Vehicle control system and vehicle control method

Abstract

A vehicle control system and a vehicle control method, the system including: an arithmetic unit that performs arithmetic of first control software when a vehicle is in a first state and performs arithmetic of second control software when the vehicle is in a second state; a comparison reference data storage unit that stores input data input from a sensor to the first control software and the second control software and output data of the first control software and the second control software; and an evaluation unit that evaluates performance of the second control software based on a difference in the output data read from the comparison reference data storage unit.

Description

Technical Field

[0001] This invention relates to vehicle control systems and vehicle control methods. Background Technology

[0002] To verify the performance and safety of programs installed in in-vehicle electronic control units (ECUs), a verification technique known as shadow testing or shadow mode testing is used to confirm the output values ​​by running the program of the target device while the vehicle is in motion. In shadow testing or shadow mode testing-based verification, for example, a previously verified program is run normally, while the program of the target device is run in the background. Then, by comparing the output values ​​of the previously verified program with the output values ​​of the target device's program, the performance and safety of the target device's program can be confirmed.

[0003] At this point, the output values ​​of the verification object's program are not used in the operation of actuators such as accelerators or brakes. Therefore, even if the verification object's program malfunctions, it will not affect the vehicle's movement while it is in motion. As a result, the performance and safety of the verification object's program can be evaluated while maintaining driver safety. Furthermore, in recent years, AI (Artificial Intelligence) technology has been provided to ECUs to process various input data. AI can handle situations where the correspondence between input and output data is not uniquely determined. Therefore, developers need to verify what kind of output data is generated by the AI ​​processing performed while the vehicle is in motion.

[0004] Therefore, the techniques described in Patent Documents 1 to 3 for verifying programs including AI are known. Patent Document 1 states: "The existence of an identification function that responds to the test conditions can be presumed based on the deviation between the output variables of a real test from a real bench tester or a real roller test bench and the output variables of a hypothetical test from a hypothetical bench tester or a hypothetical roller test bench. Furthermore, it can be presumed whether the control and / or adjustment of the vehicle are tampered with based on the presence or absence of the identification function."

[0005] Furthermore, Patent Document 2 describes that: "The inspection device automatically generates an inspection script containing an inspection procedure for verifying the fault by selecting only the fault (inspection item) of the vehicle-mounted device. In addition, the inspection device can write the generated inspection script to a storage medium."

[0006] Furthermore, Patent Document 3 describes that: "By comparing the order of actions called sequentially by the program driven by the program execution control unit based on environmental information and the order of actions defined in the action verification script, it is possible to evaluate or verify the program independently without using a simulator or an adaptive control device on a real machine." Existing technical documents Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2018-190349 Patent Document 2: Japanese Patent Application Publication No. 2015-190956 Patent Document 3: International Publication No. 2018 / 180143 Summary of the Invention The problem the invention aims to solve

[0008] The technology described in Patent Document 1 is mainly used to check the software of the vehicle's control device when simulating the operation of a car, but in the processing of the simulated driving of the car's movements, a computer device with higher performance than the on-board ECU is used. Therefore, the software described in Patent Document 1 cannot be run in the vehicle's ECU.

[0009] Furthermore, in the technology described in Patent Document 2, the inspection procedure is performed by an on-board device. When the on-board unit's inspection is complete, the storage medium containing the inspection results is removed from the unit. By connecting it to the inspection device, the appropriate response method for the on-board unit's fault can be selected. Therefore, even if this technology is applied to a vehicle in actual operation, the response to on-board unit faults will be delayed.

[0010] Furthermore, the multiple applications described in Patent Document 3 include one or more defined actions, one or more action plans, and one or more action verification scripts, which can coexist on the same autonomous vehicle. However, the computing power of multi-core processors in embedded control systems such as automobiles is limited. Due to the limitations of onboard computing resources, it is difficult to enable high-load programs such as those for autonomous driving to run simultaneously on various processor cores, thus limiting the executable programs.

[0011] The present invention was made in view of the following situation, and its purpose is to enable shadow pattern testing that compares the output values ​​of multiple control software. Technical means to solve the problem

[0012] The vehicle control system of the present invention includes: a calculation unit that executes calculations of first control software when the vehicle is in a first state and executes calculations of second control software when the vehicle is in a second state; a storage unit that stores input data from sensors to the first control software and the second control software, respectively, and output data output by calculations performed by the first control software and the second control software using the input data as input; and an evaluation unit that compares the output data read from the storage unit by the first control software and the second control software, respectively, and evaluates the performance of the second control software. The effects of the invention

[0013] According to the present invention, by comparing the output data obtained by the vehicle performing the calculation of the first control software in the first state with the output data obtained by the vehicle performing the calculation of the second control software in the second state, a shadow mode test for evaluating the performance of the second control software can be performed. Other issues, structures, and effects not mentioned above will be clarified through the following description of the implementation methods. Attached Figure Description

[0014] Figure 1 This is a block diagram illustrating an overall configuration example of a vehicle control system according to the first embodiment of the present invention. Figure 2 This is a diagram illustrating an example of state transitions in a vehicle control system according to a first embodiment of the present invention. Figure 3 This is a diagram illustrating an example of the data flow in state A of the vehicle control system according to the first embodiment of the present invention. Figure 4 This is a flowchart illustrating an example of the processing steps of the comparison reference data selection unit in the first embodiment of the present invention. Figure 5 This is a diagram illustrating an example of the data flow during state transition determination in the vehicle control system according to the first embodiment of the present invention. Figure 6 This is a flowchart illustrating an example of the processing steps of the state determination unit in the first embodiment of the present invention. Figure 7 This is a diagram illustrating an example of the data flow in state B of the vehicle control system according to the first embodiment of the present invention. Figure 8 This is a flowchart illustrating an example of the processing steps of the performance / quality evaluation unit in the first embodiment of the present invention. Figure 9 This is a flowchart illustrating an example of the processing steps of the important script determination unit in the first embodiment of the present invention. Figure 10 This is a diagram illustrating an example of the overall configuration of a vehicle control system according to a second embodiment of the present invention. Figure 11 This is a diagram illustrating an example of communication data exchanged between a vehicle control system according to a second embodiment of the present invention and a cloud server. Figure 12 This is a diagram illustrating an example of the overall configuration of a vehicle control system according to a third embodiment of the present invention. Figure 13 This is a diagram illustrating an example of state transitions in a vehicle control system according to a third embodiment of the present invention. Figure 14 This is a diagram illustrating an example of the data flow in state C of the vehicle control system according to the third embodiment of the present invention. Figure 15 This is a diagram illustrating examples of the hardware configuration of a computer according to various embodiments of the present invention. Detailed Implementation

[0015] Hereinafter, the embodiments for carrying out the present invention will be described with reference to the accompanying drawings. In this specification and the drawings, constituent elements that have substantially the same function or structure are given the same reference numerals, and repeated descriptions are omitted.

[0016] The vehicle control system of the present invention is in the form of a connection between sensors and actuators. Furthermore, the system is configured to input sensor data as input values ​​from the sensor to the vehicle control system, and output the output values ​​of the vehicle control system to the actuator. However, it should be noted that this invention can be widely applied to vehicle control systems equipped with control software, regardless of the configuration of the input source and output destination.

[0017] [First Implementation Method] Figure 1 This is a block diagram illustrating an overall configuration example of the vehicle control system 1 according to the first embodiment. The vehicle control system 1 is a system mounted on a vehicle capable of autonomous driving, and multiple electronic control units (ECUs) are connected via a network.

[0018] The vehicle control system 1 is connected to the sensor 2 and the actuator 3 via a bus. The vehicle control system 1 has the function of receiving sensor data (e.g., image data) as input to the vehicle control system 1 from the sensor 2 (e.g., a camera sensor) and sending the output data (e.g., control data) of the vehicle control system 1 to the actuator 3.

[0019] The vehicle control system 1 includes control software 10, a calculation unit 11, a comparison reference data selection unit 12, a comparison reference data storage unit 13, a status determination unit 14, a processing program modification unit 15, an evaluation software execution instruction unit 16, a performance / quality evaluation unit 17, and an important script determination unit 18.

[0020] The control software 10 includes first control software 101 and second control software 102. First control software 101 is the verified software and executes when the vehicle is in motion. Since both first control software 101 and second control software 102 have high processing loads, they cannot be executed simultaneously in the arithmetic unit 11. Therefore, second control software 102 is the software being verified and executes during the idle time of the vehicle control system 1.

[0021] The arithmetic unit (arithmetic unit 11) executes calculations of the first control software (first control software 101) when the vehicle is in a first state, and executes calculations of the second control software (second control software 102) when the vehicle is in a second state. In the following description, the first state of the vehicle is also referred to as state A of the vehicle control system 1, and the second state of the vehicle is also referred to as state B of the vehicle control system 1. Since both the first control software 101 and the second control software 102 have high processing loads, the arithmetic unit 11 cannot execute them simultaneously. However, by changing the control software executed by the arithmetic unit 11 according to the vehicle's state, the operation verification of the second control software 102 can be performed without hindering the vehicle's automatic driving. Here, the vehicle control system 1, according to the processing program change instruction from the processing program change unit 15, causes the arithmetic unit 11 to perform calculations on either the first control software 101 or the second control software 102. Figure 1 In the text, it indicates that the arithmetic unit 11 is executing the second control software 102. Furthermore, in this specification, the first control software 101 or the second control software 102 is used in the same sense as a program.

[0022] Here, an example of the state transition of vehicle control system 1 will be explained. Figure 2 This is a diagram illustrating an example of the state transitions of the vehicle control system 1 according to the first embodiment. Figure 2 The initial node, represented by the black dot in the upper left corner, indicates that the vehicle power is turned on by the driver, and the processing of the vehicle control system 1 begins.

[0023] The vehicle control system 1 has two states: state A and state B. First, an example of the internal processing of vehicle control system 1 when it is in state A will be given. State A is the state in which the vehicle is performing autonomous driving. Furthermore, a summary representation of the actions of vehicle control system 1 in state A is shown in... Figure 2 The upper part.

[0024] In state A, the vehicle control system 1 receives sensor data 20 from sensor 2 as input to the vehicle control system 1. Then, the arithmetic unit 11 executes the first control software 101 and outputs the first control software output data 1010 to the actuator 3. For example, when the first control software 101 receives image data as sensor data 20, it performs processing to identify objects reflected in the image and generates control signals required for vehicle movement.

[0025] Alternatively, the first control software 101 can also utilize sensor fusion functionality, using sensor data 20 obtained from each sensor 2 to identify the vehicle's lane, the positions of other surrounding vehicles, etc., and generate control signals to instruct the actuator 3 to accelerate or brake the vehicle. Furthermore, the first control software 101 can also determine the vehicle's lane based on image recognition results and generate operation signals for operating the steering wheel. These signals are output to the actuator 3 as first control software output data 1010.

[0026] The storage unit (comparison reference data storage unit 13) stores the input data input from the sensor (sensor 2) to the first control software (first control software 101) and the second control software (second control software 102), as well as the output data output by the first control software (first control software 101) and the second control software (second control software 102) performing operations on the input data as input. For example, the comparison reference data storage unit 13 stores sensor data 20 and first control software output data 1010. Therefore, in the comparison reference data storage unit 13, the input data and output data used by the first control software 101 are stored in groups. By storing each data in the comparison reference data storage unit 13, after the first control software 101 processes the data, the second control software 102 can perform the same processing as the first control software 101, or the developer can retrieve the data to verify the data.

[0027] Below is an example of the internal processing of vehicle control system 1 when it is in state B. For example, when vehicle control system 1 enters an idle period, it transitions from state A to state B. The idle period is determined, for example, when vehicle control system 1 detects the brake being applied, and the transition occurs from state A to state B when the vehicle stops. Furthermore, assuming the vehicle is traveling on a highway and operating in autonomous driving mode, vehicle control system 1 operates in state A. If the vehicle is traveling on a regular road and requires driver intervention, vehicle control system 1 transitions to state B. Alternatively, vehicle control system 1 can also operate in state B when the vehicle is parked in a parking lot and the onboard battery is being charged. Figure 2The lower part shows an operational summary of the vehicle control system 1 when the vehicle control system 1 transitions from state A to state B.

[0028] In state B, the arithmetic unit 11 and the comparison reference data storage unit 13 are used together with those in state A. However, in state B, the performance / quality evaluation unit 17 operates.

[0029] The arithmetic unit 11 receives sensor data 20 stored in the comparison reference data storage unit 13 and executes the second control software 102. Then, the arithmetic unit 11 outputs the second control software output data 1020 to the performance / quality evaluation unit 17. Furthermore, in state B, since the second control software output data 1020 is not output to the actuator 3, the actuator 3 will not operate based on the second control software output data 1020. For example, when switching from automatic driving to manual driving, the vehicle control system 1 transitions to state B. If the vehicle control system 1 is idle during manual driving, data on the amount of brake pedal applied when the driver depresses the brake pedal is transmitted to the actuator 3, and braking is applied.

[0030] The evaluation unit (performance / quality evaluation unit 17) compares the output data read from the storage unit (comparison reference data storage unit 13) from the first control software (first control software 101) and the second control software (second control software 102) respectively, and evaluates the performance of the second control software (second control software 102). For example, the performance / quality evaluation unit 17 performs shadow mode testing by comparing the difference between the first control software output data 1010 and the second control software output data 1020 stored in the comparison reference data storage unit 13. The first control software 101 and the second control software 102, which output the data compared and evaluated by the performance / quality evaluation unit 17, perform processing under different states, A and B. Therefore, it is not necessary to run multiple control software programs in parallel in the vehicle control system 1. As a result, the vehicle control system 1 does not need a high-performance ECU capable of processing multiple control software programs simultaneously.

[0031] Below, refer to Figures 3-9 An example illustrating the processing performed by vehicle control system 1. Figure 3 This is a diagram illustrating an example of the data flow in state A of the vehicle control system 1 according to the first embodiment.

[0032] As described above, sensor data 20 is input from sensor 2 to vehicle control system 1. The arithmetic unit 11 takes the sensor data 20, which is the output of the sensor 2, as input data, executes the first control software 101, and outputs the first control software output data 1010.

[0033] The selection unit (comparison reference data selection unit 12) selects input and output data from the input data input to the first control software (first control software 101) and the output data output by the first control software (first control software 101) for the evaluation unit (performance / quality evaluation unit 17) to evaluate the second control software (second control software 102), and saves the selected input and output data in the storage unit (comparison reference data storage unit 13). Here, the selection unit (comparison reference data selection unit 12) selects data to be saved in the storage unit (comparison reference data storage unit 13) based on the output data output by the first control software (first control software 101), as an important script for the evaluation unit (performance / quality evaluation unit 17) to evaluate the second control software (second control software 102).

[0034] For example, the comparison reference data selection unit 12 receives sensor data 20 and first control software output data 1010, and selects necessary data as verification data for the second control software 102, which is the object of verification. Then, the comparison reference data selection unit 12 outputs the selected sensor data 21 and the selected first control software output data 1011 to the comparison reference data storage unit 13. The data required for verification data includes, for example, data input to the first control software 101. However, in order to store all the data output from the sensor 2 as sensor data 20, a large recording capacity is required. Here, for example, when inputting to the first control software 101, data that is known to be misjudged by the first control software 101 is selected. Such data could be, for example, an image of a truck captured by the sensor 2 showing an image of a person on the rear door of the truck body. If the first control software 101, which inputs such an image as input data, incorrectly judges the image of a person as an actual person, the verification will be conducted on how the judgment is made in the second control software 102.

[0035] Furthermore, the first control software 101 sometimes fails to correctly detect people, vehicles, etc., in images captured by sensor 2, even in rainy or backlit environments. In such cases, it is necessary to verify how the second control software 102 can detect images that the first control software 101 cannot detect correctly. In this way, by using only a portion of sensor data 21 selected from sensor data 20 in the action verification of the software group in the control software 10, the recording capacity of the recording medium used to store sensor data 20 can be reduced.

[0036] The comparison reference data storage unit 13 saves the selected sensor data 21 and the selected first control software output data 1011 internally. Here, from... Figure 2The sensor data 20 stored in the comparison reference data storage unit 13 and the selected data in the first control software output data 1010 become... Figure 3 The selected sensor data 21 and the selected first control software output data 1011 are described in the text.

[0037] Next, the processing of the comparison reference data selection unit 12 will be described in detail. Figure 4 This is a flowchart illustrating an example of the processing steps of the comparison reference data selection unit 12 in the first embodiment. Figure 4 The following flowcharts illustrate an example of the vehicle control method of vehicle control system 1.

[0038] First, the comparison reference data selection unit 12 receives sensor data 20, which becomes input to the first control software 101, and first control software output data 1010 (S1).

[0039] Next, the comparison reference data selection unit 12 determines whether the sensor data 20 and the first control software output data 1010 received in step S1 should be used for the shadow mode test (S2). Then, if the comparison reference data selection unit 12 determines in the shadow mode test that these data should be used (S2 "Yes"), since the sensor data 20 and the first control software output data 1010 are data that should be saved, the process proceeds to step S3. The data saved here includes, for example, image data taken in inclement weather, image data that was falsely detected by the first control software 101, etc.

[0040] In step S3, the comparison reference data selection unit 12 instructs the comparison reference data storage unit 13 to store the sensor data 20 and the first control software output data 1010 received in step S1 (S3), and the process ends. Therefore, the sensor data 20 and the first control software output data 1010 are stored in the comparison reference data storage unit 13.

[0041] On the other hand, if the comparison reference data selection unit 12 determines in step S2 that the data is not suitable for use in the shadow mode test (S2 "No"), no special processing is performed and the process ends. In this case, the sensor data 20 received in step S1 and the first control software output data 1010 are not stored.

[0042] Next, the data flow for determining the state transition of the vehicle control system 1 will be explained. Figure 5 This is a diagram illustrating an example of the data flow during state transition determination in the vehicle control system 1 of the first embodiment.

[0043] The state determination unit (state determination unit 14) determines whether the vehicle is in a first state or a second state based on the availability of computing resources used by the computing unit (computing unit 11). Here, the state determination unit (state determination unit 14) determines whether the computing resources used by the computing unit (computing unit 11) are available based on at least one of the following: the scope of autonomous driving service provision, the vehicle being in charging mode, the vehicle being parked, or the load information of the computer installed in the vehicle. It also determines whether the evaluation unit (performance / quality evaluation unit 17) can execute the evaluation of the second control software (second control software 102). The scope of autonomous driving service provision refers to scenarios where the vehicle is driving autonomously, for example, corresponding to the vehicle driving on a highway. The vehicle being in charging mode is, for example, a state where a charger is connected to a parked vehicle and the onboard battery (not shown) is being charged. The vehicle being parked is, for example, waiting at a traffic light or temporarily stopped on a shoulder. The computer load information is, for example, measured as described later. Figure 15 The computer 60 is shown to display load information. Because the vehicle's state is determined in this way, the second control software 102 is executed without hindering the vehicle's autonomous driving.

[0044] Furthermore, if the status determination unit (status determination unit 14) determines that there is no available computing resources, the modification unit (processor modification unit 15) changes the control software for the calculation unit (calculation unit 11) to the first control software (first control software 101); if the status determination unit (status determination unit 14) determines that there is available computing resources, the modification unit (processor modification unit 15) changes the control software for the calculation unit (calculation unit 11) to the second control software (second control software 102). The processing program modified by the process modification unit 15 is either the first control software 101 or the second control software 102.

[0045] In this manner, the processing change unit 15 determines whether the vehicle control system 1 can transition from state A to state B based on the presence or absence of idle time determined by the state determination unit 14, and conversely, whether the vehicle control system 1 can transition from state B to state A. Then, the state determination unit 14 generates an idle time determination result as state determination result data 140. State determination result data 140 is data containing the state determination result calculated by the calculation unit 11. Since the software executed by the calculation unit 11 is selected after determining the vehicle's state, the processing of the second control software 102 is interrupted regardless of state A, and this does not hinder autonomous driving. Furthermore, even if the vehicle control system 1 processes the second control software 102 in state B, the processing of the first control software 101 is quickly resumed in the case of state A, without hindering the vehicle's autonomous driving.

[0046] The processing of the status determination unit 14 will be explained in detail below. Figure 6 This is a flowchart illustrating an example of the processing steps of the state determination unit 14 in the first embodiment.

[0047] First, the status determination unit 14 acquires the computing resource utilization information of the vehicle control system 1 (S11). The computing resource utilization information refers to, for example, the computer 60 of the vehicle control system 1 (described later). Figure 15 Information such as load rate and memory usage.

[0048] Next, the state determination unit 14 determines whether there is enough free computing resources in the vehicle control system 1 based on the computing resource utilization information (S12). If the state determination unit 14 determines that there is not enough free computing resources (S12 "No"), it outputs the state determination result data 140 of the program processed by the arithmetic unit 11 of the vehicle control system 1 as the first control software 101 in state A (S13), and ends this process.

[0049] On the other hand, if the state determination unit 14 determines that there is sufficient free space in the computing resources (S12 "Yes"), it outputs the program processed by the arithmetic unit 11 of the vehicle control system 1 as the state determination result data 140 of the second control software 102 in state B (S14), and ends the process. In the processing of the second control software 102, which is executed when computing resources are available, the selected data is used. Therefore, the amount of data required for the processing of the second control software 102 is reduced, and it does not consume more computing resources than the first control software 101.

[0050] after, Figure 5 The processing program modification unit 15 shown changes the program processed by the calculation unit 11 of the vehicle control system 1 to the first control software 101 or the second control software 102 based on the content of the state determination result data 140 generated by the state determination unit 14.

[0051] The execution instruction unit (evaluation software execution instruction unit 16) uses the second control software (second control software 102) modified by the modification unit (processor modification unit 15), and instructs the calculation unit (calculation unit 11) to perform calculations, taking the input data saved as an important script in the storage unit (comparison reference data storage unit 13) as input. The calculations of the second control software 102 are not executed immediately after the vehicle switches to state B, but rather begin upon receiving instructions from the evaluation software execution instruction unit 16. Therefore, the processing of the second control software 102 does not begin until the post-processing of state A is completed, and redundant data used in the processing of state A is not mixed into the processing of the second control software 102.

[0052] Furthermore, when the vehicle control system 1 transitions from state B to state A, the state determination unit 14 determines whether computing resources are available. If there are no available computing resources, the processing program modification unit 15 modifies the program processed by the calculation unit 11 to the first control software 101. Then, the evaluation software execution instruction unit 16 instructs the execution of the calculation of the first control software 101 under state A to begin.

[0053] Next, the data flow in vehicle control system 1 in state B will be explained. Figure 7 This is a diagram illustrating an example of the data flow in another state (state B) of the vehicle control system 1 according to the first embodiment.

[0054] The comparison reference data storage unit 13 outputs as follows: Figure 2 The selected first control software output data 1011 and the selected sensor data 21 are stored internally as shown.

[0055] When the arithmetic unit 11 receives the selected sensor data 21, it executes the second control software 102. Then, the second control software 102 outputs second control software output data 1020.

[0056] The performance / quality evaluation unit 17 receives the selected first control software output data 1011 and second control software output data 1020, evaluates the performance and quality of the two data sets and the control software that output the two data sets, and outputs evaluation result data 170. Here, performance / quality refers to, for example, the functionality of the first control software 101 and the second control software 102, and the appropriateness of the output results. The functionality of the first control software 101 and the second control software 102 refers to the function of each software itself, such as object detection or track generation for an autonomous vehicle. Then, the performance / quality evaluation unit 17 evaluates whether the function of each executed software meets the required function. For example, if it is an object detection function, it evaluates whether it can correctly detect objects such as people and signs; if it is a track generation function, it evaluates whether it correctly generates a track so that the vehicle travels on the roadway instead of the sidewalk. Furthermore, the appropriateness of the output results indicates whether the performance / quality evaluation unit 17 evaluates whether the desired output result was obtained through the execution of the software. The data processed by the performance / quality evaluation unit 17, as well as the performance and quality of the control software, are collectively referred to as "performance evaluation."

[0057] The critical script determination unit (critical script determination unit 18) receives the evaluation results from the evaluation unit (performance / quality evaluation unit 17), the input and output data selected by the selection unit (comparison reference data selection unit 12), and the output data output by the second control software (second control software 102). Based on the evaluation results, it determines the data that should be stored in the storage unit (comparison reference data storage unit 13) as critical scripts. For example, the critical script determination unit 18 receives the selected sensor data 21, the selected first control software output data 1011, the second control software output data 1020, and the evaluation result data 170. Then, the critical script determination unit 18 determines whether each piece of data is critical based on the content of the received data. Here, a script refers to the pattern of input and output data input to each software. Critical scripts that the developer wants to retain in future verification are also called "critical scripts". By determining critical scripts, it is not necessary to store a large amount of input and output data in the comparison reference data storage unit 13, thus preventing the burden of recording capacity.

[0058] Furthermore, the important script determination unit (important script determination unit 18) determines the output data of the first control software (first control software 101) and the output data of the second control software (second control software 102) whose evaluation results are deemed inconsistent. By using the determined important script, the important script determination unit 18 can easily compare the differences between the output data of the first control software 101 and the second control software 102. For example, the important script determination unit 18 confirms whether the performance of the second control software 102 is improved compared to the first control software 101. Then, if the performance is not improved, the selected sensor data 21, the selected first control software output data 1011, and the selected second control software output data 1020 are discarded. In this case, the redeveloped second control software 102 is assigned to the vehicle, and the calculations of the second control software 102 are executed.

[0059] Furthermore, if the developer of the vehicle control system 1 is interested in directly verifying the content of the data, regardless of the evaluation results, there may be situations where the control software, based on the AI ​​performing the computational processing, outputs different data due to different judgments on the same input data (e.g., image data). Such input and output data are data that the developer hopes will play a role in the development of the control software. In this case, the important script determination unit 18 can also retain the input data to the second control software 102 used by the performance / quality evaluation unit 17 when evaluating the performance of the second control software 102.

[0060] The following details the processing of the performance / quality evaluation department 17. Figure 8This is a flowchart illustrating an example of the processing steps of the performance / quality evaluation unit 17 in the first embodiment.

[0061] First, the performance / quality evaluation unit 17 receives the selected first control software output data 1011 (S21). Next, the performance / quality evaluation unit 17 receives the second control software output data 1020 (S22).

[0062] Next, the performance / quality evaluation unit 17 compares the selected first control software output data 1011 and second control software output data 1020, evaluates the comparison results, and generates evaluation result data 170 (S23). Then, the performance / quality evaluation unit 17 outputs the evaluation result data 170 (S24) and ends the process.

[0063] For example, assuming the first control software 101 has the function of detecting objects based on images when a truck approaches its vehicle from the front, it can identify the truck based on the position of the sensor 2 and the image. Furthermore, if the second control software 102 takes the image used by the first control software 101 when identifying the vehicle as input, and similarly identifies the approaching vehicle as a truck, the performance / quality evaluation unit 17 can determine that the object detection function of the second control software 102 is rated as good, or that the performance of the object detection function has not deteriorated. However, the first control software 101 and the second control software 102 may identify the size of the vehicle differently from the image. In this case, if the first control software 101 incorrectly identifies the vehicle as a station wagon, while the second control software 102 correctly identifies the vehicle as a truck, the performance / quality evaluation unit 17 can evaluate the object detection function of the second control software 102 as having improved performance.

[0064] Next, regarding Figure 1 The processing of the important script determination unit 18 shown will be explained in detail. Figure 9 This is a flowchart illustrating an example of the processing steps of the important script determination unit 18 in the first embodiment.

[0065] First, the important script determination unit 18 receives the selected sensor data 21, the selected first control software output data 1011, and the second control software output data 1020 (S31).

[0066] Next, the important script determination unit 18 receives the evaluation result data 170 (S32). Next, the important script determination unit 18 determines whether each received data is important based on the evaluation result data 170 (S33).

[0067] If the received data is determined to be important (S33 "Yes"), the important script determination unit 18 saves each piece of data to the vehicle control system 1 (S34) and ends the process. The data saved in the vehicle control system 1 includes the selected sensor data 21, the selected first control software output data 1011, and the second control software output data 1020, as well as the evaluation result data 170. The data saved in the vehicle control system 1 can be copied to a portable storage medium such as a USB flash drive for developers to verify the data content or develop new software.

[0068] On the other hand, if the important script determination unit 18 determines that the received data is not important (S33 "No"), it will not save each data in the vehicle control system 1 and will end the process.

[0069] In the vehicle control system 1 of the first embodiment described above, the same selected sensor data 21 is used as input, and the control software group of the control software 10 is processed at different times. Here, the comparison reference data storage unit 13 does not save all the input data from the sensor 2 as sensor data 20, but only specific data is saved as sensor data 20. The data stored in the vehicle control system 1 is the time when the control software group, which is the comparison object in the performance / quality evaluation unit 17, calculates the output data, or the time when the driver performs a specific operation. Then, at a time different from the time when the output value is calculated or the time when the specific operation is performed, the performance / quality evaluation unit 17 uses the sensor data 20 stored in the comparison reference data storage unit 13 to execute the second control software 102 for verification, and compares the second control software output data 1020 with the first control software output data 1010. Therefore, the vehicle control system 1 does not require a high-performance ECU. In addition, the vehicle control system 1 can perform shadow mode tests even under high load.

[0070] Furthermore, the second control software 102 is run not only during simulated vehicle movements, but also in the background using input data obtained from actual vehicles. Therefore, the second control software 102 can be verified without compromising the safety of the actual vehicle in motion.

[0071] Furthermore, the second control software 102 may be, for example, software whose AI learning model differs from the first control software 101, or software capable of reducing CPU load. Alternatively, error-correcting software included in the already functioning first control software 101 can be validated as the second control software 102. Such validation is performed using the vehicle control system 1 mounted on an actual vehicle where unexpected data is readily input; therefore, the performance / quality evaluation unit 17 can validate the quality of the second control software 102 using various varying input data (sensor data 20). For example, if the CPU load of the first control software 101 is 80%, and the CPU load of the second control software 102 is 70%, the developer can investigate using the software used as the second control software 102 as the first control software 101.

[0072] Furthermore, even if a second control software 102 with a lighter processing load than the first control software 101 used in the vehicle control system 1 can still produce second control software output data 1020 of the same quality as the first control software output data 1010, the software used as the second control software 102 can be replaced with the first control software 101 executed in autonomous driving. In this way, by replacing the first control software 101 with software that has a lighter processing load, computational processing and the consumption of computing resources in autonomous driving, which involves large amounts of computation, can be suppressed.

[0073] [Modifications of the First Embodiment] Here, when the important script determination unit (important script determination unit 18) determines that the first control software (first control software 101) is running and that the output of the first control software (first control software 101) contains errors, it saves the data determined to be important scripts in the storage unit (comparison reference data storage unit 13). Therefore, normally, when the processing result of the first control software 101, which should be normal, is abnormal, the developer can verify the data determined to be important scripts and the processing content of the first control software 101.

[0074] Here, if the selection unit (comparison reference data selection unit 12) finds that the result obtained by performing sensor fusion processing is inconsistent with the output data output by the first control software (first control software 101) after performing calculations, it determines that there is an error in the output result of the first control software (first control software 101). The sensor fusion processing is a process of synthesizing multiple input data input from multiple sensors (sensor 2). For example, whether an image recognition result is a false detection cannot always be determined solely by the image recognition software. Sensor fusion is a technique used to determine the result of image recognition using information from multiple different sensors. For example, assuming LiDAR (Light Detection and Ranging) is used as a sensor, whether a person is standing in front of a vehicle can be identified using either image data captured and output by a camera or dot matrix data output by the LiDAR. Here, even if a person is identified as standing based on the image data output from the camera, if the person cannot be identified as standing in the dot matrix data obtained from the LiDAR, the identification is incorrect for either the image data or the dot matrix data. On the other hand, if the second control software 102 can identify that either the image data or the dot matrix data indicates that a person is standing, then the second control software 102 can correctly identify the person. Here, if the first control software 101 does not have the function of detecting objects through sensor fusion, the comparison reference data selection unit 12 can determine the error of the output result of the first control software 101 by acquiring the evaluation result data 170 and the second control software output data 1020. In this way, by using sensor fusion technology, the correctness of the output result of the first control software 101 can be determined based on the identification results of data obtained from multiple sensors.

[0075] Furthermore, in cases where inconsistencies arise between the outputs of the first control software 101 and the second control software 102 due to sensor fusion in autonomous driving, actions controlled to indicate the presence of a person in front of the vehicle (e.g., stopping the vehicle) are considered safer. However, if no one is actually standing, either the first control software 101 or the second control software 102 that identifies a person as standing needs to be retested.

[0076] Furthermore, if the selection unit (comparison reference data selection unit 12) finds that the vehicle's driving log acquired by the vehicle is inconsistent with the output data output by the first control software (first control software 101) after performing calculations, it determines that there is an error in the output result of the first control software (first control software 101). The vehicle control system 1 continuously acquires its own vehicle position through a GPS (Global Positioning System) navigation system and calculations based on tire rotation speed, and saves the vehicle's driving records. Here, if the first control software 101 has the function of calculating the vehicle's trajectory plan, the comparison reference data selection unit 12 compares the vehicle's trajectory plan calculated by the first control software 101 with the actual driving records. Then, if the vehicle's trajectory plan deviates from the actual driving records, the comparison reference data selection unit 12 determines that there is an error in the trajectory plan, i.e., in the output data of the first control software 101.

[0077] Furthermore, if the selection unit (comparison reference data selection unit 12) finds that the map data possessed by the vehicle is inconsistent with the output data output by the first control software (first control software 101) after performing calculations, it determines that there is an error in the output result of the first control software (first control software 101). As described above, in the vehicle control system 1, although the vehicle is traveling on a road, sometimes the vehicle position calculated by the first control software 101 indicates that the vehicle is traveling in a location other than a road. In this case, the comparison reference data selection unit 12 determines that there is an error in the vehicle position calculated by the first control software 101 relative to the map data, that is, there is an error in the output data of the first control software 101.

[0078] [Second Implementation] Next, the vehicle control system and method according to the second embodiment of the present invention will be described. The difference between the vehicle control system in the second embodiment and the first embodiment is that the vehicle control system 1 is connected to a cloud server via an external network. Therefore, in the first embodiment, the functions, processes, and data storage performed within the vehicle control system 1 are handled in the cloud server. Furthermore, the same reference numerals are used for components identical to those in the first embodiment, and their descriptions are omitted.

[0079] Figure 10 This is a diagram showing an example of the overall configuration of the vehicle control system 1 according to the second embodiment. The vehicle control system 1 is connected to the cloud server 4 via an external network N. With this configuration, for example, the cloud server 4 can use OTA (Over-The-Air) functionality to distribute second control software 102, which is the object of verification, to the vehicle control system 1. The second control software 102 received by the vehicle control system 1 from the cloud server 4 is stored in control software 10.

[0080] The computing unit (computing unit 11) performs calculations on the second control software (second control software 102) received from the cloud server (cloud server 4) via the network (external network N), and sends the evaluation results of the evaluation unit (performance / quality evaluation unit 17) that is determined to be an important script by the important script determination unit (important script determination unit 18), the input data and output data selected by the selection unit (comparison benchmark data selection unit 12), and the output data of the second control software (second control software 102) to the cloud server (cloud server 4).

[0081] The vehicle control system 1 can discard the second control software 102, which has already undergone operational verification. Therefore, by not keeping the second control software 102 in the vehicle control system 1, the computing resources of the vehicle control system 1 can be reduced. In addition, the cloud server 4 can provide new software to vehicles after they leave the factory from the vehicle manufacturer, making software upgrades and vehicle function enhancements easier.

[0082] Figure 11 This diagram illustrates an example of communication data exchanged between the vehicle control system 1 and the cloud server 4 in the second embodiment.

[0083] A second control software 102 is distributed from the cloud server 4 to the vehicle control system 1. This second control software 102 serves as the program to be verified in shadow mode testing. Therefore, unlike the first embodiment, it is not necessary to pre-save the program of the verification object within the vehicle control system 1.

[0084] Furthermore, the selected sensor data 21, the selected first control software output data 1011, the second control software output data 1020, and the evaluation result data 170 are sent from the vehicle control system 1 to the cloud server 4. Therefore, for example, the same performance / quality evaluation as the performance / quality evaluation unit 17 can be performed within the cloud server 4. Additionally, the evaluation result processed by the cloud server 4 using data received from the vehicle control system 1 can be compared with the evaluation result data 170 received from the vehicle control system 1. Furthermore, the same processing as the important script determination unit 18 can be performed within the cloud server 4. As a result, the processing within the vehicle control system 1 can be simplified, which is different from the first embodiment.

[0085] In the vehicle control system 1 of the second embodiment described above, it is not necessary to pre-save the second control software 102. Furthermore, the second control software 102 is distributed from the cloud server 4 when verification is desired. Therefore, the vehicle control system 1 can perform verification using the latest second control software 102.

[0086] Furthermore, the data used in the vehicle control system 1 is sent to the cloud server 4. The cloud server 4 can then use the received data to perform processing such as performance / quality evaluation. Therefore, the vehicle control system 1 can be configured without a performance / quality evaluation unit 17 and an important script determination unit 18.

[0087] Furthermore, the vehicle control system 1 stores the learned program downloaded from the cloud server 4 as second control software 102 in the control software 10, and can evaluate the performance of the second control software 102. This learned program is, for example, a program created by AI. Therefore, the cloud server 4 can verify the safety of the learned program through the vehicle control system 1 installed in multiple vehicles, obtaining verification results corresponding to various driving scenarios. Moreover, if the accuracy of the output result of the second control software 102 is lower than that of the first control software 101, the developer can determine whether to discontinue using the second control software 102 or to modify it.

[0088] Furthermore, even input and output data that are determined to contain errors in the output of the first control software 101 can be stored in the comparison reference data storage unit 13. This data is then uploaded from the comparison reference data storage unit 13 to the cloud server 4, allowing developers to acquire and verify the input and output data. Additionally, if errors are determined in the output of the first control software 101, it can help developers improve the functionality of the first control software 101. Therefore, the cloud server 4 can collect the first control software output data 1010 and the evaluation result data 170 of the second control software 102 accompanying the output data from multiple vehicles.

[0089] Furthermore, by verifying the data stored in the cloud server 4, the developers can distribute the control software that improved the faults of the first control software 101 as the second control software 102 to the vehicle, and re-verify the performance of the second control software 102 through shadow mode testing.

[0090] [Third Implementation Method] Next, the vehicle control system and method of the third embodiment of the present invention will be described. The difference between the vehicle control system in the third embodiment and the first embodiment is that the vehicle control system 1 is connected to the driver operation sensor 5 via a bus.

[0091] Figure 12 This is a diagram showing an example of the overall configuration of the vehicle control system 1 according to the third embodiment. As described above, the vehicle control system 1 is connected to the driver operation sensor 5. The driver operation sensor 5 detects the driver's operation of the vehicle and outputs the operation signal to the vehicle control system 1. The driver's operation includes, for example, steering wheel operation or brake pedal operation, and the amount of the driver's operation includes the steering wheel angle or the amount of brake pedal operation.

[0092] As described above, in the vehicle control system 1 of the first embodiment, the actuator 3 is operated using the first control software output data 1010. On the other hand, in the configuration of the vehicle control system 1 of the third embodiment, the operation amount of the driver's operation is obtained via the driver operation sensor 5 and transmitted to the actuator 3. In this way, the processing for operating the actuator 3 in the automatic driving of the first embodiment is replaced by the processing of the driver's operation in the third embodiment, thereby controlling the vehicle.

[0093] Here, the evaluation unit (performance / quality evaluation unit 17) compares the driver's operation data input during vehicle operation with the output data output by the calculation performed using the input data input from the sensor (sensor 2) to the second control software (second control software 102), and evaluates the performance of the second control software (second control software 102). Therefore, the vehicle control system 1 of the third embodiment uses the first control software output data 1011 and the second control software output data 1020 selected by the performance / quality evaluation unit 17 of the first embodiment, instead of processing, the driver's operation amount obtained via the driver operation sensor 5 and the second control software output data 1020, as the comparison reference data based on the shadow mode test. In the operation of the actuator 3, the output data of the first control software 101 of the first embodiment is not required; the vehicle operation is controlled based on the output data of the driver operation sensor 5, i.e., the driver's steering wheel operation or brake pedal pressure.

[0094] Figure 13 This diagram illustrates an example of state transitions in the vehicle control system 1 according to the third embodiment. Here, it is assumed that the vehicle control system 1 transitions to state C.

[0095] In the arithmetic unit 11 of the vehicle control system 1, the output value of the sensor 2 is used to process the second control software 102. When the performance / quality evaluation unit 17 of the vehicle control system 1 transitions to state C, it directly receives the output value of the driver operation sensor 5, i.e., the driver operation data 50. Additionally, the performance / quality evaluation unit 17 receives the second control software output data 1020 processed by the arithmetic unit 11 using the second control software 102. This performance / quality evaluation unit 17 differs from the first embodiment in that it evaluates the performance / quality of the second control software 102 and can perform shadow mode testing.

[0096] Figure 14This is a diagram illustrating an example of the data flow in a state (state C) of the vehicle control system 1 according to the third embodiment.

[0097] As described above, the driver operation sensor 5 outputs driver operation data 50, which includes the amount of steering wheel operation and brake pedal depressing. On the other hand, the sensor 2 outputs the sensing results as sensor data 20.

[0098] The arithmetic unit 11 processes the received sensor data 20 using the second control software 102 and outputs second control software output data 1020. The performance / quality evaluation unit 17 receives driver operation data 50 and second control software output data 1020. Then, based on the comparison result of the two data, the performance / quality evaluation unit 17 evaluates the performance and quality of the second control software 102 and outputs evaluation result data 170.

[0099] The critical script determination unit 18 receives driver operation data 50, sensor data 20, second control software output data 1020, and evaluation result data 170, and determines the critical script based on the content of the evaluation result data 170. As described above, the performance / quality evaluation unit 17 differs from the first embodiment in that it can evaluate the performance and quality of the second control software 102 by using driver operation data 50 instead of the first control software 101.

[0100] In the vehicle control system 1 of the third embodiment described above, driver operation data 50 is used instead of the first control software 101 to evaluate the performance and quality of the second control software 102 that performs calculations while the vehicle is in motion. Thus, the vehicle control system 1 can perform shadow mode testing while the vehicle is in motion (state C).

[0101] For example, during the period when the driver of the vehicle is performing driving operations, the vehicle control system 1 takes the state of the vehicle as state C and executes the second control software 102 in the background. Furthermore, the performance / quality evaluation unit 17 compares and evaluates in real time the driver operation data 50 obtained through the driver's driving and the second control software output data 1020 output by the second control software 102. Therefore, the performance / quality evaluation unit 17 can assess the performance and quality of the second control software 102, for example, by confirming the consistency between the vehicle's trajectory when the driver, while driving, detects an object falling forward and performs a coasting operation and the trajectory of the vehicle generated by the second control software 102 based on the image it recognizes.

[0102] <Computer Hardware Structure> Next, the hardware configuration of the computer 60 that configures the vehicle control system 1 will be described. Figure 15This is a block diagram illustrating an example of the hardware configuration of computer 60. Computer 60 is an example of hardware that can be used as a computer to operate the vehicle control system 1 of this embodiment.

[0103] Computer 60 includes a CPU (Central Processing Unit) 61, ROM (Read Only Memory) 62, and RAM (Random Access Memory) 63, all connected to a bus 64. Computer 60 also includes non-volatile memory 65 and a network interface 66.

[0104] The CPU 61 reads the program code of the software implementing the functions of this embodiment from the ROM 62, loads it into the RAM 63, and executes it. Variables and parameters generated during the CPU 61's operation are temporarily written into the RAM 63, and these variables and parameters are read out by the CPU 61 as appropriate. However, an MPU (Micro Processing Unit) can also be used instead of the CPU 61. Figure 1 The functions of the arithmetic unit 11, the comparison reference data selection unit 12, etc., shown are implemented by the CPU 61.

[0105] The non-volatile memory 65 may be, for example, an HDD (Hard Disk Drive), SSD (Solid State Drive), floppy disk, optical disk, magneto-optical disk, CD-ROM, CD-R, magnetic tape, or other non-volatile memory. In addition to the OS (Operating System) and various parameters, the non-volatile memory 65 also records the programs used to enable the computer 60 to function. The ROM 62 and non-volatile memory 65 record the programs and data required for the CPU 61 to operate, serving as an example of a computer-readable non-temporary storage medium storing programs executed by the computer 60. Figure 1 The control software 10 and the comparison reference data storage unit 13 shown are configured in the non-volatile memory 65.

[0106] The network interface 66, for example, uses a NIC (Network Interface Card) and can transmit and receive various data between devices via a LAN (Local Area Network) or dedicated line connected to the NIC's terminals. For example, communication with the sensor 2, the actuator 3, and the cloud server 4 is performed through the network interface 66. Furthermore, communication between the vehicle control system 1 and the sensor 2 and actuator 3 is performed, for example, via a CAN (Controller Area Network).

[0107] Furthermore, the present invention is not limited to the embodiments described above. Other various applications and modifications may also be adopted as long as they do not depart from the spirit of the claims. For example, the above embodiments are detailed and specific descriptions of the apparatus and system configurations for the purpose of easily understanding and illustrating the present invention, and are not necessarily limited to embodiments possessing all the described configurations. Furthermore, a portion of the configuration of the embodiments described herein can be replaced with the configuration of other embodiments, and the configuration of other embodiments can be added to the configuration of a certain embodiment. Additionally, for a portion of the configuration of each embodiment, other configurations can be added, deleted, or replaced. Furthermore, while control lines and information lines are considered necessary for the description, not all control lines and information lines may be represented on the product itself. In fact, almost all components can be considered interconnected. Symbol Explanation

[0108] 1…Vehicle control system, 2…Sensor, 3…Actuator, 10…Control software, 11…Computation unit, 12…Comparison reference data selection unit, 13…Comparison reference data storage unit, 14…Status determination unit, 15…Processing program change unit, 16…Evaluation software execution instruction unit, 17…Performance / quality evaluation unit, 18…Important script determination unit, 20…Sensor data, 21…Selected sensor data, 101…First control software, 102…Second control software, 140…Status determination result data, 170…Evaluation result data, 1010…First control software output data, 1011…Selected first control software output data, 1020…Second control software output data.

Claims

1. A vehicle control system, characterized in that, have: The arithmetic unit executes calculations of the first control software when the vehicle is in a first state, and executes calculations of the second control software when the vehicle is in a second state. The storage unit stores the input data from the sensors to the first control software and the second control software, as well as the output data output by the first control software and the second control software through operations performed by the input data. The evaluation unit compares the output data read from the storage unit and output by the first control software and the second control software respectively, and evaluates the performance of the second control software. The selection unit selects the evaluation unit from the input data that is input to the first control software and the output data that is output by the first control software to evaluate the input data and the output data of the second control software, and saves the selected input data and the output data to the storage unit. The state determination unit determines whether the vehicle is in the first state or the second state based on the availability of computing resources used by the arithmetic unit. as well as The modification unit, when the status determination unit determines that the computing resources are not idle, uses the control software executed by the arithmetic unit as the first control software; when the status determination unit determines that the computing resources are idle, it changes the control software executed by the arithmetic unit to the second control software. The selection unit selects data that should be stored in the storage unit as an important script for the evaluation unit to evaluate the second control software, based on the output data output by the first control software.

2. The vehicle control system according to claim 1, characterized in that, have: The execution instruction unit uses the second control software modified by the modification unit to instruct the calculation unit to perform calculations, taking the input data stored in the storage unit as the important script as input.

3. The vehicle control system according to claim 1, characterized in that, have: The important script determination unit receives the evaluation result from the evaluation unit, the input data and output data selected by the selection unit, and the output data output by the second control software. Based on the evaluation result, it determines the data that should be saved in the storage unit as important scripts.

4. The vehicle control system according to claim 3, characterized in that, The important script determination unit determines the important script, which includes the output data of the first control software and the output data of the second control software whose evaluation results are evaluated as inconsistent.

5. The vehicle control system according to claim 3, characterized in that, When the important script determination unit determines that the first control software is running and that the output of the first control software is incorrect, it saves the data determined to be the important script to the storage unit.

6. The vehicle control system according to claim 5, characterized in that, If the selection unit finds that the result obtained by performing sensor fusion processing is inconsistent with the output data output by the first control software, it determines that there is an error in the output result of the first control software. The sensor fusion processing is a process of synthesizing multiple input data from multiple sensors.

7. The vehicle control system according to claim 5, characterized in that, If the selection unit finds that the vehicle's driving record obtained by the vehicle is inconsistent with the output data output by the first control software, it determines that there is an error in the output result of the first control software.

8. The vehicle control system according to claim 5, characterized in that, If the selection unit finds that the map data of the vehicle is inconsistent with the output data output by the first control software, it determines that there is an error in the output result of the first control software.

9. The vehicle control system according to claim 1, characterized in that, The status determination unit determines whether the computing resources of the computing unit are available based on at least one of the following: the range of autonomous driving service provided, the vehicle being in charging mode, the vehicle being parked, or the load information of the computer mounted on the vehicle; and determines whether the evaluation unit can execute the evaluation of the second control software.

10. The vehicle control system according to claim 3, characterized in that, The calculation unit performs calculations on the second control software received from the cloud server via the network, and sends the evaluation result of the evaluation unit (which is determined to be the important script by the important script determination unit), the input data and output data selected by the selection unit, and the output data of the second control software to the cloud server.

11. A vehicle control method, characterized in that, include: The process involves executing calculations of the first control software through the arithmetic unit when the vehicle is in a first state, and executing calculations of the second control software through the arithmetic unit when the vehicle is in a second state. The process of saving the input data from the sensors to the first control software and the second control software, and the output data output by the first control software and the second control software through the calculations performed by the input data as input, to the storage unit; The evaluation unit compares the output data read from the storage unit by the first control software and the second control software respectively, and evaluates the performance of the second control software. The process involves selecting the evaluation unit from the input data (input to the first control software) and the output data (output of the first control software) by the selection unit to evaluate the input data and the output data of the second control software, and saving the selected input data and the output data to the storage unit. The process involves the state determination unit determining whether the vehicle is in the first state or the second state based on the availability of computing resources used by the arithmetic unit; as well as If the status determination unit determines that the computing resources are not available, the change unit will use the control software executed by the arithmetic unit as the first control software; if the status determination unit determines that the computing resources are available, the change unit will change the control software executed by the arithmetic unit to the second control software. The selection unit selects data that should be stored in the storage unit as an important script for the evaluation unit to evaluate the second control software, based on the output data output by the first control software.

Images