Patent Description:
<CIT> discloses a vehicle incorporating an autonomous driving system. The vehicle incorporates a motive power system, a power supply system, and the autonomous driving system. The motive power system manages motive power of the vehicle in a centralized manner. The power supply system manages charging and discharging power of a battery mounted on the vehicle or supply of electric power to various vehicle-mounted devices in a centralized manner. The autonomous driving system carries out autonomous driving control of the vehicle in a centralized manner. An engine ECU of the motive power system, a power supply ECU of the power supply system, and an autonomous driving ECU of the autonomous driving system are communicatively connected to one another over a vehicle-mounted network.

An autonomous driving system developed by an autonomous driving system developer may externally be attached to a vehicle main body. In this case, autonomous driving is carried out under vehicle control by a vehicle platform (which will be described later) in accordance with an instruction from the externally attached autonomous driving system.

In such a vehicle, how to configure a power supply of the externally attached autonomous driving system is important. Depending on a power supply structure, under the influence by a failure that occurs in a power supply system of the autonomous driving system, reliability of the power supply system of the vehicle main body may be lowered. <CIT> does not particularly discuss such an aspect. <CIT> discloses a vehicle control unit (e.g., a control unit for an automobile) receives feedback from an intelligent voltage/ current sensor and a DC/DC controller. The DC/DC controller comprises a first switch for controlling power from a primary power source (e.g., low voltage power supplied from a high voltage battery). The intelligent voltage/current sensor senses power output from the primary power source. The vehicle control unit processes feedback from the intelligent voltage/current sensor and/or the DC/DC controller to determine if a failure has occurred in the primary power source. In response to determining the failure in the primary power source, the vehicle control unit disables the power from the primary power source using a second switch (e.g., a switch in a relay).

The present disclosure was made to solve the above-described problem, and an object of the present disclosure is to ensure reliability of a power supply of a vehicle platform in a vehicle that carries out autonomous driving.

A vehicle according to the present disclosure includes an autonomous driving system (an ADS or an ADK) that creates a driving plan, a vehicle platform (VP) that carries out vehicle control in accordance with an instruction from the autonomous driving system, and a vehicle control interface box (VCIB) that interfaces between the vehicle platform and the autonomous driving system. The autonomous driving system includes a power supply structure independently of a power supply structure for the vehicle platform.

In the vehicle, the power supply of the autonomous driving system is independent of the power supply of the vehicle platform. Therefore, when a failure occurs in the power supply of the autonomous driving system, the power supply of the vehicle platform is not affected by the failure of the power supply of the autonomous driving system. Therefore, according to this vehicle, reliability of the power supply of the vehicle platform can be ensured.

The vehicle platform includes a high-voltage battery, a first primary power supply system that receives supply of electric power from the high-voltage battery and a first secondary power supply system as a redundant power supply for the vehicle platform. The autonomous driving system includes a second primary power supply system that receives supply of electric power from the high-voltage battery and a second secondary power supply system as a redundant power supply for the autonomous driving system.

In the vehicle, a secondary power supply system as the redundant power supply is provided in each of the power supply of the vehicle platform and the power supply of the autonomous driving system, and the redundant power supply is provided in each of the autonomous driving system and the vehicle platform independently of each other. Thus, for example, when the power feed function of the second primary power supply system fails and power feed by the second secondary power supply system (redundant power supply) is carried out in the autonomous driving system, the first secondary power supply system (redundant power supply) of the vehicle platform is not affected thereby. Therefore, according to this vehicle, reliability also of the redundant power supply can be ensured.

When a power feed function of the first primary power supply system fails, the first secondary power supply system may keep for a certain time period, feeding power to a limited system of systems that configure the vehicle platform.

According to the vehicle, a system to which power feed from the first secondary power supply system is continued in case of a failure of the power feed function of the first primary power supply system is limited. Therefore, power feed from the first secondary power supply system for a certain time period can be continued.

The limited system may include a brake system, a steering system, and a vehicle immobilization system.

According to the vehicle, the limited system above is set as the system to which power feed from the first secondary power supply system is continued in case of a failure of the power feed function of the first primary power supply system, so that at least a steering function and a standstill function of the vehicle can be ensured.

When a power feed function of the first primary power supply system fails, the first secondary power supply system may keep feeding power to the vehicle control interface box.

Thus, even though the power feed function of the first primary power supply system fails, the vehicle control interface box can continue interfacing between the vehicle platform and the autonomous driving system.

The first primary power supply system may include a DC/DC converter that subjects electric power from the high-voltage battery to voltage conversion and an auxiliary battery connected to an output of the DC/DC converter. The first secondary power supply system may include a switching DC/DC converter connected to the output of the DC/DC converter and a secondary battery connected to an output of the switching DC/DC converter. When a power feed function of the first primary power supply system fails, the switching DC/DC converter may electrically disconnect the secondary battery from the first primary power supply system.

In the vehicle, on the vehicle platform, when the power feed function of the first primary power supply system fails, the switching DC/DC converter electrically disconnects the secondary battery from the first primary power supply system. Thus, when the power feed function of the first primary power supply system fails, the secondary battery can be disconnected from the first primary power supply system in a shorter period of time than by means of a mechanical relay apparatus. Therefore, according to this vehicle, influence onto the second secondary power supply system in case of a failure of the power feed function of the first primary power supply system can be suppressed.

An embodiment of the present disclosure will be described below in detail with reference to the drawings. The same or corresponding elements in the drawings have the same reference characters allotted and description thereof will not be repeated.

<FIG> is a diagram showing overview of a mobility as a service (MaaS) system in which a vehicle according to an embodiment of the present disclosure is used.

Referring to <FIG>, this MaaS system includes a vehicle <NUM>, a data server <NUM>, a mobility service platform (which is denoted as "MSPF" below) <NUM>, and an autonomous driving related mobility services <NUM>.

Vehicle <NUM> includes a vehicle main body <NUM> and an autonomous driving kit (which is denoted as "ADK" below) <NUM>. Vehicle main body <NUM> includes a vehicle control interface <NUM>, a vehicle platform (which is denoted as "VP" below) <NUM>, and a data communication module (DCM) <NUM>.

Vehicle <NUM> can carry out autonomous driving in accordance with commands from ADK <NUM> attached to vehicle main body <NUM>. Though <FIG> shows vehicle main body <NUM> and ADK <NUM> at positions distant from each other, ADK <NUM> is actually attached to a rooftop or the like of vehicle main body <NUM>. ADK <NUM> can also be removed from vehicle main body <NUM>. While ADK <NUM> is not attached, vehicle main body <NUM> can travel by driving by a user. In this case, VP <NUM> carries out travel control (travel control in accordance with an operation by a user) in a manual mode.

Vehicle control interface <NUM> can communicate with ADK <NUM> over a controller area network (CAN). Vehicle control interface <NUM> receives various commands from ADK <NUM> or outputs a state of vehicle main body <NUM> to ADK <NUM> by executing a prescribed application programming interface (API) defined for each communicated signal.

When vehicle control interface <NUM> receives a command from ADK <NUM>, it outputs a control command corresponding to the received command to VP <NUM>. Vehicle control interface <NUM> obtains various types of information on vehicle main body <NUM> from VP <NUM> and outputs the state of vehicle main body <NUM> to ADK <NUM>. A configuration of vehicle control interface <NUM> will be described in detail later.

VP <NUM> includes various systems and various sensors for controlling vehicle main body <NUM>. VP <NUM> carries out various types of vehicle control in accordance with a command given from ADK <NUM> through vehicle control interface <NUM>. Namely, as VP <NUM> carries out various types of vehicle control in accordance with a command from ADK <NUM>, autonomous driving of vehicle <NUM> is carried out. A configuration of VP <NUM> will also be described in detail later.

ADK <NUM> includes an autonomous driving system (which is denoted as "ADS" below) for autonomous driving of vehicle <NUM>. ADK <NUM> creates a driving plan of vehicle <NUM> and outputs various commands for traveling vehicle <NUM> in accordance with the created driving plan to vehicle control interface <NUM> in accordance with the API defined for each command. ADK <NUM> receives various signals indicating states of vehicle main body <NUM> from vehicle control interface <NUM> in accordance with the API defined for each signal and has the received vehicle state reflected on creation of the driving plan. A configuration of ADK <NUM> (ADS) will also be described later.

DCM <NUM> includes a communication interface (I/F) for vehicle main body <NUM> to wirelessly communicate with data server <NUM>. DCM <NUM> outputs various types of vehicle information such as a speed, a position, or an autonomous driving state to data server <NUM>. DCM <NUM> receives from autonomous driving related mobility services <NUM> through MSPF <NUM> and data server <NUM>, various types of data for management of travel of an autonomous driving vehicle including vehicle <NUM> by mobility services <NUM>.

MSPF <NUM> is an integrated platform to which various mobility services are connected. In addition to autonomous driving related mobility services <NUM>, not-shown various mobility services (for example, various mobility services provided by a ride-share company, a car-sharing company, an insurance company, a rent-a-car company, and a taxi company) are connected to MSPF <NUM>. Various mobility services including mobility services <NUM> can use various functions provided by MSPF <NUM> by using APIs published on MSPF <NUM>, depending on service contents.

Autonomous driving related mobility services <NUM> provide mobility services using an autonomous driving vehicle including vehicle <NUM>. Mobility services <NUM> can obtain, for example, operation control data of vehicle <NUM> that communicates with data server <NUM> or information stored in data server <NUM> from MSPF <NUM>, by using the APIs published on MSPF <NUM>. Mobility services <NUM> transmit, for example, data for managing an autonomous driving vehicle including vehicle <NUM> to MSPF <NUM>, by using the API.

MSPF <NUM> publishes APIs for using various types of data on vehicle states and vehicle control necessary for development of the ADS, and an ADS provider can use as the APIs, the data on the vehicle states and vehicle control necessary for development of the ADS stored in data server <NUM>.

<FIG> is a diagram showing a detailed configuration of vehicle <NUM> shown in <FIG>. Referring to <FIG>, ADK <NUM> includes a compute assembly <NUM>, a human machine interface (HMI) system <NUM>, sensors for perception <NUM>, sensors for pose <NUM>, and a sensor cleaning <NUM>.

During autonomous driving of vehicle <NUM>, compute assembly <NUM> obtains an environment around the vehicle and a pose, a behavior, and a position of vehicle <NUM> from various sensors which will be described later. Compute assembly <NUM> obtains a state of vehicle <NUM> from VP <NUM> through vehicle control interface <NUM> and sets a next operation (acceleration, deceleration, or turning) of vehicle <NUM>. Then, compute assembly <NUM> outputs various commands for realizing a set operation of vehicle <NUM> to vehicle control interface <NUM>.

HMI system <NUM> presents information to a user and accepts an operation during autonomous driving, during driving requiring an operation by a user, or at the time of transition between autonomous driving and driving requiring an operation by the user. HMI system <NUM> includes, for example, a touch panel display, a display apparatus, and an operation apparatus.

Sensors for perception <NUM> include sensors that perceive an environment around the vehicle, and include, for example, at least any of laser imaging detection and ranging (LIDAR), a millimeter-wave radar, and a camera.

The LIDAR refers to a distance measurement apparatus that measures a distance based on a time period from emission of pulsed laser beams (for example, infrared rays) until return of the laser beams reflected by an object. The millimeter-wave radar is a distance measurement apparatus that measures a distance or a direction to an object by emitting radio waves short in wavelength to the object and detecting radio waves that return from the object. The camera is arranged, for example, on a rear side of a room mirror in a compartment and used for shooting the front of vehicle <NUM>. As a result of image processing by artificial intelligence (AI) or an image processing processor onto images or video images shot by the camera, another vehicle, an obstacle, or a human in front of vehicle <NUM> can be recognized. Information obtained by sensors for perception <NUM> is output to compute assembly <NUM>.

Sensors for pose <NUM> include sensors that detect a pose, a behavior, or a position of vehicle <NUM>, and include, for example, an inertial measurement unit (IMU) or a global positioning system (GPS).

The IMU detects, for example, an acceleration in a front-rear direction, a lateral direction, and a vertical direction of vehicle <NUM> and an angular speed in a roll direction, a pitch direction, and a yaw direction of vehicle <NUM>. The GPS detects a position of vehicle <NUM> based on information received from a plurality of GPS satellites that orbit the Earth. Information obtained by sensors for pose <NUM> is output to compute assembly <NUM>.

Sensor cleaning <NUM> removes soiling attached to various sensors. Sensor cleaning <NUM> removes soiling attached to a lens of the camera or a portion from which laser beams or radio waves are emitted, for example, with a cleaning solution or a wiper.

Vehicle control interface <NUM> includes vehicle control interface boxes (each of which is denoted as a "VCIB" below) 111A and 111B. Each of VCIBs 111A and 111B includes an ECU, and specifically contains a central processing unit (CPU) and a memory (a read only memory (ROM) and a random access memory (RAM)) (neither of which is shown). Though VCIB 111B is equivalent in function to VCIB 111A, it is partially different in a plurality of systems connected thereto that make up VP <NUM>.

Each of VCIBs 111A and 111B is communicatively connected to compute assembly <NUM> of ADK <NUM> over the CAN or the like. VCIB 111A and VCIB 111B are communicatively connected to each other.

VCIBs 111A and 111B relay various commands from ADK <NUM> and output them as control commands to VP <NUM>. Specifically, VCIBs 111A and 111B convert various commands obtained from ADK <NUM> in accordance with the API into control commands to be used for control of each system of VP <NUM> by using information such as a program stored in a memory and output the control commands to a destination system. VCIBs 111A and 111B relay vehicle information output from VP <NUM> and output the vehicle information as a vehicle state to ADK <NUM> in accordance with prescribed APIs.

As VCIBs 111A and 111B equivalent in function relating to an operation of at least one of (for example, braking or steering) systems are provided, control systems between ADK <NUM> and VP <NUM> are redundant. Thus, when some kind of failure occurs in a part of the system, the function (turning or stopping) of VP <NUM> can be maintained by switching between the control systems as appropriate or disconnecting a control system where failure has occurred.

VP <NUM> includes brake systems 121A and 121B, steering systems 122A and 122B, an electric parking brake (EPB) system 123A, a P-Lock system 123B, a propulsion system <NUM>, a pre-crash safety (PCS) system <NUM>, and a body system <NUM>.

VCIB 111A is communicatively connected to brake system 121B, steering system 122A, EPB system 123A, P-Lock system 123B, propulsion system <NUM>, and body system <NUM> of the plurality of systems included in VP <NUM>, through a communication bus.

VCIB 111B is communicatively connected to brake system 121A, steering system 122B, and P-Lock system 123B of the plurality of systems included in VP <NUM>, through a communication bus.

Brake systems 121A and 121B can control a plurality of braking apparatuses provided in wheels of vehicle <NUM>. Brake system 121B may be equivalent in function to brake system 121A, or one of brake systems 121A and 121B may be able to independently control braking force of each wheel during travel of the vehicle and the other thereof may be able to control braking force such that equal braking force is generated in the wheels during travel of the vehicle. The braking apparatus includes, for example, a disc brake system that is operated with a hydraulic pressure regulated by an actuator.

A wheel speed sensor <NUM> is connected to brake system 121B. Wheel speed sensor <NUM> is provided, for example, in each wheel of vehicle <NUM> and detects a rotation speed of each wheel. Wheel speed sensor <NUM> outputs the detected rotation speed of each wheel to brake system 121B. Brake system 121B outputs the rotation speed of each wheel to VCIB 111A as one of pieces of information included in vehicle information.

Brake systems 121A and 121B each generate a braking instruction to a braking apparatus in accordance with a prescribed control command received from ADK <NUM> through vehicle control interface <NUM>. For example, brake systems 121A and 121B control the braking apparatus based on a braking instruction generated in one of brake systems 121A and 121B, and when a failure occurs in one of the brake systems, the braking apparatus is controlled based on a braking instruction generated in the other brake system.

Steering systems 122A and 122B can control a steering angle of a steering wheel of vehicle <NUM> with a steering apparatus. Steering system 122B is similar in function to steering system 122A. The steering apparatus includes, for example, rack-and-pinion electric power steering (EPS) that allows adjustment of a steering angle by an actuator.

A pinion angle sensor 128A is connected to steering system 122A. A pinion angle sensor 128B provided separately from pinion angle sensor 128A is connected to steering system 122B. Each of pinion angle sensors 128A and 128B detects an angle of rotation (a pinion angle) of a pinion gear coupled to a rotation shaft of the actuator. Pinion angle sensors 128A and 128B output detected pinion angles to steering systems 122A and 122B, respectively.

Steering systems 122A and 122B each generate a steering instruction to the steering apparatus in accordance with a prescribed control command received from ADK <NUM> through vehicle control interface <NUM>. For example, steering systems 122A and 122B control the steering apparatus based on the steering instruction generated in one of steering systems 122A and 122B, and when a failure occurs in one of the steering systems, the steering apparatus is controlled based on a steering instruction generated in the other steering system.

EPB system 123A can control the EPB provided in at least any of wheels of vehicle <NUM>. The EPB is provided separately from the braking apparatus, and fixes a wheel by an operation of an actuator. The EPB, for example, activates a drum brake for a parking brake provided in at least one of wheels of vehicle <NUM> to fix the wheel, or activates a braking apparatus to fix a wheel with an actuator capable of regulating a hydraulic pressure to be supplied to the braking apparatus separately from brake systems 121A and 121B.

EPB system 123A controls the EPB in accordance with a prescribed control command received from ADK <NUM> through vehicle control interface <NUM>.

P-Lock system 123B can control a P-Lock apparatus provided in a transmission of vehicle <NUM>. The P-Lock apparatus fixes rotation of an output shaft of the transmission by fitting a protrusion provided at a tip end of a parking lock pawl, a position of which is adjusted by an actuator, into a tooth of a gear (locking gear) provided as being coupled to a rotational element in the transmission.

P-Lock system 123B controls the P-Lock apparatus in accordance with a prescribed control command received from ADK <NUM> through vehicle control interface <NUM>.

Propulsion system <NUM> can switch a shift range with the use of a shift apparatus and can control driving force of vehicle <NUM> in a direction of travel that is generated from a drive source. The shift apparatus can select any of a plurality of shift ranges. The drive source includes, for example, a motor generator and an engine.

Propulsion system <NUM> controls the shift apparatus and the drive source in accordance with a prescribed control command received from ADK <NUM> through vehicle control interface <NUM>.

PCS system <NUM> controls vehicle <NUM> to avoid collision or to mitigate damage by using a camera/radar <NUM>. PCS system <NUM> is communicatively connected to brake system 121B.

PCS system <NUM> detects an obstacle (an obstacle or a human) in front by using, for example, camera/radar <NUM>, and when it determines that there is possibility of collision based on a distance to the obstacle, it outputs a braking instruction to brake system 121B so as to increase braking force.

Body system <NUM> can control, for example, components such as a direction indicator, a horn, or a wiper, depending on a state or an environment of travel of vehicle <NUM>. Body system <NUM> controls each component in accordance with a prescribed control command received from ADK <NUM> through vehicle control interface <NUM>.

An operation apparatus that can manually be operated by a user for the braking apparatus, the steering apparatus, the EPB, P-Lock, the shift apparatus, and the drive source described above may separately be provided.

<FIG> is a diagram illustrating a configuration of a power supply of vehicle <NUM>. Though <FIG> is based on <FIG>, it does not show wheel speed sensor <NUM>, pinion angle sensors 128A and 128B, and camera/radar <NUM> of VP <NUM> shown in <FIG>.

Referring to <FIG>, VP <NUM> further includes a high-voltage battery <NUM>, a DC/DC converter <NUM>, an auxiliary battery <NUM>, a switching DC/DC converter <NUM>, a secondary battery <NUM>, and an ECU <NUM>, in addition to each system and each sensor described with reference to <FIG>.

High-voltage battery <NUM> includes a plurality of (for example, several hundred) cells. Each cell is, for example, a secondary battery such as a lithium ion battery or a nickel metal hydride battery. High-voltage battery <NUM> outputs electric power for generating driving force of vehicle <NUM> to a vehicle drive system (not shown). A voltage of high-voltage battery <NUM> is, for example, several hundred volts. Instead of high-voltage battery <NUM>, a power storage element such as an electric double layer capacitor may be employed.

DC/DC converter <NUM> is electrically connected between high-voltage battery <NUM> and a power line PL1. DC/DC converter <NUM> down-converts electric power supplied from high-voltage battery <NUM> to an auxiliary machinery voltage (for example, more than ten volts or several ten volts) lower than the voltage of high-voltage battery <NUM> and outputs down-converted electric power to power line PL1, in accordance with an instruction from ECU <NUM>. DC/DC converter <NUM> is implemented, for example, by an isolated DC/DC converter including a transformer.

Auxiliary battery <NUM> is electrically connected to power line PL1. Auxiliary battery <NUM> is a chargeable and dischargeable secondary battery, and implemented, for example, by a lead acid battery. Auxiliary battery <NUM> can store electric power output from DC/DC converter <NUM> to power line PL1. Auxiliary battery <NUM> can feed stored electric power to each system electrically connected to power line PL1.

Switching DC/DC converter <NUM> is electrically connected between power line PL1 and a power line PL2. Switching DC/DC converter <NUM> supplies electric power from power line PL1 to power line PL2 in accordance with an instruction from ECU <NUM>. When switching DC/DC converter <NUM> receives a shutdown instruction from ECU <NUM>, it electrically disconnects power line PL2 (secondary battery <NUM>) from power line PL1 by shutting down. Switching DC/DC converter <NUM> is implemented, for example, by a chopper DC/DC converter that can switch between conduction and disconnection by a semiconductor switching element.

Secondary battery <NUM> is electrically connected to power line PL2. Secondary battery <NUM> is a chargeable and dischargeable secondary battery, and implemented, for example, by a lithium ion secondary battery. Secondary battery <NUM> can store electric power output from switching DC/DC converter <NUM> to power line PL2. Secondary battery <NUM> can supply stored electric power to each system electrically connected to power line PL2.

DC/DC converter <NUM> and auxiliary battery <NUM> implement a primary power supply system of VP <NUM>. Brake system 121A, steering system 122A, EPB system 123A, propulsion system <NUM>, PCS system <NUM>, body system <NUM>, and VCIB 111A are electrically connected to power line PL1 which is a power supply line of the primary power supply system, and these systems receive supply of electric power from the primary power supply system.

Switching DC/DC converter <NUM> and secondary battery <NUM> implement a secondary power supply system of VP <NUM>. Brake system 121B, steering system 122B, P-Lock system 123B, and VCIB 111B are electrically connected to power line PL2 which is a power supply line of the secondary power supply system, and these systems receive supply of electric power from the secondary power supply system.

The secondary power supply system constituted of switching DC/DC converter <NUM> and secondary battery <NUM> functions as a redundant power supply for the primary power supply system constituted of DC/DC converter <NUM> and auxiliary battery <NUM>. When a power feed function of the primary power supply system fails and power cannot be fed to each system connected to power line PL1, the secondary power supply system continues power feed to each system connected to power line PL2 at least for a certain period of time such that the function of VP <NUM> is not immediately completely lost.

More specifically, for example, when failure of the power feed function of the primary power supply system is detected due to abnormal lowering in voltage of power line PL1, switching DC/DC converter <NUM> shuts down to electrically disconnect secondary battery <NUM> from the primary power supply system, and power feed from secondary battery <NUM> to each system connected to power line PL2 is continued. A capacity of secondary battery <NUM> is designed such that power can be fed from secondary battery <NUM> at least for a certain period of time after shutdown of switching DC/DC converter <NUM>.

If it is assumed that power feed from the secondary power supply system (secondary battery <NUM>) to all systems is continued in case of failure of the power feed function of the primary power supply system, secondary battery <NUM> of a large capacity should be prepared or a time period for which power feed from secondary battery <NUM> is continued should be made shorter. In the embodiment, a system that receives supply of electric power from the secondary power supply system (secondary battery <NUM>) is limited to brake system 121B, steering system 122B, P-Lock system 123B, and VCIB 111B. Therefore, the capacity of secondary battery <NUM> can be suppressed and power feed to the limited systems can be continued at least for a certain period of time.

ECU <NUM> includes a CPU, a memory (a ROM and a RAM), and an input and output buffer (none of which is shown). The CPU executes a program stored in the ROM by developing the program on the RAM. Processing performed by the ECU is described in the program stored in the ROM.

ECU <NUM> generates an instruction for driving DC/DC converter <NUM> and provides the instruction to DC/DC converter <NUM> while VP <NUM> is on (during Ready-ON). ECU <NUM> may generate an instruction for driving DC/DC converter <NUM> when a voltage of power line PL1 (auxiliary battery <NUM>) has lowered, without constantly generating the instruction.

ECU <NUM> generates an instruction for driving switching DC/DC converter <NUM> and provides the instruction to switching DC/DC converter <NUM> while VP <NUM> is on. For switching DC/DC converter <NUM> as well, ECU <NUM> may generate an instruction for driving switching DC/DC converter <NUM> when a voltage of power line PL2 (secondary battery <NUM>) has lowered, without constantly generating the instruction.

ECU <NUM> detects a failure of the power feed function of the primary power supply system constituted of DC/DC converter <NUM> and auxiliary battery <NUM>, for example, based on a voltage of auxiliary battery <NUM> or power line PL1. When ECU <NUM> detects a failure of the power feed function of the primary power supply system, ECU <NUM> provides a shutdown instruction to switching DC/DC converter <NUM>. Switching DC/DC converter <NUM> thus shuts down to electrically disconnect secondary battery <NUM> from the primary power supply system.

In vehicle <NUM> according to the present embodiment, the power supply structure for ADK <NUM> (ADS) is designed independently of the power supply structure for VP <NUM>. Specifically, ADK <NUM> further includes a DC/DC converter <NUM>, an auxiliary battery <NUM>, a switching DC/DC converter <NUM>, and a secondary battery <NUM> in addition to the systems and the sensors described with reference to <FIG>.

DC/DC converter <NUM> is electrically connected between high-voltage battery <NUM> of VP <NUM> and a power line PL3. DC/DC converter <NUM> and high-voltage battery <NUM> are electrically connected to each other through a not-shown power terminal. DC/DC converter <NUM> down-converts electric power supplied from high-voltage battery <NUM> to an auxiliary machinery voltage lower than the voltage of high-voltage battery <NUM> and provides the down-converted auxiliary machinery voltage to power line PL3 in accordance with an instruction from compute assembly <NUM>. DC/DC converter <NUM> is implemented, for example, by an isolated DC/DC converter including a transformer.

Auxiliary battery <NUM> is electrically connected to power line PL3. Auxiliary battery <NUM> is a chargeable and dischargeable secondary battery, and implemented, for example, by a lead acid battery. Auxiliary battery <NUM> can store electric power output from DC/DC converter <NUM> to power line PL3. Auxiliary battery <NUM> can feed stored electric power to each system electrically connected to power line PL3.

Switching DC/DC converter <NUM> is electrically connected between power line PL3 and a power line PL4. Switching DC/DC converter <NUM> supplies electric power from power line PL3 to power line PL4 in accordance with an instruction from compute assembly <NUM>. When switching DC/DC converter <NUM> receives a shutdown instruction from compute assembly <NUM>, it shuts down to electrically disconnect power line PL4 (secondary battery <NUM>) from power line PL3. Switching DC/DC converter <NUM> is implemented, for example, by a chopper DC/DC converter that can switch between conduction and disconnection by a semiconductor switching element.

Secondary battery <NUM> is electrically connected to power line PL4. Secondary battery <NUM> is a chargeable and dischargeable secondary battery and implemented, for example, by a lithium ion secondary battery. Secondary battery <NUM> can store electric power output from switching DC/DC converter <NUM> to power line PL4. Secondary battery <NUM> can supply stored electric power to each system electrically connected to power line PL4.

DC/DC converter <NUM> and auxiliary battery <NUM> implement the primary power supply system of ADK <NUM> (ADS). Compute assembly <NUM>, sensors for perception <NUM>, sensors for pose <NUM>, HMI system <NUM>, and sensor cleaning <NUM> are electrically connected to power line PL3 which is a power supply line of the primary power supply system, and each system receives supply of electric power from the primary power supply system.

Switching DC/DC converter <NUM> and secondary battery <NUM> implement the secondary power supply system of ADK <NUM> (ADS). Compute assembly <NUM>, sensors for perception <NUM>, and sensors for pose <NUM> are electrically connected to power line PL4 which is a power supply line of the secondary power supply system, and each system can receive power feed also from the secondary power supply system.

The secondary power supply system constituted of switching DC/DC converter <NUM> and secondary battery <NUM> functions as a redundant power supply for the primary power supply system constituted of DC/DC converter <NUM> and auxiliary battery <NUM>. When a power feed function of the primary power supply system fails and power cannot be fed to each system connected to power line PL3, the secondary power supply system keeps feeding power to each system connected to power line PL4 such that the function of ADK <NUM> is not immediately completely lost.

More specifically, when a failure of the power feed function of the primary power supply system is detected, for example, due to abnormal lowering in voltage of power line PL3, switching DC/DC converter <NUM> shuts down to electrically disconnect secondary battery <NUM> from the primary power supply system and power feed from secondary battery <NUM> to each system connected to power line PL4 is kept.

Thus, in vehicle <NUM> according to the present embodiment, the power supply of ADK <NUM> (ADS) is independent of the power supply of VP <NUM>. Therefore, when a failure occurs in the power supply of ADK <NUM>, the power supply of VP <NUM> is not affected by the failure of the power supply of ADK <NUM>. Therefore, high reliability of the power supply of VP <NUM> is ensured.

In vehicle <NUM> according to the present embodiment, the redundant power supply (the secondary power supply system) is also provided in each of ADK <NUM> and VP <NUM> independently of each other. Thus, when the power feed function of the primary power supply system fails and power feed by the secondary power supply system (redundant power supply) is carried out in ADK <NUM>, the secondary power supply system (redundant power supply) of VP <NUM> is not affected thereby. Therefore, high reliability also of the redundant power supply can be ensured.

<FIG> is a flowchart illustrating an operation by switching DC/DC converter <NUM> of VP <NUM>. This flowchart is repeatedly performed with prescribed cycles. A series of processing shown in this flowchart is performed at least in an autonomous driving mode in which autonomous driving of vehicle <NUM> is carried out by ADK <NUM>.

Referring to <FIG>, ECU <NUM> determines whether or not the power feed function of the primary power supply system constituted of DC/DC converter <NUM> and auxiliary battery <NUM> has failed (step S10). For example, when the voltage of power line PL1 has abnormally lowered, the power feed function of the primary power supply system is determined as having failed.

When the power feed function of the primary power supply system is determined as being normal (NO in step S <NUM>), ECU <NUM> determines whether or not the voltage of the secondary power supply system constituted of switching DC/DC converter <NUM> and secondary battery <NUM> has lowered (step S20). For example, when the voltage of power line PL2 has lowered to a lower limit of a normal range, the voltage of the secondary power supply system is determined as having lowered.

When the voltage of the secondary power supply system is determined as having lowered (YES in step S20), ECU <NUM> generates an instruction for driving switching DC/DC converter <NUM> and provides the instruction to switching DC/DC converter <NUM> (step S30). Switching DC/DC converter <NUM> is thus activated and electric power is supplied from the primary power supply system to the secondary power supply system (from power line PL1 to power line PL2).

Though switching DC/DC converter <NUM> is driven when the voltage of the secondary power supply system has lowered in this example, DC/DC converter <NUM> may constantly be driven by adjusting an output from switching DC/DC converter <NUM> in accordance with the voltage of the secondary power supply system.

When the power feed function of the primary power supply system is determined in step S10 as having failed (YES in step S <NUM>), ECU <NUM> generates an instruction to shut down switching DC/DC converter <NUM> and provides the instruction to switching DC/DC converter <NUM> (step S40).

Thus, secondary battery <NUM> is disconnected from the primary power supply system, and power feed from secondary battery <NUM> to brake system 121B, steering system 122B, P-Lock system 123B, and VCIB 111B connected to the secondary power supply system (power line PL2) is kept (step S50).

As set forth above, in this embodiment, the power supply of ADK <NUM> (ADS) is independent of the power supply of VP <NUM>. Therefore, when a failure occurs in the power supply of ADK <NUM>, the power supply of VP <NUM> is not affected by the failure of the power supply of ADK <NUM>. Therefore, according to this embodiment, reliability of the power supply of VP <NUM> can be ensured.

In this embodiment, the secondary power supply system as the redundant power supply is provided in each of the power supply of VP <NUM> and the power supply of ADK <NUM>, and the redundant power supply is provided in each of ADK <NUM> and VP <NUM> independently of each other. Thus, for example, when the power feed function of the primary power supply system fails and power feed by the secondary power supply system (redundant power supply) is carried out in ADK <NUM>, the secondary power supply system (redundant power supply) of VP <NUM> is not affected thereby. Therefore, according to this embodiment, reliability also of the redundant power supply can be ensured.

According to this embodiment, when the power feed function of the primary power supply system fails in VP <NUM>, the system to which power feed from the secondary power supply system (secondary battery <NUM>) is kept is limited. Therefore, power feed for a certain time period from the secondary power supply system can be kept. By limiting the system to brake system 121B, steering system 122B, and P-Lock system 123B, at least the steering function and the standstill function of vehicle <NUM> can be ensured. Since power feed from the secondary power supply system to VCIB 111B is also kept, interfacing between VP <NUM> and ADK <NUM> is also continued.

In the embodiment, on VP <NUM>, when the power feed function of the primary power supply system fails, switching DC/DC converter <NUM> electrically disconnects secondary battery <NUM> from the primary power supply system. Thus, when the power feed function of the primary power supply system fails, secondary battery <NUM> can be disconnected from the primary power supply system in a shorter period of time than by means of a mechanical relay apparatus. Therefore, according to this embodiment, influence onto the secondary power supply system in case of a failure of the power feed function of the primary power supply system can be suppressed.

Examples are given below. Although the examples mention Toyota, they can be transposed to other companies, e.g. other vehicle manufacturers.

This document is an API specification of Toyota Vehicle Platform and contains the outline, the usage and the caveats of the application interface.

e-Palette, MaaS vehicle based on the POV (Privately Owned Vehicle) manufactured by Toyota.

All the contents are subject to change. Such changes are notified to the users. Please note that some parts are still T. will be updated in the future.

The overall structure of MaaS with the target vehicle is shown (<FIG>).

Vehicle control technology is being used as an interface for technology providers.

Technology providers can receive open API such as vehicle state and vehicle control, necessary for development of automated driving systems.

The system architecture as a premise is shown (<FIG>).

The target vehicle will adopt the physical architecture of using CAN for the bus between ADS and VCIB. In order to realize each API in this document, the CAN frames and the bit assignments are shown in the form of "bit assignment table" as a separate document.

Basic responsibility sharing between ADS and vehicle VP is as follows when using APIs.

The ADS should create the driving plan, and should indicate vehicle control values to the VP.

The Toyota VP should control each system of the VP based on indications from an ADS.

In this section, typical usage of APIs is described.

CAN will be adopted as a communication line between ADS and VP. Therefore, basically, APIs should be executed every defined cycle time of each API by ADS.

A typical workflow of ADS of when executing APIs is as follows (<FIG>).

In this section, the APIs for vehicle motion control which is controllable in the MaaS vehicle is described.

The transition to the standstill (immobility) mode and the vehicle start sequence are described. This function presupposes the vehicle is in Autonomy_State = Autonomous Mode. The request is rejected in other modes.

Acceleration Command requests deceleration and stops the vehicle. Then, when Longitudinal_Velocity is confirmed as <NUM> [km/h], Standstill Command = "Applied" is sent. After the brake hold control is finished, Standstill Status becomes "Applied". Until then, Acceleration Command has to continue deceleration request. Either Standstill Command = "Applied" or Acceleration Command's deceleration request were canceled, the transition to the brake hold control will not happen. After that, the vehicle continues to be standstill as far as Standstill Command = "Applied" is being sent. Acceleration Command can be set to <NUM> (zero) during this period.

If the vehicle needs to start, the brake hold control is cancelled by setting Standstill Command to "Released". At the same time, acceleration/deceleration is controlled based on Acceleration Command (<FIG>).

EPB is engaged when Standstill Status = "Applied" continues for <NUM> minutes.

The shift change sequence is described. This function presupposes that Autonomy_State = Autonomous Mode. Otherwise, the request is rejected.

Shift change happens only during Actual_Moving_Direction = "standstill"). Otherwise, the request is rejected.

In the following diagram shows an example. Acceleration Command requests deceleration and makes the vehicle stop. After Actual_Moving_Direction is set to "standstill", any shift position can be requested by Propulsion Direction Command. (In the example below, "D" "R").

During shift change, Acceleration Command has to request deceleration.

After the shift change, acceleration/deceleration is controlled based on Acceleration Command value (<FIG>).

The engagement and release of wheel lock is described. This function presupposes Autonomy_State = Autonomous Mode, otherwise the request is rejected.

This function is conductible only during vehicle is stopped. Acceleration Command requests deceleration and makes the vehicle stop. After Actual_Moving_Direction is set to "standstill", WheelLock is engaged by Immobilization Command = "Applied". Acceleration Command is set to Deceleration until Immobilization Status is set to "Applied".

If release is desired, Immobilization Command = "Release" is requested when the vehicle is stationary. Acceleration Command is set to Deceleration at that time.

After this, the vehicle is accelerated/decelerated based on Acceleration Command value (<FIG>).

This function presupposes Autonomy_State = "Autonomous Mode", and the request is rejected otherwise.

Tire Turning Angle Command is the relative value from
Estimated_Road_Wheel_Angle_Actual. For example, in case that Estimated_Road_Wheel_Angle_Actual = <NUM> [rad] while the vehicle is going straight;.

If ADS requests to go straight ahead, Tire Turning Angle Command should be set to <NUM>+<NUM> = <NUM> [rad].

If ADS requests to steer by -<NUM> [rad], Tire Turning Angle Command should be set to -<NUM>+<NUM> = -<NUM> [rad].

While in Autonomous driving mode, accelerator pedal stroke is eliminated from the vehicle acceleration demand selection.

The action when the brake pedal is operated. In the autonomy mode, target vehicle deceleration is the sum of <NUM>) estimated deceleration from the brake pedal stroke and <NUM>) deceleration request from AD system.

In Autonomous driving mode, driver operation of the shift lever is not reflected in Propulsion Direction Status.

If necessary, ADS confirms Propulsion Direction by Driver and changes shift position by using Propulsion Direction Command.

When the driver (rider) operates the steering, the maximum is selected from.

Note that Tire Turning Angle Command is not accepted if the driver strongly turns the steering wheel. The above-mentioned is determined by Steering_Wheel_Intervention flag.

The threshold speed between A and B is <NUM> [km/h] (<FIG>).

The accelerator position signal after zero point calibration is transmitted.

This signal shows whether the accelerator pedal is depressed by a driver (intervention).

When the requested acceleration from depressed acceleration pedal is higher than the requested acceleration from system (ADS, PCS etc.), this signal will turn to "Beyond autonomy acceleration".

This signal shows whether the brake pedal is depressed by a driver (intervention).

This signal shows whether the steering wheel is turned by a driver (intervention).

This signal shows whether the shift lever is controlled by a driver (intervention).

WheelSpeed_RL_Rotation, WheelSpeed_RR_Rotation.

When Turnsignallight_Mode_Command = <NUM>, vehicle platform sends left blinker on request.

When Turnsignallight_Mode_Command = <NUM>, vehicle platform sends right blinker on request.

Command to control the front windshield wiper of the vehicle platform
Values.

Command to control the Windshield wiper actuation interval at the Intermittent mode
Values.

Therefore, in order to control <NUM> (four) hvacs (1st_left/right, 2nd_left/right) individually, VCIB achieves the following procedure after Ready-ON. (This functionality will be implemented from the CV.

Status of the current headlight mode of the vehicle platform
Values.

When there is luggage on the seat, this signal may be set to "Occupied".

The followings are the explanation of the three power modes, i.e. [Sleep] [Wake] [Driving Mode], which are controllable via API.

Vehicle power off condition. In this mode, the high voltage battery does not supply power, and neither VCIB nor other VP ECUs are activated.

VCIB is awake by the low voltage battery. In this mode, ECUs other than VCIB are not awake except for some of the body electrical ECUs.

Ready ON mode. In this mode, the high voltage battery supplies power to the whole VP and all the VP ECUs including VCIB are awake.

Transmission interval is <NUM> within fuel cutoff motion delay allowance time (<NUM>) so that data can be transmitted more than <NUM> times. In this case, an instantaneous power interruption is taken into account.

Status of the current all door lock mode of the vehicle platform
Values.

This document is an architecture specification of Toyota's MaaS Vehicle Platform and contains the outline of system in vehicle level.

This specification is applied to the Toyota vehicles with the electronic platform called 19ePF [ver. <NUM> and ver.

The representative vehicle with 19ePF is shown as follows.

The system architecture on the vehicle as a premise is shown (<FIG>).

The target vehicle of this document will adopt the physical architecture of using CAN for the bus between ADS and VCIB. In order to realize each API in this document, the CAN frames and the bit assignments are shown in the form of "bit assignment chart" as a separate document.

The power supply architecture as a premise is shown as follows (<FIG>).

The blue colored parts are provided from an ADS provider. And the orange colored parts are provided from the VP.

The power structure for ADS is isolate from the power structure for VP. Also, the ADS provider should install a redundant power structure isolated from the VP.

The basic safety concept is shown as follows.

The strategy of bringing the vehicle to a safe stop when a failure occurs is shown as follows (<FIG>).

After occurrence of a failure, the entire vehicle executes "detecting a failure" and "correcting an impact of failure" and then achieves the safety state <NUM>. Obeying the instructions from the ADS, the entire vehicle stops in a safe space at a safe speed (assumed less than <NUM>). However, depending on a situation, the entire vehicle should happen a deceleration more than the above deceleration if needed. After stopping, in order to prevent slipping down, the entire vehicle achieves the safety state <NUM> by activating the immobilization system.

See the separated document called "Fault Management" regarding notifiable single failure and expected behavior for the ADS.

The redundant functionalities with Toyota's MaaS vehicle are shown.

Toyota's Vehicle Platform has the following redundant functionalities to meet the safety goals led from the functional safety analysis.

Any single failure on the Braking System doesn't cause loss of braking functionality. However, depending on where the failure occurred, the capability left might not be equivalent to the primary system's capability. In this case, the braking system is designed to prevent the capability from becoming <NUM> or less.

Any single failure on the Steering System doesn't cause loss of steering functionality. However, depending on where the failure occurred, the capability left might not be equivalent to the primary system's capability. In this case, the steering system is designed to prevent the capability from becoming <NUM> or less.

Toyota's MaaS vehicle has <NUM> immobilization systems, i.e. P lock and EPB. Therefore, any single failure of immobilization system doesn't cause loss of the immobilization capability. However, in the case of failure, maximum stationary slope angle is less steep than when the systems are healthy.

Any single failure on the Power Supply System doesn't cause loss of power supply functionality. However, in case of the primary power failure, the secondary power supply system keeps supplying power to the limited systems for a certain time.

Any single failure on the Communication System doesn't cause loss of all the communication functionality. System which needs redundancy has physical redundant communication lines. For more detail information, see the chapter "Physical LAN architecture (in-Vehicle)".

Regarding security, Toyota's MaaS vehicle adopts the security document issued by Toyota as an upper document.

The entire risk includes not only the risks assumed on the base e-PF but also the risks assumed for the Autono-MaaS vehicle.

The countermeasure of the above assumed risks is shown as follows.

The countermeasure for a remote attack is shown as follows.

Since the autonomous driving kit communicates with the center of the operation entity, end-to-end security should be ensured. Since a function to provide a travel control instruction is performed, multi-layered protection in the autonomous driving kit is required. Use a secure microcomputer or a security chip in the autonomous driving kit and provide sufficient security measures as the first layer against access from the outside. Use another secure microcomputer and another security chip to provide security as the second layer. (Multi-layered protection in the autonomous driving kit including protection as the first layer to prevent direct entry from the outside and protection as the second layer as the layer below the former).

The countermeasure for a modification is shown as follows.

For measures against a counterfeit autonomous driving kit, device authentication and message authentication are carried out. In storing a key, measures against tampering should be provided and a key set is changed for each pair of a vehicle and an autonomous driving kit. Alternatively, the contract should stipulate that the operation entity exercise sufficient management so as not to allow attachment of an unauthorized kit. For measures against attachment of an unauthorized product by an Autono-MaaS vehicle user, the contract should stipulate that the operation entity exercise management not to allow attachment of an unauthorized kit.

In application to actual vehicles, conduct credible threat analysis together, and measures for addressing most recent vulnerability of the autonomous driving kit at the time of LO should be completed.

The allocation of representative functionalities is shown as below (<FIG>).

Claim 1:
A vehicle (<NUM>) comprising:
a vehicle platform (<NUM>) configured to carry out vehicle control in accordance with an instruction from an autonomous driving system,
wherein the vehicle further comprises
an autonomous driving system (<NUM>) configured to create a driving plan; and
a vehicle control interface box (<NUM>) configured to interface between the vehicle platform and the autonomous driving system, wherein
the autonomous driving system includes a power supply structure independent of a power supply structure for the vehicle platform, and characterized in that
the vehicle platform includes
a high-voltage battery (<NUM>),
a first primary power supply system (<NUM>, <NUM>) configured to receive supply of electric power from the high-voltage battery, and
a first secondary power supply system (<NUM>, <NUM>) as a redundant power supply for the vehicle platform, and
the autonomous driving system includes
a second primary power supply system (<NUM>, <NUM>) configured to receive supply of electric power from the high-voltage battery, and
a second secondary power supply system (<NUM>, <NUM>) as a redundant power supply for the autonomous driving system.