5and the GNSS27; a second control device25calculating target tracks for fewer automatic driving functions than the first control device1based on the information from the sensors2,3,4, and5and GNSS27; a steering control mechanism10, a brake control mechanism13, and a throttle control mechanism20as actuators that implements the automatic driving; a human machine interface (HMI)23as a notification unit that notifies a driver or the like of the information; a vehicle motion control device26computing respective command values for the actuators10,13, and20based on the target tracks of the first control device1and the second control device25; and a steering control device8, a brake control device15, and a throttle control device19as control devices that controls the actuators10,13and20, respectively, based on the command values of the vehicle motion control device26. The steering control device8controls the steering control mechanism10based on the corresponding command value, the brake control device15controls the brake control mechanism13based on the corresponding command value to regulate a brake force distribution to each of the wheels (wheel FL, wheel FR, wheel RL, and wheel RR), and the throttle control device19controls the throttle control mechanism20based on the corresponding command value to regulate a torque output of an engine (not shown).

The sensors2,3,4, and5that senses the external field, which is for sensing lane markers and signs of the lane of the host vehicle (the lane in which the host vehicle is travelling), another vehicle around the host vehicle (which may hereinafter be referred to as an object), etc., includes a stereo camera2on the front side, laser radars3and4on the left and right sides, and a millimeter-wave radar5on the rear side in this embodiment. By these sensors, a relative distance and a relative speed of the host vehicle to a surrounding vehicle can be detected. In addition, the stereo camera2on the front side can detect sites next to the lane markers of the lane in which the host vehicle is travelling, etc. It should be noted that the sensors are configured as a combination of the aforementioned sensors as an example in this embodiment, but are not limited thereto. The sensors may be combined with an ultrasonic sensor, a monocular camera, an infrared camera, or the like. The GNSS27detects an absolute position of the host vehicle. The information from the sensors2,3,4, and5and the GNSS27is input to the first control device1and the second control device25.

Although not shown in detail inFIG.1, each of the first control device1and the second control device25is constituted by, for example, an ECU including a CPU, a ROM, a RAM, and an input/output device. For example, the ROM stores cognition and determination programs for implementing automatic driving such as automatic driving in a lane of the host vehicle, automatic lane change, automatic driving into a lane-merging section, and automatic driving into a lane-branched section, and the CPU generates a target track for the automatic driving and transmits the target track to the vehicle motion control device26. The vehicle motion control device26computes respective command values for the actuators10,13, and20and communicates with the respective control devices8,15, and19of the actuators10,13, and20, so that the vehicle follows the target track sent from the first control device1or the second control device25. The respective control devices8,15, and19of the actuators10,13, and20receive the command values from the vehicle motion control device26by communicating therewith and control the respective actuators10,13, and20based on the corresponding command values.

Next, the operations of a steering, a brake, and an accelerator constituting the actuators10,13, and20, respectively, will be described.

First of all, the operation of the brake will be described. A pedaling force of the driver stepping on a brake pedal12is boosted by a brake booster (not shown), and a hydraulic pressure is generated by a master cylinder (not shown) in response to the pedaling force. The generated hydraulic pressure is supplied to wheel cylinders16FL to16RR provided in the respective wheels via the brake control mechanism13. Each of the wheel cylinders16FL to16RR includes a cylinder (not shown), a piston, a pad, etc. The piston is propelled by hydraulic fluid supplied from the master cylinder, and the pad connected to the piston is pressed against a disc rotor. The disc rotor rotates together with the vehicle wheel. Accordingly, a braking torque acting on the disc rotor is a braking force acting between the vehicle wheel and a road surface. As described above, the braking force can be generated on each wheel in accordance with the operation of the brake pedal by the driver.

Although not shown in detail inFIG.1, the brake control device15includes, for example, a CPU, a ROM, a RAM, and an input/output device, like the first control device1or the like. Sensor signals from a combined sensor14capable of detecting a longitudinal acceleration, a horizontal acceleration, and a yaw rate, vehicle wheel speed sensors22FL to22RR provided on the respective wheels, a braking force command value from the above-described vehicle motion control device26, and a steering wheel angle detection device21via the steering control device8to be described below are input to the brake control device15. In addition, an output of the brake control device15is connected to the brake control mechanism13including a pump (not shown) and a control valve, and a certain braking force can be generated on each wheel independently of the operation of the brake pedal by the driver. The brake control device15serves to estimate the spin, the drift out, the vehicle wheel lock, etc. of the vehicle, based on the above-described various kinds of information, and control the brake control mechanism13or the like to generate a braking force of a corresponding wheel so that they are suppressed, thereby increasing the steering stability of the driver. In addition, the first control device1communicates with the brake control device15(via the vehicle motion control device26) for a brake command value, so that a certain braking force can be generated in the vehicle. However, this embodiment is not limited to the brake control device15, and another actuator such as brake-by-wire may alternatively be used.

Next, the operation of the steering will be described. A steering torque and a steering wheel angle input by the driver through a steering wheel6are detected by a steering torque detection device7and the steering wheel angle detection device21, respectively, and the steering control device8controls a motor9based on information thereof to generate an assist torque. It should be noted that, although not shown in detail inFIG.1, the steering control device8also includes, for example, a CPU, a ROM, a RAM, and an input/output device, like the first control device1or the like. The steering control mechanism10is moved by a combined force of the steering torque of the driver and the assist torque by the motor9, and the front wheels are turned. Meanwhile, a reaction force from the road surface is transmitted to the steering control mechanism10according to a turned angle of the front wheels and then transmitted to the driver as a road surface reaction force.

The steering control device8can control the steering control mechanism10by generating a torque by means of the motor9, independently of the steering operation by the driver. Therefore, the first control device1communicates with the steering control device8(via the vehicle motion control device26) for a target steering torque command value, so that the front wheels can be controlled to a certain turn angle. However, this embodiment is not limited to the steering control device8, and another actuator such as steering-by-wire may alternatively be used.

Next, the accelerator will be described. A driver's pedal stepping amount on an accelerator pedal17is detected by a stroke sensor18and input to the throttle control device19. It should be noted that, although not shown in detail inFIG.1, the throttle control device19also includes, for example, a CPU, a ROM, a RAM, and an input/output device, like the first control device1or the like. The throttle control device19adjusts an opened degree of a throttle according to the pedal stepping amount on the accelerator pedal17to control (a torque output of) the engine (not shown). The vehicle can be accelerated in accordance with the operation of the accelerator pedal by the driver as described above. In addition, the throttle control device19can control the opened degree of the throttle, independently of the operation of the accelerator pedal by the driver. Therefore, the first control device1communicates with the throttle control device8(via the vehicle motion control device26) for a target acceleration command value, so that a certain acceleration can be generated in the vehicle.

As described above, according to situations of surrounding vehicles and the like, the vehicle control system100can appropriately control a speed of the vehicle by regulating the brake and the throttle, and simultaneously, automatically implement automatic driving in a lane of the host vehicle, automatic lane change, automatic driving into a lane-merging section, automatic driving into a lane-branched section, or the like by controlling the steering.

FIG.2illustrates an entire functional block of the vehicle control system100. The first control device1includes a first cognitive determination unit201and a backup availability determination unit203, the second control device25includes a second cognitive determination unit202, and the vehicle motion control device26includes a vehicle control unit204.

As illustrated inFIG.2, the information from the sensors2,3,4, and5and the GNSS27is input to the first cognitive determination unit201of the first control device1and the second cognitive determination unit202of the second control device25. Based on the information from the sensors2,3,4, and5and the GNSS27, the first cognitive determination unit201plans a future driving behavior (an automatic driving-related function to be executed), and the planned future driving behavior is input to the backup availability determination unit203. The future driving behavior may also be planned by the second cognitive determination unit202or another block. The backup availability determination unit203determines whether or not the driving behavior can be backed up by the second cognitive determination unit202(which will be described in detail below). Based on whether or not the backup is available, the backup availability determination unit203notifies the driver via the HMI23of an automatic driving level, that is, whether the backup is not available and automatic driving is driver-responsible or the backup is available and automatic driving is system-responsible (automatic driving level). A track (target track) corresponding to the future driving behavior planned by the first cognitive determination unit201and a track (target track) corresponding to the future driving behavior planned by the second cognitive determination unit202are input to the vehicle control unit204. The vehicle control unit204further includes a failure determination unit205to determine a failure in the first cognitive determination unit201and a failure of the second cognitive determination unit202. When a failure is detected in the first cognitive determination unit201, the vehicle control unit204controls a driving state (travelling state) of the host vehicle by controlling each of the actuators10,13and20(via each of the control devices8,15and19) to follow the track from the second cognitive determination unit202. In addition, when a failure is detected in the second cognitive determination unit202, the vehicle control unit204controls a driving state (travelling state) of the host vehicle by controlling each of the actuators10,13and20(via each of the control devices8,15and19) to follow the track from the first cognitive determination unit201. It should be noted that the failure determination unit205may be mounted on the first cognitive determination unit201and/or the second cognitive determination unit202, as well as the vehicle control unit204. In addition, for determination of failure by the failure determination unit205, a conventionally known appropriate method can be used.

A block diagram of the first cognitive determination unit201will be described with reference toFIG.3. In this embodiment, the first cognitive determination unit201includes a map information recognition unit301, a map database302, a sensor fusion unit303, a driving behavior planning unit304, and a track planning unit305. Based on absolute position information from the GNSS27, information such as landmarks from the sensor2(stereo camera), information from an internal field sensor of the vehicle, which is not illustrated, and map information from the map database302, the map information recognition unit301estimates a position of the host vehicle (self-position) on a map, and saves the estimated self-position in the map database302while outputting map information on surroundings of the host vehicle to the driving behavior planning unit304and the track planning unit305. Here, the map database302stores information such as traffic rules (speed limit, pass permission, etc.), road connection status, road type (general road, expressway, etc.). The sensor fusion unit303integrates information on objects from the respective sensors2,3,4, and5, and outputs information on white lines, road edges, and objects to the driving behavior planning unit304and the track planning unit305. The driving behavior planning unit304plans a future driving behavior to be taken by the host vehicle (an automatic driving-related function to be executed) based on the map information from the map information recognition unit301and the information on white lines, road edges, and the objects from the sensor fusion unit303, and the planned future driving behavior is output to the track planning unit305and the backup availability determination unit203(seeFIG.2). Here, the driving behavior is an automatic driving function, for example, travelling in a lane of the host vehicle, automatic travelling into a lane-merging section, automatic lane change, travelling into a lane-branched section, turning right at an intersection, turning left at an intersection, or going straight at an intersection. However, the driving behaviors are not limited to the above-described functions, and may be expressed as information such as a travelling lane. The track planning unit305generates/plans a target track (a track on which the host vehicle needs to travel) based on the driving behavior, the map information, and the information on white lines, road edges, and objects, and the target track is output to (the vehicle control unit204of) the vehicle motion control device26(seeFIG.2).

Subsequently, a block diagram of the second cognitive determination unit202will be described with reference toFIG.4. In this embodiment, the second cognitive determination unit202includes a backup track generation unit401. The backup track generation unit401generates/plans a backup track as a target track based on the information from the respective sensor2,3,4, and5, and the backup track is output to (the vehicle control unit204of) the vehicle motion control device26(seeFIG.2). In this embodiment, the backup track generation unit401of the second cognitive determination unit202generates a track for stopping along a lane in which the host vehicle is travelling as a backup track when the first control device1fails as illustrated inFIG.5. At this time, the backup track generation unit401of the second cognitive determination unit202causes hazard lights to blink to alert a following vehicle.

Next,FIG.6illustrates a flowchart of backup availability determination by the backup availability determination unit203. The backup availability determination unit203determines whether or not backup is available with the track for stopping along the lane in which the host vehicle is travelling (that is, a backup track that can be generated by the second control device25) (together with driving sections in the driving behavior, specifically, backup-available and backup-unavailable sections indicating a section in which the backup is available and a section in which the backup is not available) when the first control device1fails while the host vehicle is travelling according to the driving behavior. Specifically, in S601, it is determined whether or not a course of the host vehicle intersects with that of another vehicle during the driving behavior. When it is determined that the course of the host vehicle intersects with that of another vehicle (Yes), it is determined that backup is not available with the track (backup track) for stopping in the lane of the host vehicle because deceleration and stop are not certainly safe ways, and the process moves onto S602. In S602, the driver is notified in advance (before the first control device1fails) via the HMI23that automatic driving will be driver-responsible in the future during (the driving section of) the driving behavior. On the other hand, in S601, when it is determined that the course of the host vehicle does not intersect with that of another vehicle during the driving behavior (No), it is determined that backup is available with the track (backup track) for stopping in the lane of the host vehicle because it is safe even though the host vehicle stops in its lane, and the process moves onto S603. In S603, the driver is notified in advance (before the first control device1fails) via the HMI23that automatic driving will be system-responsible in the future during (the driving section of) the driving behavior. That is, in this embodiment, the backup availability determination unit203determines that safe backup is available except for an operation during which a course intersects with that of another vehicle, such as travelling at an intersection, travelling into a lane-merging section, or changing a lane.

FIG.7illustrates an operation example of the vehicle control system100according to the first embodiment when applied.

FIG.7shows a scene in which the host vehicle is travelling toward an acceleration section to enter into an expressway. As described with reference toFIG.3, the driving behavior planning unit304plans a future driving behavior to be taken by the host vehicle to travel based on the map information and the information on white lines, road edges, and objects. Here, it is planned that the host vehicle travels in a single lane in the acceleration section, then enters into a lane-merging section, and thereafter travels in a single lane of a main road. The planning of the driving behaviors is performed regularly or when the host vehicle reaches a predetermined position. Subsequently, as described in the flowchart illustrated inFIG.6, the backup availability determination unit203determines whether or not the driving behavior can be backed up by (the backup track of) the second control device25when a failure occurs in the first control device1. Here, the backup availability determination unit203determines that travelling in a single lane can be backed up by the track (backup track) for stopping along the lane in which the host vehicle is travelling and notifies the driver via the HMI23that automatic driving will be system-responsible (for example, automatic driving level 3), and determines that travelling into a lane-merging section cannot be backed up by the track (backup track) for stopping along the lane in which the host vehicle is travelling and notifies the driver via the HMI23that automatic driving will be driver-responsible (for example, automatic driving level 2) (in other words, the system-responsible automatic driving will be switched to the driver-responsible automatic driving in the lane-merging section).

As a method of notifying the driver through the HMI23, for example, as illustrated inFIG.8, a future driving behavior to be implemented is shown on a screen, and the driver is urged to hold onto the steering wheel a few seconds to a few tens of seconds before the driving behavior begins (a few seconds to a few tens of seconds before the host vehicle reaches the lane-merging section in which the switching to the driver-responsible automatic driving will happen). However, the notification through the HMI23is not limited to the display for urging the driver to hold onto the steering wheel, and an automatic driving level may be displayed or it may be clearly indicated who is responsible for the driving behavior. In addition to what are described above, an approval for executing a function may be obtained from the driver during the driver-responsible automatic driving.

According to the vehicle control system100in the first embodiment described above, a future driving behavior is planned, and it is determined whether or not the future driving behavior can be backed up by the track (backup track) for stopping along the lane in which the host vehicle is travelling, which is generated by the second control device25, when a failure occurs in the first control device1during the driving behavior. When it is determined that the backup is not available, the system-responsible automatic driving can be switched to the driver-responsible automatic driving. That is, a driving behavior that can be backed up by the second control device25can be executed in a system-responsible automatic driving mode, and a driving behavior that cannot be backed up by the second control device25can be executed in a driver-responsible automatic driving mode. Therefore, even if a failure occurs in the first control device1during automatic driving for travelling into a lane-merging section, changing a lane, or travelling at an intersection, the driver is not suddenly required to operate the steering wheel from a system-responsible driving state. That is, safety can be ensured at a low cost even when the first control device1fails, thereby improving the safety of an automatic driving system (or a driving support system).

Second Embodiment

The first embodiment is an embodiment of a vehicle control system100for stopping the host vehicle along a lane in which the host vehicle is travelling in the event of a failure, but the second embodiment is an embodiment of a vehicle control system100for stopping the host vehicle on a shoulder next to the lane in which the host vehicle is travelling in the event of a failure to ensure safety. In the second embodiment, the system configuration diagram and the block diagram of the vehicle control system100, the block diagram of the first cognitive determination unit201of the first control device1, and the block diagram of the second cognitive determination unit202of the second control device25are basically the same as those in the first embodiment described with reference toFIGS.1to4. Therefore, the parts having the same functions as those in the first embodiment will be denoted by the same reference numerals and the description thereof will be omitted, and the differences will be mainly described below.

FIG.9illustrates a backup track when the first control device1fails. In this embodiment, as illustrated inFIG.9, the backup track generation unit401of the second cognitive determination unit202generates a backup track for stopping the host vehicle at an edge of the road (the shoulder), based on the information on white lines, road edges, and objects from the respective sensors2,3,4, and5.

FIG.10illustrates a flowchart of backup availability determination by the backup availability determination unit203in the second embodiment. In this embodiment, the sensor information and/or the map information (seeFIG.3, etc.) are input to the backup availability determination unit203in addition to the driving behavior planned by the first cognitive determination unit201. In S1001, the backup availability determination unit203determines whether or not backup is available for stopping on the shoulder (that is, a backup track that can be generated by the second control device25) during the driving behavior (together with driving sections in the driving behavior, specifically, backup-available and backup-unavailable sections indicating a section in which the backup is available and a section in which the backup is not available). Specifically, it is determined whether or not there is a space on the shoulder for the host vehicle to stop during the driving behavior. If it is determined that there is no space for stopping on the shoulder (No), it is determined that backup is not available with the track (backup track) for stopping on the shoulder because the host vehicle cannot stop safely on the shoulder, and the process moves onto S602. On the other hand, in S1001, if it is determined that there is a space on the shoulder for the host vehicle to stop during the driving behavior (Yes), it is determined that backup is available with the track (backup track) for stopping on the shoulder because the host vehicle can stop safely on the shoulder, and the process moves onto S603. S602and S603are the same as those in the first embodiment, and thus, the description thereof will be omitted.

FIG.11illustrates an operation example of the vehicle control system100according to the second embodiment when applied. Both driving behaviors shown inFIG.11are behaviors during which the host vehicle travels in a single lane. However, during (a driving section of) a driving behavior on the left of the dotted line a in the drawing, there is a space for stopping on the shoulder, and thus, the backup availability determination unit203determines that backup is available with (a backup track of) the second control device25when a failure occurs in the first control device1(in other words, it is possible to generate a backup track). On the other hand, during (a driving section of) a driving behavior on the right of the dotted line a in the drawing, there is no space on the shoulder due to a sidewall, and thus, the backup availability determination unit203determines that backup is not available with (a backup track of) the second control device25when a failure occurs in the first control device1(in other words, it is not possible to generate a backup track). The backup availability determination unit203determines that (earlier) travelling on the left of the dotted line a in the drawing can be backed up by the track (backup track) for stopping on the shoulder and notifies the driver via the HMI23that automatic driving will be system-responsible (for example, automatic driving level 3), and determines that (later) travelling on the right of the dotted line a in the drawing cannot be backed up by the track (backup track) for stopping on the shoulder and notifies the driver via the HMI23that automatic driving will be driver-responsible (for example, automatic driving level 2) (in other words, the system-responsible automatic driving will be switched to the driver-responsible automatic driving in a section with no space on the shoulder).

According to the vehicle control system100in the second embodiment described above, a future driving behavior is planned, and it is determined whether or not the future driving behavior can be backed up by the track (backup track) for stopping on the shoulder, which is generated by the second control device25, when a failure occurs in the first control device1during the driving behavior. When it is determined that the backup is not available, the system-responsible automatic driving can be switched to the driver-responsible automatic driving. That is, a driving behavior that can be backed up by the second control device25can be executed in a system-responsible automatic driving mode, and a driving behavior that cannot be backed up by the second control device25can be executed in a driver-responsible automatic driving mode. Therefore, even if a failure occurs in the first control device1during automatic driving in a situation where there is no space on the shoulder, the driver is not suddenly required to operate the steering wheel from a system-responsible driving state. That is, safety can be ensured at a low cost even when the first control device1fails, thereby improving the safety of an automatic driving system (or a driving support system).

Third Embodiment

The third embodiment is an embodiment of a vehicle control system100for continuing a before-failure function when the first control device1fails, and particularly, a vehicle control system100for continuing a single-lane automatic driving function. In the third embodiment, the system configuration diagram and the block diagram of the vehicle control system100and the block diagram of the first cognitive determination unit201of the first control device1are basically the same as those in the first embodiment described with reference toFIGS.1to3. Therefore, the same parts as those in the first or second embodiment will be denoted by the same reference numerals and the description thereof will be omitted, and the differences will be mainly described below.

FIG.12illustrates a block diagram of the second cognitive determination unit202of the second control device25. In the third embodiment, as illustrated inFIG.12, the second cognitive determination unit202includes a sensor fusion unit403and a track planning unit405. The operations and processes of the sensor fusion unit403and the track planning unit405of the second cognitive determination unit202are basically the same as those of the sensor fusion unit303and the track planning unit305of the first cognitive determination unit201described with reference toFIG.3. Based on such a configuration, the second cognitive determination unit202in this embodiment has a function to generate/plan a track (target track) for travelling in a single lane (in other words, in a lane of the host vehicle) as a backup track, based on the information on white lines, road edges, and objects from the respective sensors2,3,4, and5.

FIG.13illustrates a backup method of the second control device25when the first control device1fails. In the third embodiment, when the first control device1fails while the host vehicle is travelling in a single lane, the function is maintained by the track (backup track) for travelling in the single lane, which is planned by (the second cognitive determination unit202of) the second control device25. That is, in the first and second embodiments, the host vehicle is stopped in its lane or on the shoulder, but in the third embodiment, the before-failure function can be continued, that is, travelling in the lane of the host vehicle can be continued by generating a track for travelling in the lane of the host vehicle, rather than stopping the host vehicle immediately in the event of a failure.

Next, backup availability determination by the backup availability determination unit203depending on whether to maintain the function by travelling in the single lane will be described with reference toFIG.14. In this embodiment, in S1401, the backup availability determination unit203determines whether or not a track for continuing a before-failure driving behavior when the first control device1fails can be generated by the second cognitive determination unit202of the second control device25(together with driving sections in the driving behavior, specifically, backup-available and backup-unavailable sections indicating a section in which the backup is available and a section in which the backup is not available). If it is determined that such a track cannot be generated, that is, backup is not available using the second control device25(No), the process moves onto S602. On the other hand, if it is determined that such a track can be generated, that is, backup is available using the second control device25(Yes), the process moves onto S603. S602and S603are the same as those in the first embodiment, and thus, the description thereof will be omitted.

FIG.15is a table summarizing automatic driving functions that can be implemented by the first cognitive determination unit201and the second cognitive determination unit202. The first cognitive determination unit201can implement, for example, automatic travelling in a single lane, automatic lane change, automatic travelling into a lane-merging section, automatic travelling into a lane-branched section, and automatic gate pass. On the other hand, as described above, the second cognitive determination unit202can implement only automatic travelling in a single lane. That is, in this embodiment, the functions (automatic driving functions) that can be implemented by the first cognitive determination unit201are different from those that can be implemented by the second cognitive determination unit202. While the automatic travelling in a single lane can be implemented by both the first cognitive determination unit201and the second cognitive determination unit202, the automatic lane change, the automatic travelling into a lane-merging section, the automatic travelling into a lane-branched section, and the automatic gate pass can be implemented only by the first cognitive determination unit201and cannot be implemented by the second cognitive determination unit202. It should be noted that the functions that can be implemented by the first cognitive determination unit201and the second cognitive determination unit202are merely examples, and are not limited thereto.

FIG.16illustrates an operation example of the vehicle control system100according to the third embodiment when applied.

FIG.16shows a scene in which the host vehicle is travelling toward an acceleration section to enter into an expressway. As described in the flowchart illustrated inFIG.14, the backup availability determination unit203determines whether or not backup is available using the second control device25when a failure occurs in the first control device1. Here, the backup availability determination unit203determines that travelling in a single lane can be continued (backed up) by the second control device25although a failure occurs while executing the function and notifies the driver via the HMI23that automatic driving will be system-responsible (for example, automatic driving level 3), and determines that travelling into a lane-merging section other than travelling in a single lane cannot be continued (backed up) by the second control device25when a failure occurs while executing the function and notifies the driver via the HMI23that automatic driving will be driver-responsible (for example, automatic driving level 2) (in other words, the system-responsible automatic driving will be switched to the driver-responsible automatic driving in the lane-merging section).

According to the vehicle control system100in the third embodiment described above, it is determined, when a failure occurs in the first control device1while executing a future driving behavior, whether or not the function (in other words, the future driving behavior) can be continued by the second control device25. When it is determined that the function cannot be continued, the system-responsible automatic driving can be switched to the driver-responsible automatic driving. In particular, in the third embodiment, for travelling in a single lane that can be continued by the second control device25, the function can be executed in a system-responsible automatic driving mode, and for the other driving behaviors that cannot be continued by the second control device25, the functions can be executed in a driver-responsible automatic driving mode. Therefore, even if a failure occurs in the first control device1during automatic driving for travelling into a lane-merging section, changing a lane, or travelling at an intersection, the driver is not suddenly required to operate the steering wheel from a system-responsible driving state. That is, safety can be ensured at a low cost even when the first control device1fails, thereby improving the safety of an automatic driving system (or a driving support system).

Fourth Embodiment

The fourth embodiment is an embodiment of a vehicle control system100for continuing a before-failure function when the first control device1fails, and particularly, a vehicle control system100for continuing a function for automatic travelling in a single lane, automatic lane change, automatic travelling into a lane-merging section, or automatic travelling into a lane-branched section. That is, more continuable functions are added to the fourth embodiment as compared with the third embodiment. In the fourth embodiment, the system configuration diagram and the block diagram of the vehicle control system100and the block diagram of the first cognitive determination unit201of the first control device1are basically the same as those in the first embodiment described with reference toFIGS.1to3. In addition, the block diagram of the second cognitive determination unit202of the second control device25is basically the same as that of the first cognitive determination unit201of the first control device1in the first embodiment described with reference toFIG.3. Therefore, the same parts as those in the first, second, or third embodiment will be denoted by the same reference numerals and the description thereof will be omitted, and the differences will be mainly described below.

As described above, the second cognitive determination unit202of the second control device25in this embodiment has the same configuration as the first cognitive determination unit201of the first control device1illustrated inFIG.3. However, in this embodiment, the first control device1and the second control device25have different hardware specifications, although not illustrated, and thus, the respective functions that can be implemented thereby are different from each other.

FIG.17shows a backup method of the second control device25when the first control device1fails. In the fourth embodiment, when a failure occurs in the first control device1while the host vehicle travels in a single lane (without/with a pedestrian), changes a lane, travels in a lane-merging section, or travels in a lane-branched section, the before-failure function is continued by (the second cognitive determination unit202of) the second control device25. That is, in the first and second embodiments, the host vehicle is stopped in its lane or on the shoulder, but in the fourth embodiment, like the third embodiment, the before-failure function can be continued, rather than stopping the host vehicle immediately in the event of a failure. That is, the travelling in the lane of the host vehicle, the lane change, the travelling into the lane-merging section, and the travelling into the lane-branched section can be continued by generating a track for travelling in the lane of the host vehicle, a track for travelling into the lane-merging section, a track for changing the lane, and a track for travelling into the lane-branched section, respectively.

It should be noted that backup availability determination by the backup availability determination unit203depending on whether to maintain the functions is the same as that in the third embodiment, and thus, the description thereof will be omitted.

FIG.18is a table summarizing automatic driving functions that can be implemented by the first cognitive determination unit201and the second cognitive determination unit202. The first cognitive determination unit201can implement, for example, automatic travelling in a single lane, brake-based automatic obstacle avoidance with respect to a pedestrian and an obstacle, automatic lane change, automatic travelling into a lane-merging section, automatic travelling into a lane-branched section, travelling at an intersection, and steering-based automatic obstacle avoidance with respect to a pedestrian and an obstacle.

On the other hand, as described above, the second cognitive determination unit202can implement travelling in a single lane, brake-based obstacle avoidance with respect to a pedestrian and an obstacle, automatic lane change, automatic travelling into a lane-merging section, and automatic travelling into a lane-branched section. That is, in this embodiment, the functions (automatic driving functions) that can be implemented by the first cognitive determination unit201are different from those that can be implemented by the second cognitive determination unit202. The automatic travelling in a single lane, the brake-based automatic obstacle avoidance with respect to a pedestrian and an obstacle, the automatic lane change, the automatic travelling into a lane-merging section, and the automatic travelling into a lane-branched section can be implemented by both the first cognitive determination unit201and the second cognitive determination unit202, but the travelling at an intersection and the steering-based automatic obstacle avoidance with respect to a pedestrian and an obstacle can be implemented only by the first cognitive determination unit201and cannot be implemented by the second cognitive determination unit202. It should be noted that the functions that can be implemented by the first cognitive determination unit201and the second cognitive determination unit202are merely examples, and are not limited thereto.

FIG.19illustrates an operation example of the vehicle control system100according to the fourth embodiment when applied.

FIG.19shows a scene in which the host vehicle is travelling toward a right turn at an intersection. As described in the flowchart illustrated inFIG.14, the backup availability determination unit203determines whether or not backup is available using the second control device25when a failure occurs in the first control device1. Here, the backup availability determination unit203determines that travelling in a single lane and changing a lane can be continued (backed up) by the second control device25although a failure occurs while executing the functions and notifies the driver via the HMI23that automatic driving will be system-responsible (for example, automatic driving level 3), and determines that turning right at an intersection cannot be continued (backed up) by the second control device25when a failure occurs while executing the function and notifies the driver via the HMI23that automatic driving will be driver-responsible (for example, automatic driving level 2) (in other words, the system-responsible automatic driving will be switched to the driver-responsible automatic driving in the lane-merging section).

In the scene shown inFIG.19, the driver-responsible automatic driving (for example, automatic driving level 2) may be notified to the driver while travelling in the single lane or while changing the lane.

According to the vehicle control system100in the fourth embodiment described above, it is determined, when a failure occurs in the first control device1while executing a future driving behavior, whether or not the function (in other words, the future driving behavior) can be continued by the second control device25. When it is determined that the function cannot be continued, the system-responsible automatic driving can be switched to the driver-responsible automatic driving. In particular, in the fourth embodiment, for automatic travelling in a single lane, brake-based automatic obstacle avoidance with respect to a pedestrian and an obstacle, automatic lane change, automatic travelling into a lane-merging section, automatic travelling into a lane-branched section that can be continued by the second control device25, the functions can be executed in a system-responsible automatic driving mode, and for the other driving behaviors that cannot be continued by the second control device25, the functions can be executed in a driver-responsible automatic driving mode. Therefore, even if a failure occurs in the first control device1during automatic driving for travelling at an intersection and steering-based automatic obstacle avoidance with respect to a pedestrian and an obstacle, the driver is not suddenly required to operate the steering wheel from a system-responsible driving state. That is, safety can be ensured at a low cost even when the first control device1fails, thereby improving the safety of an automatic driving system (or a driving support system).

In this embodiment, the above-described functions are examples, but the functions do not need to be limited thereto. This embodiment is valid as long as the second cognitive determination unit202can implement fewer functions than the first cognitive determination unit201.

Although each of the embodiments has been described above, the specific configuration is not limited to each of the above-described embodiments. The present invention covers any modifications and the like in a range without departing from the gist of the invention.

Also, the respective embodiments may be appropriately combined together. Further, with respect to a part of the configuration of each embodiment, it is possible to perform addition of another configuration, deletion, or replacement with another configuration.

Further, each of the above-described configurations, functions, processing units, processing means, and the like may be implemented by hardware, for example, by designing an integrated circuit for a part or all thereof. Further, each of the above-described configurations, functions, and the like may be implemented by software by interpreting and executing a program for implementing each of the functions through a processor. Information such as programs, tables, and files for implementing the respective functions can be stored in a storage device such as a memory, a hard disk, or a solid state drive (SSD), or a recording medium such as an IC card, an SD card, or a DVD.

In addition, control lines and information lines which are considered to be necessary for the explanation are illustrated, however, all the controlling lines and the information lines are not essentially necessary in products. Practically, it may be assumed that almost all components are connected to each other.

REFERENCE SIGNS LIST