JP7800524B2 - Control device, automatic driving device and driving control device - Google Patents

Description

This specification discloses technology for responding to collisions during autonomous vehicle driving.

Patent Document 1 discloses that a vehicle issues a warning that autonomous driving cannot continue, using a warning method that corresponds to the driver's condition.

Japanese Patent Application Laid-Open No. 2017-107502

Even during autonomous driving, when the driver is not required to monitor the surroundings, it is possible that the vehicle may collide with another object, making it impossible to continue autonomous driving. In such a situation, if the driver is not monitoring the surroundings, it will be difficult for them to immediately grasp what has happened. This raises concerns that a smooth handover of driving may not be possible.

One of the purposes of the disclosure of this specification is to provide a control device that enables a smooth handover of control to the driver. It is also to provide an automatic driving device and a cruise control device that are suitable for this control device.

One aspect disclosed herein is a control device that controls in-vehicle devices (21, 22, 23, 24, 25, 28) in a vehicle (Am) that can be driven by automatic driving and in which the driver is not required to monitor the surroundings,
an information grasping unit (81, 82) that grasps collision occurrence information indicating whether or not a collision has occurred between the autonomously driven vehicle and another object, and vehicle control information indicating a state of control of the vehicle after control of the vehicle corresponding to the collision has been executed;
The system is provided with a notification control unit (88) that performs both a notification indicating the state of vehicle control after executing vehicle control corresponding to a collision , and a notification from the system side requesting or warning the driver to take over driving.

In this manner, even if the driver is not monitoring their surroundings, both notifications are issued, allowing the driver to understand the vehicle's control status in response to a collision and what they should do. As a result, the driver can begin taking over driving after understanding the vehicle's control status, enabling a smooth handover of driving to the next driver.

Another aspect disclosed herein is an automatic driving device configured to be able to communicate with the control device described above and performing automatic driving of a vehicle,
a collision recognition unit (74) that recognizes the occurrence of a collision between a plurality of other objects in the vicinity of the vehicle;
and an action determination unit (63) that changes the response regarding the control of the automatic driving in accordance with the determination of whether or not the vehicle can move away from the scene of the collision.

Another aspect disclosed herein is a driving control device configured to be able to communicate with the control device described above and configured to control driving of a vehicle,
A movement limiting section (40b) is provided for limiting the movement of the vehicle in response to the occurrence of a collision after the collision has occurred.

In these aspects, it is possible to provide an automatic driving device and a driving control device that are suitable for the control device described above.

Note that the reference symbols in parentheses in the claims and other sections are intended to exemplify the correspondence with the embodiments described below and are not intended to limit the technical scope.

FIG. 1 is a configuration diagram showing an overall view of a vehicle system. FIG. 2 is a configuration diagram showing details of an autonomous driving ECU. FIG. 2 is a configuration diagram showing details of an HCU. 4 is a flowchart showing a processing method performed by the vehicle system. FIG. 10 is a diagram showing an example in which two notifications are both performed. 10 is a flowchart showing a processing method by the HCU. FIG. 10 is a diagram showing an example of an accompanying notification. 10 is a flowchart showing a processing method by the HCU. 4 is a flowchart showing a processing method performed by the vehicle system. FIG. 1 is a configuration diagram showing an overall view of a vehicle system. 10 is a flowchart showing a processing method by the HCU. FIG. 10 is a diagram showing an example of a notification pattern. FIG. 10 is a diagram showing an example of a notification pattern. FIG. 10 is a diagram showing an example of a notification pattern. FIG. FIG. 1 is a configuration diagram showing an overall view of a vehicle system. 10 is a flowchart showing a processing method by the HCU. FIG. 1 is a configuration diagram showing an overall view of a vehicle system. FIG. 2 is a configuration diagram showing details of an HCU. 4 is a flowchart showing a processing method performed by the vehicle system. 4 is a flowchart showing a processing method performed by the vehicle system. FIG. 2 is a diagram showing the details of a driving control ECU. 4 is a flowchart showing a processing method performed by the vehicle system. 4 is a flowchart showing a processing method performed by the vehicle system.

Below, several embodiments will be described based on the drawings. Note that corresponding components in each embodiment will be given the same reference numerals, and duplicate explanations may be omitted. When only a portion of the configuration is described in each embodiment, the configuration of another previously described embodiment can be applied to the remaining portions of that configuration. Furthermore, in addition to the combinations of configurations explicitly stated in the description of each embodiment, configurations of several embodiments can also be partially combined together even if not explicitly stated, as long as there are no particular problems with the combination.

(First embodiment)
The vehicle system 1 can be used in a vehicle capable of automatic driving (hereinafter referred to as an automatic driving vehicle). Automatic driving may also be referred to as autonomous traveling. As shown in FIG. 1 , the vehicle system 1 includes a perimeter monitoring sensor 30, a locator 35, a navigation ECU 38, an on-board communication device 39, a cruise control ECU 40, a body ECU 43, a driving assistance ECU 50a, an automatic driving ECU 50b, and an HCU 100. The perimeter monitoring sensor 30, the locator 35, the navigation ECU 38, the on-board communication device 39, the cruise control ECU 40, the body ECU 43, the driving assistance ECU 50a, the automatic driving ECU 50b, and the HCU 100 are communicatively connected to a communication bus 99 of an on-board network mounted in the host vehicle Am. These nodes connected to the communication bus 99 can communicate with each other. Specific nodes among these devices and ECUs may be directly electrically connected to each other by wire harnesses or the like and be able to communicate without using the communication bus 99.

There can be multiple levels of autonomous driving for autonomous vehicles (hereinafter referred to as "automation levels"), as defined by the SAE, for example. Automation levels are classified, for example, as follows: Levels 0 to 5.

Level 0 is the level at which the driver performs all driving tasks without system intervention. The driving task may also be referred to as the dynamic driving task. Examples of driving tasks include steering, acceleration/deceleration, and surrounding monitoring. Level 0 corresponds to so-called fully manual driving. Level 1 is the level at which the system assists with either steering or acceleration/deceleration. Level 1 corresponds to so-called driving assistance. Level 2 is the level at which the system assists with both steering and acceleration/deceleration. Level 2 corresponds to partial driving automation. For example, at levels 1 and 2, the driver has the responsibility to monitor safe driving (hereinafter simply referred to as the monitoring responsibility). In other words, levels 1 and 2 can be classified as manual driving in a broad sense. Monitoring duties include visual monitoring of the surroundings.

Level 3 is a level at which the system can perform all driving tasks under certain conditions, with the driver taking over driving operations in an emergency. LV3 autonomous driving requires the driver to be able to respond quickly when the system requests a handover of driving. This handover can also be described as the transfer of the responsibility for monitoring the surrounding area from the vehicle's system to the driver. Level 3 corresponds to so-called conditional automated driving. Level 3 includes area-limited level 3, which is limited to specific areas. The specific area referred to here may be a highway. The specific area may be, for example, a specific lane. Level 3 also includes congestion-limited level 3, which is limited to traffic jams. Congestion-limited level 3 autonomous driving corresponds to congestion-limited autonomous driving. Congestion-limited level 3 may be configured to be limited to traffic jams on highways, for example. Expressways may include expressways.

Level 4 is a level at which the system can perform all driving tasks except under certain circumstances such as on unmanageable roads or in extreme environments. Level 4 corresponds to what is known as highly automated driving. Level 5 automated driving is a level at which the system can perform all driving tasks in any environment. Level 5 corresponds to what is known as fully automated driving. Levels 4 and 5 automated driving can be performed, for example, on driving sections where high-precision map data has been developed. High-precision map data will be discussed later.

For example, levels 3 to 5 may be classified as autonomous driving. Autonomous driving at levels 3 to 5 can be said to be autonomous driving where the driver has no supervisory responsibility. During autonomous driving at levels 3 to 5, a second task may be permitted. A second task is an action other than driving that the driver is permitted to perform, and is a specific action that has been specified in advance. A second task can also be referred to as work other than the driving task. A second task can also be referred to as a secondary activity, other activity, etc. A second task must not prevent the driver from responding to a request from the autonomous driving system 50 to take over driving operations (hereinafter referred to as a driving handover request). As examples, actions such as watching content such as videos, operating a smartphone, reading, and eating are considered as second tasks.

Of levels 3 to 5 of autonomous driving, levels 4 and above correspond to autonomous driving in which the driver is permitted to sleep. In other words, they correspond to sleep-permitted autonomous driving. Levels 4 and above can also be described as autonomous driving in which the driver does not need to take over driving, even in an emergency. Of levels 3 to 5 of autonomous driving, level 3 corresponds to autonomous driving in which the driver is not permitted to sleep (hereinafter referred to as sleep-non-permitted autonomous driving). The autonomous vehicle of this embodiment is assumed to have switchable automation levels. The automation level may be configured to be switchable only between some of levels 0 to 5. The autonomous vehicle of this embodiment is at least capable of switching between autonomous driving without supervisory obligation and manual driving.

The perimeter monitoring sensor 30 is an autonomous sensor that monitors the environment surrounding the host vehicle Am. The perimeter monitoring sensor 30 includes, for example, one or more of a camera unit 31, a millimeter-wave radar 32, a lidar 33, and a sonar 34. The perimeter monitoring sensor 30 is capable of detecting moving and stationary objects within a detection range around the host vehicle. The perimeter monitoring sensor 30 provides detection information about objects around the host vehicle to the driving assistance ECU 50a, the autonomous driving ECU 50b, etc.

The locator 35 includes a GNSS (Global Navigation Satellite System) receiver and an inertial sensor. The locator 35 combines positioning signals received from multiple positioning satellites by the GNSS receiver, measurement results from the inertial sensor, and vehicle speed information output to the communication bus 99, to sequentially determine the position and direction of the host vehicle Am. The locator 35 sequentially outputs position information and direction information for the host vehicle Am based on the positioning results to the communication bus 99 as locator information.

The locator 35 also has a map database (hereinafter referred to as map DB) 36 that stores map data. The map DB 36 is primarily composed of a large-capacity storage medium that stores a large amount of 3D and 2D map data. The 3D map data is a so-called HD (High Definition) map, and includes road information necessary for autonomous driving. Specifically, the 3D map data includes 3D road shape information and detailed information about each lane. The locator 35 can update the 3D and 2D map data to the latest information through external communication via the on-board communication device 39. The locator 35 reads map data for the area around the current location from the map DB 36 and provides it to the driving assistance ECU 50a, autonomous driving ECU 50b, etc., along with locator information.

The navigation ECU 38 acquires destination information specified by the occupants, including the driver, based on operation information acquired from the HCU 100. The navigation ECU 38 acquires vehicle position information and direction information from the locator 35 and sets a route from the current position to the destination. The navigation ECU 38 provides route information indicating the set route to the destination to the driving assistance ECU 50a, autonomous driving ECU 50b, HCU 100, etc. The navigation ECU 38 works in conjunction with the HMI system 10 to provide route guidance to the destination by combining screen displays and voice messages, etc., and notifying the driver of the direction of travel of the vehicle Am at intersections, branching points, etc.

Here, a user terminal such as a smartphone may be connected to the in-vehicle network or HCU 100. Such a user terminal may provide vehicle position information, direction information, map data, etc. to the driving assistance ECU 50a and autonomous driving ECU 50b, etc., instead of the locator 35. Furthermore, the user terminal may provide route information to the destination to the driving assistance ECU 50a, autonomous driving ECU 50b, HCU 100, etc., instead of the navigation ECU 38.

The on-board communication device 39 is an external communication unit mounted on the host vehicle Am and functions as a V2X (Vehicle to Everything) communication device. The on-board communication device 39 transmits and receives information via wireless communication with roadside devices installed on the side of the road. As an example, the on-board communication device 39 receives congestion information and road construction information around the current location of the host vehicle Am and in the direction of travel from the roadside devices. The congestion information and road construction information is VICS (registered trademark) information, etc. The on-board communication device 39 provides the received congestion information and road construction information to the autonomous driving ECU 50b, HCU 100, etc.

The cruise control ECU 40 is an electronic control device that primarily includes a microcontroller. The cruise control ECU 40 has at least the functions of a brake control ECU, drive control ECU, and steering control ECU. The cruise control ECU 40 continuously controls the braking force of each wheel using the brake actuator 41, controls the output of the on-board power source, and controls the steering angle based on one of the operation commands based on the driver's driving operation, the control commands of the driving assistance ECU 50a, and the control commands of the autonomous driving ECU 50b.

The body ECU 43 is an electronic control device that primarily includes a microcontroller. The body ECU 43 has at least the function of controlling the operation of lighting devices (e.g., turn signals 44, hazard lights 45, etc.) installed on the vehicle Am. Based on the detection of a user operation input to a turn signal switch (winker lever) provided on the steering column or the like, the body ECU 43 initiates flashing of either the left or right turn signal 44 corresponding to the operation direction.

The body ECU 43 also controls a door lock motor 46 that opens and closes the door lock mechanism of the host vehicle Am. The body ECU 43 also controls a power window 47 that opens and closes the side windows of the host vehicle Am.

The driving assistance ECU 50a and the autonomous driving ECU 50b make up the autonomous driving system 50 of the host vehicle Am. The driving assistance ECU 50a implements a driving assistance function in the autonomous driving system 50 that assists the driver in driving operations. The driving assistance ECU 50a enables driving assistance of around level 2 or partial autonomous driving.

The autonomous driving ECU 50b can take over driving operations from the driver and can implement autonomous driving at level 3 or higher, where the system is the main controller. The autonomous driving implemented by the autonomous driving ECU 50b does not require monitoring of the vehicle's surroundings, i.e., it is eyes-off autonomous driving where the driver is not required to monitor the surroundings.

In the above-described autonomous driving system 50, the driving control state of the autonomous driving function is switched between multiple states, including at least driving assistance control by the driving assistance ECU 50a, which requires surrounding area monitoring, and autonomous driving control by the autonomous driving ECU 50b, which does not require surrounding area monitoring.

The driving assistance ECU 50a is a computer that primarily includes a control circuit equipped with a processing unit, RAM (Random Access Memory), a storage unit, an input/output interface, and a bus connecting these. The driving assistance ECU 50a implements driving assistance functions such as ACC (Adaptive Cruise Control), LTC (Lane Trace Control), and LCA (Lane Change Assist) by executing programs in the processing unit. ACC, LTC, and LCA are referred to as driving assistance applications. The driving assistance ECU 50a provides control status information indicating the state of driving assistance control to the autonomous driving ECU 50b.

The processing unit may include at least one processor. The processor may include at least one type of core, such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), or RISC (Reduced Instruction Set Computer)-CPU. The storage unit may include at least one type of non-transitory tangible storage medium, such as semiconductor memory, magnetic media, or optical media, that non-temporarily stores programs and data readable by the processor 51b.

The autonomous driving ECU 50b has higher computing power than the driving assistance ECU 50a and can perform at least driving control equivalent to ACC and LTC. In situations where control by the driving assistance ECU 50a is temporarily interrupted, the autonomous driving ECU 50b may be able to perform driving assistance control in place of the driving assistance ECU 50a, which requires the driver to monitor the surroundings.

The autonomous driving ECU 50b is a computer that mainly includes a processing unit 51, RAM 52, memory unit 53, input/output interface 54, and a control circuit equipped with a bus connecting these. The processing unit 51 accesses RAM 52 to execute various processes for implementing the autonomous driving control method of the present disclosure. The memory unit 53 stores various programs (such as an autonomous driving control program) executed by the processing unit 51.

The processing unit 51 may include at least one processor. The processor may include at least one type of core, such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), or RISC (Reduced Instruction Set Computer)-CPU. The storage unit 53 may include at least one type of non-transient tangible storage medium, such as semiconductor memory, magnetic media, or optical media, that non-temporarily stores programs and data that can be read by the processor.

By executing the program by the processing unit 51, the autonomous driving ECU 50b is configured with multiple functional units for realizing the autonomous driving function, such as an information linkage unit 61, an environment recognition unit 62, an action determination unit 63, and a control execution unit 64 (see Figure 2).

The information linking unit 61 provides information to and acquires information from the information linking unit 82 of the HCU 100, which will be described later. Through the linkage between these information linking units 61 and 82, the autonomous driving ECU 50b and the HCU 100 share the information they have acquired. The information linking unit 61 generates control status information indicating the operating status of the autonomous driving function, and provides the generated control status information to the information linking unit 82. The control status information includes collision occurrence information indicating that the host vehicle Am has collided with another object. The collision occurrence information is, for example, the result of the determination performed in the collision determination process (see S12 in Figure 4), which will be described later. The control status information also includes restriction information for the autonomous driving function.

The information linking unit 61 outputs control status information to the information linking unit 82, enabling the HCU 100 to issue notifications synchronized with the operating status of the autonomous driving function. In addition, the information linking unit 61 acquires operation information from the driver or other occupants from the information linking unit 82 and understands the content of user operations input to the HMI system 10, etc.

The environment recognition unit 62 has a vehicle recognition unit 72 and a road information recognition unit 73 as sub-functional units for recognizing the driving environment. The vehicle recognition unit 72 recognizes the relative position and relative speed of dynamic objects around the vehicle, such as other vehicles traveling around the vehicle Am. The vehicle recognition unit 72 recognizes at least the vehicles ahead and behind traveling in the same lane as the vehicle Am (hereinafter referred to as the vehicle lane), and vehicles to the side traveling in an adjacent lane adjacent to the vehicle lane. When the vehicle Am is traveling on a road with three or more lanes, the vehicle recognition unit 72 recognizes vehicles to the side traveling in a separated lane located on the opposite side of the vehicle lane across the adjacent lane.

The environment recognition unit 62 has sub-functional units for recognizing the driving environment, including an other vehicle recognition unit 72, a road information recognition unit 73, and a collision recognition unit 74. The other vehicle recognition unit 72 recognizes the relative position and relative speed of dynamic objects around the host vehicle, such as other vehicles traveling around the host vehicle Am. The other vehicle recognition unit 72 recognizes at least the vehicles ahead and behind traveling in the same lane as the host vehicle Am (hereinafter referred to as the host vehicle lane), and vehicles to the side traveling in an adjacent lane adjacent to the host vehicle lane. When the host vehicle Am is traveling on a road with three or more lanes, the other vehicle recognition unit 72 recognizes vehicles to the side traveling in a separated lane located on the opposite side of the host vehicle lane across the adjacent lane.

The road information grasping unit 73 grasps information related to the road on which the host vehicle Am is traveling. When the road information grasping unit 73 acquires route information from the navigation ECU 38, it extracts specific points on the road on which the host vehicle Am is scheduled to travel, specifically, branch points (junctions, etc.) on expressways, merge points, and exit points. Furthermore, the road information grasping unit 73 grasps congested sections where congestion is occurring, and restricted sections where restrictions are in place due to road construction, etc., on the road on which the host vehicle Am is scheduled to travel.

The road information grasping unit 73 grasps whether the road on which the host vehicle Am is traveling or is scheduled to travel is within a preset permission area or limited permission area. Information indicating whether the road is a permission area or a limited permission area may be recorded in the map data stored in the map DB 36, or may be included in the information received by the on-board communication device 39. Specifically, the autonomous driving includes multiple control modes: congestion-limited control (hereinafter, "Congestion Level 3"), which is implemented only when traveling in congestion, and area-limited control (hereinafter, "Area Level 3"), which is implemented only within a specific permission area. On roads within a permission area, both congestion level 3 and area level 3 are permitted, while on roads within a limited area, only congestion level 3 is permitted. Automated driving is prohibited on roads that are not included in either a permission area or a limited permission area (hereinafter, "Non-permitted Area"). Permitted areas and limited permission areas are set, for example, on expressways or expressways.

The collision recognition unit 74 recognizes the occurrence of a collision between the host vehicle Am and another object. Specifically, the collision recognition unit 74 recognizes a collision based on the video captured by the camera unit 31, information from the acceleration sensor 37 (G sensor) that detects the acceleration occurring in the host vehicle Am, and the like. The collision recognition unit 74 may further recognize at least one of the type of object that has collided, the part of the body of the host vehicle Am that has collided, and the severity of the collision. The collision recognition unit 74 provides the information linkage unit 61 with the presence or absence of a collision, the type of object that has collided, the part that has collided, and the severity of the collision as collision occurrence information.

The type of object that has been hit may be another vehicle, a bicycle, a pedestrian, a building, a structure such as a utility pole, or fallen objects on the road. The collision recognition unit 74 can recognize the type of object that has been hit from the video captured by the camera unit 31, the point cloud acquired by the lidar 33, etc.

The impacted area may be the front part of the vehicle, a side part of the vehicle, a rear part of the vehicle, etc. The impacted area may also be identified in more detail. The impacted area may be identified by parts that make up the vehicle, such as the front bumper, rear bumper, driver's door, or right rear wheel. The impact recognition unit 74 may recognize the impacted area based on images captured by the camera unit 31, information from the acceleration sensor, and the failure status of the perimeter monitoring sensors 30 installed in various parts.

The degree of collision may be the strength of the impact at the time of collision. Alternatively, the degree of collision may be the degree of collision damage. The collision recognition unit 74 may determine the image captured by the camera unit 31, the failure status of components such as the perimeter monitoring sensor 30, and the degree of collision damage.

The behavior determination unit 63 works in cooperation with the driving assistance ECU 50a and the HCU 100 to control the autonomous driving system 50 and the driver's handover. When the autonomous driving ECU 50b has control of the driving operation, the behavior determination unit 63 generates a planned driving line for the host vehicle Am to travel based on the results of recognition of the driving environment by the environment recognition unit 62, and outputs the generated planned driving line to the control execution unit 64.

When the autonomous driving ECU 50b has control of driving operations, the control execution unit 64 works in conjunction with the cruise control ECU 40 to execute acceleration/deceleration control, steering control, and other control of the host vehicle Am in accordance with the planned driving line generated by the behavior determination unit 63. Specifically, the control execution unit 64 generates control commands based on the planned driving line and sequentially outputs the generated control commands to the cruise control ECU 40.

As shown in FIG. 1, the HCU 100 is electrically connected to multiple display devices, an audio device 24, ambient lighting 25, and an operation device 26. The HCU 100, multiple display devices, audio device 24, ambient lighting 25, and operation device 26 constitute the HMI system 10 of the host vehicle Am.

The display devices visually notify the driver or other passengers of information by displaying images, etc. Display devices include a meter display 21, a center information display (hereinafter referred to as CID) 22, and a head-up display (hereinafter referred to as HUD) 23. The CID 22 has touch panel functionality and detects touch operations on the display screen by the driver or other passengers. In other words, the CID 22 also corresponds to the operation device 26.

The audio system 24 has multiple speakers installed in the vehicle cabin, surrounding the driver's seat, and plays alert sounds or voice messages through the speakers. The ambient lights 25 are provided on the instrument panel, steering wheel, etc. The ambient lights 25 use ambient displays that change the emitted light color to provide alerts that utilize the driver's peripheral vision.

The operation device 26 is an input unit that accepts user operations by the driver or other passengers. For example, user operations related to activating and deactivating the autonomous driving function, and user operations related to setting a destination for route guidance are input to the operation device 26. Examples of operation devices 26 include a steering switch mounted on the spokes of the steering wheel, an operation lever mounted on the steering column, and a voice input device that recognizes what is being said by the driver or other passengers.

The HCU 100 is an information presentation device that comprehensively controls notifications using multiple display devices, an audio device 24, and ambient light 25. The HCU 100 controls the notification of information related to autonomous driving in cooperation with the autonomous driving system 50. The HCU 100 is a computer that primarily includes a control circuit equipped with a processing unit 11, RAM 12, a storage unit 13, an input/output interface 14, and buses connecting these. The processing unit 11 accesses the RAM 12 to execute various processes for notification control processing. The RAM 12 may be configured to include a video RAM for generating video data. The storage unit 13 stores various programs (such as notification control programs) executed by the processing unit 11.

The processing unit 11 may include at least one processor. The processor may include at least one type of core, such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), or RISC (Reduced Instruction Set Computer)-CPU. The storage unit 13 may include at least one type of non-transient tangible storage medium, such as semiconductor memory, magnetic media, or optical media, that non-temporarily stores programs and data that can be read by the processor.

The HCU 100 configures multiple functional units by executing programs stored in the memory unit 13 using the processing unit 11. The HCU 100 configures functional units such as an information acquisition unit 81, an information linking unit 82, a request processing unit 84, and a notification control unit 88 (see Figure 3).

The information acquisition unit 81 acquires operation information indicating the content of user operations from the CID 22, the operation device 26, etc. The information acquisition unit 81 provides operation information of user operations related to the autonomous driving function to the autonomous driving ECU 50b via the information linkage unit 82. The information acquisition unit 81 provides operation information of the user operation to set the destination of the host vehicle Am to the navigation ECU 38 via the request processing unit 84.

The information linking unit 82 links with the autonomous driving ECU 50b, enabling information sharing between the autonomous driving system 50 and the HCU 100. The information linking unit 82 provides the autonomous driving ECU 50b with operation information obtained by the information acquisition unit 81. The information linking unit 82 obtains control status information indicating the state of the autonomous driving function from the autonomous driving ECU 50b. The information linking unit 82 obtains the operating status of autonomous driving by the autonomous driving system 50 based on the control status information. Specifically, the information linking unit 82 determines whether the host vehicle Am is traveling autonomously.

The request processing unit 84 enables cooperation between the HCU 100 and each on-board device through communication with the on-board devices connected to the communication bus 99. Specifically, the request processing unit 84 acquires route information to the destination, guidance images based on map data, and guidance implementation requests from the navigation ECU 38, and provides these to the notification control unit 88, thereby enabling route guidance by the HMI (Human Machine Interface) system 10. In addition, the request processing unit 84 outputs an operation request to the body ECU 43, enabling the turn indicators 44 linked to displays related to autonomous driving to be switched on and off.

The notification control unit 88 comprehensively notifies the driver or other occupants of information using each display device, audio device 24, ambient light 25, etc. The notification control unit 88 processes the control status information acquired by the information linkage unit 82 as a request to implement notifications related to the autonomous driving function, and provides content and notifications according to the operating status of the autonomous driving. When the information linkage unit 82 determines that autonomous driving control is being implemented with eyes off, the notification control unit 88 enables the playback of video content, etc. When the notification control unit 88 determines that autonomous driving is scheduled to end, it requests the driver to take over driving, etc.

Next, an example of a processing method by the vehicle system 1 will be described using the flowchart in Figure 4. The series of processes shown in steps S11 to S15 is performed at predetermined time intervals or based on a predetermined trigger by at least one processor of the vehicle system 1 executing a program. This series of processes is preferably performed during automated driving, when the driver is not required to monitor the surroundings. This series of processes is performed so that a smooth handover of driving to the driver is achieved immediately after a collision occurs.

In S11, the autonomous driving ECU 50b (e.g., the environment recognition unit 62) obtains sensor information. This sensor information may include at least one of the detection results of the perimeter monitoring sensor 30, the detection results of the acceleration sensor 37 (G sensor), the position estimation results of the locator 35, and information obtained through V2X communication. After processing S11, the process proceeds to S12.

In S12, the autonomous driving ECU 50b (e.g., the collision recognition unit 74) determines whether a collision has occurred between the host vehicle Am and another object. If the answer is Yes (i.e., if a collision has been recognized), the process proceeds to S13. If the answer is No (i.e., if a collision has not been recognized), the process ends with S12.

In S13, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) determines how the host vehicle Am will respond to the collision. Then, the autonomous driving ECU 50b (e.g., the control execution unit 64) executes vehicle control in accordance with the collision response determination. After processing S13, the process proceeds to S14.

In S14, the HCU 100 (e.g., the information linking unit 82) obtains collision occurrence information, including information indicating whether a collision has occurred, and vehicle control information corresponding to the collision, from the autonomous driving ECU 50b. After processing S14, the process proceeds to S15.

In S15, the HCU 100 (e.g., the notification control unit 88) issues both a notification indicating the state of vehicle control in response to the collision and a notification urging the driver to take over driving. In other words, both the current state and what the driver should do are notified. The notification indicating the state of vehicle control in response to the collision and the notification urging the driver to take over driving may be issued simultaneously. The series of processes ends with S15.

Now, as shown in Figure 5, the notification in S15 will be described in detail. The notification indicating the state of vehicle control is a notification indicating that the movement of the host vehicle Am is being restricted, for example, by the application of the brakes. Specifically, when the autonomous driving ECU 50b recognizes a collision between the host vehicle Am and another object, it applies the brakes as vehicle control to respond to the collision, safely and quickly stopping the host vehicle Am. Even after the host vehicle Am has stopped, the autonomous driving ECU 50b continues to apply the brakes, restricting the movement of the host vehicle Am until the driver takes over driving of the host vehicle Am. The brake application referred to here may be the application of either the foot brake or the electric parking brake, or both. In the case of the foot brake, the restriction on the movement of the host vehicle Am may include not only a completely stopped state of the host vehicle Am, but also a slow-moving state.

The HCU 100 notifies the driver of the vehicle Am of this control status using a display device, audio device 24, ambient light 25, etc. Notification of the vehicle control status may be performed, for example, by using a combination of multiple display devices. For example, as shown in FIG. 5, the meter display 21 may indicate the operation of the electric parking brake using an indicator light or an image D1 in the form of an indicator light, and at the same time, the CID 22 may indicate that vehicle movement is restricted using an alarm image D2.

Furthermore, when the autonomous driving ECU 50b or HCU 100 recognizes a collision between the host vehicle Am and another object, it may turn on the hazard lights 45 of the host vehicle Am as vehicle control in response to the collision. The notification indicating the vehicle status may further include a notification that displays the lighting status of the hazard lights 45 on the meter display 21 using an indicator light or an image in the form of an indicator light.

The notification prompting the driver to take over driving may change in stages depending on the time remaining until the time the driver's handover should be completed. When the remaining time is greater than a predetermined threshold, meaning there is still time before the driver immediately begins taking action to take over driving, the notification prompting the driver to take over driving may be a notification indicating that the time to do so is approaching. When the remaining time is less than a predetermined threshold, meaning the driver should immediately begin taking action to take over driving, the notification prompting the driver to take over driving may be a notification indicating that the system is requesting the driver to take over driving. Furthermore, if the driver does not begin taking action to take over driving when the time is right to do so, the notification prompting the driver to take over driving may be a notification warning the driver that they should immediately take over driving. Here, the notification assumed in S15 is a sudden notification in response to the occurrence of a collision, so the notification prompting the driver to take over driving may begin with a notification indicating that a driver change is being requested or a notification warning the driver that they should immediately take over driving.

The notification prompting the driver to take over driving may be implemented using at least one of the meter display 21 and the HUD 23, which can be displayed in front of the driver. For example, as shown in Figure 5, the notification prompting the driver to take over driving may include an image D3 on the meter display 21 of the driver grasping the steering wheel. This allows the driver to smoothly transition from confirming the notification to facing forward and taking the action to take over driving. Alternatively, the notification prompting the driver to take over driving may be implemented using the CID 22. In this way, if the driver is watching a video using the CID 22 as a second task, the driver can be made to immediately recognize the need to take over driving.

According to the first embodiment described above, even in situations where the driver is not monitoring the surrounding area, two notifications (a notification indicating the vehicle control status and a notification urging the driver to take over driving) are issued, allowing the driver to understand the control status of the vehicle Am in response to a collision and what the driver should do. As a result, the driver can begin the driving handover operation after understanding the control status of the vehicle Am, enabling a smooth handover of driving to the next driver.

Furthermore, according to the first embodiment, the notification indicating the control status of the host vehicle Am includes a notification indicating that the movement of the host vehicle Am is restricted by brake operation, and a notification indicating that the hazard lights 45 of the host vehicle Am are illuminated. By allowing the driver to understand the specific control status in response to a collision, the driver can calmly begin the operation to take over driving.

Note that the display device in the first embodiment corresponds to the "in-vehicle device." At least one of the information acquisition unit 81 and the information linkage unit 82 in the first embodiment corresponds to the "information grasping unit."

In addition, in this embodiment, the grasping may be performed by the device that is responsible for grasping acquiring information from an external device, or by the device that is responsible for grasping deriving information by calculating or identifying it itself. When deriving information, the source data for analysis (sensor information, vehicle status), etc. necessary to derive the information may be acquired from an external device.

Second Embodiment
As shown in Fig. 6, the second embodiment is a modification of the first embodiment. The second embodiment will be described, focusing on the differences from the first embodiment.

An example of a processing method by the HCU 100 in the second embodiment will be described using the flowchart in Figure 6. The series of processes shown in steps S101 to S105 is performed by the processor of the HCU 100 executing a program. This series of processes is preferably performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

In S101, the HCU 50b (e.g., the information linking unit 82) obtains collision occurrence information, including information indicating whether or not a collision has occurred, and vehicle control information corresponding to the collision, from the autonomous driving ECU 50b. Here, the vehicle control corresponding to the collision includes limiting the autonomous driving function in addition to the brake operation described in the first embodiment.

Restrictions on autonomous driving functions may prohibit the execution of all functions at level 1 or above, including driving assistance and autonomous driving. Restrictions on autonomous driving functions may prohibit the execution of all functions at level 3 or above. Restrictions on autonomous driving functions may prohibit some driving assistance applications. A partial prohibition state would mean, for example, that ACC can be executed but LTA cannot. Restrictions on autonomous driving functions may also be a vehicle speed limit during autonomous driving. HCU 100 grasps the specific conditions for restricting these autonomous driving functions.

After processing S101, the process proceeds to S102. S102 is the same as S15 in Figure 4. The system will hand over driving to the driver in response to a notification prompting the driver to take over driving. After processing S102, the process proceeds to S103. In S103, the HCU 100 determines that the driver changeover has been completed. After processing S103, the process proceeds to S104.

In S104, the HCU 100 (e.g., the information acquisition unit 81) determines whether the driver or another occupant has used the operation device 26 to turn on the restricted autonomous driving function. This determination is made by comparing the specific conditions identified in S101 with the operation performed on the operation device 26. If the result is Yes, proceed to S105. If the result is No, the determination in S104 is made again unless the restriction on the autonomous driving function is released.

If the function that is turned on is not prohibited, the HCU requests the driving assistance ECU 50a or the autonomous driving ECU 50b to start operating that function via the information linkage unit 82.

In S105, the HCU 100 (e.g., the notification control unit 88) issues a notification to the driver or other person who operated the operation device 26, indicating that the autonomous driving function is restricted. This notification is issued using a display device located closest to the operation device 26, or a specific meter display 21 or HUD 23, for a preset time period starting immediately after operation. The notification may also present the specific conditions described above. The series of processes ends with S105.

Next, we will explain how to release the restriction on the autonomous driving function. The vehicle system 1 is configured so that the autonomous driving function that was restricted in response to the occurrence of a collision is prohibited from being released until a specific, preset condition is met. The specific condition may be that a predetermined, pre-set time has elapsed after the collision. The specific condition may be that the start switch (e.g., ignition switch) of the host vehicle Am is turned off.

Alternatively, the specific condition may be that the vehicle system 1 or the autonomous driving ECU 50b is initialized. If initialization is set as a condition, there will essentially be no dedicated program within the vehicle system 1 that removes restrictions. For example, the initialization work is performed when an authorized vehicle manager repairs the vehicle body and performs a vehicle diagnosis, and determines that there are no problems with implementing autonomous driving.

The vehicle manager here may be, for example, a car dealer or a vehicle inspection company if the vehicle Am is a personally owned POV (Personally Owned Vehicle). If the vehicle Am is a dedicated MaaS (Mobility as a Service) vehicle (also called a service car), the vehicle manager may be a company that operates a vehicle service.

In the second embodiment described above, when the information linking unit 82 determines that the autonomous driving function of the host vehicle Am is restricted after a collision occurs, the notification control unit 88 issues a notification indicating that the autonomous driving function is restricted. By understanding that the driver must drive manually, a smooth response can be implemented by driving manually.

Furthermore, according to the second embodiment, the information acquisition unit 81 may detect an operation to turn on the autonomous driving function on the operation device 26 of the host vehicle Am. Then, when it is detected that the autonomous driving function of the host vehicle Am is restricted after a collision occurs and an operation to turn on the autonomous driving function is detected, the notification control unit 88 may issue a notification indicating that the autonomous driving function is restricted. Such a notification can prevent the driver from mistakenly believing that the autonomous driving function has been turned on, allowing the driver to appropriately respond by manual driving.

Furthermore, according to the second embodiment, the host vehicle Am may be configured to prohibit the lifting of restrictions on the autonomous driving function until an authorized vehicle manager performs initialization work. Furthermore, the host vehicle Am may be configured to prohibit the lifting of restrictions on the autonomous driving function when the vehicle's start switch is turned off. This configuration prevents the lifting of restrictions on the autonomous driving function while problems such as malfunctions still exist, thereby preventing problems such as secondary collisions from occurring.

(Third embodiment)
As shown in Fig. 7, the third embodiment is a modification of the first embodiment. The third embodiment will be described, focusing on the differences from the first embodiment.

In the third embodiment, the HCU 100 (e.g., the notification control unit 88) issues at least one of the following notifications to the driver or other occupants: a notification indicating the collision area, a notification indicating a malfunction, and a notification indicating the possibility of a fire. These notifications are hereinafter referred to as accompanying notifications. The accompanying notifications are issued, for example, simultaneously with a notification indicating the state of vehicle control in response to the collision and a notification urging the driver to take over driving.

The accompanying notification is displayed on the screen of, for example, the CID 22, the meter display 21, etc. As shown in Figure 7, when the accompanying notification is implemented in the form of a consolidated display content, the driver and others can easily recognize the information.

The notification indicating the collision area is implemented, for example, by superimposing an icon Ds1 indicating the collision area on a vehicle overhead image IMV of the host vehicle Am. This visualization allows the driver and others to instantly understand the collision area of the host vehicle Am.

The notification of a malfunction is made, for example, by the text Ds2, such as "Sensor malfunctioning." If the text Ds2 is associated with the collision location by a line or arrow, the driver can instantly understand the relationship between the malfunction and the collision. The notification of a malfunction may also be made by methods other than the text Ds2. For example, the notification of a malfunction may be realized by changing the icon Ds1 indicating the collision location to an icon indicating a malfunction, such as an image of the perimeter monitoring sensor 30 with a slash superimposed on it.

The notification of the possibility of a fire is made, for example, by text Ds3 such as "Warning: Possible Fire." The text Ds3 is placed, for example, near the vehicle overhead image IMV in a manner that allows it to be recognized as an accompanying notification. The notification of the possibility of a fire may also be made by methods other than text. For example, an icon indicating the possibility of a fire may be superimposed on the vehicle overhead image IMV in a portion of the host vehicle Am where a fire is expected to break out.

The possibility of a fire in the host vehicle Am may be estimated by either the HCU 100, the driving assistance ECU 50a, or the autonomous driving ECU 50b. The possibility of a fire is estimated based on the collision area, the severity of the collision, and the failure status of any parts that have failed due to the collision.

In the third embodiment described above, the notification control unit 88 further issues a notification indicating the collision area of the host vehicle Am. By identifying the collision area, the driver can quickly grasp the surrounding environment, including the collision area and other objects that have come into contact with the collision area.

Furthermore, according to the third embodiment, the notification control unit 88 further issues a notification indicating a malfunction associated with the collision area. This allows the driver to understand the circumstances under which a malfunction has occurred due to the impact of the collision, allowing them to quickly take action such as manual driving in response to the malfunction.

Furthermore, according to the third embodiment, the notification control unit 88 further issues a notification indicating the possibility of a fire in the host vehicle Am. By understanding the possibility of a fire, the driver can accurately determine whether or not they need to evacuate the vehicle.

(Fourth embodiment)
As shown in Fig. 8, the fourth embodiment is a modification of the first embodiment. The fourth embodiment will be described, focusing on the differences from the first embodiment.

An example of a processing method by the HCU 100 in the second embodiment will be described using the flowchart in Figure 8. The series of processes shown in steps S201 to S207 are performed by the processor of the HCU 100 executing a program. This series of processes is preferably performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

In S201, the HCU 100 (e.g., the information linking unit 82) obtains collision occurrence information, including information indicating whether or not a collision has occurred, and vehicle control information corresponding to the collision, by acquiring the information from the autonomous driving ECU 50b. Here, the vehicle control corresponding to the collision includes the stopping position in addition to the brake operation described in the first embodiment.

The stopping position information indicates the position on the road where the host vehicle Am has stopped as a result of applying the brakes. For example, in the case of a road with multiple lanes on each side, the stopping position information may include information on which of the multiple lanes the host vehicle Am is stopped in. After processing S201, the process proceeds to S202.
S202 is the same as S15 in Fig. 4. It is assumed that the system switches over to the driver in response to the notification urging the driver to take over driving, i.e., the automated driving ends. After processing S202, the process proceeds to S203.

In S203, the HCU 100 (e.g., the notification control unit 88 or the request processing unit 84) determines whether occupants, including the driver, need to urgently exit the vehicle. The HCU 100 may obtain the determination result from another ECU. The need to exit the vehicle may be determined based on, for example, the possibility of a fire or the state of a fire, as described in the third embodiment. For example, it is determined that it is necessary to exit the vehicle when there is a high possibility of a fire breaking out in the host vehicle Am, or when a fire has already broken out. The need to exit the vehicle may also be determined taking into account the environment or weather outside the vehicle. For example, it is determined that it is not necessary to exit the vehicle when the terrain outside the vehicle is poorly footed, or when there is a high possibility of a mentally unstable person outside the vehicle due to an accident caused by aggressive driving, etc. If the answer is Yes in S203, proceed to S204. If the answer is No, proceed to S205.

In S204, the door locks are automatically released or are made available for release by manual operation by the driver or other means. The door lock can be made available for release by the HCU 100 (e.g., the request processing unit 84) requesting the body ECU 43, which controls the door lock motor 46, to make the door lock available.

Furthermore, the HCU 100 (e.g., the notification control unit 88) issues a notification indicating the stopping position of the host vehicle Am. For example, in the case of a road with multiple lanes in each direction, the notification indicating the stopping position of the host vehicle Am may indicate which of the multiple lanes the host vehicle Am is stopped in. The HCU 100, for example, causes the CID 22 or the meter display 21 to display an overhead road image of the road surrounding the host vehicle Am and an image of the host vehicle Am superimposed on the overhead road image. This makes it easier for the driver, etc. to grasp a safe position given the road structure. In other words, the driver, etc. can easily determine which of the left and right doors they should use to escape. After processing S204, proceed to S206.

In S205, the door locks are changed to an unreleasable state by manual operation by the driver or other person. The unreleasable state can be achieved by the HCU 100 requesting the body ECU 43, which controls the door lock motor 46, to change to an unreleasable state. This prevents the driver or other occupants from panicking and getting out of the vehicle when it would be better not to. This unreleasable state may be changed to a releasable state after a predetermined time has elapsed. After processing S205, proceed to S206.

In S206, the HCU 100 (e.g., the information acquisition unit 81) determines whether the driver or another occupant has performed an emergency window opening operation using the operation device 26. It is preferable that the emergency window opening operation can be performed with a single action (one touch or one push of a dedicated switch, etc.). If the answer is Yes, proceed to S207. If the answer is No, the HCU 100 (e.g., the information acquisition unit 81) may wait until an emergency window opening operation is detected, or may end the series of processes if no emergency window opening operation is detected after waiting for a preset time.

In S207, the side windows are controlled to be fully open. If side windows are provided at the driver's seat, passenger seat, and rear seats, all of the side windows need to be opened. The side windows can be opened by the HCU 100 (e.g., the request processing unit 84) issuing an emergency opening request to the body ECU 43, which controls the power windows 47. The series of processes ends with S207.

In the fourth embodiment described above, the notification control unit 88 further issues a notification indicating the position on the road where the host vehicle Am has stopped. Furthermore, the notification indicating the position on the road where the host vehicle Am has stopped may include information on which lane the host vehicle Am is stopped in on a multi-lane road. By allowing the occupant to understand the position of the host vehicle Am on the road, it is possible to prevent the occupant from inadvertently opening a door in a position that could cause contact with another vehicle in motion, or from inadvertently running out onto a road where other vehicles are present.

Furthermore, according to the fourth embodiment, when there is no urgent need for the occupants of the host vehicle Am to exit the vehicle, the request processing unit 84 requests the host vehicle Am to make the doors of the host vehicle Am unable to be unlocked manually by the occupants. By making the doors unable to be unlocked, it is possible to prevent the occupants from inadvertently exiting the vehicle. It is also possible to protect the occupants from outside the vehicle.

Furthermore, according to the fourth embodiment, the information acquisition unit 81 detects an emergency window opening operation on the operating device 26 of the host vehicle Am. When the execution of the emergency opening operation is detected, the request processing unit 84 requests the host vehicle Am to fully open the side windows of the host vehicle Am. By fully opening the side windows, even if an abnormality occurs in the door opening/closing due to the impact of a collision and a fire breaks out, the occupants can escape from the vehicle.

Fifth Embodiment
9, the fifth embodiment is a modification of the first embodiment. The fifth embodiment will be described, focusing on the differences from the first embodiment.

In the fifth embodiment, if a collision occurs between the host vehicle Am and another object during autonomous driving, a decision is made as to whether to continue the autonomous driving function according to predetermined conditions. Specifically, an example of a processing method by the vehicle system 1 of the fifth embodiment will be described using the flowchart in Figure 9. The series of processes shown in steps S301 to S310 is performed at predetermined time intervals or based on a predetermined trigger by at least one processor of the vehicle system 1 executing a program. This series of processes is preferably performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes is performed so that a smooth handover of driving to the driver is achieved immediately after a collision occurs.

Steps S301 to S303 are the same as steps S11 to S13 in Figure 4. After processing step S303, proceed to step S304.

In S304, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) determines whether to restrict the autonomous driving function. This determination is made based on preset conditions that are determined by the nature of the collision.

A first example of the conditions to be set is a condition based on the severity of the collision and the sensor failure status. If the severity of the collision is less than the preset judgment criterion and no failure has been confirmed in the perimeter monitoring sensors 30 installed in the host vehicle Am, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) determines not to restrict the autonomous driving function. No failure may mean that a normal state has been confirmed. On the other hand, if the severity of the collision is greater than the preset judgment criterion, or if a failure has been confirmed in even one location in the perimeter monitoring sensors 30 installed in the host vehicle Am, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) determines to restrict the autonomous driving function.

A second example of a condition to be set is a condition based on the collision area and the object that was hit. This condition may take into account at least one of the size and type of the object that was hit. If the collision area of the host vehicle Am is a part that does not affect the execution of autonomous driving (for example, a minor collision such as scraping only the wheel cover), the autonomous driving ECU 50b (for example, the behavior determination unit 63) determines not to restrict the autonomous driving function. Furthermore, if the size of the object that was hit is smaller than a preset judgment criterion (for example, a small fallen object or pebble), the autonomous driving ECU 50b (for example, the behavior determination unit 63) determines not to restrict the autonomous driving function. Otherwise, the autonomous driving ECU 50b (for example, the behavior determination unit 63) determines to restrict the autonomous driving function. If the answer is Yes in S304, proceed to S305. If the answer is No, proceed to S308.

In S305, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) decides to restrict the autonomous driving function. After processing S305, the process proceeds to S306.

In S306, the HCU 100 (e.g., the information linkage unit 82) obtains collision occurrence information and vehicle control. Specifically, brake operation information and autonomous driving function restriction information are obtained. After processing S306, the process proceeds to S307.

In S307, the HCU 100 (e.g., the notification control unit 88) issues both a notification indicating the state of vehicle control in response to the collision and a notification urging the driver to take over driving. In other words, both the current state and what the driver should do are notified. The notification indicating the state of vehicle control in response to the collision and the notification urging the driver to take over driving may be issued simultaneously. In particular, the notification urging the driver to take over driving is a notification that warns the driver that they should immediately take over driving. The series of processes ends with S307.

If the answer is No in S304, in S308, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) decides to continue the autonomous driving function without restricting it. At this time, the autonomous driving ECU 50b (e.g., the behavior determination unit 63) may allow the host vehicle Am to continue driving without completely stopping, depending on the severity of the collision and the object of the collision. After processing S308, proceed to S309.

In S309, the HCU 100 (e.g., the information linkage unit 82) obtains collision occurrence information and vehicle control. Specifically, brake operation information and autonomous driving function restriction information are obtained. After processing S309, the process proceeds to S310.

In S310, the HCU 100 (e.g., the notification control unit 88) issues both a notification indicating the state of vehicle control in response to the collision and a notification urging the driver to take over driving. In other words, both the current state and what the driver should do are notified. The notification indicating the state of vehicle control in response to the collision and the notification urging the driver to take over driving may be issued simultaneously. In particular, the notification urging the driver to take over driving is a notification that prompts the driver to take over driving at their own leisure (in other words, a non-urgent notification). In other words, the notification urging the driver to take over driving at their own leisure may be a non-urgent notification indicating that the driver can take over driving when they are ready. Alternatively, the notification urging the driver to take over driving at their own leisure may be a non-urgent notification indicating that the time to take over driving is approaching, as described in the first embodiment. The series of processes ends with S310.

In the fifth embodiment described above, the notification control unit 88 performs processing based on the decision to continue the autonomous driving function made in a decision based on preset conditions based on the type of collision. This processing is a notification to encourage the driver to take over driving, and is a notification that encourages a less urgent change of driving compared to when the autonomous driving function is restricted. The less urgent and more relaxed notification allows the driver to calmly take over driving even when a collision occurs.

Furthermore, according to the fifth embodiment, the pre-set conditions based on the type of collision may be conditions based on the severity of the collision and the failure status of the perimeter monitoring sensor 30 mounted on the host vehicle Am. By adopting such conditions, it is possible to determine whether to continue the autonomous driving function, taking into account whether the autonomous driving function is operating normally.

Furthermore, according to the fifth embodiment, the pre-set conditions based on the type of collision may be conditions based on the collision part of the host vehicle Am and other objects. By adopting such conditions, it is possible to determine whether to continue the autonomous driving function, taking into account the need to respond to the collision.

Sixth Embodiment
10 to 14, the sixth embodiment is a modification of the first embodiment. The sixth embodiment will be described, focusing on the differences from the first embodiment.

In the sixth embodiment, the HCU 100 (e.g., the notification control unit 88) changes the amount of information in the notification shown in S15 of FIG. 4 depending on the state of the occupant (e.g., the driver) at the time of the collision. The HCU 100 (e.g., the information acquisition unit 81) determines the state of the driver at the time of the collision by acquiring occupant state information from an occupant state sensor such as the Driver Status Monitor (hereinafter referred to as DSM) 27.

As shown in FIG. 10 , the DSM 27 is provided in, for example, the HMI system 10 of the vehicle system 1. The DSM 27 includes, for example, a near-infrared light source, a near-infrared camera, and a control unit that controls these. The DSM 27 is mounted, for example, on the instrument panel with the near-infrared camera facing the driver's seat. The DSM 27 uses the near-infrared camera to capture an image of the driver illuminated with near-infrared light from the near-infrared light source. The image captured by the near-infrared camera is analyzed by the control unit. The control unit detects the driver's level of alertness, facial orientation, poor posture, etc. based on the driver's features extracted through image analysis.

An example of a processing method used by the vehicle system 1 of the sixth embodiment will be described using the flowchart in Figure 11. The series of processes shown in steps S1501 to S1505 show a detailed example of the process of S15 in Figure 4.

In S1501, the HCU 100 (e.g., the notification control unit 88) determines whether the driver is monitoring the surroundings. If the answer is Yes, proceed to S1503. If the answer is No, proceed to S1502.

In S1502, the HCU 100 (e.g., the notification control unit 88) determines whether the driver is asleep. If the answer is Yes, proceed to S1505. If the answer is No, proceed to S1503.

If it is determined that the driver is monitoring the surroundings, in S1503, the HCU 100 (e.g., the notification control unit 88) selects notification pattern A, which has a small amount of information, as the notification pattern for CID 22 and causes CID 22 to make a notification.

As shown in FIG. 12, notification pattern A may include a warning image D2A as a notification indicating the state of vehicle control in response to a collision. The warning image D2A may include a notification indicating the operation of the electric parking brake, a notification indicating a collision has occurred, and a notification indicating that vehicle movement is restricted. The notification indicating the operation of the electric parking brake may be, for example, image D2A1 in the form of an indicator light. The notification indicating a collision has occurred may be an image that simply displays the fact that a collision has occurred, such as image D2A2 mainly composed of text. The notification indicating that vehicle movement is restricted may be, for example, image D2B3 mainly composed of text. The series of processes ends with the processing of S1503.

If it is determined that the driver is neither monitoring the surroundings nor sleeping, in other words, if the driver is performing a second task, in S1504, the HCU 100 (e.g., notification control unit 88) selects notification pattern B, which has a medium amount of information, as the notification pattern for CID 22 and causes CID 22 to issue a notification. The amount of information for notification pattern B is set to be greater than the amount of information for notification pattern A.

As shown in FIG. 13, notification pattern B may include a warning image D2B as a notification indicating the state of vehicle control in response to a collision. Warning image D2B may include a notification indicating the operation of the electric parking brake, a notification indicating a collision has occurred, and a notification indicating that vehicle movement is restricted. The notifications indicating the operation of the electric parking brake (e.g., image D2B1) and the notification indicating that vehicle movement is restricted (e.g., image D2B3) may be the same as those in notification pattern A. The notification indicating a collision may be image D2B2, which displays not only the fact that a collision has occurred but also the type of object that has collided. If the object that has collided is a vehicle, the type of object may include the type of vehicle (passenger car, truck, bus, etc.) and vehicle characteristics (vehicle color, size, brand, model, license plate number, etc.). The process of S1504 ends the series of processes.

In S1505, if it is determined that the driver is asleep, the HCU 100 (e.g., the notification control unit 88) selects notification pattern C, which has a large amount of information, as the notification pattern for CID 22 and causes CID 22 to make a notification. The amount of information in notification pattern C is set to be greater than the amount of information in notification pattern A and greater than the amount of information in notification pattern B.

As shown in FIG. 14, notification pattern C may include a warning image D2C as a notification indicating the state of vehicle control in response to a collision. The warning image D2C may include a notification indicating that the electric parking brake has been activated, a notification indicating that a collision has occurred, and a notification indicating that vehicle movement is restricted. The notification indicating that the electric parking brake has been activated (e.g., image D2C1) and the notification indicating that vehicle movement is restricted (e.g., image D2C3) may be the same as notification pattern A.

The notification indicating the occurrence of a collision in notification pattern C may, for example, be a combination of image D2C2, which is primarily text, and image D2C4, which is primarily diagrammatic, to notify the fact that a collision has occurred, the type of object that has collided, and the relative positions of the object that has collided with the vehicle Am. Image D2C2 may display the type of object that has collided and the direction of the collision in addition to the fact that a collision has occurred. Image D2C4 may illustrate the relative positions of the object that has collided with the vehicle Am from a bird's-eye view. The series of processes ends at S1505.

In S1503 to S1505, the meter display 21 may be configured to issue a notification urging the driver to switch drivers, similar to that shown in Figure 5.

According to the sixth embodiment described above, the amount of information provided varies depending on the state of the occupants at the time of the collision. This reduces the annoyance felt by the occupants and allows for a smooth driver handover.

Furthermore, according to the sixth embodiment, when the occupant is sleeping, the notification is provided with a larger amount of information than when the occupant is performing a second task, and when the occupant is performing a second task, the notification is provided with a larger amount of information than when the occupant is monitoring the surroundings. By changing the amount of information depending on the sleeping or second task status, the annoyance felt by the occupant can be further reduced and the necessary information can be notified.

Furthermore, according to the sixth embodiment, when the occupant is not in a state where they are monitoring their surroundings, a notification indicating the type of other object is issued. If the occupant is not monitoring their surroundings, it takes time for them to identify the object they have collided with. In contrast, by notifying the occupant of the type of object, the time it takes for them to understand and recognize the object they have collided with can be shortened. This allows for a smooth driver handover.

Seventh Embodiment
15, the seventh embodiment is a modification of the fourth embodiment. The seventh embodiment will be described, focusing on the differences from the fourth embodiment.

In the seventh embodiment, in step S204 of the fourth embodiment, in addition to or instead of the notification indicating the stopping location, the HCU 100 provides at least one of a notification providing guidance on accident handling and a notification indicating the action required of the vehicle occupants.

In Figure 15, the host vehicle Am is a bus, and an example of a notification using an in-vehicle display 22a for passengers is shown. The in-vehicle display 22a is controlled by the HCU 100, similar to the CID 22 on the bus. The notification providing guidance on accident handling may be, for example, a notification indicating the status of vehicles being dispatched for accident handling (image Da1), a notification providing guidance to emergency exits on the bus from which escape is possible (image Da3), etc. The notification indicating the action required of occupants may be, for example, a notification providing guidance to escape from the vehicle (image Da3).

According to the seventh embodiment described above, after a collision, a notification is issued providing guidance on how to deal with the accident. This allows the occupants to decide on their subsequent actions while understanding the situation regarding how the accident is being handled.

Furthermore, according to the seventh embodiment, after a collision, a notification is issued informing the vehicle occupants of the actions they are expected to take. This allows the occupants to take more appropriate actions in accordance with the notification.

Eighth Embodiment
16 and 17, the eighth embodiment is a modification of the first embodiment. The eighth embodiment will be described, focusing on the differences from the first embodiment.

Figure 16 shows the HMI system 10 when the host vehicle Am is a bus. The HMI system 10 is configured to include an exterior display device 28 instead of the ambient light 25.

The exterior display device 28 is mounted on the exterior of the vehicle body and is configured to display images primarily using, for example, an LCD panel, OLED, or the like. Only one exterior display device 28 may be provided, but multiple devices may also be provided, such as a device that displays information facing the front of the vehicle and a device that displays information facing the rear of the vehicle. If the HCU 100 does not have collision information, the exterior display device 28 may display the destination, or may display information indicating that occupants are getting in or out of the vehicle.

An example of a processing method by the vehicle system 1 of the eighth embodiment will be described using the flowchart in Figure 17. The series of processes shown in steps S401 to S404 is performed by at least one processor of the vehicle system 1 executing a program. This series of processes may be performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

In S401, the HCU 100 (e.g., the information linkage unit 82) obtains collision occurrence information, including information indicating whether a collision has occurred, and vehicle control information corresponding to the collision, from the autonomous driving ECU 50b. Here, the vehicle control corresponding to the collision includes, in addition to the brake operation described in the first embodiment, travel readiness information indicating whether the host vehicle Am is travellable. After processing S401, the process proceeds to S402.

S402 is the same as S15 in Figure 4. The system will hand over driving to the driver upon receiving a notification urging the driver to take over, i.e., autonomous driving will end. After processing S402, proceed to S403.

In S403, the HCU 100 (e.g., the notification control unit 88) determines whether the host vehicle Am is capable of traveling. If the answer is Yes, the process proceeds to S404. If the answer is No, the process ends.

In S404, if the collided object is a dynamic object such as another vehicle that can recognize an exterior notification, the HCU 100 (e.g., the notification control unit 88) issues an exterior notification to the other object. The other object may be a motorcycle, bicycle, or pedestrian. The exterior notification may be implemented by display on the exterior display device 28. The exterior notification may be implemented by audio from a speaker directed to the exterior of the vehicle, or a combination of display and audio from a speaker. The exterior notification may be a notification that safely guides the other object so that the host vehicle Am can resume traveling. The notification that safely guides the other object may be, for example, a notification indicating a safe stopping position for the other object. The process of S404 ends the series of processes.

According to the eighth embodiment described above, if the host vehicle Am is able to continue driving after a collision, an external notification is issued to guide other objects, which are dynamic objects, so that the host vehicle Am can resume driving. Road users outside the vehicle who confirm the external notification can take action after understanding the possibility that the host vehicle Am may resume driving.

Ninth Embodiment
18 to 20, the ninth embodiment is a modification of the first embodiment. The ninth embodiment will be described, focusing on the differences from the first embodiment.

The HMI system 10 shown in FIG. 18 is configured to include an emergency call switch 29. The emergency call switch 29 is located, for example, on the ceiling of the vehicle interior in a position within reach of the driver, or on the instrument panel. The emergency call switch 29 may be, for example, a push-button labeled "SOS."

The onboard communication device 39 is also configured to be able to communicate with the remote management center X1 and the transfer vehicle X2. The remote management center X1 is a center that remotely manages and supports each vehicle traveling on public roads, etc. The remote management center X1 is configured to include a computer that is configured to be able to communicate with each vehicle. An operator who operates the computer may be resident at the remote management center X1. The transfer vehicle X2 is, for example, a vehicle arranged by an operator at the remote management center X1.

As shown in FIG. 19 , the information acquisition unit 81 of the HCU 100 acquires an operation signal indicating that the emergency call switch 29 has been operated by an occupant of the host vehicle Am when a collision occurs, etc. The HCU 100 further includes a communication processing unit 85.

When the information acquisition unit acquires the operation signal, the communication processing unit 85 begins communication with the remote management center X1 via the in-vehicle communication device 39. The remote management center X1 or its operator grasps the circumstances of the collision through conversations with the occupants using the HCU 100 or the HCU 100. If the remote management center X1 or its operator determines that the host vehicle Am is unable to travel, it arranges for a transfer vehicle X2 for the occupants of the host vehicle Am to transfer to.

The transfer vehicle X2 may be selected from available vehicles in the vicinity of the collision point. The available vehicle may be a vehicle that has been registered in advance as a transfer vehicle X2. The available vehicle may also be a vehicle that has been requested and approved by the remote management center X1 or its operator to head to the collision point as a transfer vehicle X2.

When the arranged transfer vehicle X2 arrives at the site, the notification control unit 88 issues a notification indicating the arrival of transfer vehicle X2 and the location of transfer vehicle X2. This notification may be implemented, for example, by displaying a map image indicating the location of transfer vehicle X2 on CID 22.

An example of a processing method by the vehicle system 1 of the ninth embodiment will be described using the flowchart in Figure 20. The series of processes shown in steps S501 to S507 is performed by at least one processor of the vehicle system 1 executing a program. This series of processes may be performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

Steps S501 and S502 are the same as steps S401 and S402 in the eighth embodiment. After processing step S502, proceed to step S503.

In S503, the HCU 100 (e.g., the information acquisition unit 81) determines whether an occupant of the host vehicle Am has operated the emergency call switch 29. If the answer is Yes, proceed to S504. If the answer is No, the series of processes ends.

In S504, the HCU 100 (e.g., the communications processing unit 85) makes an emergency call to the remote management center X1. The remote management center X1 arranges for a transfer vehicle X2 and notifies the HCU 100 that arrangement has been made. After processing S504, the process proceeds to S505.

In S505, the HCU 100 (e.g., the notification control unit 88) determines whether the transfer vehicle X2 has arrived in the vicinity of the site. The arrival determination may be based on a notification from at least one of the remote management center X1 and the transfer vehicle X2. The arrival determination may also be based on the perimeter monitoring sensor 30 recognizing the transfer vehicle X2 in the vicinity of the host vehicle Am. If the answer is Yes, proceed to S506. If the answer is No, the determination in S505 is made again after a preset time has elapsed.

In S506, the HCU 100 (e.g., the notification control unit 88) notifies the passengers in the vehicle of the arrival of transfer vehicle X2 and the location of transfer vehicle X2. After processing S506, the process proceeds to S507.

In S507, the HCU 100 (e.g., the communication processing unit 85) transmits information about the host vehicle Am to the transfer vehicle X2. This allows the information about the host vehicle Am to be handed over to the transfer vehicle X2. The series of processes ends with S507.

The communication processing unit 85 in the ninth embodiment corresponds to the "information handover unit."

According to the ninth embodiment described above, after a collision, when the transfer vehicle X2 arrives, a notification indicating the location of the transfer vehicle X2 is issued. This allows the occupants to grasp the location of the transfer vehicle X2 and smoothly transfer.

Furthermore, according to the ninth embodiment, the transfer vehicle X2 is arranged when the occupant operates the emergency call switch 29 provided on the vehicle Am. Since the transfer vehicle X2 can be arranged easily, the occupant can smoothly transfer.

Furthermore, according to the ninth embodiment, the transfer vehicle X2 is a vehicle selected from available vehicles around the collision point. By using an available vehicle as the transfer vehicle X2, occupants can transfer quickly.

Furthermore, according to the ninth embodiment, when the occupant transfers to the transfer vehicle X2, information about the subject vehicle Am is transmitted to the transfer vehicle X2, and the information is passed on to the transfer vehicle X2. This allows the occupant to travel comfortably after transferring to the transfer vehicle X2.

Tenth Embodiment
As shown in Fig. 21, the tenth embodiment is a modification of the first embodiment. The tenth embodiment will be described, focusing on the differences from the first embodiment.

In the tenth embodiment, the collision recognition unit 74 of the autonomous driving ECU 50b further recognizes the occurrence of a collision between multiple other objects in the vicinity of the host vehicle Am. Here, "surroundings" may mean an area in which the host vehicle Am is recognized as being present at the site where the collision occurred (hereinafter referred to as the collision site).

The collision recognition unit 74 recognizes a collision based on the video captured by the camera unit 31. The collision recognition unit 74 provides this information to the information linkage unit 61 as peripheral collision occurrence information. This allows the peripheral collision occurrence information to be grasped on the HCU 100 side.

The HCU 100 or the autonomous driving ECU 50b determines whether the vehicle can leave the collision site based on the surrounding collision occurrence conditions. If this determination is made by the HCU 100, it may be made by, for example, the notification control unit 88. If this determination is made by the autonomous driving ECU 50b, it may be made by, for example, the collision recognition unit 74 or the behavior determination unit 63.

Depending on the result of this determination, the behavior determination unit 63 changes its response regarding autonomous driving control, and the notification control unit 88 changes its response regarding notification. In this way, the HCU 100 and autonomous driving ECU 50b work together to respond to the occurrence of a collision in the vicinity.

An example of a processing method by the vehicle system 1 of the tenth embodiment will be described using the flowchart in Figure 21. The series of processes shown in steps S601 to S608 is performed by at least one processor of the vehicle system 1 executing a program. This series of processes may be performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

In S601, the HCU 100 obtains information about the occurrence of a surrounding collision. After processing S601, the process proceeds to S602.

In S602, one of the HCU 100 (e.g., the notification control unit 88) and the autonomous driving ECU 50b (e.g., the behavior determination unit 63) determines whether the host vehicle Am can leave the collision site. If the answer is Yes, proceed to S603. If the answer is No, proceed to S608.

In S603, it is determined whether the host vehicle Am can be used as a transfer vehicle. In other words, if the other object that collided with is another vehicle, it is determined whether the occupants of the other vehicle can transfer to the host vehicle Am. For example, if the host vehicle Am has only the driver as an occupant and the passenger seat and rear seats are empty, it is determined that the host vehicle Am can be used as a transfer vehicle. If the passenger seat and rear seats are full, it is determined that the host vehicle Am cannot be used as a transfer vehicle. If the answer is Yes, proceed to S604. If the answer is No, proceed to S605.

In S604, the HCU 100 (e.g., the notification control unit 88) issues an exterior notification indicating that it is possible to board the host vehicle Am. Based on this notification, the occupants of the other vehicle are allowed to board the host vehicle Am. Meanwhile, in S605, the HCU 100 (e.g., the notification control unit 88) issues an exterior notification indicating that it is not possible to board the host vehicle Am. These exterior notifications may be issued, for example, using the exterior display device 28 described in the eighth embodiment, or may be issued using audio from an exterior speaker. After processing S604 or S605, the process proceeds to S606.

In S606, the HCU 100 (e.g., the notification control unit 88) issues a notification to the interior of the vehicle, using, for example, the CID, indicating a driving route away from the collision site. This driving route may be a driving route planned by the autonomous driving ECU 50b (e.g., the behavior determination unit 63), or may be a driving route derived by the navigation ECU 38. After processing S606, the process proceeds to S607.

In S607, the autonomous driving ECU 50b (e.g., the control execution unit 64) controls the host vehicle Am to leave the collision site along the notified driving route. The series of processes ends with S607.

In S608, after it is determined in S602 that the host vehicle Am cannot leave the collision scene, the behavior determination unit 63 in the autonomous driving ECU 50b, for example, first determines to temporarily stop the host vehicle Am, and the control execution unit 64 temporarily stops the host vehicle Am. Next, the behavior determination unit 63 or the notification control unit 88 determines to unlock the doors and requests the body ECU 43, which controls the door lock motor 46, to unlock the doors.

Furthermore, in response to the temporary stop of the host vehicle Am, the HCU 100 (e.g., the notification control unit 88) issues an in-vehicle notification indicating the reason for the stop of the host vehicle Am, for example, using the CID. Here, the notification indicating the reason for the stop may be a notification that a collision has occurred near the host vehicle Am and that the host vehicle Am cannot leave the collision site.

Note that steps S603 to S605 may be skipped, and if S602 returns Yes, the process may proceed to S606.

The automatic driving ECU 50b in the tenth embodiment corresponds to the "automatic driving device."

According to the tenth embodiment described above, peripheral collision occurrence information indicating whether or not a collision has occurred between multiple other objects in the vicinity of the host vehicle Am is further obtained. Then, the response regarding the notification is changed depending on whether or not the host vehicle Am can move away from the collision site, which is determined based on the peripheral collision occurrence information. Therefore, it is possible to provide an appropriate notification depending on whether or not it is possible to move away from the collision site.

Furthermore, according to the tenth embodiment, surrounding collision occurrence information indicating whether or not a collision has occurred between multiple other objects in the vicinity of the vehicle is further obtained. Then, if a collision between other objects occurs, an alert is issued to the outside of the vehicle indicating whether or not it is possible to board the host vehicle Am. This allows road users outside the vehicle to decide their actions after understanding whether or not it is possible to board the host vehicle Am.

Furthermore, according to the tenth embodiment, the occurrence of a collision between multiple other objects in the vicinity of the vehicle is recognized. Then, depending on whether or not it is possible for the host vehicle Am to move away from the scene of the collision, the response regarding the control of the autonomous driving is changed. Therefore, it is possible to provide appropriate control depending on whether or not it is possible to move away from the scene of the collision.

Furthermore, according to the tenth embodiment, if it is determined that the host vehicle Am cannot leave the scene of the collision, the host vehicle Am is forced to stop temporarily. This makes it possible to prevent confusion at the scene of the collision due to inappropriate behavior of the host vehicle Am.

Eleventh Embodiment
22 and 23, the eleventh embodiment is a modification of the first embodiment. The eleventh embodiment will be described, focusing on the differences from the first embodiment.

The cruise control ECU 40X of the 11th embodiment is an electronic control device that adds a function to limit vehicle movement to the cruise control ECU 40 of the vehicle system 1 shown in FIG. 1, and corresponds to a cruise control device.

The driving control ECU 40X is a computer that primarily includes a control circuit equipped with a processing unit, RAM, a memory unit, an input/output interface, and a bus connecting these. The processing unit accesses the RAM to execute various processes for implementing the autonomous driving control method of the present disclosure. The memory unit stores various programs (such as an autonomous driving control program) that are executed by the processing unit.

The processing unit may include at least one processor. The processor may include at least one type of core, such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), or RISC (Reduced Instruction Set Computer)-CPU. The storage unit 53 may include at least one type of non-transient tangible storage medium, such as semiconductor memory, magnetic media, or optical media, that non-temporarily stores programs and data readable by the processor.

By executing the program by the processing unit, the driving control ECU 40X is configured with multiple functional units for realizing the driving control function, such as an information acquisition unit 40a, a movement restriction unit 40b, and a driving control unit 40c (see Figure 22).

The information acquisition unit 40a is configured to acquire information output from each on-board device of the vehicle system 1. The information acquisition unit 40a may also acquire information output from the remote management center X1 described in the ninth embodiment. This information also includes requests, commands, etc., sent to the driving control ECU 40X.

The movement restriction unit 40b restricts the movement of the host vehicle Am by imposing restrictions on the operation commands or control commands output by the driving control unit 40c to the movement actuator 41X. The movement restriction unit 40b may determine the content of the restrictions based on information acquired by the information acquisition unit 40a. The movement restriction unit 40b may restrict the movement of the host vehicle Am in accordance with a restriction request from the on-board equipment of the vehicle system 1 or a restriction request from the remote management center X.

The driving control unit 40c continuously controls the motion actuator 41X based on one of the operation commands based on the driver's driving operation, the control commands from the driving assistance ECU 50a, the control commands from the autonomous driving ECU 50b, and the control commands from the remote management center X1. The motion actuator 41X may include a brake actuator that controls the braking force of each wheel, a powertrain that controls the output of the on-board power source, and a steering actuator that controls the steering angle.

An example of a processing method by the vehicle system 1 of the eleventh embodiment will be described using the flowchart in Figure 23. The series of processes shown in steps S701 to S706 is performed by at least one processor of the vehicle system 1 executing a program. This series of processes may be performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

Steps S701 to S703 are the same as steps S101 to S103 in the second embodiment. After processing step S703, proceed to step S704.

In S704, the cruise control ECU 40X (e.g., information acquisition unit 40a) acquires processing information from the HCU 100 and the autonomous driving ECU 50b. Furthermore, the cruise control ECU 40X (e.g., movement restriction unit 40b) determines whether the severity of the collision is severe (exceeds a preset level). Specifically, the movement restriction unit 40b may determine whether the perimeter monitoring sensor 30 has malfunctioned due to the collision. If the answer is Yes, proceed to S705. If the answer is No, proceed to S706.

In S705, the cruise control ECU 40X (e.g., movement restriction unit 40b) limits the speed of the host vehicle Am to a preset maximum speed. The preset maximum speed may be a speed at which the host vehicle Am can travel stably even if the vehicle body or perimeter monitoring sensor 30 has been damaged by a collision. The maximum speed may be set to, for example, 10 km/h, 20 km/h, etc. The maximum speed may also be set to change depending on the severity of the collision, gradually decreasing as the severity of the collision increases. The series of processes ends with S705.

In S705, the cruise control ECU 40X (e.g., the motion restriction unit 40b) does not restrict the speed of the host vehicle Am. In other words, the cruise control ECU 40X (e.g., the cruise control unit 40b) controls the motion actuator 41X to exactly reproduce the vehicle motion instructed by the operation command or control command. The series of processes ends with S705.

According to the eleventh embodiment described above, after a collision occurs, the movement of the host vehicle Am is restricted in response to the collision. This makes it possible to suppress inappropriate movement of the host vehicle Am.

Furthermore, according to the 11th embodiment, if the severity of the collision exceeds a preset level, the speed of the host vehicle Am is limited. This speed limit can prevent secondary collisions and confusion at the scene of the collision.

Twelfth Embodiment
As shown in Fig. 24, the twelfth embodiment is a modification of the eleventh embodiment. The twelfth embodiment will be described, focusing on the differences from the eleventh embodiment.

In the twelfth embodiment, the movement restriction unit 40b prohibits the host vehicle Am from restarting after being temporarily stopped due to a collision until all three pre-specified restart permissions are obtained. The first restart permission is permission from the occupant of the host vehicle Am. This permission is obtained, for example, by the occupant operating a start permission switch mounted on the host vehicle Am. The second restart permission is permission from the remote management center X1. This permission is obtained, for example, by an operator of the remote management center X1 collecting information about the collision site using V2X communication, etc., and issuing permission after confirming that the vehicle can restart.

The third permission to restart is permission from the vehicle system 1 installed in the vehicle. This permission is obtained when a pre-set decision-making entity (ECU or processor) in the vehicle system 1 issues permission after confirming that restarting is possible. The decision-making entity may be, for example, the autonomous driving ECU 50b, which has the authority to switch the autonomous driving level.

An example of a processing method by the vehicle system 1 of the twelfth embodiment will be described using the flowchart in Figure 24. The series of processes shown in steps S801 to S805 is performed by at least one processor of the vehicle system 1 executing a program. This series of processes may be performed during autonomous driving when the driver is not required to monitor the surroundings. This series of processes may be performed in accordance with the processing of the autonomous driving ECU 50b in steps S11 to S13 in Figure 4.

Steps S801 to S803 are the same as steps S701 to S703 in the 11th embodiment. After processing step S803, proceed to step S804.

In S804, the cruise control ECU 40X (e.g., the movement restriction unit 40b) maintains the restart prohibition state of the host vehicle Am and determines whether all restart permissions have been obtained. If the answer is Yes, proceed to S805. If the answer is No, the determination in S804 is made again after a predetermined time has elapsed or after a predetermined trigger has occurred.

In S805, the cruise control ECU 40X (e.g., the motion restriction unit 40b) lifts the prohibition on restarting the host vehicle Am and allows it to restart. This allows the cruise control ECU 40X (e.g., the cruise control unit 40b) to control the motion actuator 41X to exactly reproduce the vehicle motion instructed by the operation command or control command. The series of processes ends with S805.

Note that after S805, the speed of the host vehicle Am may be limited after it restarts by executing the processing of S704 to S706 of the 11th embodiment.

According to the twelfth embodiment described above, when the host vehicle Am temporarily stops after a collision occurs, the host vehicle Am is prohibited from restarting until permission is obtained from the occupants of the host vehicle Am, from the remote management center X1 that remotely manages the host vehicle Am, and from the vehicle system 1 installed in the host vehicle Am. By prohibiting inappropriate restarts, it is possible to prevent secondary collisions and confusion at the scene of the collision.

(Other embodiments)
Although multiple embodiments have been described above, the present disclosure should not be construed as being limited to those embodiments, and can be applied to various embodiments and combinations within the scope that does not deviate from the gist of the present disclosure.

In other embodiments, decisions regarding the driver handover may be made by an ECU separate from the autonomous driving ECU 50b. For example, a status management ECU separate from the autonomous driving ECU 50b may be provided, and the status management ECU may switch the autonomous driving level of the host vehicle Am and manage the driver handover.

In another embodiment, if the operation device 26 is a touch panel integrated with the CID 22, the HCU 100 (e.g., the notification control unit 88) may perform the following processing. This processing may be to prohibit the display of the interface for turning on the restricted autonomous driving function (or to erase the display) while the autonomous driving function is restricted.

In another embodiment, if the host vehicle Am is a bus, in response to the emergency opening operation of the fourth embodiment, all windows may be fully opened, as well as all boarding and alighting doors. Buses may have windows installed at a high position, making it difficult to escape from the vehicle through the windows, so it is preferable to be able to escape through the doors.

In other embodiments, the determination in S203 may be omitted and processing may proceed from S202 to S204.

Furthermore, as an embodiment related to the seventh embodiment, if at least one of a notification providing guidance on accident handling and a notification indicating the desired action to be taken by the occupants is implemented after a collision in S204, the processing may be skipped from S201 to S203 without implementing the notification in S202.

In other embodiments, at least some of the functions of ECUs such as the HCU 100, driving assistance ECU 50a, autonomous driving ECU 50b, and cruise control ECU 40 may be integrated into a single ECU or reorganized into multiple ECUs.

The control unit and method described herein may be implemented by a special-purpose computer comprising a processor programmed to perform one or more functions embodied in a computer program. Alternatively, the device and method described herein may be implemented by a special-purpose hardware logic circuit. Alternatively, the device and method described herein may be implemented by one or more special-purpose computers configured by a combination of a processor that executes a computer program and one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium.

(Disclosure of technical ideas)
This specification discloses multiple technical ideas described in the following multiple clauses. Some clauses may be written in a multiple dependent form, where the subsequent clause alternatively refers to the preceding clause. These multiple dependent clauses define multiple technical ideas.

<Technical philosophy 1>
A control device that controls in-vehicle devices (21, 22, 23, 24, 25, 28) in a vehicle (Am) that can be driven by automatic driving without a driver having to monitor its surroundings,
an information grasping unit (81, 82) that grasps collision occurrence information indicating whether or not a collision has occurred between the vehicle and another object during the autonomous driving, and vehicle control information indicating control of the vehicle in response to the collision;
a notification control unit (88) that issues a notification indicating the control state of the vehicle and a notification urging the driver to take over driving.

<Technical philosophy 2>
The control device described in Technical Idea 1, wherein the notification indicating the control status of the vehicle includes a notification indicating that the movement of the vehicle is restricted by the operation of the brakes, and a notification indicating that the hazard lights (45) of the vehicle are on.

<Technical philosophy 3>
A control device described in technical idea 1 or 2, in which, when the information grasping unit grasps that the vehicle's autonomous driving function is restricted after the occurrence of the collision, the notification control unit issues a notification indicating that the autonomous driving function is restricted.

<Technical philosophy 4>
The information grasping unit grasps an operation to turn on an automatic driving function for an operation device (26) of the vehicle,
A control device described in technical idea 1 or 2, in which when it is determined that the autonomous driving function is restricted after the collision occurs and an operation to turn on the autonomous driving function is determined, the notification control unit issues a notification indicating that the autonomous driving function is restricted.

<Technical philosophy 5>
A control device as described in Technical Idea 3 or 4, in which the vehicle is specified such that lifting of the restriction on the automatic driving function is prohibited until initialization work is performed by the vehicle manager.

<Technical philosophy 6>
A control device as described in Technical Idea 3 or 4, in which the vehicle is specified such that the restriction on the autonomous driving function is lifted when the vehicle's start switch is turned off.

<Technical philosophy 7>
The control device according to any one of Technical Ideas 1 to 6, wherein the notification control unit further provides a notification indicating a collision part of the vehicle.

<Technical philosophy 8>
The control device according to Technical Idea 7, wherein the notification control unit further issues a notification indicating a failure associated with the collision portion.

<Technical philosophy 9>
The control device according to any one of Technical Ideas 1 to 8, wherein the notification control unit further issues a notification indicating a possibility of a fire in the vehicle.

<Technical Thought 10>
The control device according to any one of Technical Ideas 1 to 9, wherein the notification control unit further provides a notification indicating the position on the road where the vehicle is stopped.

<Technical Thought 11>
The control device according to Technical Idea 10, wherein the notification indicating the position on the road where the vehicle is stopped includes information on which lane the vehicle is stopped in on a multi-lane road.

<Technical Thought 12>
A control device described in any one of technical ideas 1 to 11, further comprising a request processing unit (84) that requests the vehicle to make the door lock of the vehicle unable to be manually unlocked by the occupant when there is no need for the occupant of the vehicle to get out of the vehicle urgently.

<Technical Thought 13>
The information grasping unit grasps an emergency window opening operation performed on an operation device (26) of the vehicle,
The control device described in any one of technical ideas 1 to 11 further includes a request processing unit (84) that requests the vehicle to fully open the side window of the vehicle when the execution of the emergency opening operation is detected.

<Technical Thought 14>
The control device described in Technical Idea 1, in which the notification control unit implements a notification to encourage the driver to take over driving, which is less urgent than when the automatic driving function is restricted, based on the fact that a decision to continue the automatic driving function is made in a decision on whether to continue the automatic driving function made based on predetermined conditions based on the nature of the collision.

<Technical Thought 15>
The control device according to Technical Idea 14, wherein the predetermined condition based on the type of collision is a condition based on the severity of the collision and a failure state of a perimeter monitoring sensor (30) mounted on the vehicle.

<Technical Thought 16>
The control device according to Technical Concept 14, wherein the predetermined condition based on the type of collision is a condition based on the collision part of the vehicle and the other object.

<Technical Thought 17>
The control device according to any one of Technical Ideas 1 to 16, wherein the notification control unit performs notification so that the amount of information is changed depending on the state of the occupant at the time of the collision.

<Technical Thought 18>
The notification control unit
When the occupant is sleeping, the amount of information is increased compared to when the occupant is performing a second task,
A control device described in technical idea 17, which provides a notification with a larger amount of information when the occupant is performing a second task than when the occupant is monitoring the surroundings.

<Technical Thought 19>
The control device according to Technical Idea 18, wherein the notification control unit issues a notification indicating the type of the other object when the occupant is not in a state of monitoring the surroundings.

<Technical Thought 20>
The control device according to any one of Technical Ideas 1 to 17, wherein the notification control unit issues a notification indicating guidance on accident handling after the collision.

<Technical Thought 21>
The control device according to any one of Technical Ideas 1 to 17 and 20, wherein the notification control unit issues a notification indicating a desired action to be taken by an occupant of the vehicle after the collision.

<Technical Thought 22>
A control device described in any one of technical ideas 1 to 21, wherein the notification control unit issues an outside-vehicle notification to guide the other object, which is a dynamic object, so that the vehicle can resume driving after the collision if the vehicle is able to drive.

<Technical Thought 23>
A control device described in any one of technical ideas 1 to 22, in which the notification control unit issues a notification indicating the location of a transfer vehicle (X2) for occupants of the vehicle to transfer from the vehicle after the collision when the transfer vehicle arrives.

<Technical Thought 24>
The control device according to technical idea 23, wherein the transfer vehicle is arranged when the occupant operates an emergency call switch (29) provided in the vehicle.

<Technical Thought 25>
The control device according to technical idea 23 or 24, wherein the transfer vehicle is a vehicle selected from available vehicles around the collision point.

<Technical Thought 26>
A control device described in any one of technical ideas 23 to 25, further comprising an information transfer unit (85) that transmits information about the vehicle to the transfer vehicle when the occupant transfers to the transfer vehicle and transfers the information to the transfer vehicle.

<Technical Thought 27>
The information grasping unit further grasps surrounding collision occurrence information indicating whether or not a collision has occurred between a plurality of the other objects in the vicinity of the vehicle,
A control device described in any one of technical ideas 1 to 26, in which the notification control unit changes the response regarding the notification depending on a judgment of whether the vehicle is able to leave the scene of the collision, which is made based on the surrounding collision occurrence information.

<Technical Thought 28>
The information grasping unit further grasps surrounding collision occurrence information indicating whether or not a collision has occurred between a plurality of the other objects in the vicinity of the vehicle,
A control device described in any one of technical ideas 1 to 27, wherein the notification control unit issues a notification to the outside of the vehicle indicating whether or not it is possible to board the vehicle when a collision occurs between the other objects.

<Technical Thought 29>
An automatic driving device configured to be able to communicate with the control device according to Technical Concept 27 or 28 and performing the automatic driving of the vehicle,
a collision recognition unit (74) that recognizes the occurrence of a collision between a plurality of other objects in the vicinity of the vehicle;
An automatic driving device comprising: an action determination unit (63) that changes the response regarding the control of the automatic driving depending on whether or not the vehicle is able to leave the scene of the collision.

<Technical Thought 30>
The automatic driving device according to Technical Idea 29, wherein the behavior determination unit temporarily stops the vehicle when it is determined that the vehicle cannot leave the scene of the collision.

<Technical Thought 31>
Technical Concepts A driving control device configured to be able to communicate with the control device according to any one of claims 1 to 28 and controlling driving of the vehicle,
A driving control device including a movement limiting unit (40b) that limits the movement of the vehicle in response to the collision after the collision occurs.

<Technical Thought 32>
The travel control device according to Technical Idea 31, wherein the movement restriction unit restricts the speed of the vehicle when the severity of the collision exceeds a preset level.

<Technical Thought 33>
The driving control device according to technical idea 31 or 32, wherein the movement restriction unit prohibits the vehicle from restarting when the vehicle is temporarily stopped after the occurrence of the collision until permission is obtained from the vehicle's occupants, permission from a remote management center (X1) that remotely manages the vehicle, and permission from a system (1) installed in the vehicle.

<Technical Thought 34>
A control device that controls in-vehicle devices (21, 22, 23, 24, 25) in a vehicle (Am) that can be driven by automatic driving without a driver having to monitor its surroundings,
an information grasping unit (81, 82) that grasps collision occurrence information indicating whether or not a collision has occurred between the vehicle and another object during the autonomous driving and including information on the type of the collision, and vehicle control information indicating control of the vehicle in response to the collision;
A control device comprising: a notification control unit (88) that issues a notification to the driver to encourage a change of driving, which is less urgent than when the automatic driving function is restricted, based on the decision to continue the automatic driving function made in a decision on whether to continue the automatic driving function based on predetermined conditions based on the type of collision.

This technical concept 34 allows the driver to calmly take over driving even in the event of a collision, thanks to the ample, low-urgency notification.

<Technical Thought 35>
A control device that controls in-vehicle devices (21, 22, 23, 24, 25, 28) in a vehicle (Am) that can be driven by automatic driving without a driver having to monitor its surroundings,
an information grasping unit (81, 82) that grasps collision occurrence information indicating whether or not a collision has occurred between the vehicle and another object during the autonomous driving, and vehicle control information indicating control of the vehicle in response to the collision;
A control device comprising: a notification control unit (88) that, after the collision, issues a notification indicating guidance on how to handle the accident, and a notification indicating the desired action to be taken by the vehicle's occupants, in accordance with the collision occurrence information and the vehicle control information.

This technical concept 35 allows the crew to decide on subsequent actions while understanding the situation regarding accident handling, and can take more appropriate actions by referring to the notification indicating the desired actions for the crew.

<Technical Thought 36>
An automatic driving device that performs automatic driving of a vehicle,
a collision recognition unit (74) that recognizes the occurrence of a collision between a plurality of other objects in the vicinity of the vehicle;
An automatic driving device comprising: an action determination unit (63) that changes the response regarding the control of the automatic driving depending on whether or not the vehicle is able to leave the scene of the collision.

This technical concept 36 makes it possible to provide appropriate control depending on whether it is possible to move away from the scene of a collision.

<Technical Thought 37>
A driving control device that controls driving of a vehicle,
an information acquisition unit (40a) that acquires collision occurrence information indicating whether or not a collision has occurred between the vehicle and another object during the autonomous driving, and vehicle control information indicating control of the vehicle in response to the collision;
A driving control device including a movement limiting unit (40b) that limits the movement of the vehicle in response to the collision after the collision occurs.

This technical concept 37 makes it possible to suppress inappropriate vehicle movement.

21: Meter display (on-board device), 22: CID (on-board device), 23: HUD (on-board device), 24: Audio device (on-board device), 25: Ambient light (on-board device), 28: Exterior display device, 81: Information acquisition unit (information grasping unit), 82: Information linkage unit (information grasping unit), 88: Notification control unit, 100: HCU (control unit), Am: Host vehicle (vehicle)

Claims (33)

A control device that controls in-vehicle devices (21, 22, 23, 24, 25, 28) in a vehicle (Am) that can be driven by automatic driving without a driver having to monitor its surroundings,
an information grasping unit (81, 82) that grasps collision occurrence information indicating whether or not a collision has occurred between the vehicle and another object during the autonomous driving, and vehicle control information indicating a control state of the vehicle after control of the vehicle corresponding to the collision has been executed;
A control device comprising: a notification control unit (88) that performs both a notification indicating the control status of the vehicle after executing control of the vehicle in response to the collision, and a notification from the system side requesting or warning the driver to take over driving. 2. The control device according to claim 1, wherein the notification indicating the state of control of the vehicle after executing control of the vehicle in response to the collision includes a notification indicating that movement of the vehicle is restricted by brake operation and a notification indicating that hazard lights (45) of the vehicle are illuminated. The control device described in claim 1, wherein, when the information grasping unit determines that the autonomous driving function of the vehicle is restricted after the occurrence of the collision, the notification control unit issues a notification indicating that the autonomous driving function is restricted. The information grasping unit grasps an operation to turn on an automatic driving function for an operation device (26) of the vehicle,
The control device described in claim 1, wherein when it is determined that the autonomous driving function is restricted after the occurrence of the collision and an operation to turn on the autonomous driving function is determined, the notification control unit issues a notification indicating that the autonomous driving function is restricted. The control device described in claim 3 or 4 is configured such that the lifting of the restriction on the autonomous driving function in the vehicle is prohibited until initialization is performed by the vehicle administrator. The control device described in claim 3 or 4 is configured so that the restriction on the autonomous driving function of the vehicle is lifted when the vehicle's activation switch is turned off. The control device described in claim 1, wherein the notification control unit further issues a notification indicating the collision area of the vehicle. The control device described in claim 7, wherein the notification control unit further issues a notification indicating a malfunction associated with the collision area. The control device described in claim 1, wherein the notification control unit further issues a notification indicating the possibility of a fire in the vehicle. The control device described in claim 1, wherein the notification control unit further provides a notification indicating the location on the road where the vehicle is stopped. The control device described in claim 10, wherein the notification indicating the location on the road where the vehicle is stopped includes information about which lane the vehicle is stopped in on a multi-lane road. The control device described in claim 1 further includes a request processing unit (84) that requests the vehicle to make the vehicle door locks unable to be manually unlocked by the occupant when there is no emergency need for the occupant to exit the vehicle. The information grasping unit grasps an emergency window opening operation performed on an operation device (26) of the vehicle,
2. The control device according to claim 1, further comprising a request processing unit (84) that requests the vehicle to fully open a side window of the vehicle when the execution of the emergency opening operation is detected. The control device described in claim 1, wherein the notification control unit issues a notification to the driver requesting or warning the driver to take over driving, based on a decision to continue the autonomous driving function made in a decision on whether to continue the autonomous driving function based on predetermined conditions based on the type of collision, and encourages a change of driving with less urgency than when the autonomous driving function is restricted. The control device described in claim 14, wherein the predetermined condition based on the type of collision is a condition based on the severity of the collision and a failure status of a perimeter monitoring sensor (30) mounted on the vehicle. The control device described in claim 14, wherein the predetermined conditions based on the type of collision are conditions based on the impacted part of the vehicle and the other object. The control device described in claim 1, wherein the notification control unit performs notification so that the amount of information provided varies depending on the state of the occupant at the time of the collision. The notification control unit
When the occupant is sleeping, the amount of information is increased compared to when the occupant is performing a second task,
The control device according to claim 17, wherein when the occupant is performing a second task, the notification is performed so that the amount of information is greater than when the occupant is monitoring the surroundings. The control device described in claim 18, wherein the notification control unit issues a notification indicating the type of the other object when the occupant is not in a state where the occupant is monitoring the surroundings. The control device described in claim 1, wherein the notification control unit issues a notification indicating accident response instructions after the collision. The control device described in claim 1 or 20, wherein the notification control unit issues a notification indicating the desired action to be taken by an occupant of the vehicle after the collision. The control device described in claim 1, wherein the notification control unit issues an external notification to guide the other object, which is a dynamic object, so that the vehicle can resume driving after the collision if the vehicle is able to continue driving. The control device described in claim 1, wherein the notification control unit issues a notification indicating the location of a transfer vehicle (X2) for occupants of the vehicle to transfer from the vehicle after the collision when the transfer vehicle arrives. The control device described in claim 23, wherein the transfer vehicle is arranged when the occupant operates an emergency call switch (29) provided on the vehicle. The control device described in claim 23 or 24, wherein the transfer vehicle is a vehicle selected from available vehicles around the collision point. The control device described in claim 23 further includes an information transfer unit (85) that transmits information about the vehicle to the transfer vehicle when the occupant transfers to the transfer vehicle and transfers the information to the transfer vehicle. The information grasping unit further grasps surrounding collision occurrence information indicating whether or not a collision has occurred between a plurality of the other objects in the vicinity of the vehicle,
The control device according to claim 1 , wherein the notification control unit changes the response regarding the notification in accordance with a determination as to whether the vehicle can move away from the collision site, which is determined based on the surrounding collision occurrence information. The information grasping unit further grasps surrounding collision occurrence information indicating whether or not a collision has occurred between a plurality of the other objects in the vicinity of the vehicle,
The control device according to claim 1 , wherein the notification control unit issues a notification to an exterior of the vehicle indicating whether or not it is possible to get into the vehicle when a collision between the other objects occurs. An automatic driving device configured to be able to communicate with the control device according to claim 27 or 28 and to perform the automatic driving of the vehicle,
a collision recognition unit (74) that recognizes the occurrence of a collision between a plurality of other objects in the vicinity of the vehicle;
An automatic driving device comprising: an action determination unit (63) that changes the response regarding the control of the automatic driving depending on whether or not the vehicle is able to leave the scene of the collision. The automated driving device described in claim 29, wherein the behavior determination unit temporarily stops the vehicle when it determines that the vehicle cannot leave the scene of the collision. A travel control device configured to be able to communicate with the control device according to claim 1 and controlling travel of the vehicle,
A driving control device including a movement limiting unit (40b) that limits the movement of the vehicle in response to the collision after the collision occurs. The driving control device described in claim 31, wherein the movement restriction unit restricts the speed of the vehicle when the severity of the collision exceeds a predetermined level. A driving control device as described in claim 31 or 32, wherein the movement restriction unit prohibits the vehicle from restarting when the vehicle is temporarily stopped after the collision occurs until permission is obtained from all of the following: an occupant of the vehicle; a remote management center (X1) that remotely manages the vehicle; and a system (1) installed in the vehicle.