Electronic control device and method for vehicle

Abstract

Provided are a vehicle electronic control apparatus and method. A sub-program, which is a program having a different configuration from the main program, is installed in a vehicle electronic control device (30) mounted on a vehicle, and a function equivalent to that of the main program can be executed, and a part or all of the sub-program is installed in order to improve the performance. The calculation result of the sub-process performed in accordance with the sub-program is compared with the calculation result of the main process performed in accordance with the main program. Based on the comparison result, an abnormality of the main process is determined.

Description

Technical Field

[0001] The present disclosure relates to a vehicle electronic control device that is mounted on a vehicle and is used to execute a desired function in the vehicle, and a method for determining an abnormality in a main process executed according to a main program in the vehicle electronic control device. Background Art

[0002] For example, Patent Document 1 discloses a vehicle control device that utilizes a microcomputer on one side to perform operations equivalent to those performed by a microcomputer on the other side, and when an abnormality is detected in the microcomputer on the other side based on a comparison of the operation results, the microcomputer on one side takes over the automatic driving control performed by the microcomputer on the other side.

[0003] Prior Art Literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent No. 6777761 Summary of the invention

[0006] As for the desired functions for vehicles, such as autonomous driving control functions, their performance has been improved year by year, and they are often installed in new and upgraded vehicles. Furthermore, in recent years, technologies such as so-called OTA (Over The Air) that rewrite programs via wireless communication after market launch have also become increasingly popular.

[0007] Here, in order to verify the performance improvement of the desired function, it is desirable to evaluate different versions of the control program with improved performance in various scenarios that a vehicle may actually encounter.

[0008] The present disclosure is made in view of the above-mentioned points, and its purpose is to provide a vehicle control device and method. In order to evaluate different versions of control programs with improved performance, different versions of control programs with improved performance are installed in a control device mounted on a vehicle, and the different versions of control programs can be used to detect abnormalities in the processing performed by the control program that actually performs control.

[0009] In order to achieve the above-mentioned object, the electronic control device for a vehicle disclosed in the present invention is mounted on a vehicle and is used to perform a desired function in the vehicle, wherein it comprises:

[0010] a main processing unit that executes a main process implemented according to a main program based on input data from at least one sensor;

[0011] a sub-processing unit that performs sub-processing according to a sub-program based on the same input data as the main processing unit; and

[0012] an abnormality determination unit that compares a calculation result of a main process in the main processing unit with a calculation result of a sub-process in the sub-processing unit, and determines an abnormality in the main processing unit based on a result of the comparison,

[0013] The desired function is executed by the main processing of the main processing unit according to the main program.

[0014] A subroutine is a program that can execute functions equivalent to those of a main program and has a partially or entirely different configuration from that of the main program in order to improve performance.

[0015] In addition, the method disclosed herein is a method for storing a desired data set executed by at least one processor in a vehicle electronic control device, wherein the vehicle electronic control device is mounted on a vehicle and is used to execute a desired function in the vehicle.

[0016] Methods include:

[0017] executing a main process implemented according to a main program based on input data from at least one sensor;

[0018] executing a sub-process implemented according to a sub-routine based on the same input data as the main process; and

[0019] Compare the calculation result of the main process with the calculation result of the sub-process, and determine the abnormality of the main process based on the result of the comparison.

[0020] The desired function is executed by the main processing implemented according to the main program.

[0021] A subroutine is a program that can execute functions equivalent to those of a main program and has a partially or entirely different configuration from that of the main program in order to improve performance.

[0022] According to the vehicular electronic control device and method of the present disclosure, a subprogram that can execute functions equivalent to those of a main program and has a partially or entirely different configuration from the main program for performance improvement is installed in a vehicular electronic control device mounted on a vehicle.

[0023] Then, the calculation result of the sub-processing executed according to the sub-routine is compared with the calculation result of the main process executed according to the main program, and the abnormality of the main process is determined based on the comparison result.

[0024] As described above, according to the vehicle electronic control device and method of the present disclosure, it is possible to detect abnormality in the main process performed by the main program that actually performs control using the subroutine. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 1 is a structural diagram showing an example of the structure of a vehicle electronic control device according to an embodiment.

[0026] Figure 2 This is a flowchart showing the processing executed by the main SoC including the main processing performed according to the main program.

[0027] Figure 3 It means Figure 2 The processing shown in the flowchart is a flowchart of processing executed in parallel by the main SoC.

[0028] Figure 4 This is a flowchart showing processing executed by the sub-SoC including sub-processing performed according to a subroutine.

[0029] Figure 5 It means next Figure 4 A flowchart of the process performed by the sub-SoC.

[0030] Figure 6 1 is a diagram for explaining abnormality determination of a main process of the main SoC.

[0031] Figure 7 is a flow chart representing a process performed by a data center.

[0032] Figure 8 is a flowchart showing other processing performed by the data center.

[0033] Fig. 9 This is a flowchart showing processing executed by the vehicle electronic control device of the target vehicle for communication with the data center and updating of the main program and subprograms.

[0034] Fig.10 This is a flowchart showing a part of the processing executed by the vehicle electronic control device according to the second embodiment.

[0035] Fig.11 This is a flowchart showing a part of the processing executed by the vehicle electronic control device according to the modified example of the second embodiment. DETAILED DESCRIPTION

[0036] Hereinafter, preferred embodiments of the present disclosure will be described with reference to the accompanying drawings. In addition, for identical or similar structures, descriptions are sometimes omitted by assigning the same reference numerals in multiple figures. In the case where only a portion of a structure is described in each embodiment, the structures of other embodiments previously described can be applied to the other portions of the structure. In addition, not only the combinations of structures explicitly described in the description of each embodiment, but also the structures of multiple embodiments may be partially combined with each other even if not explicitly described, as long as the combination does not particularly cause obstacles.

[0037] (First Embodiment)

[0038] Figure 1 : is a structural diagram showing an example of the structure of the vehicle electronic control device 30 of the present embodiment. In addition, the vehicle equipped with the vehicle electronic control device 30 is not limited to a normal private car, but may also be a rental vehicle, a manned taxi vehicle, a carpool vehicle, a cargo vehicle, a bus, etc. In addition, the vehicle equipped with the vehicle electronic control device 30 may be a right-hand drive vehicle or a left-hand drive vehicle. Furthermore, the traffic environment in which the vehicle is traveling may be a traffic environment based on left-hand traffic or a traffic environment based on right-hand traffic.

[0039] like Figure 1 As shown, the vehicle electronic control device 30 has two SoCs (System on Chip), namely, a main SoC 36 and a sub-SoC 44, as processors for performing various calculations according to a program. However, the processor is not limited to SoC, and may be, for example, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an NPU (Neural Network Processing Unit), etc. Furthermore, the processor may also be composed of an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit), etc.

[0040] In addition, Figure 1 In the example of two SoCs as processors, the number of processors may be one or more than three. When the number of processors is one, the main processing of the main SoC 36 and the sub-processing of the sub-SoC 44 may be multi-tasked by time division, for example.

[0041] The program is stored in, for example, rewritable ROMs (Read Only Memory) 40 and 48 connected to the main SoC 36 and the sub-SoC 44, respectively. However, the form of the storage medium (non-transitory tangible computer readable medium: non-transitory tangible storage medium) storing the program can also be appropriately changed to an optical disk, a hard disk drive, a solid-state drive, etc. Furthermore, the storage medium is not limited to a structure provided on a circuit substrate, and can also be a structure provided in the form of a memory card, etc. and inserted into a slot and electrically connected to the main SoC 36 and the sub-SoC 44, respectively.

[0042] The vehicle electronic control device 30 is connected to an on-board network (not shown) mounted on the vehicle, and can output control instructions to various devices, equipment, actuators, etc. of the vehicle via the on-board network. In addition, various devices, equipment, and actuators connected to the on-board network can communicate with each other. In addition, it can also be configured to connect various sensors to the on-board network.

[0043] The vehicle electronic control device 30 has at least one camera 20 and / or at least one radar sensor 22 as sensors, and can obtain information about the surrounding environment of the vehicle through these sensors. The camera 20 is installed in front of the vehicle, for example, and is configured to capture the front image of the vehicle and output the captured front image as serial data. The camera 20 can also be installed in the vehicle in a manner that outputs the side image of the vehicle, the rear image of the vehicle, etc. in addition to the front image. The peripheral images such as the front image, the side image, and / or the rear image output from the camera 20 are input to the vehicle electronic control device 30.

[0044] The radar sensor 22 can be set as a millimeter wave sensor, for example, which is installed in front of the vehicle and has a transmitting unit that transmits millimeter waves toward the front range, front side range, etc. of the vehicle, a receiving unit that receives the millimeter waves reflected by the target object, and a detecting unit that detects the target object (stationary object or moving object) based on the transmitted and received millimeter waves. The receiving unit has a plurality of millimeter wave receiving antennas. The detecting unit detects the distance to the target object based on the transmission and reception time of the millimeter wave. Furthermore, the detecting unit detects the orientation of the target object relative to the vehicle based on the phase difference of the millimeter waves received in the plurality of receiving antennas. In this way, the radar sensor 22 generates detection information (peripheral information) of the target object around the vehicle including the distance to the target object (or the transmission and reception time of the millimeter wave), the orientation of the target object, etc., and outputs the generated peripheral information as serial data. In addition, the radar sensor 22 can also be set at multiple locations of the vehicle in a manner that detects the target object around the vehicle such as the side range, the rear side range, and / or the rear range in addition to the front range and the front side range of the vehicle. The surrounding information output by the radar sensor 22 is input to the vehicle electronic control device 30 .

[0045] The peripheral image from the camera 20 and the peripheral information from the radar sensor 22 input to the vehicle electronic control device 30 are serial-parallel converted by the deserializers 32 and 34, respectively. And the peripheral image data converted by the deserializer 32 and the peripheral information data converted by the deserializer 32 are respectively input in parallel to the main SoC 36 and the sub SoC 44. That is, the same input data is input to the main SoC 36 and the sub SoC 44.

[0046] In addition, as sensors, a surround camera, a laser radar sensor, a sonar sensor, etc. may be mounted on the vehicle in addition to or instead of the above-mentioned camera 20 and radar sensor 22. In addition, as a receiving interface from each sensor 20, 22, a communication interface of an in-vehicle network such as Ethernet (registered trademark) or CAN (registered trademark) may be used instead of the above-mentioned deserializer 32, 34 to send the detection data from each sensor 20, 22 to the main SoC 36 and the sub-SoC 44 via the in-vehicle network.

[0047] In addition, the vehicle electronic control device 30 can be configured to input a detection signal from a sensor (not shown) for detecting the state of the vehicle. The sensor for detecting the state of the vehicle can include, for example, a GNSS (Global Navigation Satellite System) sensor that can obtain location and time information, a vehicle speed sensor that detects the driving speed of the vehicle, a temperature sensor or a humidity sensor for determining weather information, and the like. Furthermore, the vehicle electronic control device 30 can also be equipped with a receiving device that can receive traffic information from an external traffic management center. The vehicle electronic control device 30 can obtain traffic environment data related to the traffic environment around the vehicle, such as whether the vehicle is in congestion, based on the received traffic information. In addition, the vehicle electronic control device 30 can also obtain weather information from an external server.

[0048] The main SoC 36 of the vehicle electronic control device 30 implements the main processing, for example, according to the main program stored in the ROM 40 by utilizing the temporary storage function of the RAM 42, thereby executing the desired function in the vehicle. In the present embodiment, as the desired function, for example, the main SoC 36 detects the object (stationary object or dynamic object) existing in front of the vehicle based on the input data from at least one sensor such as the camera 20 and the radar sensor 22, determines the possibility of collision with the detected object, and executes the anti-collision control function of outputting control instructions to various devices, equipment, and actuators according to the size of the determined collision possibility. In the anti-collision control function, the main SoC 36, for example, calculates the collision prediction time until the vehicle collides with the front object. When the calculated collision prediction time is lower than the first time threshold, the main SoC 36 regards that the collision possibility is increased, and outputs a control instruction to an output device not shown in the figure so that it uses sound and display to warn. Furthermore, when the calculated collision prediction time is lower than a second time threshold that is shorter than the first time threshold, the main SoC36 regards that the possibility of collision is further increased, and outputs a control instruction to the driving device of the vehicle to reduce the driving force, outputs a control instruction to the braking device of the vehicle to apply braking force, and / or outputs a control instruction to the steering device of the vehicle to avoid the object in front.

[0049] The sub-SoC44 of the vehicle electronic control device 30 also uses the temporary storage function of the RAM50 to implement, for example, sub-processing performed according to the sub-program stored in the ROM48. The sub-program is a program that can perform functions equivalent to those of the main program, and in order to improve performance, a part or all of the structure is different from the main program. On the other hand, although the sub-program is a program with improved performance than the main program, it is a program whose performance verification has not yet been completed. Therefore, the sub-SoC44 can also detect the object (stationary object or moving object) existing in front of the vehicle based on the input data from at least one sensor such as the camera 20 and the radar sensor 22, and determine the possibility of collision with the detected object by executing the sub-processing implemented according to the sub-program, like the main SoC36. However, since the verification of the performance of the sub-program is not completed, it is not constituted to actually execute, for example, the above-mentioned anti-collision control function. Therefore, the sub-program is not constituted to output control instructions to various devices, etc. through its execution.

[0050] In addition to executing the subroutine, the sub-SoC 44 also performs a storage process of storing a data set for evaluating the performance of the subroutine in the data storage memory 46 as a storage medium. The program for performing this storage process is also stored in the ROM 48. In addition, the storage process can also be configured as a part of the subroutine.

[0051] In the storage processing performed by the sub-SoC 44, the calculation result calculated by the main processing implemented in accordance with the main program is compared with the calculation result calculated by the sub-processing implemented in accordance with the sub-program. And, when the two calculation results meet the specified deviation condition, a data set representing the situation when the calculation result that deviated is obtained, which includes at least the input data and one of the two calculation results, is stored in the data storage memory 46. In this embodiment, the following situation is called shadow mode: the calculation processing for determining the possibility of collision with the detected object mark is performed by the sub-processing implemented in accordance with the sub-program, and when the calculation result of the sub-program deviates from the calculation result of the main program, the control of storing the data set representing the situation when the calculation result that deviated is obtained in the storage medium is performed.

[0052] The calculation results of the main process and the calculation results of the sub-process can use the same type of correlation index associated with the performance when executing the desired function. In the case of the above-mentioned anti-collision control function, for example, as the performance correlation index, the number of objects, the position of the object, and the collision prediction time from the object calculated in the main process and the sub-process can be used. And, when the result of comparing the number of objects, the position of the object, and the collision prediction time from the object in the main process and the sub-process is that any item exceeds the prescribed judgment standard and deviates, it can be determined that the above-mentioned prescribed deviation condition is satisfied. For example, with respect to the collision prediction time, when the time difference between the collision prediction times of the two parties exceeds the prescribed third time threshold, or with respect to the position of the object, when the difference between the positions of the two objects exceeds the prescribed distance threshold, it can be determined that the prescribed judgment standard is exceeded and the deviation has occurred. Furthermore, when the number of detected objects has a difference of more than the prescribed object number threshold, it can also be determined that the prescribed judgment standard is exceeded and the deviation has occurred.

[0053] The ROM48 of the sub-SoC44 also stores a backup program that has the same functions as the main program executed by the main SoC36 and performs backup processing (alternative processing). When the sub-SoC44 determines that there is a possibility of an abnormality in the main processing executed by the main SoC36 by comparing the performance-related indicators of the main processing with the performance-related indicators of the sub-processing, the sub-SoC44 switches the execution object program from the sub-program to the backup program and performs backup control. The backup program is a verified program like the main program of the main SoC36. The backup program can be the same as or different from the main program. In this embodiment, the state in which the main SoC36 has some abnormalities and the sub-SoC44 executes the backup program is called the backup mode.

[0054] In the standby control, first, the sub-SoC44 compares the performance-related index of the standby process implemented according to the switched standby program with the performance-related index of the standby process implemented according to the main program executed in the main SoC36, and further confirms whether the main process executed by the main SoC36 is abnormal. If it is also confirmed in the confirmation process that the main process executed by the main SoC36 is abnormal, the sub-SoC44 is determined to be the abnormal determination of the main SoC36. In this case, the sub-SoC44 continues to execute the standby process implemented according to the switched standby program, thereby replacing the main SoC36 and outputting control instructions to various devices. For example, usually, the control instruction from the main SoC36 is directly output, but in the case where the control instruction is output from both the main SoC36 and the sub-SoC44, the control instruction from the sub-SoC44 is output by setting a selection output circuit that selects the control instruction from the sub-SoC44 to output, thereby enabling the control instruction from the sub-SoC44 to be output. Alternatively, when the sub-SoC44 outputs the control instruction of the standby control, the main SoC36 is instructed to stop the output of the control instruction. As a result, various devices can be driven by the control instruction output from the sub-SoC44 during the standby control.

[0055] Figure 1 The data center 10 shown collects evaluation data (data set) of the subprograms stored in the vehicle electronic control device 30 of each vehicle. In addition, if the data center 10 fully verifies the subprogram on the data center side by the engineer who developed the system and the program based on the collected evaluation data, the verified subprogram is distributed to each vehicle as a new main program. In each vehicle, based on the fact that the new main program is received, the main program in the ROM 40 of the main SoC 36 is rewritten as the new main program. Furthermore, if the data center 10 prepares a different version of the subprogram that achieves improved performance based on the collected evaluation data, etc., the subprogram is distributed to each vehicle. In each vehicle, based on the fact that a different version of the subprogram is received, the subprogram in the ROM 48 of the sub SoC 44 is rewritten as the received different version of the subprogram.

[0056] The vehicle electronic control device 30 includes a communication device 38 for communicating with the data center 10. Figure 1 In the example shown, the communication device 38 is connected to the main SoC 36. Therefore, for example, when the evaluation data of the subprogram is sent to the data center 10, the main SoC 36 obtains the evaluation data from the subSoC 44 and sends it to the data center 10. In addition, when a subprogram of a different version that achieves improved performance is received by the communication device 38, the main SoC 36 hands over the received subprogram to the subSoC 44. In addition, it is also possible to configure the communication device 38 to be also provided in the subSoC 44 so that the subSoC 44 can communicate directly with the data center 10.

[0057] Next, refer to Figure 2 - Figure 5 and Figure 7 - Fig. 9 The flowcharts of FIG. 4 illustrate various processes executed in the main SoC 36 and the sub SoC 44 . Figure 2 2 is a flowchart showing the processing executed by the main SoC 36 including the main processing performed according to the main program.

[0058] In the first step S100, the main SoC 36 performs a self-test. In the self-test, the main SoC 36 checks, for example, whether the supplied operating voltage falls within a predetermined voltage range, whether the clock frequency that serves as the reference for the operation of the main SoC 36 oscillates stably, etc. If an abnormality is detected in the self-test, the possibility that the operation of the main SoC 36 becomes abnormal increases. Therefore, the main SoC 36 saves the result of the self-test and then provides the self-test result to the sub SoC 44 that performs the abnormality determination of the main SoC 36.

[0059] In step S110, the main SoC 36 receives the surrounding image from the camera 20. In step S120, the main SoC 36 performs image analysis processing on the received surrounding image to extract the object that may become an obstacle to the driving of the vehicle. At this time, if the surrounding image includes multiple object targets, the main SoC 36 extracts the multiple object targets respectively. Then, in step S130, the main SoC 36 calculates the relative speed of the object target based on the change in the position and size of the object target in the surrounding image.

[0060] In step S140, the main SoC 36 receives the surrounding information from the radar sensor 22. In step S150, the main SoC 36 extracts the target object based on the received surrounding information. For example, with respect to multiple reflectors, if the distances in the horizontal, vertical and depth directions are within a specified distance range, the multiple reflectors are integrated and extracted as one target object. In step S160, the main SoC 36 calculates, for example, the average distance or the minimum distance of the integrated multiple reflectors as the distance of the extracted target object.

[0061] In step S170, the main SoC36 compares the object extracted from the peripheral image from the camera 20 with the object extracted from the peripheral information from the radar sensor 22 based on the position and orientation of the object, and establishes correspondence between the same object. Then, in step S180, the main SoC36 uses the relative speed of the object calculated in step S130 and the distance of the object calculated in step S160 for each corresponding object, to calculate the time until the vehicle collides with the object, that is, the collision prediction time. In addition, the main SoC36 can calculate the distance to each object and the relative speed of each object based on the peripheral image from the camera 20 by using a stereo camera. In addition, the main SoC36 can also calculate the relative speed based on the change in the distance of the object calculated using the peripheral information from the laser radar sensor 22, and calculate the collision prediction time. This is also the same for the sub-SoC44 described later.

[0062] In step S190, the main SoC36 determines whether anti-collision control is needed based on the calculated collision prediction time. For example, when the calculated collision prediction time is lower than the first time threshold, the main SoC36 determines that anti-collision control is needed, and outputs a control instruction to an output device not shown in the figure in step S200 so that it uses sound and display to warn. Furthermore, when the calculated collision prediction time is lower than the second time threshold that is shorter than the first time threshold, the main SoC36 outputs a control instruction to the vehicle's drive device in step S200 as an anti-collision control to reduce the driving force, outputs a control instruction to the vehicle's braking device to apply braking force, and / or outputs a control instruction to the vehicle's steering device to avoid the object in front. In addition, when multiple object markers are detected, the main SoC36 can, for example, use the object marker with the shortest collision prediction time as the object to determine whether anti-collision control is needed.

[0063] In step S210, the main SoC 36 determines whether to terminate the desired function based on, for example, whether the main switch of the vehicle is turned off and whether the vehicle is parked. If it is determined that the function is to be terminated, the main SoC 36 terminates the function. Figure 2 On the other hand, when it is determined that the function is not to be terminated, the main SoC 36 repeatedly performs the processing from step S100.

[0064] In the above Figure 2 In the flowchart of FIG. 1 , at least the processing of steps S110 to S200 corresponds to the main processing performed according to the main program.

[0065] Next, Figure 3 The flowchart is described below. Figure 3 It means Figure 2 The processing shown in the flowchart is a flowchart of the processing executed by the main SoC 36 in parallel.

[0066] As described later, the sub-SoC 44 inquires various information from the main SoC 36 in order to perform processing for storing evaluation data for evaluating the subroutine and determining abnormal processing based on the main process executed by the main SoC 36. The types of inquiries from the sub-SoC 44 will be described in detail later. The main SoC 36 determines whether there is an inquiry from the sub-SoC 44 in step S300. If it is determined that there is an inquiry, the main SoC 36 replies to the sub-SoC 44 with information corresponding to the inquiry in step S310.

[0067] Next, Figure 4 and Figure 5 The flowchart is described below. Figure 4 and Figure 5 It is a flowchart showing the processing executed by the sub-SoC 44 including the sub-processing performed according to the sub-routine.

[0068] In the initial step S400, the sub-SoC 44 performs a self-test. The content of the self-test is the same as the self-test of the main SoC 36. In step S410, the sub-SoC 44 determines whether the self-test result of step S400 is OK (good) and whether it is in a state where it can function normally. If the self-test result is OK, the sub-SoC 44 proceeds to step S420. On the other hand, if the self-test result is not OK, the sub-SoC 44 returns to step S400.

[0069] In step S420, the sub-SoC 44 inquires the main SoC 36 about the result of the self-test. And, the sub-SoC 44 receives the self-test result as a reply to its inquiry. The received self-test result is temporarily stored in the RAM 50. In step S430, the sub-SoC 44 determines whether the self-test result of the main SoC 36 is OK. In the case where the self-test result of the main SoC 36 is OK, the sub-SoC 44 proceeds to steps S440 and S470. On the other hand, in the case where the self-test result of the main SoC 36 is not OK, the sub-SoC 44 proceeds to step S560.

[0070] The processing in steps S440 to S460 is the processing in which the sub-SoC 44 extracts the object from the peripheral image from the camera 20 and calculates the relative speed of the object, which is basically the same as the processing in steps S110 to S130 performed by the main SoC 36. In addition, the processing in steps S470 to S490 is the processing in which the sub-SoC 44 extracts the object from the peripheral information from the radar sensor 22 and calculates the distance of the object, which is basically the same as the processing in steps S140 to S160 performed by the main SoC 36. However, a subroutine is a program that can perform functions equivalent to those of a main program and has a part or all of a different structure from the main program for performance improvement, and does not necessarily perform all the same operations as the main program.

[0071] In step S500, the sub-SoC 44 compares the object extracted from the surrounding image from the camera 20 with the object extracted from the surrounding information from the radar sensor 22, and establishes correspondence between the same object. Then, in step S510, the sub-SoC 44 calculates the time until the vehicle collides with the object using the relative speed of the object calculated in step S460 and the distance of the object calculated in step S490 for each corresponding object. The comparison result and the collision prediction time obtained by the sub-SoC 44 are temporarily stored in the RAM 50.

[0072] In step S520, the sub-SoC 44 inquires the main SoC 36 about the comparison result and collision prediction time of the object as the calculation result (performance-related index) of the main SoC 36. And, the sub-SoC 44 receives the comparison result and collision prediction time as a response to its inquiry. The received comparison result and collision prediction time are temporarily stored in the RAM 50. In step S530, the sub-SoC 44 compares the comparison result and collision prediction time received from the main SoC 36 with the comparison result and collision prediction time calculated by the sub-SoC 44, and determines whether the comparison results and collision prediction times of the two parties deviate.

[0073] For example, when the number of object marks in the comparison results of the two parties does not differ, the positions of the object marks in the comparison results of the two parties do not differ by more than a predetermined distance threshold, and the collision prediction time for the object mark closest to the vehicle does not differ by more than a predetermined third time threshold, the sub-SoC44 can determine that the comparison results and the collision prediction time of the two parties do not diverge. In this case, the determination result in step S540 becomes "no", and the sub-SoC44 proceeds to step S565.

[0074] On the other hand, for example, if there is a difference in the number of object marks in the comparison results of the two parties, the positions of the object marks in the comparison results of the two parties differ by more than a predetermined distance threshold, or the collision prediction time for the object mark closest to the vehicle differs by more than a predetermined third time threshold, it can be determined that the comparison results and the collision prediction time of the two parties diverge. In this case, the determination result in step S540 becomes "yes", and the sub-SoC44 enters step S550.

[0075] In step S550, since the two operation results (performance-related indexes) of the main SoC36 and the sub-SoC44 satisfy the prescribed deviation conditions, the sub-SoC44 stores a data set containing at least the input data and one of the two operation results, which indicates the situation when the operation result in which the deviation occurs, in the data storage memory 46. In addition, the input data and the two operation results are temporarily stored in the RAM50. The sub-SoC44 reads the corresponding data from the RAM50 and stores it in the data storage memory 46. Thus, the evaluator of the program can grasp the situation when the deviation occurs based on the stored data set. Therefore, the evaluator of the program (the engineer on the data center side) can confirm whether the performance improvement of the sub-program is as expected, or whether the performance of the sub-program is not worse than the performance of the main program or under what circumstances it occurs if it is worse than the performance of the main program. In addition, the data set stored in the data storage memory 46 preferably includes the deviation amount of the performance-related indexes of the main SoC36 and the sub-SoC44. Thus, it is easy to grasp the degree of deviation.

[0076] Here, it is preferred that the data set at least includes input data and one of the two operation results spanning a prescribed period before and after the divergent operation result is obtained. This is because it is possible to more accurately grasp under what circumstances the operation result diverges based on the data set. In this case, the input data and at least one of the two operation results are repeatedly stored in the RAM 50. And when it is determined that the operation result diverges, the input data and / or the two operation results of the prescribed period before and after are read from the RAM 50 and stored in the data storage memory 46.

[0077] In addition, the data set preferably includes at least one of the main program version, the subroutine version, traffic environment data related to the traffic environment around the vehicle (e.g., congested, unobstructed, etc.), driving state data related to the driving state of the vehicle (speed, whether turning or going straight, etc.), weather data related to weather (sunny, rainy, snowy, foggy, etc.), and time data related to time. Based on the above-mentioned additional data, the program evaluator can more accurately grasp the main program and subroutine versions used when obtaining the divergent calculation results, and the status of the vehicle when the divergent calculation results were obtained. Furthermore, by including the above-mentioned additional data in the data set, when evaluation data under specific conditions is required, for example, it is possible to easily distinguish between the required data and the unnecessary data and collect the required data.

[0078] Furthermore, the sub-SoC 44 may also limit the number of stored data sets to a specified number in consideration of the storage capacity of the memory 46 for data storage. At this time, it is preferred that the sub-SoC 44 selects data sets in descending order of the degree of deviation between the calculation results of the main SoC 36 and the sub-SoC 44, and stores the selected data sets. This is because the greater the degree of deviation of the calculation results, the higher the importance of the evaluation data as a subroutine. In addition, after the number of stored data sets reaches the limited number, if a calculation result with a greater degree of deviation than the stored data set is obtained, it is better to use the current data set to overwrite the stored data set.

[0079] In addition, when storing the data set in the data storage memory 46, the sub-SoC 44 may also store the data set in the case where the performance of the sub-processing result when executing the desired function is better than the performance of the main processing result when executing the main program, and the data set in the case where the performance of the sub-processing result when executing the desired function is worse than the performance of the main processing result when executing the desired function, respectively, in the data storage memory 46. Thus, the performance of the sub-program can be evaluated from two aspects of performance improvement and performance degradation relative to the main program based on the stored data set. In this case, as described above, when the number of stored data sets is limited to a specified number, restrictions can be set independently for the data set in the case where the performance of the sub-processing result when executing the desired function is better than the performance of the main processing result, and the data set in the case where the performance of the sub-processing result when executing the desired function is worse than the performance of the main processing result.

[0080] exist Figure 4 In step S560 of the flowchart of FIG. 4 , the sub-SoC 44 determines whether there is a possibility that an abnormality has occurred in the main process of the main SoC 36 based on the determination result of the self-test of the main SoC 36 in step S430, the comparison result of the main SoC 36 and the sub-SoC 44 in step S530, and the comparison result of the collision prediction time. For example, when it is determined in step S430 that the self-test result of the main SoC 36 is not OK, the sub-SoC 44 can determine that there is a possibility that an abnormality has occurred in the main process of the main SoC 36.

[0081] In addition, when the result of comparing the comparison result and the collision prediction time between the main SoC 36 and the sub-SoC 44 is, for example, when the object is detected in the sub-SoC 44 but not in the main SoC 36, the sub-SoC 44 can determine that there is a possibility that an abnormality has occurred in the main process of the main SoC 36. In addition, when the object that becomes the object of calculating the collision prediction time is not detected in the main SoC 36 at the time point when the collision prediction time calculated by the sub-SoC 44 reaches the fourth time threshold, the sub-SoC 44 can determine that there is a possibility that an abnormality has occurred in the main process of the main SoC 36. Furthermore, when the collision prediction time calculated by the main SoC 36 is delayed by more than the third time threshold compared with the collision prediction time calculated by the sub-SoC 44, the sub-SoC 44 can also determine that there is a possibility that an abnormality has occurred in the main process of the main SoC 36.

[0082] Reference Figure 6 The abnormality determination of the main processing of the main SoC 36 described above will be described from another perspective. Figure 6 In the table, a circle mark is added when an object is extracted from the peripheral image from the camera 20 and when an object is extracted from the peripheral information from the radar sensor 22, and a cross mark is added when an object is not extracted. For example, in scenario 1, an object is extracted from the peripheral image from the camera 20 and the peripheral information from the radar sensor 22 in the main process and the sub-process, respectively. In this case, if the number, position, and collision prediction time of the object do not differ to the extent that the main SoC 36 is judged to be abnormal, the sub-SoC 44 executes the shadow mode, and if there is a difference to the extent that the main SoC 36 is judged to be abnormal, the backup mode is executed.

[0083] In the case of scenes 2 to 4, 8, and 12, there is a defect in the detection of the target object by the camera 20 and / or the radar sensor 22 in the sub-processing, while in the main processing, the target object is detected normally by the camera 20 and / or the radar sensor 22 compared to the sub-processing. In this case, it is considered that the main processing by the main SoC 36 is executed normally, so the sub-SoC 44 executes the shadow mode.

[0084] On the other hand, in the case of scenes 5, 9, 13, 14, and 15, the detection of the target object by the camera 20 and / or the radar sensor 22 in the sub-process is normal, while in the main process, the detection of the target object by the camera 20 and / or the radar sensor 22 is defective compared to the sub-process. In this case, since there is a possibility that an abnormality has occurred in the main process performed by the main SoC 36, the sub-SoC 44 executes the backup mode.

[0085] In the case of scenes 6, 7, 10, and 11, both the sub-processing and the main processing have defects in the detection of the target object by the camera 20 or the radar sensor 22. Therefore, in this case, as described above, it is determined whether there is a possibility that an abnormality has occurred in the main processing by the main SoC 36 based on the number, position, and collision prediction time of the target object, and one of the shadow mode and the backup mode is executed according to the determination result.

[0086] In scenario 16, it is impossible to determine whether or not there is a possibility that an abnormality has occurred in the main processing performed by the main SoC 36. Therefore, the sub SoC 44 executes the shadow mode.

[0087] Thus, in the present embodiment, when the calculation result (performance-related index) of the main process is degraded beyond the above-mentioned abnormality determination criterion in terms of executing the expected function relative to the calculation result (performance-related index) of the sub-process, the sub-SoC 44 determines that there is a possibility that an abnormality of the main process (or an abnormality of the main SoC 36) has occurred. Therefore, according to the electronic control device and method for a vehicle of the present embodiment, it is possible to detect an abnormality of the main process implemented by the main program that actually performs control by using a sub-program.

[0088] If the sub-SoC 44 determines in step S560 that there is a possibility that an abnormality has occurred in the main processing of the main SoC 36, it enters step S560. Figure 5 On the other hand, if the sub-SoC 44 determines that there is no possibility of an abnormality occurring in the main processing of the main SoC 36, it proceeds to step S565. In step S565, the sub-SoC 44 determines whether to terminate the desired function (i.e., the anti-collision control function). If it is determined that the function is terminated, the sub-SoC 44 terminates. Figure 4 On the other hand, if it is determined that the function is not to be terminated, the sub-SoC 44 returns to step S400.

[0089] In step S570, the data and calculation results stored in RAM 50 during the sub-processing performed according to the sub-routine are discarded. In step S580, the sub-SoC 44 switches the execution target program from the sub-routine (or the abnormality determination process of the main program) to the standby program. Figure 4 In the flowchart of, at least the processing of steps S440 to S510 is equivalent to the subprocessing performed according to the subroutine. In addition, the processing of steps S530 to S550 is equivalent to the storage processing of storing the data set used to evaluate the performance of the subroutine. Furthermore, the processing of steps S560 and S570 is equivalent to the abnormality determination processing of the main program. The storage processing and the abnormality determination processing can also be constituted as part of the subroutine.

[0090] In step S590, the sub-SoC 44 uses the switched backup program to calculate the collision prediction time until the collision with the target object. In addition, at this time, the sub-SoC 44 calculates the collision prediction time until the collision with the target object by executing the switched backup program, thereby performing at least the calculation processing of the above-mentioned steps S110 to S170.

[0091] In step S600, the sub-SoC 44 inquires the main SoC 36 about the collision prediction time. And, the sub-SoC 44 receives the collision prediction time as a reply to its inquiry. And, in step S610, the sub-SoC 44 compares the collision prediction time received from the main SoC 36 with the collision prediction time calculated by the sub-SoC 44 to determine whether the main SoC 36 has an abnormality. In addition, the sub-SoC 44 may inquire not only about the collision prediction time but also about the comparison result from the main SoC 36 in step S600, and in step S610, determine whether the main SoC 36 has an abnormality based on the comparison result and the comparison result of the collision prediction time.

[0092] The result of the comparison process in step S610 is that, for example, when the collision prediction time calculated by the sub-SoC 44 reaches the fourth time threshold, the main SoC 36 does not detect the target object for calculating the collision prediction time, or the collision prediction time calculated by the main SoC 36 is delayed by more than the third time threshold compared with the collision prediction time calculated by the sub-SoC 44, the sub-SoC 44 determines that an abnormality has occurred in the main process of the main SoC 36. Furthermore, when the result of the self-check of the main SoC 36 is NG, the sub-SoC 44 also determines that an abnormality has occurred in the main process of the main SoC 36. When such a determination is made, in step S620, the sub-SoC 44 determines that the abnormality of the main SoC 36 has been confirmed, and proceeds to step S630. On the other hand, when the sub-SoC 44 determines in step S610 that there is no abnormality in the main process of the main SoC 36 and when the result of the self-check of the main SoC 36 is OK, it proceeds to step S650.

[0093] In step S630, the sub-SoC 44 continues to execute the switched standby program, thereby outputting control instructions from the sub-SoC 44 as needed. Then, in step S640, the sub-SoC 44 determines whether to terminate the desired function (i.e., the anti-collision control function). If it is determined to terminate the function, the sub-SoC 44 terminates. Figure 4 and Figure 5On the other hand, when it is determined that the function is not terminated, the sub-SoC 44 repeatedly performs the processing from step S590. At this time, it can also be configured so that once the sub-SoC 44 determines that the abnormality of the main SoC 36 has been confirmed, the sub-SoC 44 outputs the control instruction in step S630 regardless of the processing results of steps S600 to S620. Or it can be configured so that after the sub-SoC 44 determines that the abnormality of the main SoC 36 has been confirmed, the processing of steps S600 to S620 is skipped.

[0094] In step S650, which is executed when it is determined in step S620 that the main SoC 36 is normal, the sub SoC 44 also determines whether to terminate the desired function. If it is determined that the function is terminated, the sub SoC 44 terminates. Figure 4 and Figure 5 On the other hand, if it is determined that the function is not to be terminated, the sub-SoC 44 proceeds to step S660. In step S660, after switching to the standby program, the data and calculation results stored in the RAM 50 are discarded. Then, in step S670, the sub-SoC 44 switches the execution target program from the standby program to the sub-program. After that, the sub-SoC 44 returns to Figure 4 4. The flowchart of step S400 is shown in FIG.

[0095] Next, Figure 7 The flowchart is described below. Figure 7 2 is a flowchart showing the processing executed by the data center 10 .

[0096] In the first step S700, the data center 10 prepares a subprogram of a different version that achieves improved performance based on the collected evaluation data, etc., and distributes the prepared subprogram to the target vehicle. The target vehicle is a vehicle that uses the corresponding subprogram. For example, the data center 10 assigns a vehicle ID to each vehicle and manages the type of program used in each vehicle on a database.

[0097] In step S710, the data center 10 inquires the evaluation data (data set) of the subprogram from the target vehicle in which the subprogram to be evaluated is installed in the subSoC44. In response to the inquiry, each target vehicle replies with a summary of the stored evaluation data as described later, i.e., the comparison results of performance-related indicators, the size of the deviation (i.e., the deviation amount), the versions of the main program and the subprogram, and / or the accompanying data indicating the situation when the deviation occurred. In this way, each target vehicle does not suddenly send input data such as camera images, but sends a summary of the evaluation data, which can suppress the increase in communication load, and at the same time, as described later, the data center 10 can implement screening of collected data. In addition, the summary of the evaluation data is also included in the evaluation data.

[0098] In step S720, the data center 10 determines whether the evaluation data is needed based on the summary of the evaluation data returned from each target vehicle. For example, if the evaluation data under similar conditions has been sufficiently collected, the data center 10 determines the corresponding evaluation data as "not needed". On the contrary, if the evaluation data under similar conditions has not been sufficiently collected, the data center 10 determines the corresponding evaluation data as "needed". In addition, the data center 10 may also determine whether the evaluation data is needed based on the size of the deviation of the performance-related index. For example, the data center 10 may also determine that the evaluation data with a deviation size of more than a prescribed size is "needed", and the evaluation data with a deviation size less than a prescribed size is "unnecessary". Alternatively, the data center 10 may also determine that the evaluation data with a deviation size of the same size or more is "needed", and the evaluation data with a deviation size less than the same size is "unnecessary" relative to the smallest deviation size among the evaluation data that has been collected. In the case where the evaluation data is determined to be "needed", the data center 10 proceeds to step S730. On the other hand, when the evaluation data is determined to be “unnecessary”, the data center 10 proceeds to step S750 .

[0099] In step S730, the data center 10 instructs the target vehicle whose evaluation data is determined to be "necessary" to send all the evaluation data including the input data such as the camera image. Then, in step S740, all the evaluation data is received from each target vehicle and all the received evaluation data is stored in the database. On the other hand, in step S750, the data center 10 instructs the target vehicle whose evaluation data is determined to be "unnecessary" to discard the evaluation data.

[0100] Then, the data center 10 determines in step S760 whether the required amount of evaluation data has been collected or whether the evaluation data has been collected from all the target vehicles. In this determination, if it is determined that the required amount of evaluation data has been collected or the evaluation data has been collected from all the target vehicles, the data center 10 ends the process. Figure 7 On the other hand, if it is determined that the required amount of evaluation data has not been collected or the evaluation data has not been collected from all the target vehicles, the data center 10 returns to step S710.

[0101] Next, Figure 8 The flowchart is described below. Figure 8 : is a flowchart showing other processing executed by the data center 10 .

[0102] If the performance of the subprogram is verified based on sufficient evaluation data, the subprogram is distributed to each target vehicle as an updated main program for updating the existing main program. Figure 8 In the first step S800, the data center 10 distributes the updated main program to the target vehicle. Then, in step S810, the updated information is stored by writing the distributed main program version on the database.

[0103] Next, Fig. 9 The flowchart is described below. Fig. 9 This is a flowchart showing processing executed by the vehicle electronic control device 30 of the target vehicle for communication with the data center 10 and updating of the main program and the sub-program.

[0104] In the first step S900, the vehicle electronic control device 30 determines whether an updated main program has been distributed from the data center 10. If an updated main program has been distributed, the vehicle electronic control device 30 receives the updated main program in step S910. Then, the vehicle electronic control device 30 writes the received updated main program over the existing main program in the main program write ROM 40. In this way, the vehicle electronic control device 30 rewrites the main program write ROM 40.

[0105] In step S920, the vehicle electronic control device 30 determines whether a subprogram of a different version that achieves improved performance based on the collected evaluation data or the like is distributed from the data center 10. If a subprogram of a different version that achieves improved performance is distributed, the vehicle electronic control device 30 receives the subprogram of the different version in step S930. The vehicle electronic control device 30 then overwrites the existing subprogram in the subprogram write ROM 48 with the received subprogram of the different version. In this way, the vehicle electronic control device 30 rewrites the subprogram write ROM 48.

[0106] In step S940, the vehicle electronic control device 30 determines whether the inquiry for evaluation data of the subroutine is received from the data center 10. If it is determined that the inquiry for evaluation data is received, the vehicle electronic control device 30 transmits the summary of the stored evaluation data (data stored in the data storage memory 46) in step S950. However, if no evaluation data is stored, the vehicle electronic control device 30 replies to the data center 10 that no evaluation data is stored.

[0107] In step S960, the vehicle electronic control device 30 determines whether it has received a transmission instruction of the evaluation data of the subroutine or an instruction to discard the evaluation data from the data center 10. When receiving the transmission instruction, the vehicle electronic control device 30 transmits the stored evaluation data to the data center 10 in step S970. On the other hand, when receiving the instruction to discard the evaluation data, the vehicle electronic control device 30 discards the stored evaluation data in step S980.

[0108] As described above, according to the electronic control device 30 for a vehicle of the present embodiment, when the operation results of a different version of a program, i.e., a subroutine, which achieves improved performance for a desired function, and a current version of a program, i.e., a main program, which executes the desired function, diverge, a data set representing the current situation is stored in a storage medium. The stored data set includes at least input data and one of the two operation results. Therefore, according to the electronic control device 30 for a vehicle of the present embodiment, a data set important for evaluating a subroutine can be efficiently stored in a storage medium and data can be efficiently collected by the data center 10.

[0109] (Second Embodiment)

[0110] Next, a vehicle electronic control device 30 according to a second embodiment of the present disclosure will be described. The vehicle electronic control device 30 according to this embodiment can be configured similarly to the vehicle electronic control device 30 according to the first embodiment. Therefore, descriptions related to the configuration will be omitted.

[0111] When the calculation result of the main process performed according to the main routine and the calculation result of the sub process performed according to the sub routine diverge, the vehicle electronic control device 30 of the first embodiment stores a data set indicating the situation when the divergent calculation result was obtained in the storage medium.

[0112] In contrast, when the calculation result of the main process performed according to the main program and the calculation result of the sub-process performed according to the sub-program diverge, the vehicle electronic control device 30 of the present embodiment does not directly store the data set indicating the situation when the divergent calculation result is obtained, but inquires the data center 10 whether it is necessary to store the data set. And, when the data center 10 answers that the data set needs to be stored, the corresponding data set is stored in the storage medium. In this way, it is possible to avoid the storage of unnecessary data sets and efficiently use the storage capacity of the storage medium.

[0113] Fig.10 1 is a flowchart showing a storage process executed by the vehicle electronic control device 30 (sub SoC 44 ) according to the present embodiment. Fig.10 The flowchart shown is relative to Figure 4 The flowchart of FIG. 5 adds the processing of steps S542 and S544. The other steps are Figure 4 Flowchart and Fig.10 The same is true in the flowchart.

[0114] If it is determined in step S540 that the two calculation results diverge, the sub-SoC 44 proceeds to step S542. In step S542, the sub-SoC 44 sends information related to the data set (for example, information equivalent to the summary of the above-mentioned evaluation data) to the data center 10, asking the data center 10 whether it is necessary to store the data set. In step S544, when the sub-SoC 44 determines that the data set needs to be stored based on the reply content from the data center 10, it proceeds to step S550. In step S550, the sub-SoC 44 stores the data set in the storage medium. On the other hand, in the case of receiving an answer from the data center 10 that the data set does not need to be stored, the sub-SoC 44 does not store the data set and proceeds to step S565.

[0115] The above example is an example of inquiring the data center 10 whether to store a data set from the vehicle electronic control device 30. However, the vehicle electronic control device 30 may obtain sorting information for sorting the data sets to be stored from the data center 10 in advance, and store only the data sets that match the sorting information in the storage medium.

[0116] Fig.11 The present invention is a flowchart of a storage process including storing only data sets that match the picking information. Fig.11 The flowchart shown is relative to Figure 4 The flowchart of FIG. 1 adds the processing of steps S543 and S546. The other steps are Figure 4 Flowchart and Fig.11 The same is true in the flowchart.

[0117] If it is determined in step S540 that the two calculation results diverge, the sub-SoC 44 proceeds to step S543. In step S543, the sub-SoC 44 determines whether the data set matches the previously acquired sorting information. And, if it matches the sorting information, the determination result in step S546 becomes "yes", and in step S550, the sub-SoC 44 stores the data set in the storage medium. On the other hand, if the data set does not match the sorting information, the determination result in step S546 becomes "no", and the sub-SoC 44 does not store the data set and proceeds to step S565.

[0118] As mentioned above, although the preferred embodiment of the present disclosure has been described, the present disclosure is not limited to the above-mentioned embodiment at all, and can be implemented with various modifications within the scope not departing from the gist of the present disclosure.

[0119] For example, in each of the above-mentioned embodiments, the vehicle electronic control device 30 performs an anti-collision control function as an example of a desired function. However, the function performed by the vehicle electronic control device 30 is not limited to the anti-collision control function. For example, the vehicle electronic control device 30 may also perform the following functions as desired functions: a rear crossing traffic warning function that detects a moving object approaching from a blind spot when the vehicle is backing up and issues a warning, automatically applying the brakes; an adaptive cruise control function that detects a vehicle in front and follows the vehicle while maintaining a distance between the vehicles; a traffic sign recognition function that recognizes various traffic signs on the road and communicates them to the driver; a lane departure prevention function that detects white lines on the road and assists driving in the lane; and a blind spot monitoring function that detects vehicles approaching from the side and rear and notifies the driver.

[0120] Furthermore, for example, when the rear crossing traffic warning function, the blind spot monitoring function, the adaptive cruise control function, etc. detect other vehicles or other objects, the deviation of the calculation results can also be determined based on the detectable distance. In addition, for the traffic sign recognition function, the deviation of the calculation results can also be determined based on the identifiable distance and recognition rate of the traffic sign. For the lane departure prevention function, the deviation of the calculation results can also be determined based on the recognition rate of the white line, the vehicle position within the white line (the closer to the center, the higher the performance).

[0121] In each of the above-mentioned embodiments, input data such as the surrounding image from the camera 20 and the surrounding information from the radar sensor 22 are input in parallel from the deserializers 32 and 34 to the main SoC 36 and the sub-SoC 44. However, it is also possible to configure the input data to be once input to the main SoC 36 and then sent from the main SoC 36 to the sub-SoC 44 via the communication interface.

[0122] In addition, the control device described in the present disclosure and the method executed in the control device can be implemented by a special-purpose computer, which is a processor programmed to execute one or more functions embodied by a computer program. Alternatively, the control device described in the present disclosure and the method executed in the control device can also be implemented by one or more special-purpose computers composed of a combination of a processor executing a computer program and one or more hardware logic circuits.

Claims

1. A vehicle electronic control device, mounted on a vehicle and used to perform a desired function in the vehicle, characterized in that: have: a main processing unit that executes a main process implemented according to a main program based on input data from at least one sensor; a sub-processing unit that performs sub-processing according to a subroutine based on the same input data as the main processing unit; as well as an abnormality determination unit that compares a calculation result of the main processing in the main processing unit with a calculation result of the sub-processing in the sub-processing unit, and determines an abnormality in the main processing unit based on a result of the comparison, The desired function is executed by the main processing performed by the main processing unit according to the main program. The subroutine is a program that can execute functions equivalent to those of the main program and has a partially or entirely different configuration from that of the main program for performance improvement.

2. The vehicle electronic control device according to claim 1, characterized in that: The calculation result of the main process and the calculation result of the sub-process are the same type of performance-related indicators related to the performance when executing the desired function, The abnormality determination unit determines that the main processing unit is abnormal when the performance-related index of the main processing deteriorates beyond an abnormality determination criterion in terms of execution of the desired function relative to the performance-related index of the sub-process.

3. The vehicle electronic control device according to claim 1 or 2, characterized in that: The main processing unit has a verified program for executing an alternative process to the main process, The sub-processing unit switches the execution target program from the sub-program to the verified program for executing the alternative process in response to the abnormality determination unit determining that the main processing unit is abnormal.

4. The vehicle electronic control device according to claim 3, characterized in that: After switching to a verified program for executing the alternative processing, the sub-processing unit compares the calculation result of the alternative processing with the calculation result of the main processing in the main processing unit, and determines an abnormality in the main processing unit based on the comparison result.

5. The vehicle electronic control device according to claim 3, characterized in that: The sub-processing section executes the desired function by the alternative processing of the switched verified program instead of the main processing of the main processing section.

6. The vehicle electronic control device according to claim 3, characterized in that: further comprising an abnormality detection unit for detecting an abnormality in the sub-processing unit, When an abnormality in the sub-processing section is detected by the abnormality detection unit, the sub-processing section does not switch the execution target program.

7. The vehicle electronic control device according to claim 3, characterized in that: The sub-processing unit includes a data storage unit for temporarily storing data during execution of the sub-processing performed according to the sub-program. The sub-processing unit discards the data stored in the data storage unit in response to the execution target program being switched from the sub-program to a verified program for executing the alternative process.

8. A method for determining an abnormality of a main process performed according to a main program, executed by at least one processor in a vehicle electronic control device, the vehicle electronic control device being mounted on a vehicle and used to execute a desired function in the vehicle, the method comprising: executing a main process implemented according to a main program based on input data from at least one sensor; executing a sub-process implemented according to a sub-routine based on the same input data as the main process; as well as Comparing the calculation result of the main process with the calculation result of the sub-process, and determining the abnormality of the main process based on the comparison result, The desired function is executed by the main process implemented according to the main program, The subroutine is a program that can execute functions equivalent to those of the main program and has a partially or entirely different configuration from that of the main program for performance improvement.

Images