Alternative device, alternative control program product, and alternative method

Abstract

The replacement device is mounted on a vehicle equipped with multiple vehicle-mounted control devices, and includes a control unit and a replacement unit. The control unit controls the replacement unit based on the transmission data sent from the multiple vehicle-mounted control devices, determines the abnormal vehicle-mounted control device based on the transmission data, and invalidates the abnormal vehicle-mounted control device. A program for performing the function that the abnormal vehicle-mounted control device determines to be performed under normal circumstances is applied to the replacement unit, and the replacement unit replaces the invalid vehicle-mounted control device by executing the applied program.

Description

Technical Field

[0001] The present disclosure relates to alternative apparatus, alternative control program products, and alternative methods.

[0002] This application claims the benefit of priority based on Japanese Patent Application No. 2019-044034, filed on March 11, 2019, and incorporates by reference all the contents of the aforementioned Japanese Application. Background Art

[0003] Vehicles are equipped with ECUs (Electronic Control Units) for controlling onboard devices, including powertrain systems such as engine control and body systems such as air conditioning control. An ECU includes a processing unit such as an MPU, rewritable non-volatile storage such as RAM, and a communication unit for communicating with other ECUs. The ECU controls onboard devices by reading and executing control programs stored in the storage unit. Any ECU installed in the vehicle detects spoofed messages by determining whether messages sent from other ECUs are valid. If a spoofed message is detected, it overwrites the spoofed message with an error frame during data frame reception (see, for example, Patent Document 1).

[0004] Prior art literature

[0005] Patent Document 1: Japanese Patent Application Laid-Open No. 2018-182767 Summary of the Invention

[0006] A substitution device according to one aspect of the present disclosure is mounted on a vehicle equipped with a plurality of vehicle-mounted control devices, and includes a control unit and a substitution unit.

[0007] The control unit controls the substitution unit based on the transmission data transmitted from the plurality of vehicle-mounted control devices.

[0008] The control unit identifies an abnormal vehicle-mounted control device based on the transmitted data.

[0009] The control unit disables the identified abnormal vehicle-mounted control device,

[0010] The control unit applies a program for realizing a function that the identified abnormal vehicle-mounted control device performs under normal conditions to the replacement unit.

[0011] The replacement unit replaces the disabled vehicle-mounted control device by executing the applied program. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a schematic diagram illustrating the configuration of an on-vehicle control device replacement system including the replacement device of the first embodiment.

[0013] Figure 2 is a block diagram illustrating the physical structure of an alternative device.

[0014] Figure 3 This is an explanatory diagram (sequence diagram) illustrating one form of substitution by a substitution device.

[0015] Figure 4 This is a flowchart illustrating the processing of the control unit of the replacement device.

[0016] Figure 5 This is a block diagram illustrating the logical structure of an alternative device in the second embodiment (virtual environment). DETAILED DESCRIPTION

[0017] [Problems to be Solved by the Present Disclosure]

[0018] The ECU of Patent Document 1 can overwrite an unauthorized message from an abnormal or unauthorized ECU that transmits a fake message using an error frame, but does not consider replacing the function that the abnormal ECU would normally perform.

[0019] An object of the present disclosure is to provide a replacement device or the like that replaces the function of an ECU when an abnormal ECU is detected.

[0020] [Effects of the Present Disclosure]

[0021] According to one aspect of the present disclosure, it is possible to provide a replacement device or the like that replaces the function of an ECU when an abnormal ECU is detected.

[0022] [Description of Embodiments of the Present Disclosure]

[0023] First, the embodiments of the present disclosure will be described by way of example. Furthermore, at least a portion of the embodiments described below may be arbitrarily combined.

[0024] (1) A substitution device according to one aspect of the present disclosure is mounted on a vehicle equipped with a plurality of vehicle-mounted control devices, and includes a control unit and a substitution unit.

[0025] The control unit controls the substitution unit based on the transmission data transmitted from the plurality of vehicle-mounted control devices.

[0026] The control unit identifies an abnormal vehicle-mounted control device based on the transmitted data.

[0027] The abnormal vehicle-mounted control device determined by the control unit is invalid.

[0028] The control unit applies a program for realizing a function that the identified abnormal vehicle-mounted control device performs under normal conditions to the replacement unit.

[0029] The replacement unit replaces the disabled vehicle-mounted control device by executing the applied program.

[0030] In this aspect, the control unit disables the identified abnormal onboard control device and applies a program to the replacement unit for performing the function normally performed by the abnormal onboard control device. The replacement unit, to which the program is applied, executes the program to replace the disabled onboard control device. Thus, the abnormal onboard control device can be disabled to prevent any impact on other onboard devices or the vehicle, while the replacement unit can perform the function normally performed by the abnormal onboard control device.

[0031] (2) In an alternative device according to one aspect of the present disclosure,

[0032] The plurality of vehicle-mounted control devices are connected to the control unit in a communicative manner via a communication protocol of a control local area network or Ethernet.

[0033] The replacement unit is communicably connected to the control unit via the control area network and the Ethernet communication protocol.

[0034] In this form, the replacement unit is connected to the control unit in a communicative manner via the communication protocols of CAN and Ethernet, and can therefore replace both the vehicle-mounted control device using CAN as the communication protocol and the vehicle-mounted control device using Ethernet as the communication protocol.

[0035] (3) In an alternative device according to one aspect of the present disclosure,

[0036] The control unit controls so that, before the program is applied to the substitution unit, a relay path for relaying the transmission data transmitted from the plurality of vehicle-mounted control devices does not include the substitution unit.

[0037] After the above-mentioned program is applied to the above-mentioned substitution part, the above-mentioned relay path includes the above-mentioned substitution part.

[0038] In this aspect, when the control unit relays communications between onboard control devices, the relay path used for relaying does not include the replacement unit until the program for replacing the malfunctioning onboard control device is applied to the replacement unit. Therefore, data transmitted from the onboard control device is not relayed to the replacement unit. Therefore, even if the transmitted data contains fraudulent data, the replacement unit's robustness against the fraudulent data is guaranteed.

[0039] (4) In one aspect of the replacement device disclosed herein, the replacement unit replaces an onboard control device that generates output data based on data obtained via a communication path for communicating with other onboard control devices, and outputs the generated data via the communication path.

[0040] In this aspect, an onboard control device replaces the onboard control device. This onboard control device generates output data based on data acquired via a communication path used for communication with other onboard control devices, and outputs this generated data via the communication path. Specifically, this onboard control device is not directly connected to onboard devices such as motors, brakes, and various sensors that are controlled via a wiring harness, but rather generates output data based on data acquired via the communication path and outputs this generated data via the communication path. Therefore, there is no need for a wiring harness or the like connecting the replacement unit to the onboard device that is controlled, simplifying the wiring within the vehicle.

[0041] (5) In an alternative device according to one aspect of the present disclosure,

[0042] The vehicle is equipped with an off-vehicle communication device for communicating with an external server outside the vehicle.

[0043] The control unit obtains the program from the external server via the external vehicle communication device.

[0044] The control unit applies the acquired program to the replacement unit.

[0045] In this embodiment, the control unit obtains the program from the external server via the off-vehicle communication device. Therefore, even if the storage unit of the replacement device does not store the program for performing the function that the identified abnormal on-vehicle control unit performs under normal conditions, the program can be obtained from the external server and applied to the replacement unit.

[0046] (6) In an alternative device according to one aspect of the present disclosure,

[0047] The control unit performs recovery processing on the disabled vehicle-mounted control device.

[0048] When the disabled in-vehicle control device becomes normal through the recovery process, the control unit stops the substitution by the substitution unit.

[0049] In this aspect, the control unit performs recovery processing on the disabled onboard control device, such as restarting the onboard control device or reprogramming the onboard control device. When the disabled onboard control device becomes normal through the recovery processing, the control unit stops the replacement by the replacement unit, thereby enabling efficient recovery of the abnormal onboard control device.

[0050] (7) In an alternative device according to one aspect of the present disclosure,

[0051] The above-mentioned replacement part generates a virtual environment by virtualizing the operating system.

[0052] Execute the above program in the above virtual environment.

[0053] In this embodiment, the replacement unit generates a virtual environment using a virtualized operating system, and the program executes within this virtual environment. Therefore, even if there are differences in hardware structure between the replacement unit and the replaced vehicle control device, for example, these differences can be absorbed by the virtual environment based on the virtualized operating system, allowing the replacement unit to efficiently replace multiple different types of vehicle control devices.

[0054] (8) In an alternative device according to one aspect of the present disclosure,

[0055] The virtual environment is generated according to the number of the disabled vehicle-mounted control devices.

[0056] The number of the above programs is the same as the number of the above in-vehicle control devices that have been disabled.

[0057] The above-mentioned programs are executed on the virtual environments generated corresponding to the above-mentioned number.

[0058] In this aspect, virtual environments are generated in accordance with the number of identified faulty onboard control devices, and programs corresponding to the identified faulty onboard control devices are executed in each generated virtual environment. Therefore, even if the replacement portion physically consists of a single device, the replacement device containing that replacement portion can simultaneously replace multiple onboard control devices.

[0059] (9) An alternative control program according to one aspect of the present disclosure causes a computer to execute the following processing:

[0060] Identify an abnormal vehicle-mounted control device based on transmission data transmitted from a plurality of vehicle-mounted control devices mounted on the vehicle,

[0061] Disable the vehicle control device that is determined to be abnormal.

[0062] The disabled on-vehicle control device is replaced by executing a program for performing the function that the identified abnormal on-vehicle control device performs under normal circumstances.

[0063] In this aspect, a computer can be made to function as an alternative device.

[0064] (10) In an alternative method according to one aspect of the present disclosure,

[0065] Identify an abnormal vehicle-mounted control device based on transmission data transmitted from a plurality of vehicle-mounted control devices mounted on the vehicle,

[0066] Disable the vehicle control device that is determined to be abnormal.

[0067] The disabled on-vehicle control device is replaced by executing a program for performing the function that the identified abnormal on-vehicle control device performs under normal circumstances.

[0068] In this aspect, it is possible to provide a replacement method for replacing the function of an abnormal ECU when the abnormal ECU is detected.

[0069] [Details of the embodiments of the present disclosure]

[0070] The present disclosure is described in detail based on the accompanying drawings showing embodiments thereof. Hereinafter, an alternative device 6 to the embodiment of the present disclosure will be described with reference to the accompanying drawings. The present disclosure is not limited to these examples but is defined by the claims and encompasses all modifications within the meaning and scope of the claims.

[0071] (Implementation Method 1)

[0072] Hereinafter, embodiments will be described based on the drawings. Figure 1 1 is a schematic diagram illustrating the configuration of an on-vehicle control device replacement system S including the replacement device 6 according to the first embodiment. Figure 2 is a block diagram illustrating the physical structure of the replacement device 6.

[0073] The vehicle-mounted control device replacement system S includes a replacement device 6 mounted on the vehicle and an off-vehicle communication device 1, which applies a program obtained from an external server 100 connected via an off-vehicle network N to a replacement ECU 5 (replacement unit) included in the replacement device 6, thereby replacing any one of the multiple vehicle-mounted ECUs 3 (Electronic Control Units / vehicle-mounted control devices) installed on the vehicle C.

[0074] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and has a storage unit 101 such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. In the external server 100, a program or data for controlling the onboard ECU 3, generated by the manufacturer of the onboard ECU 3, is stored in the storage unit 101. This program or data is sent to the vehicle C as an update program to update the program or data of the onboard ECU 3 installed in the vehicle C. The external server 100 configured in this way is also called an OTA (Over The Air) server. The onboard ECU 3 installed in the vehicle C obtains the update program sent by wireless communication from the external server 100, and by applying a program that executes the update program, it can update (update) the program executed by the ECU itself. The storage unit 101 of the external server 100 stores a program (alternative program) to be applied to the alternative ECU 5 described later.

[0075] Vehicle C is equipped with an external vehicle communication device 1, an alternative device 6, a display device 7, and multiple onboard ECUs 3 for controlling various onboard devices. The alternative device 6 includes an onboard relay device 2 and an alternative ECU 5. The onboard relay device 2 and the external vehicle communication device 1 are communicatively connected via a wiring harness, such as a serial cable. The onboard relay device 2 and the onboard ECUs 3 are communicatively connected via a communication line 41 compatible with a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark), and an in-vehicle LAN 4.

[0076] The off-vehicle communication device 1 includes an off-vehicle communication unit (not shown) and an input / output interface (I / F) (not shown) for communicating with the on-vehicle relay device 2. The off-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, or WiFi, and transmits and receives data with an external server 100 via an antenna 11 connected to the off-vehicle communication unit. Communication between the off-vehicle communication device 1 and the external server 100 is performed via an external network N such as a public line network or the Internet. The input / output I / F is a communication interface for performing, for example, serial communication with the on-vehicle relay device 2. The off-vehicle communication device 1 and the on-vehicle relay device 2 communicate with each other via the input / output I / F and a wiring harness such as a serial cable connected to the input / output I / F. In this embodiment, the off-vehicle communication device 1 is configured as a separate device from the on-vehicle relay device 2, and the two devices are connected to each other via the input / output I / F, etc. so that they can communicate, but this is not limited to this. The off-vehicle communication device 1 can be built into the on-vehicle relay device 2 as a component of the on-vehicle relay device 2.

[0077] The replacement device 6 includes a vehicle-mounted relay device 2 and a replacement ECU5, which determines the abnormal vehicle-mounted ECU3 based on the transmission data sent from the vehicle-mounted ECU3, invalidates the determined abnormal vehicle-mounted ECU3, and applies a program (replacement program) for performing the functions performed by the determined abnormal vehicle-mounted ECU3 under normal circumstances to the replacement ECU5, thereby replacing the invalid vehicle-mounted ECU3.

[0078] The on-board relay device 2 includes a control unit 20, a storage unit 21, an input / output interface 22, and an in-vehicle communication unit 23. The on-board relay device 2 is a gateway (repeater) that manages components of a system, such as the on-board ECU 3 for the recognition system, the on-board ECU 3 for the judgment system, and the on-board ECU 3 for the operation system, over multiple communication lines 41, and relays communications between these components and the on-board ECUs 3. Alternatively, the on-board relay device 2 can be configured as a functional unit of the body ECU that controls the entire vehicle C. The on-board relay device 2 is configured to obtain an update program received by the off-board communication device 1 from an external server 100 via wireless communication and transmit the update program to a predetermined on-board ECU 3 (the on-board ECU 3 to be updated) via the in-vehicle LAN 4 (main update unit).

[0079] The control unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Microprocessing Unit), and performs various control and computational processes by reading and executing control programs and data pre-stored in the storage unit 21. The control unit 20 of the vehicle-mounted relay device 2 functions as the control unit of the alternative device 6.

[0080] The control unit 20 of the on-board relay device 2 (the control unit of the substitute device 6) functions as a determination unit that determines whether transmission data transmitted from the on-board ECU is abnormal, based on the transmission data transmitted by the on-board ECU, by executing the control program stored in the storage unit 21. The control unit 20 of the on-board relay device 2 (the control unit of the substitute device 6) functions as a determination unit that identifies the abnormal on-board ECU, which is the source of the transmission data determined to be abnormal, by executing the control program stored in the storage unit 21. The control unit 20 of the on-board relay device 2 (the control unit of the substitute device 6) functions as a deactivation unit that deactivates the identified abnormal on-board ECU, by executing the control program stored in the storage unit 21. The control unit 20 of the on-board relay device 2 (the control unit of the substitute device 6) functions as a deactivation unit that applies the program (the deactivation program) for performing the function that the identified abnormal on-board ECU performs under normal conditions to the substitute ECU 5. The control unit 20 of the vehicle-mounted relay device 2 (the control unit of the alternative device 6) functions as an acquisition unit that obtains the program of the vehicle-mounted ECU 3 sent from the external server 100 or the program (alternative program) applied to the alternative ECU 5 via the off-vehicle communication device 1 by executing the control program stored in the storage unit 21.

[0081] The storage unit 21 is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory. It pre-stores control programs and data referenced during processing. The control programs stored in the storage unit 21 can be stored in a recording medium 211 that can be read from the on-board relay unit 2. Alternatively, the control programs can be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0082] The storage unit 21 stores relay path information (routing table) used when performing relay processing for communication between on-board ECUs 3 or communication between on-board ECUs 3 and an external server 100. The writing method of the relay path information is determined based on the communication protocol. When the communication protocol is CAN, the relay path information for CAN includes the message identifier (CAN-ID) included in the CAN message and the relay destination (I / O port number of the CAN communication unit 232) associated with the CAN-ID. When the communication protocol is TCP / IP, the relay path information for TCP / IP includes the destination address (MAC address or IP address) included in the IP packet and the relay destination (physical port number of the Ethernet communication unit 231) associated with the destination address.

[0083] The control unit 20 can modify the relay path information based on the execution or suspension of the replacement processing performed by the replacement ECU 5, as described in detail below. Specifically, while the replacement ECU 5 is suspended from performing the replacement processing, the control unit 20 can, for example, remove the replacement ECU 5 from the relay path information, thereby preventing the replacement ECU 5 from being included in communications between onboard ECUs 3 or with an external server 100. While the replacement ECU 5 is performing the replacement processing, the control unit 20 includes the replacement ECU 5 in the relay path information and includes it in the relay paths (paths used to relay communications between onboard ECUs 3 or with an external server 100) in communications between onboard ECUs 3 or with an external server 100. By removing the replacement ECU 5 from the relay path information while the replacement ECU 5 is suspended from performing the replacement processing, the replacement ECU 5 is prevented from being included in the relay paths. This prevents the replacement ECU 5 from being attacked by external devices outside the vehicle or by unauthorized onboard ECUs 3 inside the vehicle.

[0084] The storage unit 21 stores a program for the on-vehicle ECU 3 transmitted from the external server 100. The storage unit 21 also stores a program (alternative program) for the replacement ECU 5. By making the hardware specifications of the replacement ECU 5 identical to those of the on-vehicle ECU 3 or making the two specifications compatible, the program for the on-vehicle ECU 3 transmitted from the external server 100 can be used as the program (alternative program) for the replacement ECU 5. Details will be described later.

[0085] The storage unit 21 stores the configuration information (vehicle configuration information) of all onboard ECUs 3 installed in vehicle C. The configuration information (vehicle configuration information) of each onboard ECU 3 stored in the storage unit 21 includes, for example, the onboard ECU 3's manufacturing number (serial number), ECU part number (model number), software part number, current program version, previous version, number of action planes, action plane, MAC (Media Access Control) address, IP address, last update completion date and time, update status, and VIN (vehicle identification number). Furthermore, if the onboard ECU 3 is connected via CAN, the configuration information of the onboard ECU 3 may include the CAN-ID used (included) by the onboard ECU 3 when sending messages. This vehicle configuration information is managed in association with the ECU-ID, which is a serial number or other uniquely assigned to each onboard ECU 3, and is stored in the storage unit 21 as data in a table format, for example. The control unit 20 stably acquires configuration information of each onboard ECU 3 from all or a specific onboard ECU 3 mounted in the vehicle C at a predetermined timing such as when the IG switch is turned on or off, and stores the configuration information in the storage unit 21 .

[0086] The control unit 20 can determine the program of the on-vehicle ECU 3 to be replaced by referring to the software part number and current program version included in the vehicle configuration information stored in the storage unit 21. Based on the determined program, the control unit 20 can determine the program to be applied to the replacement ECU 5 (the replacement program). Alternatively, the ECU-ID that uniquely identifies each on-vehicle ECU 3 can be associated with the program (the replacement program) to be applied to the replacement ECU when the ECU-ID is replaced, and stored in the storage unit 21, and the control unit 20 can determine the replacement program based on the ECU-ID.

[0087] The input / output I / F 22 is a communication interface for serial communication, similar to the input / output I / F of the external vehicle communication device 1. The onboard relay device 2 is communicatively connected to the external vehicle communication device 1, the display device 7 (HMI device), and the IG switch (not shown) for starting and stopping the vehicle C via the input / output I / F 22.

[0088] The in-vehicle communication unit 23 is an input / output interface (CAN communication unit 232, Ethernet communication unit 231) that uses a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark). The control unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle LAN 4 via the in-vehicle communication unit 23.

[0089] The Ethernet communication unit 231 is an Ethernet PHY unit that supports TCP / IP packets transmitted via the Ethernet cable 411 such as 100BASE-T1 or 1000BASE-T1.

[0090] CAN communication unit 232 is a CAN transceiver that receives a waveform generated by the potential difference of the differential voltage on CAN bus 412, which is composed of two high-side and low-side wires, and decrypts the received waveform into a signal represented by a bit sequence of 1s and 0s. Alternatively, CAN communication unit 232 may include a CAN transceiver and a CAN controller.

[0091] Multiple in-vehicle communication units 23 (Ethernet communication unit 231, CAN communication unit 232) are provided, and each of the in-vehicle communication units 23 is connected to the communication lines 41 (Ethernet cable 411, CAN bus 412) that constitute the in-vehicle LAN 4. By providing multiple in-vehicle communication units 23, the in-vehicle LAN 4 is divided into multiple sections, and each section is connected to the in-vehicle ECU 3 according to the function of the in-vehicle ECU 3 (cognitive system function, judgment system function, operating system function).

[0092] The replacement ECU 5 functions as a replacement unit for the replacement device 6 based on instructions from the control unit 20 of the onboard relay device 2 (the control unit of the replacement device 6). Like the onboard relay device 2, the replacement ECU 5 includes a control unit 50, a storage unit 51, and an in-vehicle communication unit 52. Like the onboard relay device 2, the storage unit 51 is composed of volatile and non-volatile memory elements and stores a program (replacement program) that performs the same functions as the replaced onboard ECU 3. Like the onboard relay device 2, the control unit 50 is composed of a CPU and other components. It reads and executes the program (replacement program) stored in the storage unit 51 to perform processing related to the control of onboard devices, thereby replacing the inoperable onboard ECU 3.

[0093] The in-vehicle communication unit 52 includes at least one of an Ethernet communication unit 521 and a CAN communication unit 522 similar to the in-vehicle relay device 2 . The substitute ECU 5 communicates with the control unit 20 of the in-vehicle relay device 2 (the control unit of the substitute device 6 ) via the Ethernet communication unit 521 or the CAN communication unit 522 .

[0094] The in-vehicle communication unit 52 includes an Ethernet communication unit 521 and a CAN communication unit 522. The replacement ECU 5 is preferably connected to the in-vehicle relay device 2 via the two in-vehicle communication units 52, namely, the Ethernet communication unit 521 and the CAN communication unit 522. The replacement ECU 5 includes the Ethernet communication unit 521 and the CAN communication unit 522, thereby being able to replace both the in-vehicle ECU 3 having only the Ethernet communication unit and the in-vehicle ECU 3 having only the CAN communication unit.

[0095] The in-vehicle communication unit 23 (Ethernet communication unit 231 and CAN communication unit 232) of the on-vehicle relay device 2 connected to the in-vehicle communication unit 52 (Ethernet communication unit 521 and CAN communication unit 522) of the alternative ECU 5 is preferably a different in-vehicle communication unit 23 from the in-vehicle communication unit 23 (Ethernet communication unit 231 and CAN communication unit 232) connected to the on-vehicle ECU 3. By making the in-vehicle communication unit 23 connected to the alternative ECU 5 different from the in-vehicle communication unit 23 connected to the on-vehicle ECU 3 and connecting the alternative ECU 5 to a portion other than the portion connected to the on-vehicle ECU 3, the communication bandwidth between the alternative ECU 5 and the on-vehicle relay device 2 can be reliably ensured.

[0096] The replacement ECU 5 is shown as a separate housing from the onboard relay device 2, but this is not limiting. The replacement ECU 5 may also be built into the same housing as the onboard relay device 2 and integrated with the onboard relay device 2. In this case, the onboard relay device 2 itself, which houses the replacement ECU 5, corresponds to the replacement device 6.

[0097] The control unit that controls the alternative processing by the alternative ECU 5 (the control unit of the alternative device 6) is assumed to be the control unit 20 of the onboard relay device 2, but this is not the only limitation. The alternative device 6, which includes the control unit that controls the alternative processing by the alternative ECU 5, may also be a dedicated device separate from the onboard relay device 2. This dedicated device is communicatively connected to the onboard relay device 2 and the alternative ECU 5, and transmits a program (alternative program) obtained via the onboard relay device 2 to the alternative ECU 5, thereby applying the program to the alternative ECU 5. Alternatively, the control unit 20 of the onboard relay device 2 may cooperate with the control unit 50 of the alternative ECU 5 to function as the control unit of the alternative device 6.

[0098] The program (alternative program) applied to the replacement ECU 5 is obtained from the external server 100 by the on-board relay device 2 via the off-board communication device 1, but this is not limited to this. Alternatively, the number or type of programs (alternative programs) applied to the replacement ECU 5 may be multiple, depending on the number of on-board ECUs 3 to be replaced, with all or part of these multiple alternative programs pre-stored in the storage unit 21 of the on-board relay device 2 or the storage unit 51 of the replacement ECU 5. In this case, the control unit 20 of the on-board relay device 2 obtains the alternative program by referring to its own storage unit 21 and applies the obtained alternative program to the replacement ECU 5. Alternatively, if the alternative program is pre-stored in the storage unit 51 of the replacement ECU 5, the control unit 20 of the on-board relay device 2 can apply the alternative program stored in the storage unit 51 of its own ECU to the replacement ECU 5 by sending, for example, an application instruction signal to the replacement ECU 5.

[0099] The on-board ECU 3, like the replacement ECU 5, includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown). The storage unit is composed of a volatile memory element such as RAM (Random Access Memory) or a non-volatile memory element such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and stores programs or data for the on-board ECU 3. These programs or data are updated by the update program sent from the on-board relay device 2. In addition, the storage unit stores the configuration information of this ECU. The in-vehicle communication unit, like the replacement ECU 5 or the on-board relay device 2, includes an Ethernet communication unit or a CAN communication unit. The on-board ECU 3 communicates with the on-board relay device 2 (the replacement device 6) via the in-vehicle communication unit.

[0100] The situation is not limited to the case where all of the on-board ECUs 3 installed in the vehicle C are replaced by the replacement ECU 5. A portion of the on-board ECUs 3 installed in the vehicle C may also be replaced by the replacement ECU 5. The hardware specifications of the on-board ECU 3 replaced by the replacement ECU 5 may be the same as those of the replacement ECU 5, or these hardware specifications may be interchangeable. Due to these hardware specifications being the same or interchangeable, the replacement ECU 5 can execute the same program as the program executed by the on-board ECU 3.

[0101] like Figure 1 and Figure 2 As shown, the in-vehicle ECU 3 may be functionally classified into, for example, a recognition system, a judgment system, or an operation system by executing a program stored in a storage unit.

[0102] The onboard ECU 3 of the recognition system is connected to a sensor 42 such as a camera, an infrared sensor, or LIDAR (Light Detection and Ranging), converts the output value from the sensor 42 into a digital form, and transmits (outputs) the digital value to the onboard ECU 3 of the judgment system via the in-vehicle LAN 4 .

[0103] The on-board ECU3 of the judgment system, for example, receives (obtains) data sent from the on-board ECU3 of the cognitive system, and based on the received data, generates data or processes data for exerting the automatic driving function of vehicle C, and sends (outputs) the generated data to the on-board ECU3 of the operating system via the in-vehicle LAN4.

[0104] The vehicle-mounted ECU3 of the operating system is connected to an actuator 43 (vehicle-mounted drive device) such as an electric motor, engine or brake, receives (obtains) data sent from the vehicle-mounted ECU3 of the judgment system, and controls the action of the actuator based on the received data to perform operations such as driving, stopping or turning of the vehicle C, thereby exerting the automatic driving function.

[0105] Specifically, the onboard ECU 3 of the judgment system is not directly connected to the sensor 42 or actuator 43, processes data acquired via the in-vehicle LAN 4, or generates output data based on the acquired data, and then outputs the generated data to another onboard ECU 3, such as the onboard ECU 3 of the operating system. Therefore, by replacing an onboard ECU 3, such as the onboard ECU 3 of the judgment system, that generates data but is not directly connected to the sensor 42 or actuator 43, with the replacement ECU 5, there is no need to directly connect the replacement ECU 5 to the sensor 42 or actuator 43 via a wiring harness, etc., thereby simplifying the wiring in the vehicle.

[0106] The display device 7 is an HMI (Human Machine Interface) device, such as a display in a car navigation system. The display device 7 is communicatively connected to the input / output interface 22 of the onboard relay device 2 via a wiring harness such as a serial cable. Data or information output from the control unit 20 of the onboard relay device 2 via the input / output interface 22 is displayed on the display device 7.

[0107] The replacement device 6 is a structure including the vehicle-mounted relay device 2 and the replacement ECU 5. Figure 2 In the figure, the replacement device 6 includes one replacement ECU 5, but the present invention is not limited to this. The replacement device 6 may include two or more replacement ECUs 5. If the replacement device 6 includes multiple replacement ECUs 5, even if multiple on-vehicle ECUs 3 become abnormal at the same time, the multiple replacement ECUs 5 can be used to replace each of the multiple on-vehicle ECUs 3.

[0108] Figure 3 This is an explanatory diagram (sequence diagram) illustrating one form of substitution by the substitution device 6. Figure 3 In the following, the process of the replacement device 6 replacing the invalid in-vehicle ECU 3 is described using a sequence diagram including the processes of the external server 100 , the in-vehicle ECU 3 , and the replacement device 6 (the in-vehicle relay device 2 , the replacement ECU 5 ).

[0109] The onboard ECU 3 transmits data to the onboard relay device 2 (S1). The onboard ECU 3 executes a program stored in its storage unit to perform processing related to the control of onboard devices or onboard equipment, and transmits the generated data to other onboard ECUs 3 or by multicast.

[0110] The on-board relay device 2 receives the transmitted data and performs anomaly detection (S2). The on-board relay device 2 receives data transmitted from all on-board ECUs 3 installed in the vehicle C for relay processing and relays the data based on the header information and relay path information of the received data. The on-board relay device 2 functions as a determination unit to determine the accuracy of the received data by analyzing the received data, thereby detecting anomalies in the received data. In determining the accuracy of the data, improper data refers to messages transmitted from an improper on-board ECU 3, such as an improper on-board ECU 3 that has entered an abnormal state due to a virus that has infiltrated from outside the vehicle via the external communication device 1, or an improperly replaced on-board ECU 3. The control unit 20 analyzes the received data to determine its accuracy by executing a diagnostic program (diagnostic process) or by performing the functions of an IDS (Intrusion Detection System). Alternatively, the control unit 20 may determine that data transmitted at a different transmission cycle than the specified transmission cycle is improper data.

[0111] The on-board relay device 2 identifies the on-board ECU 3 as the source of the data determined to be abnormal (S3). For example, the on-board relay device 2 refers to the header information of the data determined to be abnormal to identify the on-board ECU 3 as the source of the data. If the data is an IP packet, the on-board relay device 2 extracts the IP address or MAC address of the source contained in the header information and, based on the extracted source address and referring to the vehicle configuration information, identifies the on-board ECU 3 (ECU-ID) as the source. If the data is a CAN message, the on-board relay device 2 extracts the CAN-ID contained in the header information and, based on the extracted CAN-ID and referring to the vehicle configuration information, identifies the on-board ECU 33 (ECU-ID) as the source.

[0112] The on-board relay device 2 invalidates the on-board ECU 3 that has been determined to be abnormal (S4). As a process for invalidating the on-board ECU 3 that has been determined to be abnormal, the on-board relay device 2, for example, sends a signal to the on-board ECU 3 that has been determined to be abnormal to force it to stop. The on-board ECU 3 that has received the signal transitions to a stopped state. The signal for forced stop may include a signal that cuts off the power supplied to the on-board ECU 3 that has received the signal. Alternatively, the on-board relay device 2 may not relay the data sent from the on-board ECU 3 that has been determined to be abnormal but may discard it, thereby invalidating the function of the on-board ECU 3 that has been abnormal. Alternatively, the on-board relay device 2 may send (broadcast) the source address such as the MAC address or ECU-ID of the on-board ECU 3 that has been determined to be abnormal to other on-board ECUs 3, and notify other on-board ECUs 3 to ignore or discard the data containing the source address, thereby invalidating the function of the on-board ECU 3 that has been abnormal.

[0113] The on-board relay device 2 obtains a program (alternative program) to be applied to the replacement ECU 5 from the external server 100 (S5). The on-board relay device 2, for example, refers to the vehicle configuration information to determine the program that the disabled on-board ECU 3 normally executes, and obtains a program (alternative program) from the external server 100 that performs the same function as the determined program. As described above, if the hardware specifications of the disabled on-board ECU 3 are the same as or compatible with the hardware specifications of the replacement ECU 5, the program (alternative program) applied to the replacement ECU 5 is the same as the program that the disabled on-board ECU 3 normally executes.

[0114] Even if the hardware specifications of the disabled on-board ECU 3 differ from or are not compatible with those of the replacement ECU 5, the on-board relay device 2 can install a simulator that accommodates these hardware specification differences as middleware on the replacement ECU 5 (causing the replacement ECU 5 to execute the program). The on-board relay device 2 can also use the simulator to apply the program normally executed by the disabled on-board ECU 3 as a replacement program to the replacement ECU 5. By installing the simulator that accommodates the hardware specification differences on the replacement ECU 5, the same program as that executed by the replacement on-board ECU 3 can be applied to the replacement ECU 5 as a replacement program (causing the replacement ECU 5 to execute the program).

[0115] The vehicle-mounted relay device 2 is not limited to obtaining the alternative program from the external server 100. If the alternative program or simulator is pre-stored in the storage unit 21 of the vehicle-mounted relay device 2, the vehicle-mounted relay device 2 may refer to the storage unit 21 to obtain the pre-stored alternative program.

[0116] The on-vehicle relay device 2 applies the application (alternative program) to the alternative ECU 5 (S6). The on-vehicle relay device 2 transmits the obtained alternative program to the alternative ECU 5 and sends a start signal to activate the alternative ECU 5 to execute the alternative program. If the alternative program is pre-stored in the storage unit 51 of the alternative ECU 5, the on-vehicle relay device 2 transmits information identifying the alternative program to be executed to the alternative ECU 5 and sends a start signal to activate the alternative ECU 5 to execute the alternative program.

[0117] The on-vehicle relay device 2 changes the relay path information (S7). The on-vehicle relay device 2 changes the relay path information so that the replacement ECU 5 can perform the functions performed by the disabled on-vehicle ECU 3. If the replacement ECU 5 is connected to an in-vehicle communication unit 23 different from the disabled on-vehicle ECU 3, the replacement ECU 5 communicates with the other on-vehicle ECU 3. Therefore, the on-vehicle relay device 2 changes the association between the port number of the in-vehicle communication unit 23 connected to the replacement ECU 5 and the MAC address, IP address, ECU-ID, or CAN-ID of the replacement ECU 5 in the relay path information.

[0118] The replacement ECU 5, to which the replacement program is applied, executes the replacement program and begins replacing the disabled on-board ECU 3 (S8). The replacement program is a program for performing the functions that the disabled on-board ECU 3 normally performs, so the replacement ECU 5 can perform the same functions as the disabled ECU. Even if the disabled ECU and the replacement ECU 5 are connected to different in-vehicle communication units 23 in the on-board relay device 2, by changing the relay path information, the replacement ECU 5 and other on-board ECUs 3 are relayed by the on-board relay device 2, ensuring a smooth communication environment for the replacement ECU 5 and other on-board ECUs 3.

[0119] The on-board relay device 2 performs a recovery process on the disabled on-board ECU 3 (S9). As a recovery process for the disabled on-board ECU 3, the on-board relay device 2, for example, transmits a restart signal to the disabled on-board ECU 3 to cause it to restart (reset). Alternatively, the on-board relay device 2 may obtain the official program for the disabled on-board ECU 3 from the external server 100 and apply the obtained program to the disabled on-board ECU 3, i.e., reprogram the program. Alternatively, the on-board relay device 2 may communicate with the disabled on-board ECU 3 in a diagnostic mode and attempt to recover the disabled on-board ECU 3 by performing a self-recovery process on the disabled on-board ECU 3.

[0120] The on-vehicle relay device 2 confirms whether the disabled on-vehicle ECU 3 has been restored (normalized) through the restoration process (S10). The on-vehicle relay device 2 communicates with the restored on-vehicle ECU 3 in a diagnostic mode, for example, to obtain a self-diagnosis result based on the restored on-vehicle ECU 3, thereby confirming whether the disabled on-vehicle ECU 3 has been restored (normalized).

[0121] When the disabled in-vehicle ECU 3 has recovered (become normal), the in-vehicle relay device 2 outputs (transmits) a signal to terminate the replacement to the replacement ECU 5 ( S11 ).

[0122] The substitute ECU 5 that has acquired (received) the signal for terminating substitution from the in-vehicle relay device 2 stops the substitute program being executed and terminates substitution ( S12 ).

[0123] The on-vehicle relay device 2 changes the current relay path information to the relay path information before the substitute ECU 5 started the substitution process (S13). By changing the current relay path information to the relay path information before the substitute ECU 5 started the substitution process, the on-vehicle ECU 3 that has returned to normal operation can communicate with other on-vehicle ECUs 3.

[0124] Figure 4 This is a flowchart illustrating the processing of the control unit 20 of the alternative device 6. The control unit 20 of the vehicle-mounted relay device 2 (alternative device 6) performs the following processing in a steady state when, for example, the vehicle C is in the startup state (IG switch is on).

[0125] The control unit 20 of the on-vehicle relay device 2 acquires the transmission data transmitted from the on-vehicle ECU 3 ( S100 ). The control unit 20 receives (acquires) the data transmitted from the on-vehicle ECU 3 while relaying the communication between the on-vehicle ECUs 3 .

[0126] The control unit 20 of the on-vehicle relay device 2 determines whether the acquired transmission data is abnormal (S101). The control unit 20 determines whether the acquired transmission data is abnormal based on, for example, the transmission timing of the received data or the analysis results of the IDS, regarding the transmission data (received data) sent from the on-vehicle ECU 3.

[0127] If the transmission data transmitted from the in-vehicle ECU 3 is not abnormal ( S101 : No), that is, if the transmission data transmitted from the in-vehicle ECU 3 is normal, the control unit 20 of the in-vehicle relay device 2 performs a loop process to execute the process of S100 again.

[0128] If the transmission data sent from the on-vehicle ECU 3 is abnormal (S101: YES), the control unit 20 of the on-vehicle relay device 2 identifies the abnormal on-vehicle ECU 3 based on the transmission data (S102). The control unit 20 extracts the transmission source address and message identifier (CAN-ID) contained in the header information of the acquired transmission data, and refers to the vehicle configuration information to identify the transmission source of the abnormal transmission data, that is, the abnormal on-vehicle ECU 3.

[0129] The control unit 20 of the on-board relay device 2 disables the abnormal on-board ECU 3 (S103). The control unit 20 outputs a signal, such as a forced termination signal, to the identified abnormal on-board ECU 3, thereby disabling the abnormal on-board ECU 3. Alternatively, the abnormal on-board ECU 3 can be disabled by discarding data transmitted from the identified abnormal on-board ECU 3.

[0130] The control unit 20 of the on-vehicle relay device 2 obtains a program to be applied to the replacement ECU 5 (S104). The control unit 20, for example, refers to the vehicle configuration information to identify the invalidated program of the on-vehicle ECU 3 and obtains a program (replacement program) that performs the same function as the identified program from the external server 100. Alternatively, if the replacement program is pre-stored (or saved) in a storage area such as the storage unit 21 of the on-vehicle relay device 2 that the control unit 20 of the on-vehicle relay device 2 can refer to (access), the stored replacement program can be obtained (used).

[0131] The control unit 20 of the on-vehicle relay device 2 applies the acquired program to the substitute ECU 5 (S105). The control unit 20 transmits the acquired program (substitute program) to the substitute ECU 5 and outputs (sends) a start signal to the substitute ECU 5, thereby applying the substitute program to the substitute ECU 5. The substitute ECU 5, to which the substitute program is applied, starts by executing the substitute program and performs the same functions as the disabled on-vehicle ECU 3, thereby replacing the disabled on-vehicle ECU 3.

[0132] The control unit 20 of the vehicle-mounted relay device 2 changes the relay path information ( S106 ). The control unit 20 changes the relay path information stored in the storage unit 21 of the vehicle-mounted relay device 2 so that the substitute ECU 5 can communicate with the other vehicle-mounted ECU 3 .

[0133] The control unit 20 of the vehicle-mounted relay device 2 attempts to restore the disabled vehicle-mounted ECU 3 (S107). The control unit 20 attempts to restore the disabled vehicle-mounted ECU 3 by, for example, sending a restart signal to the disabled vehicle-mounted ECU 3 to execute a reprogramming process, or by communicating with the disabled vehicle-mounted ECU 3 in a diagnostic mode to cause the disabled vehicle-mounted ECU 3 to execute a self-recovery process.

[0134] The control unit 20 of the on-board relay device 2 determines whether the disabled on-board ECU 3 has been restored (S108). For example, the control unit 20 communicates with the restored on-board ECU 3 in a diagnostic mode to obtain a self-diagnostic result from the restored on-board ECU 3, thereby determining whether the disabled on-board ECU 3 has been restored (normalized). Alternatively, the control unit 20 may reprogram the disabled on-board ECU 3 to restart it, and then analyze the data transmitted from the restarted on-board ECU 3 to determine whether the restarted on-board ECU 3 has been restored (normalized).

[0135] If the vehicle-mounted relay device 2 has not recovered (S108: No), the control unit 20 of the vehicle-mounted relay device 2 again disables the abnormal vehicle-mounted ECU 3 (S1081). If the disabled vehicle-mounted ECU 3 has not recovered (normalized) despite attempting a recovery process, that is, if the abnormal state of the vehicle-mounted ECU 3 continues, the control unit 20 again disables the vehicle-mounted ECU 3 that continues to be in the abnormal state.

[0136] If the vehicle-mounted relay device 2 has recovered (S108: Yes), the control unit 20 of the vehicle-mounted relay device 2 terminates the replacement by the replacement ECU 5 (S109). If the vehicle-mounted ECU 3, which was disabled by the recovery process, has recovered (returned to normal), the control unit 20 outputs (transmits), for example, a signal to terminate the replacement to the replacement ECU 5. Upon receiving the signal to terminate the replacement, the replacement ECU 5 stops executing the replacement program, terminating the replacement.

[0137] The control unit 20 of the vehicle-mounted relay device 2 changes the relay path information (S110). The control unit 20 changes the current relay path information so that the current relay path information becomes the relay path information before the substitution ECU 5 starts the substitution process.

[0138] After performing S110 or S1081, the control unit 20 of the vehicle-mounted relay device 2 terminates the processing of this flowchart. Alternatively, the control unit 20 may loop the processing after performing S110 to execute S100 again. The control unit 20 of the vehicle-mounted relay device 2 may store information related to the vehicle-mounted ECU 3 that was determined to be abnormal in the determination results (S101, S108) during the processing of this flowchart in the storage unit 21, output it to the display device 7 or the external server 100, and notify the operator of the vehicle C or the administrator of the external server 100 of this information.

[0139] The replacement device 6 disables the abnormal on-board ECU 3 to prevent it from affecting other on-board devices or the vehicle C. It also enables the replacement ECU 5 to perform the functions that the abnormal on-board ECU 3 normally performs. Therefore, for example, if the vehicle C has an autonomous driving function, even if one of the on-board ECUs 3 fails, the abnormal on-board ECU 3 can be disabled and replaced by the replacement ECU 5, allowing autonomous driving to continue.

[0140] The replacement device 6 determines a program to be executed by the vehicle-mounted ECU 3 as a replacement based on the vehicle configuration information stored in the device. The replacement device 6 obtains a program (replacement program) from the external server 100 that, when applied to the replacement ECU 5, performs the same function as the determined program. Therefore, the replacement device 6 can obtain replacement programs corresponding to the programs of multiple vehicle-mounted ECUs 3 without compressing the storage area of the storage unit 21 of the device.

[0141] After the replacement ECU 5 replaces the disabled on-vehicle ECU 3, the replacement device 6 attempts to restore the disabled on-vehicle ECU 3. When the disabled on-vehicle ECU 3 has been restored (normalized), the replacement device 6 terminates the replacement by the replacement ECU 5. Therefore, the functions of the abnormal on-vehicle ECU 3 can be continued by replacing it with the replacement ECU 5, and the abnormal on-vehicle ECU 3 can be restored efficiently.

[0142] (Implementation Method 2)

[0143] Figure 5 This is a block diagram illustrating the logical structure of a replacement device 6 in Embodiment 2 (virtual environment). Embodiment 2 differs from Embodiment 1 in that the replacement device 6 executes a replacement program in the replacement ECU 5 in a virtual environment. Like the replacement device 6 in Embodiment 1, the replacement device 6 in Embodiment 2 includes an in-vehicle relay device 2 and an alternative ECU 5 (replacement unit). The in-vehicle relay device 2 included in the replacement device 6 in Embodiment 2 has the same structure and functions as the replacement device 6 in Embodiment 1, and therefore detailed description will be omitted.

[0144] The replacement ECU 5 included in the replacement device 6 of the second embodiment includes, similarly to the replacement ECU 5 of the first embodiment, a control unit 50, a storage unit 51, and an in-vehicle communication unit 52. The in-vehicle communication unit 52 includes at least one or both of an Ethernet communication unit 521 and a CAN communication unit 522. In other words, the hardware configuration of the replacement ECU 5 of the first embodiment and the replacement ECU 5 of the second embodiment is identical.

[0145] Figure 5This is a diagram illustrating the logical structure of the substitute ECU 5 according to the second embodiment, and is a block diagram illustrating a hierarchical structure in which the hardware layer (physical base) based on the control unit 50 and the like is the lowest layer and the substitute program executed in the virtual environment is the highest layer.

[0146] A virtualized operating system 53 (Hypervisor) is stored in the storage unit 51 of the alternative ECU 5. The control unit 50 of the alternative ECU 5 is started using the virtualized operating system 53, thereby being able to construct multiple virtual environments on the virtualized operating system 53. The virtualization method can be as follows: Figure 5 The virtual machine monitor method shown here is to directly access hardware resources such as the control unit 50 through the virtualization operating system 53, or the host operating system method is to interpose an operating system such as Linux (registered trademark) between the virtualization operating system 53 and the hardware resources.

[0147] After being activated using the virtualized operating system 53, the substitute ECU 5 can create multiple virtual environments using the functions of the virtualized operating system 53, and allocate hardware resources such as the control unit 50 included in the substitute ECU 5 to the multiple virtual environments. Each virtual environment to which these hardware resources are allocated includes a virtual control unit (virtual control unit), a storage unit (virtual storage unit), and an in-vehicle communication unit (virtual in-vehicle communication unit), and functions as a virtual ECU 54.

[0148] In each virtual storage unit of the virtual ECU 54, a guest operating system such as Ubuntu (registered trademark) is stored. The virtual ECU 54 starts the guest operating system and executes a replacement program on the guest operating system, thereby replacing the invalid vehicle-mounted ECU. As described above, the entity of the virtual storage unit is the storage area of the storage unit 51 to which the virtual ECU 54 is respectively allocated. Therefore, it is self-evident that the guest operating system is also stored in the storage unit 51 in the same manner as the virtualized operating system 53. In the case where the operating environment of the program on the guest operating system is different from the operating environment of the program in the invalid vehicle-mounted ECU that is the replacement object, a simulator that absorbs the difference in the operating environment can be started on the guest operating system as intermediate software. Alternatively, in the case of using a container-based virtualized operating system 53, a guest operating system is not required. A container can be generated on the virtualized operating system 53, and a simulator can be started on the container to absorb the difference in the operating environment.

[0149] The substitute ECU 5 activated using the virtualized operating system 53 executes a program (virtual environment management program) for managing any virtual environment (virtual ECU 54) created by one of the virtual ECUs 54. The virtual ECU 54 executing the virtual environment management program communicates with the control unit 20 of the onboard relay device 2 and, based on signals transmitted from the onboard relay device 2, executes commands prepared by the virtualized operating system 53, thereby creating a new virtual ECU 54 or deleting a created virtual ECU 54. In other words, the virtual ECU 54 executing the virtual environment management program can also serve as a control panel for the virtualized operating system 53.

[0150] When a replacement program is transmitted from the in-vehicle relay device 2, the virtual ECU 54 executing the virtual environment management program generates a new virtual ECU 54. The generated virtual ECU 54 executes the replacement program obtained from the in-vehicle relay device 2, thereby enabling the replacement program to be applied to the replacement device 6. Alternatively, when a signal indicating the end of replacement is transmitted from the in-vehicle relay device 2, the virtual ECU 54 executing the virtual environment management program may terminate the replacement program in the virtual ECU 54 executing the replacement process or delete the generated virtual ECU 54 based on the signal.

[0151] By using the alternative ECU5 started by the virtualized operating system 53, the virtual ECU54 that performs overall management of the virtual environment such as the generation or deletion of the virtual ECU54 and the virtual ECU54 that executes the alternative program are set as different action environments, thereby suppressing mutual interference between these virtual ECU54 and achieving stable operation of each virtual ECU54.

[0152] By using a guest operating system or emulator installed on the virtualized operating system 53, the program execution environment of the virtual ECU 54 can be made identical or compatible with the program execution environment of the disabled on-board ECU 3. Therefore, even if the hardware specifications of the on-board ECU 3 and the replacement ECU 5 differ, the specification difference can be accommodated, and the virtual ECU 54 can execute the same program as the program of the replacement on-board ECU 3 as the replacement program.

[0153] like Figure 5 As shown, the replacement ECU 5 generates multiple virtual ECUs 54 in response to instructions from the control unit 20 of the on-board relay device 2. Each of the generated virtual ECUs 54 can execute a different replacement program. Therefore, even if multiple on-board ECUs 3 become abnormal at the same time, a single replacement ECU 5 can generate multiple virtual ECUs 54, allowing these multiple on-board ECUs 3 to be replaced.

[0154] The embodiments disclosed herein are to be considered in all respects as illustrative and non-restrictive. The scope of the present disclosure is defined by the claims rather than the above, and includes all modifications within the meaning and scope equivalent to the claims.

[0155] Description of Reference Numerals

[0156] C Vehicle

[0157] S On-board control unit replacement system

[0158] 100 External server (OTA server)

[0159] 101 Storage Department

[0160] 1 External vehicle communication device

[0161] 11 Antenna

[0162] 2 Vehicle-mounted relay device (gateway)

[0163] 20 Control Unit

[0164] 21 Storage

[0165] 211 Recording Media

[0166] 22 Input / Output I / F

[0167] 23 In-vehicle communication department

[0168] 231 Ethernet Communications Department

[0169] 232 CAN Communication Department

[0170] 3 On-board ECU (on-board control unit)

[0171] 4 In-car LAN

[0172] 41 communication lines

[0173] 411 Ethernet cable

[0174] 412 CAN bus

[0175] 42 sensors

[0176] 43 Actuator

[0177] 5. Replacement ECU (replacement part)

[0178] 50 Control Department

[0179] 51 Storage

[0180] 52 In-vehicle communication department

[0181] 521 Ethernet Communications Department

[0182] 522 CAN Communication Department

[0183] 53 Virtualized Operating System

[0184] 54 Virtual ECU (Virtual Environment)

[0185] 6 Alternative devices

[0186] 7 Display device.

Claims

1. A substitution device, mounted on a vehicle equipped with a plurality of vehicle-mounted control devices, comprising a control unit and a substitution unit, The control unit controls the substitution unit based on the transmission data transmitted from the plurality of vehicle-mounted control devices. The control unit identifies an abnormal vehicle-mounted control device based on the transmitted data, The control unit disables the determined abnormal vehicle-mounted control device, The control unit applies a program for realizing a function that the determined abnormal vehicle-mounted control device performs normally to the replacement unit, The replacement unit replaces the disabled vehicle-mounted control device by executing the applied program. The control unit performs the following control: Before the program is applied to the substitution unit, a relay path for relaying the transmission data transmitted from the plurality of vehicle-mounted control devices does not include the substitution unit. After applying the program to the substitute part, the relay path includes the substitute part, Based on the execution or stop of the substitution process by the substitution unit, the relay path information stored in the storage unit of the substitution device is changed.

2. The alternative device according to claim 1, wherein The plurality of vehicle-mounted control devices are connected to the control unit in a communicative manner via a communication protocol of a control area network or Ethernet. The substitute unit is communicably connected to the control unit via the communication protocol of the control area network and the Ethernet.

3. The alternative device according to claim 1, wherein The substitution unit substitutes for an onboard control device that generates output data based on data acquired via a communication path for communicating with another onboard control device and outputs the generated data via the communication path.

4. The alternative device according to claim 2, wherein: The substitution unit substitutes for an onboard control device that generates output data based on data acquired via a communication path for communicating with another onboard control device and outputs the generated data via the communication path.

5. The replacement device according to any one of claims 1 to 4, wherein: The vehicle is equipped with an off-vehicle communication device for communicating with an external server outside the vehicle. The control unit obtains the program from the external server via the external vehicle communication device. The control unit applies the acquired program to the replacement unit.

6. The replacement device according to any one of claims 1 to 4, wherein: The control unit performs a recovery process on the disabled vehicle-mounted control device. When the disabled in-vehicle control device becomes normal through the recovery process, the control unit stops the substitution by the substitution unit.

7. An alternative device according to claim 5, wherein The control unit performs a recovery process on the disabled vehicle-mounted control device. When the disabled in-vehicle control device becomes normal through the recovery process, the control unit stops the substitution by the substitution unit.

8. The replacement device according to any one of claims 1 to 4, wherein: The replacement unit generates a virtual environment by virtualizing the operating system. The program is executed on the virtual environment.

9. The alternative device according to claim 5, wherein: The replacement unit generates a virtual environment by virtualizing the operating system. The program is executed on the virtual environment.

10. The alternative device according to claim 6, wherein The replacement unit generates a virtual environment by virtualizing the operating system. The program is executed on the virtual environment.

11. The alternative device according to claim 7, wherein The replacement unit generates a virtual environment by virtualizing the operating system. The program is executed on the virtual environment.

12. The alternative device according to claim 8, wherein The virtual environment is generated according to the number of the disabled vehicle-mounted control devices. The number of the programs is the same as the number of the disabled vehicle-mounted control devices. The program is executed on each virtual environment generated corresponding to the number.

13. An alternative device according to any one of claims 9 to 11, wherein: The virtual environment is generated according to the number of the disabled vehicle-mounted control devices. The number of the programs is the same as the number of the disabled vehicle-mounted control devices. The program is executed on each virtual environment generated corresponding to the number.

14. A substitute control program product, comprising a substitute control program, wherein the substitute control program causes a computer to execute the following processing: Based on the transmission data transmitted from a plurality of vehicle-mounted control devices mounted on the vehicle, an abnormal vehicle-mounted control device is identified. disabling the determined abnormal vehicle control device, The disabled vehicle-mounted control device is replaced by executing a program for performing the function that the abnormal vehicle-mounted control device performs under normal conditions. Before the program is executed to replace the disabled in-vehicle control device, a relay path for relaying the transmission data transmitted from the plurality of in-vehicle control devices does not include a replacement unit responsible for the replacement process. After the program is executed to replace the disabled vehicle-mounted control device, the relay path includes a replacement unit responsible for the replacement process. Based on the execution or stop of the replacement process, the relay path information stored in the storage unit of the replacement device is changed.

15. An alternative method, Based on the transmission data transmitted from a plurality of vehicle-mounted control devices mounted on the vehicle, an abnormal vehicle-mounted control device is identified. disabling the determined abnormal vehicle control device, The disabled vehicle-mounted control device is replaced by executing a program for performing the function that the abnormal vehicle-mounted control device performs under normal conditions. Before the program is executed to replace the disabled onboard control device, the relay path for relaying the transmission data transmitted from the plurality of onboard control devices does not include a replacement unit responsible for replacement processing. After the program is executed to replace the disabled vehicle-mounted control device, the relay path includes a replacement unit responsible for the replacement process. Based on the execution or stop of the replacement process, the relay path information stored in the storage unit of the replacement device is changed.

Images