Abstract: A processing method, implemented by at least one processor, includes: detecting a manual deviation between a driver's manual operation and a driver's standard operation when the host moving body is under manual-driving; and storing an acceptable response time for the host moving body. The acceptable response time is a response time during which the host moving body is allowed to respond while the manual deviation is generating. The acceptable response time is acquired based on a safety model that is a model in compliance with a driving policy and is formed by modeling a safety of intended functionality.

Abstract: A processing method executed by a processor for performing a process related to driving control of a host moving object includes: monitoring an abnormality in detection information that is generated by detecting an internal and external environment of the host moving object; and in response to determining the abnormality being occurred, setting a constraint or restriction on the driving control according to the detection information using a safety model, which is in compliance with a driving policy and is generated by modeling safety of intended functionality.

Abstract: A system for controlling behaviors of a vehicle is provided. The system comprises a first transmission device (for example, an ABS ECU), a second transmission device (for example, an engine ECU), and a reception/processing unit (i.e., a superior control unit). The first transmission device transmits a first time-dependent data to be used for controlling behaviors of the vehicle, while the second transmission device transmits a second time-dependent data to be used for controlling behaviors of the vehicle. The reception/processing unit receives both of the first and second time-dependent data and performs processing to ensure simultaneity between the first and second time-dependent data that have been received. The reception/processing unit also produces parameters for controlling the behaviors of the vehicle using both of the first and second time-dependent data which have been subjected to the simultaneity-ensuring processing.

Abstract: In a vehicle control system which requires a plurality of ECUs (electronic control units) to control in real time states of the vehicle using time-dependent data transmitted and received among the ECUs. The time-dependent data reflecting the vehicle states is detected or produced. A transmitting ECU, one of the plural ECUs, transmits the time-dependent data with a degree of newness thereof to a receiving ECU, another one of the plural ECUs, which takes part in the real-time control. The receiving ECU determines whether or not the time-dependent data has expired for the real-time control based on the degree of newness of the time-dependent data and performs processing with the time-dependent data based on determined results of the expiration, the processing having the time-dependent data adapted to the real-time control. Thus the real-time control can be performed based on only the adaptive time-dependent data to the real-time control.

Abstract: An automatic code generation section reads a control model, and generates and releases a control program which is written in the C language. At the generation of the control program, a correspondence information formation section creates correspondence information indicative of the correspondence relationship between the control model and the control program. A simulation section reads the control model and simulates its operation. A program execution section reads the control program and executes it. A synchronizing section makes synchronization, that is, a relational linkage, between the operation results of the simulation section and the program execution section based on the correspondence information.

Abstract: A system for controlling behaviors of a vehicle is provided. The system comprises a first transmission device (for example, an ABS ECU), a second transmission device (for example, an engine ECU), and a reception/processing unit (i.e., a superior control unit). The first transmission device transmits a first time-dependent data to be used for controlling behaviors of the vehicle, while the second transmission device transmits a second time-dependent data to be used for controlling behaviors of the vehicle. The reception/processing unit receives both of the first and second time-dependent data and performs processing to ensure simultaneity between the first and second time-dependent data that have been received. The reception/processing unit also produces parameters for controlling the behaviors of the vehicle using both of the first and second time-dependent data which have been subjected to the simultaneity-ensuring processing.

Abstract: In a vehicle control system which requires a plurality of ECUs (electronic control units) to control in real time states of the vehicle using time-dependent data transmitted and received among the ECUs. The time-dependent data reflecting the vehicle states is detected or produced. A transmitting ECU, one of the plural ECUs, transmits the time-dependent data with a degree of newness thereof to a receiving ECU, another one of the plural ECUs, which takes part in the real-time control. The receiving ECU determines whether or not the time-dependent data has expired for the real-time control based on the degree of newness of the time-dependent data and performs processing with the time-dependent data based on determined results of the expiration, the processing having the time-dependent data adapted to the real-time control. Thus the real-time control can be performed based on only the adaptive time-dependent data to the real-time control.

Abstract: An automatic code generation section reads a control model, and generates and releases a control program which is written in the C language. At the generation of the control program, a correspondence information formation section creates correspondence information indicative of the correspondence relationship between the control model and the control program. A simulation section reads the control model and simulates its operation. A program execution section reads the control program and executes it. A synchronizing section makes synchronization, that is, a relational linkage, between the operation results of the simulation section and the program execution section based on the correspondence information.