Patent Description:
<CIT> (<CIT>) discloses a driving assistance system configured to assist driving of a vehicle. The driving assistance system includes an imaging unit, a target trajectory generation unit, a traveling condition acquisition unit, and a control unit. The imaging unit acquires an image including a boundary of a lane where the vehicle is traveling. The target trajectory generation unit generates, based on the image, a target trajectory along which the vehicle may travel in the lane. The traveling condition acquisition unit acquires, based on the image, a traveling condition of the vehicle in the lane. The control unit executes steering control based on the target trajectory and the traveling condition such that the vehicle follows the target trajectory.

<CIT> (<CIT>) discloses a course evaluation device configured to evaluate courses of a vehicle. The course evaluation device generates a plurality of estimated courses, and evaluates the courses by using two or more different evaluation criteria.

<CIT> (<CIT>) discloses a course setting device configured to set a desired course of a specific object. The course setting device estimates possible courses of a plurality of objects including the specific object, and sets the course of the specific object based on estimation results.

<CIT> (<CIT>), which shows the features of the preamble of claim <NUM>, discloses an autonomous vehicle which includes multiple independent control systems that provide redundancy as to specific and critical safety situations which may be encountered when the autonomous vehicle is in operation. <CIT> (<CIT>) discloses a driving control apparatus for a vehicle that recognizes traveling environment, detects traveling information on the vehicle provided, and performs a self-driving control. <CIT> (<CIT>) discloses a method and a system for operating a vehicle in an automated driving mode, which include identifying current positions of the vehicle and objects and open spaces currently present in vehicle surroundings, calculating trajectories for independent vehicle guidance, and generating control signals for actuator devices to control the vehicle.

According to the technology described in <CIT>, the steering control is executed based on the target trajectory generated by the target trajectory generation unit. When the target trajectory generation unit malfunctions, however, an appropriate target trajectory is not generated. Without an appropriate target trajectory, the safety of vehicle traveling may be lost. There is room for improvement in vehicle traveling control based on the target trajectory.

The present invention provides a technology that contributes to securing safety during vehicle traveling control based on a target trajectory.

One aspect of the present invention relates to a vehicle control system according to claim <NUM>.

According to the aspect of the present invention, the target trajectory generation device generates and outputs not only the first target trajectory but also the second target trajectory. The second target trajectory is the target trajectory for decelerating and stopping the vehicle. When the malfunctioning device exists, the vehicle traveling control device executes the vehicle traveling control based on the second target trajectory output from the target trajectory generation device before the malfunction occurs. The vehicle traveling control device decelerates and stops the vehicle by executing the vehicle traveling control based on the second target trajectory. Thus, the safety of the vehicle is secured.

Embodiments of the present invention are described with reference to the accompanying drawings.

<FIG> is a conceptual diagram for describing an overview of a vehicle control system <NUM> according to a first embodiment. The vehicle control system <NUM> controls a vehicle <NUM>. The vehicle control system <NUM> is typically mounted on the vehicle <NUM>. Alternatively, at least a part of the vehicle control system <NUM> may be arranged in an external device outside the vehicle <NUM> to control the vehicle <NUM> remotely. That is, the vehicle control system <NUM> may be distributed over the vehicle <NUM> and the external device.

The vehicle control system <NUM> executes "vehicle traveling control" for controlling traveling of the vehicle <NUM> (steering, acceleration, and deceleration). In particular, the vehicle control system <NUM> executes the vehicle traveling control based on a target trajectory TR.

The target trajectory TR includes a target position [X(t), Y(t)] and a target speed [VX(t), VY(t)] of the vehicle <NUM> on a road where the vehicle <NUM> travels. In the example illustrated in <FIG>, an X direction is a forward direction of the vehicle <NUM>, and a Y direction is a plane direction orthogonal to the X direction. The coordinate system (X, Y) is not limited to that in the example illustrated in <FIG>. The target position [X(t), Y(t)] and the target speed [VX(t), VY(t)] are functions of time t. The target speed [VX(t), VY(t)] may be set for each target position [X(t), Y(t)]. That is, the target position [X(t), Y(t)] and the target speed [VX(t), VY(t)] may be associated with each other. The vehicle control system <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the target trajectory TR.

<FIG> is a block diagram schematically illustrating the configuration of the vehicle control system <NUM> according to this embodiment. The vehicle control system <NUM> includes a target trajectory generation device <NUM> and a vehicle traveling control device <NUM>. The target trajectory generation device <NUM> and the vehicle traveling control device <NUM> may physically be different devices or the same device. When the target trajectory generation device <NUM> and the vehicle traveling control device <NUM> are physically different devices, the devices exchange necessary information through communication.

The target trajectory generation device <NUM> generates the target trajectory TR. More specifically, the target trajectory generation device <NUM> acquires driving environment information <NUM> indicating a driving environment of the vehicle <NUM>. For example, the driving environment information <NUM> includes map information, positional information, and surrounding condition information. The positional information indicates the position and direction of the vehicle <NUM>. The surrounding condition information indicates conditions around the vehicle <NUM>. The target trajectory generation device <NUM> determines a traveling plan of the vehicle <NUM> based on the driving environment information <NUM>, and generates the target trajectory TR necessary to achieve the traveling plan. Examples of the traveling plan include a plan to keep a current traveling lane, a plan to change the lane, a plan to avoid an obstacle, and a plan to decelerate and stop. Typically, the target trajectory generation device <NUM> repeatedly generates the target trajectory TR in each predetermined cycle, that is, updates the target trajectory TR. The target trajectory generation device <NUM> outputs the generated (updated) target trajectory TR to the vehicle traveling control device <NUM>.

The vehicle traveling control device <NUM> executes the vehicle traveling control for controlling the traveling of the vehicle <NUM> (steering, acceleration, and deceleration). In particular, the vehicle traveling control device <NUM> receives the target trajectory TR output from the target trajectory generation device <NUM>, and executes the vehicle traveling control based on the received target trajectory TR. Typically, the vehicle traveling control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the target trajectory TR. Therefore, the vehicle traveling control device <NUM> calculates deviations between the vehicle <NUM> and the target trajectory TR (such as a lateral deviation, a yaw angle deviation, and a speed deviation), and executes the vehicle traveling control such that the deviations decrease.

According to this embodiment, two types of target trajectory TR, that is, a "first target trajectory TR1" and a "second target trajectory TR2" are used. The first target trajectory TR1 is a target trajectory TR for at least one of steering, acceleration, and deceleration of the vehicle <NUM>. For example, the first target trajectory TR1 is a target trajectory TR for continuing autonomous driving of the vehicle <NUM> along a traveling lane. The second target trajectory TR2 is a target trajectory TR for decelerating and stopping the vehicle <NUM>.

<FIG> is a conceptual diagram for describing the second target trajectory TR2. The horizontal axis represents the time t, and the vertical axis represents the target speed [VX(t), VY(t)]. As illustrated in <FIG>, the target speed [VX(t), VY(t)] decreases along with elapse of the time t, and finally reaches zero. The vehicle <NUM> decelerates and stops by executing the vehicle traveling control based on the second target trajectory TR2. The second target trajectory TR2 may request steering in addition to the deceleration. For example, the second target trajectory TR2 may be generated such that the vehicle <NUM> travels to and stops at a road shoulder in a limp home mode.

The target trajectory generation device <NUM> generates and outputs the first target trajectory TR1 and the second target trajectory TR2. The vehicle traveling control device <NUM> receives and stores the first target trajectory TR1 and the second target trajectory TR2. The vehicle traveling control device <NUM> executes the vehicle traveling control based on at least one of the first target trajectory TR1 and the second target trajectory TR2.

In particular, the vehicle traveling control device <NUM> according to this embodiment selectively uses the first target trajectory TR1 and the second target trajectory TR2 depending on whether the target trajectory generation device <NUM> malfunctions. When the target trajectory generation device <NUM> malfunctions, an appropriate target trajectory TR is not output from the target trajectory generation device <NUM>. For example, the generation (update) and output of the target trajectory TR halt when the target trajectory generation device <NUM> malfunctions. Even if the target trajectory TR is generated and output, the target trajectory TR is inappropriate.

First, it is assumed that the target trajectory generation device <NUM> is normal (does not malfunction). In this case, the target trajectory generation device <NUM> generates and outputs the first target trajectory TR1 and the second target trajectory TR2. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the first target trajectory TR1. That is, the vehicle traveling control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the first target trajectory TR1.

Next, referring to <FIG>, it is assumed that the target trajectory generation device <NUM> malfunctions. The malfunctioning target trajectory generation device <NUM> is hereinafter referred to as a "malfunctioning device 100F". After the malfunction occurs, an appropriate target trajectory TR is not output from the malfunctioning device 100F. Without an appropriate target trajectory TR, the safety of vehicle traveling may be lost.

According to this embodiment, when the malfunctioning device 100F exists, an appropriate second target trajectory TR2 before the malfunction is used. That is, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the second target trajectory TR2 output from the target trajectory generation device <NUM> before the malfunction occurs. The vehicle <NUM> decelerates and stops by executing the vehicle traveling control based on the second target trajectory TR2. Thus, the safety of the vehicle <NUM> is secured.

The second target trajectory TR2 may be regarded as a "testament" prepared by the target trajectory generation device <NUM> in case of malfunction. The vehicle traveling control device <NUM> receives and stores in advance the testament output from the target trajectory generation device <NUM> before malfunction occurs. When the target trajectory generation device <NUM> malfunctions, the vehicle traveling control device <NUM> executes the testament received in advance to stop the vehicle <NUM>. Thus, the safety of the vehicle <NUM> is secured.

The driving environment of the vehicle <NUM> changes incessantly. When the target trajectory generation device <NUM> malfunctions, it is preferable to use as new a second target trajectory TR2 as possible. However, the timing of malfunction in the target trajectory generation device <NUM> is not known in advance. Therefore, it is appropriate that the target trajectory generation device <NUM> update and output at least the second target trajectory TR2 "continuously". The term "continuously" is herein a concept including both "constantly" and "intermittently". For example, the output of the second target trajectory TR2 may be suspended for quite a short time. Also in this case, it can be said that the output of the second target trajectory TR2 is continuous over a long period.

It is appropriate that the vehicle traveling control device <NUM> execute the vehicle traveling control based on the latest second target trajectory TR2 output from the target trajectory generation device <NUM> for the last time before malfunction occurs. The vehicle <NUM> can be stopped more appropriately because the latest second target trajectory TR2 reflects the latest driving environment.

The latest second target trajectory TR2 need not be used essentially. For example, a sufficient effect may be attained also when a second target trajectory TR2 that is generated in a previous cycle of the latest is used. The vehicle traveling control device <NUM> includes a storage device that stores, for a predetermined period, the second target trajectory TR2 output from the target trajectory generation device <NUM>. When the target trajectory generation device <NUM> malfunctions, the vehicle traveling control device <NUM> executes the vehicle traveling control by using a relatively new second target trajectory TR2 out of the second target trajectories TR2 output before the malfunction occurs. Thus, the vehicle <NUM> can be stopped and the safety can be secured.

The vehicle control system <NUM> according to this embodiment is described below in more detail.

<FIG> is a block diagram illustrating an example of the configuration of the target trajectory generation device <NUM> according to this embodiment. The target trajectory generation device <NUM> includes an information acquisition device <NUM>, a control device <NUM>, and an input and output interface <NUM>.

The information acquisition device <NUM> acquires the driving environment information <NUM> indicating the driving environment of the vehicle <NUM>.

<FIG> is a block diagram illustrating examples of the information acquisition device <NUM> and the driving environment information <NUM>. The information acquisition device <NUM> includes a map information acquisition device <NUM>, a positional information acquisition device <NUM>, a vehicle condition sensor <NUM>, a surrounding condition sensor <NUM>, and a communication device <NUM>. The driving environment information <NUM> includes map information <NUM>, positional information <NUM>, vehicle condition information <NUM>, surrounding condition information <NUM>, and distribution information <NUM>.

The map information acquisition device <NUM> acquires the map information <NUM>. The map information <NUM> indicates lane arrangements and road shapes. The map information acquisition device <NUM> acquires map information <NUM> of a necessary area from a map database. The map database may be stored in a predetermined storage device mounted on the vehicle <NUM>, or in a management server outside the vehicle <NUM>. In the latter case, the map information acquisition device <NUM> communicates with the management server to acquire necessary map information <NUM>.

The positional information acquisition device <NUM> acquires the positional information <NUM> indicating the position and direction of the vehicle <NUM>. For example, the positional information acquisition device <NUM> includes a Global Positioning System (GPS) device configured to measure the position and direction of the vehicle <NUM>. The positional information acquisition device <NUM> may increase the accuracy of the positional information <NUM> through a known self-position estimation process (localization).

The vehicle condition sensor <NUM> acquires the vehicle condition information <NUM> indicating conditions of the vehicle <NUM>. For example, the vehicle condition sensor <NUM> includes a vehicle speed sensor, a yaw rate sensor, an acceleration sensor, and a steering angle sensor. The vehicle speed sensor detects a vehicle speed (speed of the vehicle <NUM>). The yaw rate sensor detects a yaw rate of the vehicle <NUM>. The acceleration sensor detects accelerations of the vehicle <NUM> (lateral acceleration, longitudinal acceleration, and vertical acceleration). The steering angle sensor detects a steering angle (steered angle) of the vehicle <NUM>.

The surrounding condition sensor <NUM> recognizes (detects) conditions around the vehicle <NUM>. For example, the surrounding condition sensor <NUM> includes at least one of a camera, a Laser Imaging Detection and Ranging (LIDAR) sensor, and a radar. The surrounding condition information <NUM> indicates a result of the recognition by the surrounding condition sensor <NUM>. For example, the surrounding condition information <NUM> includes target information related to a target recognized by the surrounding condition sensor <NUM>. Examples of the target include a surrounding vehicle, a pedestrian, an object on a roadside, an obstacle, and a lane line (lane marking line). The target information includes information on a relative position and a relative speed of the target to the vehicle <NUM>.

The communication device <NUM> communicates with the outside of the vehicle <NUM>. For example, the communication device <NUM> communicates with an external device outside the vehicle <NUM> via a communication network. The communication device <NUM> may perform Vehicle-to-Infrastructure (V2I) communication with surrounding infrastructure. The communication device <NUM> may perform Vehicle-to-Vehicle (V2V) communication with a surrounding vehicle. The distribution information <NUM> is obtained through the communication device <NUM>. For example, the distribution information <NUM> includes surrounding vehicle information and traffic information.

A part of the information acquisition device <NUM> may be included in the vehicle traveling control device <NUM>. That is, the target trajectory generation device <NUM> and the vehicle traveling control device <NUM> may share a part of the information acquisition device <NUM>. In this case, the target trajectory generation device <NUM> and the vehicle traveling control device <NUM> exchange necessary information.

Referring back to <FIG>, the input and output interface <NUM> is communicably connected to the vehicle traveling control device <NUM>. For example, the input and output interface <NUM> includes a communication device.

The control device <NUM> (controller) is an information processing device configured to execute various processes. For example, the control device <NUM> is a microcomputer. The control device <NUM> is also called an electronic control unit (ECU). The control device <NUM> includes a processor <NUM> and a storage device <NUM>.

The storage device <NUM> stores various types of information. Examples of the storage device <NUM> include a volatile memory and a non-volatile memory.

The processor <NUM> executes computer programs. The computer programs are stored in the storage device <NUM> or recorded in a computer-readable recording medium. The processor <NUM> executes the computer programs to implement functions of the control device <NUM> (processor <NUM>).

The control device <NUM> repeatedly acquires the driving environment information <NUM> from the information acquisition device <NUM>. The acquired driving environment information <NUM> is stored in the storage device <NUM>.

The control device <NUM> determines a traveling plan of the vehicle <NUM> based on the driving environment information <NUM>, and generates target trajectories TR necessary to achieve the traveling plan. Examples of the traveling plan include a plan to keep a current traveling lane, a plan to change the lane, a plan to avoid an obstacle, and a plan to decelerate and stop. Typically, the control device <NUM> repeatedly generates the target trajectories TR in each predetermined cycle, that is, updates the target trajectories TR. The generated target trajectories TR (first target trajectory TR1 and second target trajectory TR2) are stored in the storage device <NUM>.

The control device <NUM> outputs the generated (updated) target trajectories TR to the vehicle traveling control device <NUM> via the input and output interface <NUM>.

<FIG> is a block diagram illustrating an example of the configuration of the vehicle traveling control device <NUM> according to this embodiment. The vehicle traveling control device <NUM> includes a traveling condition acquisition device <NUM>, a control device <NUM>, an input and output interface <NUM>, and a traveling device <NUM>.

The traveling condition acquisition device <NUM> acquires traveling condition information <NUM> indicating traveling conditions of the vehicle <NUM>. Examples of the traveling condition include a position, a direction, a vehicle speed, a yaw rate, accelerations, and a steering angle (steered angle) of the vehicle <NUM>. For example, the traveling condition acquisition device <NUM> acquires positional information indicating the position and direction of the vehicle <NUM> by using a GPS device. The traveling condition acquisition device <NUM> may increase the accuracy of the positional information through a known self-position estimation process. The traveling condition acquisition device <NUM> includes a vehicle speed sensor, a yaw rate sensor, an acceleration sensor, and a steering angle sensor. At least a part of the traveling condition acquisition device <NUM> may be in common with the information acquisition device <NUM> of the target trajectory generation device <NUM>.

The input and output interface <NUM> is communicably connected to the target trajectory generation device <NUM>. For example, the input and output interface <NUM> includes a communication device.

The traveling device <NUM> includes a steering system <NUM>, a driving device <NUM>, and a braking device <NUM>. The steering system <NUM> turns wheels of the vehicle <NUM>. Examples of the steering system <NUM> include an electric power steering (EPS) system. The driving device <NUM> is a power source configured to generate a driving force. Examples of the driving device <NUM> include an engine, an electric motor, and an in-wheel motor. The braking device <NUM> generates a braking force.

The control device <NUM> (controller) is an information processing device configured to execute various processes. For example, the control device <NUM> is a microcomputer. The control device <NUM> is also called an ECU. The control device <NUM> includes a processor <NUM> and a storage device <NUM>.

For example, the control device <NUM> executes the "vehicle traveling control" for controlling steering, acceleration, and deceleration of the vehicle <NUM>. The control device <NUM> executes the vehicle traveling control by controlling an operation of the traveling device <NUM>. Specifically, the control device <NUM> controls the steering (turning) of the vehicle <NUM> by controlling an operation of the steering system <NUM>. The control device <NUM> controls the acceleration of the vehicle <NUM> by controlling an operation of the driving device <NUM>. The control device <NUM> controls the deceleration of the vehicle <NUM> by controlling an operation of the braking device <NUM>.

The control device <NUM> repeatedly acquires the traveling condition information <NUM> from the traveling condition acquisition device <NUM>. The acquired traveling condition information <NUM> is stored in the storage device <NUM>.

The control device <NUM> receives, via the input and output interface <NUM>, the target trajectories TR output from the target trajectory generation device <NUM>. The received target trajectories TR (first target trajectory TR1 and second target trajectory TR2) are stored in the storage device <NUM>. After the target trajectories TR are updated, the previous target trajectories TR (in particular, the previous second target trajectory TR2) may be stored in the storage device <NUM> for a predetermined period.

The control device <NUM> executes the vehicle traveling control based on the target trajectory TR. Specifically, the control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the target trajectory TR. Therefore, the control device <NUM> calculates deviations between the vehicle <NUM> and the target trajectory TR based on the target trajectory TR and the traveling condition information <NUM>. Examples of the deviation include a lateral deviation (Y-direction deviation), a yaw angle deviation (azimuth angle deviation), and a speed deviation. The control device <NUM> executes the vehicle traveling control such that the deviations between the vehicle <NUM> and the target trajectory TR decrease. Through the vehicle traveling control, the vehicle <NUM> travels to follow the target trajectory TR.

For example, steering control using the steering system <NUM> is as follows. The control device <NUM> calculates a target yaw rate necessary to reduce a deviation between the vehicle <NUM> and the target trajectory TR. An actual yaw rate is included in the traveling condition information <NUM>. The control device <NUM> calculates a target steering angle depending on a yaw rate deviation, which is a difference between the target yaw rate and the actual yaw rate. As the yaw rate deviation increases, the target steering angle increases. An actual steering angle is included in the traveling condition information <NUM>. The control device <NUM> executes feedback control for the steering system <NUM> such that the actual steering angle equals the target steering angle.

The following are examples of the malfunction in the target trajectory generation device <NUM>.

[Malfunction in Input] The driving environment information <NUM> necessary to generate the target trajectory TR cannot appropriately be acquired due to an abnormality or failure in the information acquisition device <NUM> (sensor).

[Malfunction in Arithmetic Process] An arithmetic process for generating the target trajectory TR is not properly executed due to an abnormality or failure in the control device <NUM>.

[Malfunction in Calculation Result] The generated target trajectory TR does not satisfy a predetermined requirement.

[Malfunction in Output] The target trajectory TR is not properly output from the target trajectory generation device <NUM> due to an abnormality or failure in the output function of the input and output interface <NUM>.

The target trajectory generation device <NUM> has a self-diagnosis function. The following are examples of items to be checked by using the self-diagnosis function.

[Item <NUM>] The control device <NUM> is properly operating (for example, the calculation period of the processor <NUM> falls within a normal range).

[Item <NUM>] The sensors of the information acquisition device <NUM> are properly operating (for example, sensing periods, detected data counts, and detected data values fall within normal ranges).

[Item <NUM>] The control device <NUM> successively receives the driving environment information <NUM> (for example, a reception period and a data amount fall within normal ranges).

[Item <NUM>] The result of calculation of the target trajectory TR is normal (for example, a data amount and a data value fall within normal ranges).

[Item <NUM>] The target trajectory TR is properly output from the input and output interface <NUM> (for example, a transmission period and a data amount fall within normal ranges).

When an abnormality is detected in any item, the self-diagnosis function determines that the target trajectory generation device <NUM> malfunctions. When the self-diagnosis function determines that the malfunction occurs, the self-diagnosis function outputs an error signal to the outside via a dedicated signal line. By receiving the error signal, the vehicle traveling control device <NUM> can recognize the malfunction in the target trajectory generation device <NUM>.

<FIG> is a flowchart illustrating a summary of a process to be executed by the vehicle control system <NUM> according to this embodiment.

In Step S100, the target trajectory generation device <NUM> acquires the driving environment information <NUM>. The target trajectory generation device <NUM> generates (updates) the target trajectories TR based on the driving environment information <NUM>. The target trajectory generation device <NUM> outputs the generated (updated) target trajectories TR to the vehicle traveling control device <NUM>.

In Step S200, the vehicle traveling control device <NUM> receives the target trajectories TR output from the target trajectory generation device <NUM>. The vehicle traveling control device <NUM> stores the received target trajectories TR in the storage device <NUM>.

In Step S300, the vehicle traveling control device <NUM> determines whether the target trajectory generation device <NUM> malfunctions. For example, the vehicle traveling control device <NUM> determines whether the error signal is output from the target trajectory generation device <NUM>. When the target trajectory generation device <NUM> does not malfunction, that is, when the malfunctioning device 100F does not exist (Step S300; No), the process proceeds to Step S400. When the target trajectory generation device <NUM> malfunctions, that is, when the malfunctioning device 100F exists (Step S300; Yes), the process proceeds to Step S500.

In Step S400, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the first target trajectory TR1. That is, the vehicle traveling control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the first target trajectory TR1.

In Step S500, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the second target trajectory TR2. That is, the vehicle traveling control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the second target trajectory TR2. Thus, the vehicle <NUM> decelerates and stops.

As described above, the target trajectory generation device <NUM> according to this embodiment generates and outputs not only the first target trajectory TR1 but also the second target trajectory TR2. The second target trajectory TR2 is a target trajectory TR for decelerating and stopping the vehicle <NUM>. When the malfunctioning device 100F exists, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the second target trajectory TR2 output from the target trajectory generation device <NUM> before the malfunction occurs. The vehicle <NUM> decelerates and stops by executing the vehicle traveling control based on the second target trajectory TR2. Thus, the safety of the vehicle <NUM> is secured. This operation contributes to improvement in the reliability of the vehicle control system <NUM>.

In a second embodiment, a plurality of target trajectory generation devices <NUM> exists. Description overlapping that of the first embodiment is omitted as appropriate.

<FIG> is a block diagram schematically illustrating the configuration of a vehicle control system <NUM> according to the second embodiment. The vehicle control system <NUM> includes a plurality of target trajectory generation devices <NUM>-A and <NUM>-B and the vehicle traveling control device <NUM>.

The configurations of the target trajectory generation devices <NUM>-A and <NUM>-B are similar to the configuration of the target trajectory generation device <NUM> described in the first embodiment (see <FIG> and <FIG>).

Regarding the target trajectory generation device <NUM>-A, the driving environment information <NUM>, the target trajectory TR, the first target trajectory TR1, and the second target trajectory TR2 described in the first embodiment are referred to as driving environment information <NUM>-A, a target trajectory TR-A, a first target trajectory TR1-A, and a second target trajectory TR2-A, respectively. The target trajectory generation device <NUM>-A generates and outputs the target trajectories TR-A (TR1-A and TR2-A) based on the driving environment information <NUM>-A.

Regarding the target trajectory generation device <NUM>-B, the driving environment information <NUM>, the target trajectory TR, the first target trajectory TR1, and the second target trajectory TR2 described in the first embodiment are referred to as driving environment information <NUM>-B, a target trajectory TR-B, a first target trajectory TR1-B, and a second target trajectory TR2-B, respectively. The target trajectory generation device <NUM>-B generates and outputs the target trajectories TR-B (TR1-B and TR2-B) based on the driving environment information <NUM>-B.

The configuration of the vehicle traveling control device <NUM> is similar to the configuration in the first embodiment (see <FIG>).

The vehicle traveling control device <NUM> receives the target trajectories TR-A (TR1-A and TR2-A) output from the target trajectory generation device <NUM>-A. The vehicle traveling control device <NUM> also receives the target trajectories TR-B (TR1-B and TR2-B) output from the target trajectory generation device <NUM>-B. The vehicle traveling control device <NUM> stores the received target trajectories TR (TR1-A, TR2-A, TR1-B, and TR2-B) in the storage device <NUM>. The vehicle traveling control device <NUM> executes the vehicle traveling control based on at least one target trajectory TR.

First, it is assumed that both the target trajectory generation devices <NUM>-A and <NUM>-B are normal, that is, the malfunctioning device 100F does not exist. In this case, the vehicle traveling control device <NUM> executes the vehicle traveling control based on at least one of the first target trajectories TR1-A and TR1-B. For example, when the first target trajectory TR1-A is output but the first target trajectory TR1-B is not output, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the first target trajectory TR1-A.

As another example, when both the first target trajectories TR1-A and TR1-B are output, the vehicle traveling control device <NUM> selects the first target trajectory TR1-A or TR1-B, and executes the vehicle traveling control based on the selected first target trajectory. Alternatively, the vehicle traveling control device <NUM> may determine a final target trajectory TR by combining the first target trajectories TR1-A and TR1-B, and execute the vehicle traveling control based on the final target trajectory TR.

Next, referring to <FIG>, it is assumed that the target trajectory generation device <NUM>-A or <NUM>-B malfunctions, that is, the malfunctioning device 100F exists. In the example illustrated in <FIG>, the target trajectory generation device <NUM>-A is the malfunctioning device 100F. After the malfunction occurs, appropriate target trajectories TR-A (TR1-A and TR2-A) are not output from the target trajectory generation device <NUM>-A that is the malfunctioning device 100F. In this case, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the second target trajectory TR2-A or TR2-B to stop the vehicle <NUM>.

For example, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the second target trajectory TR2-A output from the target trajectory generation device <NUM>-A before the malfunction occurs. Alternatively, according to a non-claimed example, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the second target trajectory TR2-B output from the target trajectory generation device <NUM>-B other than the malfunctioning device 100F. In any case, the vehicle traveling control is executed based on an appropriate second target trajectory TR2, and therefore the vehicle <NUM> decelerates and stops. Thus, the safety of the vehicle <NUM> is secured.

As described above, when the malfunctioning device 100F exists, the vehicle traveling control device <NUM> according to this embodiment executes the vehicle traveling control based on the second target trajectory TR2 output from the target trajectory generation device <NUM>-A before the malfunction occurs, or, according to the non-claimed example, based on the second target trajectory TR2-B output from the target trajectory generation device <NUM>-B other than the malfunctioning device 100F. In any case, the vehicle traveling control is executed based on an appropriate second target trajectory TR2, and therefore the vehicle <NUM> decelerates and stops. Thus, the safety of the vehicle <NUM> is secured. This operation contributes to improvement in the reliability of the vehicle control system <NUM>.

A third embodiment is a specific example of the first embodiment. Description overlapping that of the first embodiment is omitted as appropriate.

<FIG> is a block diagram schematically illustrating the configuration of a vehicle control system <NUM> according to the third embodiment. The vehicle control system <NUM> includes an autonomous driving control device <NUM>-D and the vehicle traveling control device <NUM>.

The autonomous driving control device <NUM>-D is a target trajectory generation device <NUM> configured to generate a target trajectory TR necessary for autonomous driving of the vehicle <NUM>. The autonomous driving is herein assumed to be autonomous driving in which a driver need not concentrate on driving <NUM>% (for example, so-called Level <NUM> or higher autonomous driving).

The configuration of the autonomous driving control device <NUM>-D is similar to the configuration of the target trajectory generation device <NUM> described in the first embodiment (see <FIG> and <FIG>). Regarding the autonomous driving control device <NUM>-D, the driving environment information <NUM> and the target trajectory TR described in the first embodiment are referred to as driving environment information <NUM>-D and a target trajectory TR-D, respectively.

The autonomous driving control device <NUM>-D generates and outputs the target trajectories TR-D based on the driving environment information <NUM>-D. The target trajectories TR-D include two types of target trajectory, which are an "autonomous driving trajectory TR1-D" and a "limp home trajectory TR2-D" described below.

The autonomous driving trajectory TR1-D is a first target trajectory TR1 for autonomous driving of the vehicle <NUM>. That is, the autonomous driving trajectory TR1-D is intended to perform at least one of steering, acceleration, and deceleration for the autonomous driving of the vehicle <NUM>.

The autonomous driving control device <NUM>-D creates a traveling plan of the vehicle <NUM> during the autonomous driving based on the driving environment information <NUM>-D. Examples of the traveling plan include a plan to keep a current traveling lane, a plan to change the lane, and a plan to avoid an obstacle. The autonomous driving control device <NUM>-D generates, as the autonomous driving trajectory TR1-D, a first target trajectory TR1 necessary for the vehicle <NUM> to travel in accordance with the traveling plan.

For example, the autonomous driving control device <NUM>-D generates an autonomous driving trajectory TR1-D for keeping a current traveling lane. More specifically, the autonomous driving control device <NUM>-D recognizes a traveling lane where the vehicle <NUM> is traveling based on the map information <NUM> and the positional information <NUM>, and acquires the arrangement and shape of the traveling lane ahead of the vehicle <NUM>. Alternatively, the autonomous driving control device <NUM>-D may recognize the arrangement and shape of the traveling lane ahead of the vehicle <NUM> by recognizing a lane marking line (lane line) of the traveling lane based on the surrounding condition information <NUM>. The autonomous driving control device <NUM>-D generates the autonomous driving trajectory TR1-D for keeping the traveling lane based on the arrangement and shape of the traveling lane ahead of the vehicle <NUM>.

As another example, the autonomous driving control device <NUM>-D may generate an autonomous driving trajectory TR1-D for changing a lane. More specifically, the autonomous driving control device <NUM>-D plans to change a lane to arrive at a destination based on the map information <NUM>, the positional information <NUM>, and the destination. The autonomous driving control device <NUM>-D generates the autonomous driving trajectory TR1-D for changing the lane based on, for example, the map information <NUM>, the positional information <NUM>, the vehicle condition information <NUM>, and the surrounding condition information <NUM> (conditions of other vehicles). The autonomous driving trajectory TR1-D for changing the lane requests at least steering.

As still another example, the autonomous driving control device <NUM>-D may generate an autonomous driving trajectory TR1-D for avoiding collision between the vehicle <NUM> and its surrounding object. More specifically, the autonomous driving control device <NUM>-D recognizes an avoidance target ahead of the vehicle <NUM> (such as a surrounding vehicle or a pedestrian) based on the surrounding condition information <NUM>. The autonomous driving control device <NUM>-D estimates future positions of the vehicle <NUM> and the avoidance target based on the vehicle condition information <NUM> and the surrounding condition information <NUM>, and calculates a possibility of collision between the vehicle <NUM> and the avoidance target. When the possibility of collision between the vehicle <NUM> and the avoidance target is equal to or higher than a threshold, the autonomous driving control device <NUM>-D generates the autonomous driving trajectory TR1-D for avoiding the collision based on the vehicle condition information <NUM> and the surrounding condition information <NUM>. The autonomous driving trajectory TR1-D for avoiding the collision requests at least one of steering and deceleration.

The autonomous driving control device <NUM>-D repeatedly generates the autonomous driving trajectory TR1-D in each predetermined cycle, that is, updates the autonomous driving trajectory TR1-D. It is appropriate that the autonomous driving control device <NUM>-D update and output the autonomous driving trajectory TR1-D "continuously". The term "continuously" is herein a concept including both "constantly" and "intermittently". For example, the output of the autonomous driving trajectory TR1-D may be suspended for quite a short time. Also in this case, it can be said that the output of the autonomous driving trajectory TR1-D is continuous in the long term.

<FIG> is a conceptual diagram for describing the limp home trajectory TR2-D. The limp home trajectory TR2-D is a second target trajectory TR2 for decelerating and stopping the vehicle <NUM>. In particular, the limp home trajectory TR2-D is a second target trajectory TR2 for causing the vehicle <NUM> to travel to a safe stopping area in the limp home mode.

In the example illustrated in <FIG>, the vehicle <NUM> travels to and stops at a road shoulder in the limp home mode along the limp home trajectory TR2-D. For example, the position of the road shoulder in a stoppable area is registered in advance in the map information <NUM>. Alternatively, the stoppable road shoulder may be detected based on the surrounding condition information <NUM>. That is, the autonomous driving control device <NUM>-D recognizes the stoppable road shoulder based on at least one of the map information <NUM> and the surrounding condition information <NUM>. The autonomous driving control device <NUM>-D generates the limp home trajectory TR2-D for causing the vehicle <NUM> to travel to and stop at the road shoulder in the limp home mode. The limp home trajectory TR2-D requests steering and deceleration.

The autonomous driving control device <NUM>-D repeatedly generates the limp home trajectory TR2-D in each predetermined cycle, that is, updates the limp home trajectory TR2-D. It is appropriate that the autonomous driving control device <NUM>-D update and output the limp home trajectory TR2-D "continuously". The term "continuously" is herein a concept including both "constantly" and "intermittently". For example, the output of the limp home trajectory TR2-D may be suspended for quite a short time. Also in this case, it can be said that the output of the limp home trajectory TR2-D is continuous in the long term.

The vehicle traveling control device <NUM> receives the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D output from the autonomous driving control device <NUM>-D. The vehicle traveling control device <NUM> stores the received autonomous driving trajectory TR1-D and the received limp home trajectory TR2-D in the storage device <NUM>. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the autonomous driving trajectory TR1-D or the limp home trajectory TR2-D.

First, it is assumed that the autonomous driving control device <NUM>-D is normal, that is, the malfunctioning device 100F does not exist. In this case, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the autonomous driving trajectory TR1-D. That is, the vehicle traveling control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the autonomous driving trajectory TR1-D. Thus, desired autonomous driving is achieved.

Next, it is assumed that the autonomous driving control device <NUM>-D malfunctions, that is, the malfunctioning device 100F exists (see <FIG>). The autonomous driving is impossible after the malfunction occurs. Therefore, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the limp home trajectory TR2-D output from the autonomous driving control device <NUM>-D before the malfunction occurs. For example, the vehicle traveling control device <NUM> executes the vehicle traveling control based on a limp home trajectory TR2-D output from the autonomous driving control device <NUM>-D for the last time before the malfunction occurs. Thus, the vehicle <NUM> stops at a safe position. That is, the safety of the vehicle <NUM> is secured.

As described above, when the autonomous driving control device <NUM>-D malfunctions, the vehicle traveling control device <NUM> according to this embodiment executes the vehicle traveling control based on the limp home trajectory TR2-D output before the malfunction occurs. Thus, the vehicle <NUM> can promptly be stopped in a situation in which the autonomous driving is impossible. As a result, the safety of the vehicle <NUM> is secured. This operation contributes to improvement in the reliability of the vehicle control system <NUM>.

A fourth embodiment is a specific example of the second embodiment above. Description overlapping those of the above embodiments is omitted as appropriate.

<FIG> is a block diagram schematically illustrating the configuration of a vehicle control system <NUM> according to the fourth embodiment. The vehicle control system <NUM> includes the autonomous driving control device <NUM>-D, a traveling assistance control device <NUM>-G, and the vehicle traveling control device <NUM>.

The autonomous driving control device <NUM>-D is the same as that described in the third embodiment.

The traveling assistance control device <NUM>-G is a target trajectory generation device <NUM> configured to generate a target trajectory TR for "traveling assistance control". The traveling of the vehicle <NUM> is assisted in the traveling assistance control. More specifically, in the traveling assistance control, at least one of steering, acceleration, and deceleration of the vehicle <NUM> is controlled to improve the safety of the traveling of the vehicle <NUM> or to stabilize the behavior of the vehicle <NUM>. Examples of the traveling assistance control include collision avoidance control, lane keeping control, and vehicle stability control. In the collision avoidance control, avoidance of collision between the vehicle <NUM> and its surrounding object (avoidance target) is assisted. The lane keeping control suppresses deviation of the vehicle <NUM> from a traveling lane. The vehicle stability control suppresses unstable behavior of the vehicle, such as a spin. The traveling assistance control may be regarded as control for reducing risks.

The configuration of the traveling assistance control device <NUM>-G is similar to the configuration of the target trajectory generation device <NUM> described in the first embodiment (see <FIG> and <FIG>). Regarding the traveling assistance control device <NUM>-G, the driving environment information <NUM> and the target trajectory TR described in the first embodiment are referred to as driving environment information <NUM>-G and a target trajectory TR-G, respectively. The information acquisition device <NUM> of the autonomous driving control device <NUM>-D may partially be in common with the information acquisition device <NUM> of the traveling assistance control device <NUM>-G.

The traveling assistance control device <NUM>-G generates and outputs the target trajectories TR-G based on the driving environment information <NUM>-G. The target trajectories TR-G include two types of target trajectory, which are a "traveling assistance trajectory TR1-G" and an "emergency stop trajectory TR2-G" described below.

The traveling assistance trajectory TR1-G is a first target trajectory TR1 for the traveling assistance control. That is, the traveling assistance trajectory TR1-G is a first target trajectory TR1 for improving the safety of the traveling of the vehicle <NUM> or stabilizing the behavior of the vehicle <NUM>.

The traveling assistance control is not constantly executed but executed as necessary. That is, the traveling assistance control is executed only when a predetermined execution condition is satisfied. The traveling assistance control device <NUM>-G determines whether the execution condition is satisfied based on the driving environment information <NUM>-G. When the execution condition is satisfied, the traveling assistance control device <NUM>-G generates and outputs the traveling assistance trajectory TR1-G.

<FIG> illustrates an example of the traveling assistance trajectory TR1-G. The collision avoidance control is assumed as an example of the traveling assistance control. The traveling assistance control device <NUM>-G recognizes an avoidance target ahead of the vehicle <NUM> (such as a surrounding vehicle or a pedestrian) based on the surrounding condition information <NUM>. The traveling assistance control device <NUM>-G estimates future positions of the vehicle <NUM> and the avoidance target based on the vehicle condition information <NUM> and the surrounding condition information <NUM>, and calculates a possibility of collision between the vehicle <NUM> and the avoidance target. The execution condition for the collision avoidance control is that the possibility of collision between the vehicle <NUM> and the avoidance target is equal to or higher than a threshold.

When the execution condition for the collision avoidance control is satisfied, the traveling assistance control device <NUM>-G generates the traveling assistance trajectory TR1-G for the collision avoidance control. As illustrated in <FIG>, the traveling assistance trajectory TR1-G for the collision avoidance control requests at least one of steering and deceleration of the vehicle <NUM> to avoid the collision with the avoidance target.

The lane keeping control is assumed as another example of the traveling assistance control. For example, when the vehicle <NUM> wobbles down the traveling lane to approach a lane marking line (lane line) of the traveling lane, the vehicle <NUM> is steered in the lane keeping control to return to the center of the traveling lane. Therefore, the traveling assistance control device <NUM>-G recognizes the lane marking line of the traveling lane where the vehicle <NUM> is traveling based on the surrounding condition information <NUM>, and monitors the distance between the vehicle <NUM> and the lane marking line. A first execution condition for the lane keeping control is that the distance between the vehicle <NUM> and the lane marking line of the traveling lane is smaller than a predetermined distance threshold. When the first execution condition is satisfied, the traveling assistance control device <NUM>-G generates the traveling assistance trajectory TR1-G that requests steering to return the vehicle <NUM> to the center of the traveling lane.

In the lane keeping control, the vehicle <NUM> is decelerated in response to prediction that the vehicle <NUM> may fail to navigate a curve ahead of the vehicle <NUM>. Therefore, the traveling assistance control device <NUM>-G acquires a road shape ahead of the vehicle <NUM> based on the map information <NUM> and the positional information <NUM>. The traveling assistance control device <NUM>-G determines whether the vehicle <NUM> can navigate the curve ahead of the vehicle <NUM> without deviating from the traveling lane based on the road shape and the vehicle condition information <NUM> (such as a vehicle speed). At this time, the traveling assistance control device <NUM>-G may make the determination in consideration of a road condition (coefficient of road friction). The road condition can be estimated by a known technology using the vehicle condition information <NUM> (such as a vehicle speed or a wheel speed) or the surrounding condition information <NUM> (such as imaging information). A second execution condition for the lane keeping control is that the vehicle <NUM> may fail to navigate the curve ahead of the vehicle <NUM> without deviating from the traveling lane. When the second execution condition is satisfied, the traveling assistance control device <NUM>-G generates the traveling assistance trajectory TR1-G that requests deceleration of the vehicle <NUM> to suppress the lane deviation at the curve ahead of the vehicle <NUM>.

While the execution condition is satisfied, the traveling assistance control device <NUM>-G may repeatedly generate the traveling assistance trajectory TR1-G in each predetermined cycle, that is, update the traveling assistance trajectory TR1-G.

<FIG> is a conceptual diagram for describing the emergency stop trajectory TR2-G. The emergency stop trajectory TR2-G is a second target trajectory TR2 for decelerating and stopping the vehicle <NUM>. In particular, the emergency stop trajectory TR2-G is a second target trajectory TR2 for promptly stopping the vehicle <NUM> in a current traveling lane. In the example illustrated in <FIG>, the vehicle <NUM> is promptly stopped along the emergency stop trajectory TR2-G in the current traveling lane without steering.

The traveling assistance control device <NUM>-G repeatedly generates the emergency stop trajectory TR2-G in each predetermined cycle, that is, updates the emergency stop trajectory TR2-G. It is appropriate that the traveling assistance control device <NUM>-G update and output the emergency stop trajectory TR2-G "continuously". The term "continuously" is herein a concept including both "constantly" and "intermittently". For example, the output of the emergency stop trajectory TR2-G may be suspended for quite a short time. Also in this case, it can be said that the output of the emergency stop trajectory TR2-G is continuous in the long term.

The vehicle traveling control device <NUM> receives the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D output from the autonomous driving control device <NUM>-D. The vehicle traveling control device <NUM> also receives the emergency stop trajectory TR2-G output from the traveling assistance control device <NUM>-G. When the execution condition for the traveling assistance control is satisfied, the vehicle traveling control device <NUM> receives the traveling assistance trajectory TR1-G output from the traveling assistance control device <NUM>-G. The vehicle traveling control device <NUM> stores the received target trajectories TR (TR1-D, TR2-D, TR1-G, and TR2-G) in the storage device <NUM>. The vehicle traveling control device <NUM> executes the vehicle traveling control based on at least one target trajectory TR.

<FIG> is a conceptual diagram for describing rules of the vehicle traveling control of this embodiment.

When the autonomous driving control device <NUM>-D malfunctions, the autonomous driving trajectory TR1-D is disabled. Even if the autonomous driving control device <NUM>-D recovers from the malfunction, the autonomous driving trajectory TR1-D remains disabled. When the execution condition for the traveling assistance control is satisfied and the traveling assistance trajectory TR1-G is output, the limp home trajectory TR2-D is disabled. When the traveling assistance control device <NUM>-G malfunctions, the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D are disabled.

The autonomous driving trajectory TR1-D, the limp home trajectory TR2-D, and the emergency stop trajectory TR2-G have priority levels in descending order. That is, the priority level of the autonomous driving trajectory TR1-D is highest, and the priority level of the emergency stop trajectory TR2-G is lowest.

When the autonomous driving trajectory TR1-D is enabled, the vehicle traveling control is executed based on the autonomous driving trajectory TR1-D. When the autonomous driving trajectory TR1-D is disabled, the vehicle traveling control is executed based on the limp home trajectory TR2-D having the second highest priority level. When both the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D are disabled, the vehicle traveling control is executed based on the emergency stop trajectory TR2-G.

When the execution condition for the traveling assistance control is satisfied and the traveling assistance trajectory TR1-G is output, arbitration between the traveling assistance trajectory TR1-G and the other target trajectory TR (TR1-D or TR2-G) is performed.

In the steering control, the traveling assistance trajectory TR1-G has a higher priority level. That is, the steering control is executed based on the traveling assistance trajectory TR1-G.

In the deceleration control, a target trajectory TR that requests the highest deceleration level has the highest priority level. For example, when the traveling assistance trajectory TR1-G requests a relatively high deceleration level (for example, -<NUM>) and the autonomous driving trajectory TR1-D requests a relatively low deceleration level (for example, -<NUM>), the traveling assistance trajectory TR1-G has a higher priority level. When the autonomous driving trajectory TR1-D requests a relatively high deceleration level (for example, -<NUM>) and the traveling assistance trajectory TR1-G requests a relatively low deceleration level (for example, -<NUM>), the autonomous driving trajectory TR1-D has a higher priority level.

The vehicle traveling control device <NUM> may report the arbitration result to the autonomous driving control device <NUM>-D and the traveling assistance control device <NUM>-G.

Various examples of the vehicle traveling control in accordance with the rules described above are described below.

<FIG> is a timing chart for describing a first example of the vehicle traveling control according to this embodiment.

In the first example, both the autonomous driving control device <NUM>-D and the traveling assistance control device <NUM>-G are normal, that is, the malfunctioning device 100F does not exist. The autonomous driving control device <NUM>-D generates (updates) and outputs the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D. The traveling assistance control device <NUM>-G generates (updates) and outputs the emergency stop trajectory TR2-G. The execution condition for the traveling assistance control is not satisfied, and the traveling assistance control device <NUM>-G does not output the traveling assistance trajectory TR1-G. This state is hereinafter referred to as a "first state".

In the first state, the priority level of the autonomous driving trajectory TR1-D is highest. Thus, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the autonomous driving trajectory TR1-D. That is, the vehicle traveling control device <NUM> executes the vehicle traveling control such that the vehicle <NUM> follows the autonomous driving trajectory TR1-D.

<FIG> is a timing chart for describing a second example of the vehicle traveling control according to this embodiment. Description overlapping that of the first example is omitted as appropriate.

The execution condition for the traveling assistance control is satisfied during the first state. The traveling assistance control device <NUM>-G generates and outputs the traveling assistance trajectory TR1-G. This state is hereinafter referred to as a "second state".

In the example illustrated in <FIG>, a period from a time t1 to a time t2 corresponds to the second state. The traveling assistance control device <NUM>-G reports the start and end of the traveling assistance control to the vehicle traveling control device <NUM> and the autonomous driving control device <NUM>-D. Based on the report, the vehicle traveling control device <NUM> recognizes the execution of the traveling assistance control. Also during the execution of the traveling assistance control, the autonomous driving control device <NUM>-D generates (updates) and outputs the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D.

In the second state, the vehicle traveling control device <NUM> disables the limp home trajectory TR2-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the autonomous driving trajectory TR1-D and the traveling assistance trajectory TR1-G. More specifically, the vehicle traveling control device <NUM> performs arbitration between the autonomous driving trajectory TR1-D and the traveling assistance trajectory TR1-G in accordance with the arbitration rule described above, and executes the vehicle traveling control based on the arbitration result.

<FIG> is a timing chart for describing a third example of the vehicle traveling control according to this embodiment. Description overlapping those of the above examples is omitted as appropriate.

The autonomous driving control device <NUM>-D malfunctions, that is, the autonomous driving control device <NUM>-D is the malfunctioning device 100F during the first state. This state is hereinafter referred to as a "third state".

In the example illustrated in <FIG>, a period from a time t1 to a time t2 corresponds to the third state. The autonomous driving control device <NUM>-D detects its malfunction, and outputs an error signal to the vehicle traveling control device <NUM> and the traveling assistance control device <NUM>-G. Based on the error signal, the vehicle traveling control device <NUM> recognizes the malfunction in the autonomous driving control device <NUM>-D.

In the third state, the vehicle traveling control device <NUM> disables the autonomous driving trajectory TR1-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the limp home trajectory TR2-D in accordance with the priority rule described above.

While the autonomous driving control device <NUM>-D malfunctions, the limp home trajectory TR2-D is not appropriately updated or output. Thus, the vehicle traveling control device <NUM> executes the vehicle traveling control based on a limp home trajectory TR2-D output from the autonomous driving control device <NUM>-D before the malfunction occurs. For example, the vehicle traveling control device <NUM> executes the vehicle traveling control based on a limp home trajectory TR2-D output from the autonomous driving control device <NUM>-D for the last time before the malfunction occurs. Thus, the vehicle <NUM> stops at a safe position.

The autonomous driving trajectory TR1-D remains disabled also after the time t2 when the autonomous driving control device <NUM>-D recovers from the malfunction.

<FIG> is a timing chart for describing a fourth example of the vehicle traveling control according to this embodiment. Description overlapping those of the above examples is omitted as appropriate.

In the third embodiment above, the traveling assistance control device <NUM>-G also malfunctions, that is, both the autonomous driving control device <NUM>-D and the traveling assistance control device <NUM>-G are the malfunctioning devices 100F during the third state. This state is hereinafter referred to as a "fourth state".

In the example illustrated in <FIG>, a period after a time t2 corresponds to the fourth state. The traveling assistance control device <NUM>-G detects its malfunction, and outputs an error signal to the vehicle traveling control device <NUM> and the autonomous driving control device <NUM>-D. Based on the error signal, the vehicle traveling control device <NUM> recognizes the malfunction in the traveling assistance control device <NUM>-G.

In the fourth state, the vehicle traveling control device <NUM> disables the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G in accordance with the priority rule described above.

While the traveling assistance control device <NUM>-G malfunctions, the emergency stop trajectory TR2-G is not appropriately updated or output. Thus, the vehicle traveling control device <NUM> executes the vehicle traveling control based on an emergency stop trajectory TR2-G output from the traveling assistance control device <NUM>-G before the malfunction occurs. For example, the vehicle traveling control device <NUM> executes the vehicle traveling control based on an emergency stop trajectory TR2-G output from the traveling assistance control device <NUM>-G for the last time before the malfunction occurs. Thus, the vehicle <NUM> stops.

<FIG> is a timing chart for describing a fifth example of the vehicle traveling control according to this embodiment. Description overlapping those of the above examples is omitted as appropriate.

The execution condition for the traveling assistance control is satisfied during the third state. The traveling assistance control device <NUM>-G generates and outputs the traveling assistance trajectory TR1-G. This state is hereinafter referred to as a "fifth state". In the example illustrated in <FIG>, a period after a time t2 corresponds to the fifth state.

In the fifth state, the vehicle traveling control device <NUM> disables the limp home trajectory TR2-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G in accordance with the priority rule described above.

At this time, the traveling assistance trajectory TR1-G is also output. Thus, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the traveling assistance trajectory TR1-G and the emergency stop trajectory TR2-G output from the traveling assistance control device <NUM>-G. More specifically, the vehicle traveling control device <NUM> performs arbitration between the traveling assistance trajectory TR1-G and the emergency stop trajectory TR2-G in accordance with the arbitration rule described above, and executes the vehicle traveling control based on the arbitration result. Whether the steering control is executed depends on the traveling assistance trajectory TR1-G, but at least the deceleration control is executed. Thus, the vehicle <NUM> stops.

<FIG> is a timing chart for describing a sixth example of the vehicle traveling control to be executed by the vehicle control system according to this embodiment. Description overlapping those of the above examples is omitted as appropriate.

The traveling assistance control device <NUM>-G malfunctions, that is, the traveling assistance control device <NUM>-G is the malfunctioning device 100F during the first state. This state is hereinafter referred to as a "sixth state". In the example illustrated in <FIG>, a period after a time t1 corresponds to the sixth state.

In the sixth state, the vehicle traveling control device <NUM> disables the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G in accordance with the priority rule described above.

<FIG> is a timing chart for describing a seventh example, which is a non-claimed example, of the vehicle traveling control according to this embodiment. Description overlapping those of the above examples is omitted as appropriate.

The autonomous driving control device <NUM>-D malfunctions, that is, the autonomous driving control device <NUM>-D is the malfunctioning device 100F during the second state. This state is hereinafter referred to as a "seventh state". In the example illustrated in <FIG>, a period after a time t2 corresponds to the seventh state.

In the seventh state, the vehicle traveling control device <NUM> disables the autonomous driving trajectory TR1-D in accordance with the disabling rule described above. Since the execution of the traveling assistance control continues, the limp home trajectory TR2-D remains disabled. Thus, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G in accordance with the priority rule described above.

<FIG> is a timing chart for describing an eighth example of the vehicle traveling control according to this embodiment. Description overlapping those of the above examples is omitted as appropriate.

The traveling assistance control device <NUM>-G malfunctions, that is, the traveling assistance control device <NUM>-G is the malfunctioning device 100F during the second state. This state is hereinafter referred to as an "eighth state". In the example illustrated in <FIG>, a period after a time t2 corresponds to the eighth state.

In the eighth state, the vehicle traveling control device <NUM> disables the autonomous driving trajectory TR1-D and the limp home trajectory TR2-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G in accordance with the priority rule described above.

The vehicle traveling control device <NUM> stores the traveling assistance trajectory TR1-G output from the traveling assistance control device <NUM>-G before the malfunction occurs. After the malfunction occurs, the vehicle traveling control device <NUM> may execute the traveling assistance control in a feedforward manner in consideration of the traveling assistance trajectory TR1-G as well. That is, in the eighth state, the vehicle traveling control device <NUM> may execute the vehicle traveling control based on the traveling assistance trajectory TR1-G and the emergency stop trajectory TR2-G output from the traveling assistance control device <NUM>-G before the malfunction occurs. More specifically, the vehicle traveling control device <NUM> performs arbitration between the traveling assistance trajectory TR1-G and the emergency stop trajectory TR2-G in accordance with the arbitration rule described above, and executes the vehicle traveling control based on the arbitration result. Thus, at least the deceleration control is executed, and the vehicle <NUM> stops.

As described above, when the malfunctioning device 100F exists, the vehicle traveling control device <NUM> according to this embodiment executes the vehicle traveling control based on the limp home trajectory TR2-D or the emergency stop trajectory TR2-G. Specifically, when the autonomous driving control device <NUM>-D malfunctions, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the limp home trajectory TR2-D output before the malfunction occurs, or based on the emergency stop trajectory TR2-G output from the normal traveling assistance control device <NUM>-G. When the traveling assistance control device <NUM>-G malfunctions, the vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G output before the malfunction occurs. Thus, the vehicle <NUM> stops promptly, and the safety of the vehicle <NUM> is secured. This operation contributes to improvement in the reliability of the vehicle control system <NUM>.

A fifth embodiment is a modified example of the fourth embodiment. Description overlapping that of the fourth embodiment is omitted as appropriate.

<FIG> is a block diagram schematically illustrating the configuration of a vehicle control system <NUM> according to the fifth embodiment. In the fifth embodiment, the limp home trajectory TR2-D is omitted. That is, the autonomous driving control device <NUM>-D generates and outputs only the autonomous driving trajectory TR1-D.

<FIG> is a timing chart for describing an example of vehicle traveling control according to this non-claimed example. The autonomous driving control device <NUM>-D malfunctions, that is, the autonomous driving control device <NUM>-D is the malfunctioning device 100F during the first state. This state is hereinafter referred to as a "ninth state". In the example illustrated in <FIG>, a period from a time t1 to a time t2 corresponds to the ninth state.

In the ninth state, the vehicle traveling control device <NUM> disables the autonomous driving trajectory TR1-D in accordance with the disabling rule described above. The vehicle traveling control device <NUM> executes the vehicle traveling control based on the emergency stop trajectory TR2-G output from the traveling assistance control device <NUM>-G. Thus, the vehicle <NUM> stops. As compared to the third state illustrated in <FIG>, the limp home trajectory TR2-D does not exist, and therefore the emergency stop trajectory TR2-G is used as a substitute for the limp home trajectory TR2-D.

The vehicle traveling control in the other states is similar to that of the fourth embodiment (see <FIG> and <FIG>).

Claim 1:
A vehicle control system configured to control a vehicle (<NUM>), the vehicle control system comprising:
a first target trajectory generation device (<NUM>-A) configured to generate and output target trajectories each including a target position and a target speed of the vehicle (<NUM>);
a second target trajectory generation device (<NUM>-B) configured to generate and output target trajectories each including a target position and a target speed of the vehicle (<NUM>); and
a vehicle traveling control device (<NUM>) configured to receive the target trajectories output from the first and the second target trajectory generation devices (<NUM>-A, <NUM>-B), and execute vehicle traveling control for controlling traveling of the vehicle (<NUM>) based on the received target trajectories, wherein
a first target trajectory is the target trajectory for at least one of steering, acceleration, and deceleration of the vehicle (<NUM>),
a second target trajectory is the target trajectory for decelerating and stopping the vehicle (<NUM>),
the vehicle traveling control device (<NUM>) is configured to execute, when the second target trajectory generation device (<NUM>-B) does not malfunction, the vehicle traveling control based on the first target trajectory output from one of the first and the second target trajectory generation devices (<NUM>-A, <NUM>-B), and
the vehicle control system is characterized in that the vehicle traveling control device (<NUM>) is configured to stop, when the second target trajectory generation device (<NUM>-B) malfunctions, the vehicle (<NUM>) by executing the vehicle traveling control based on the second target trajectory output from the first target trajectory generation device (<NUM>-A).