Software verification system and vehicle control device

Abstract

Provided are a software verification system and the like that can easily improve software using sensor data of a vehicle as an input. The software verification system uses the first information, the second information, and the third information to detect degradation of the control software of a new version (performance determination unit 118), and verifies the control software of the new version using the sensor data when the degradation is detected. The first information is an output of a current version of control software used for controlling the vehicle when sensor data from a sensor mounted on the vehicle is input, and the second information is an output of a new version of control software not used for controlling the vehicle when the sensor data is input. The third information is information pertaining to control of the vehicle other than the first information and the second information.

Description

Technical Field

[0001] The invention relates to a software verification system and a vehicle control device. Background Art

[0002] Non-patent document 1 introduces various methods as software safety assessment methods. Among them, the assessment method based on Shadow Mode uses external environment information to run and evaluate the software in the background in an actual vehicle, so it is expected to ensure safety and high-precision assessment.

[0003] Patent document 1 proposes a technique of running old version software and new version software concurrently or in parallel and outputting inconsistent information when comparing output results. The actual vehicle not only uses data sensed in the actual environment as input information, but also can perform verification on multiple vehicles at the same time, which is effective from the perspective of verification system and efficiency.

[0004] Prior art literature

[0005] Non-patent literature

[0006] Non-patent literature 1: S Riedmaier.et.al., “Survey on Scenario-Based Safety Assessment of Automated Vehicles,” in IEEE Access, 2020.

[0007] Patent Literature

[0008] Patent Document 1: Japanese Patent Application Publication No. 2022-13187 Summary of the invention

[0009] In the Shadow Mode technology of non-patent document 1, the new software of the object is run and verified in the background different from the old software in the actual vehicle. As a result, it is possible to obtain data using the actual vehicle and obtain the results of the software of the object running in the background. However, there is a problem that it takes a lot of time to evaluate all the operation results. Therefore, a method for evaluating the operation results of the old software and the new software is desired.

[0010] In patent document 1, the old and new versions of software are run concurrently (running on one CPU) or concurrently (running on multiple CPUs) using the (verification scenario) obtained during vehicle driving. In this way, software verification can be performed in a limited manner. However, there is a problem that it is difficult for the system to make a performance judgment (improvement or decline) of the new software on the vehicle based on the difference in the running results of the old software and the new software, and it takes a lot of work time for people to make performance judgments. In addition, when the old software and the new software both produce the same output and the output result is an erroneous output, it is impossible to have a difference in the running results, and thus it is difficult to evaluate. Therefore, there is a problem that the system on the vehicle makes a performance judgment based on the difference in the running results of the old software and the new software, and also makes a judgment when both the old software and the new software have inappropriate outputs.

[0011] An object of the present invention is to provide a software verification system or the like that can easily improve software that uses vehicle sensor data as input.

[0012] In order to achieve the above-mentioned purpose, in a software verification system of an example of the present invention, first information, second information and third information are used to detect degradation of a new version of control software, wherein the first information is the output of the current version of the control software used for controlling the vehicle when sensor data from a sensor mounted on the vehicle is used as input, the second information is the output of the new version of the control software that is not used for controlling the vehicle when the sensor data is used as input, and the third information is information related to the control of the vehicle other than the first information and the second information; and the new version of the control software is verified using the sensor data when the degradation is detected.

[0013] Effects of the Invention

[0014] According to the present invention, it is possible to easily improve software that uses sensor data of a vehicle as an input. Other problems, configurations, and effects than those described above will become apparent from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a diagram showing the overall configuration of a vehicle control device in a first embodiment of the present invention.

[0016] Figure 2 The diagram shows a connection relationship between control devices connected to the vehicle control device in the first embodiment of the present invention via a network.

[0017] Figure 3 1 is a flowchart showing an example of a processing procedure of the radar sensor information acquisition unit in the first embodiment of the present invention.

[0018] Figure 4 It is a diagram showing an example of radar sensor information in the first embodiment of the present invention.

[0019] Figure 5 This is a flowchart showing an example of the processing procedure of the camera sensor information acquisition unit in the first embodiment of the present invention.

[0020] Figure 6 This is a diagram showing an example of camera sensor information in the first embodiment of the present invention.

[0021] Figure 7 This is a flowchart showing an example of a processing procedure of an object detection unit using a radar sensor in the first embodiment of the present invention.

[0022] Figure 8 FIG. 1 is a diagram showing an example of an object detection result using a radar sensor in the first embodiment of the present invention.

[0023] Fig. 9 This is a diagram showing an example of an accident avoidance necessity flag based on an object detection result by a radar sensor in the first embodiment of the present invention.

[0024] Fig.10 This is a flowchart showing an example of the processing procedure of the object detection unit of the software of Ver. N using the camera sensor in the first embodiment of the present invention.

[0025] Fig.11 This is a diagram showing an example of object detection results using software Ver. N of the camera sensor in the first embodiment of the present invention.

[0026] Fig.12 This is a diagram showing an example of an accident avoidance necessity flag based on an object detection result using software of Ver. N of a camera sensor in the first embodiment of the present invention.

[0027] Fig.13 This is a flowchart showing an example of the processing procedure of the object detection unit using the software of Ver. N+1 of the camera sensor in the first embodiment of the present invention.

[0028] Fig.14 This is a diagram showing an example of object detection results using software Ver. N+1 of the camera sensor in the first embodiment of the present invention.

[0029] Fig.15 This is a diagram showing an example of an accident avoidance necessity flag based on an object detection result using software Ver. N+1 of a camera sensor in the first embodiment of the present invention.

[0030] Fig.16This is a flowchart showing an example of a processing procedure for transmitting the execution results of each software to a server in the first embodiment of the present invention.

[0031] Fig.17 It is a diagram showing the system configuration of a server in the first embodiment of the present invention.

[0032] Fig.18 This is a flowchart showing an example of the processing procedure of the server receiving unit in the first embodiment of the present invention.

[0033] Fig.19 This is a diagram showing an example of the accident avoidance necessity determination result stored in the server in the first embodiment of the present invention.

[0034] Fig. 20 This is a diagram showing an example of camera sensor information in the server in the first embodiment of the present invention.

[0035] Fig.21 This is a flowchart showing an example of the processing procedure of the performance determination unit that determines the performance of the software of Version N+1 in the server in the first embodiment of the present invention.

[0036] Fig. 22 This is a diagram showing an example of the determination performance of the software of Version N+1 determined in the server in the first embodiment of the present invention.

[0037] Fig.23 This is a flowchart showing an example of the processing procedure of the log output unit that creates and outputs a log based on the judgment performance of the Ver. N+1 software in the server in the first embodiment of the present invention.

[0038] Fig.24 This is a diagram showing an example of log information created based on the judgment performance of the software of Ver. N+1 in the server in the first embodiment of the present invention.

[0039] Fig.25 It is a diagram showing the overall configuration of a vehicle control device in a second embodiment of the present invention.

[0040] Fig.26 This is a flowchart showing an example of the processing procedure of the performance determination unit of the software of Version N+1 in the second embodiment of the present invention.

[0041] Fig. 27 This is a diagram showing an example of the judgment performance of the software of Ver. N+1 in the second embodiment of the present invention.

[0042] Fig.28This is a flowchart showing an example of the processing procedure of the log output unit 124 for creating and outputting a log based on the judgment performance of the software of Ver. N+1 in the second embodiment of the present invention.

[0043] Fig.29 This is a diagram showing an example of log information created based on the judgment performance of the software of Ver. N+1 in the second embodiment of the present invention.

[0044] Fig. 30A It is a diagram showing the overall configuration of a vehicle control device in a third embodiment of the present invention.

[0045] Fig. 30B It is a diagram showing the overall configuration of a vehicle control device in a modified example of the third embodiment of the present invention.

[0046] Fig.31 This is a flowchart showing an example of the processing procedure of the real-time transmission unit that transmits log information in real time in the third embodiment of the present invention.

[0047] Fig.32 This is a diagram showing an example of real-time transmission of log information in the third embodiment of the present invention.

[0048] Fig.33 This is a flowchart showing an example of a processing procedure of a non-real time transmission unit that transmits log information in non-real time in the third embodiment of the present invention.

[0049] Fig.34 This is a diagram showing an example of non-real-time transmission of log information in the third embodiment of the present invention.

[0050] Fig.35 It is a diagram showing the overall configuration of a vehicle control device in a fourth embodiment of the present invention.

[0051] Fig.36 1 is a flowchart showing an example of a processing procedure of a driver input acquisition unit in the fourth embodiment of the present invention.

[0052] Fig.37 FIG. 1 is a diagram showing an example of driver input information in the fourth embodiment of the present invention.

[0053] Fig.38 It is a diagram showing an example of a processing sequence of an accident avoidance operation detection unit in the fourth embodiment of the present invention.

[0054] Fig.39 1 is a diagram showing an example of the accident avoidance operation detection result in the fourth embodiment of the present invention.

[0055] Fig.40 FIG. 1 is a diagram showing an example of an accident avoidance operation mark (driver) in the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0056] The following embodiments relate to a software verification system and a vehicle control device (electronic control device) used in the software verification system. Each embodiment is used to solve the problem of judging the performance of new software (degradation detection, etc.), and the purpose of each embodiment is to provide a vehicle control device that can use the operating results of old software and new software and other information to judge the performance of new software in the software verification system.

[0057] (First embodiment)

[0058] use Figure 1 to Figure 24 A vehicle control system according to a first embodiment of the present invention will be described.

[0059] Figure 1 It is a diagram showing the overall configuration of a vehicle control system in the first embodiment of the present invention.

[0060] The vehicle control device 1 has a radar sensor information acquisition unit 101, radar sensor information 102, a camera sensor information acquisition unit 103, camera sensor information 104, an object detection unit (radar) 105, an object detection result (radar) 106, an accident avoidance necessity flag (radar) 107, an object detection unit (Ver.N) 108, an object detection result (Ver.N) 109, an accident avoidance necessity flag (Ver.N) 110, an object detection unit (Ver.N+1) 111, an object detection result (Ver.N+1) 112, an accident avoidance necessity flag (Ver.N+1) 113, and a server sending unit 114.

[0061] It should be noted that the vehicle control device 1 is composed of a processor such as a CPU (Central Processing Unit), a storage device such as a memory, a communication device corresponding to various communication standards, etc. The functions of the object detection unit (Ver.N) 108 and the object detection unit (Ver.N+1) 111 are implemented, for example, by the processor running software stored in the storage device. The same applies to the following other functions.

[0062] Figure 2: is a diagram showing an example of the connection relationship of the control device connected to the vehicle control device 1 in the first embodiment of the present invention using a network. The vehicle control device 1 is connected to the gateway 2, the camera control device 3, the radar control device 4, and the sonar control device 5 using the in-vehicle network. The vehicle data such as the vehicle speed is sent from the gateway 2 to the vehicle control device 1. In addition, the sensor data from the camera sensor, the sensor data from the radar sensor, and the sensor data from the sonar sensor are sent to the vehicle control device 1 from the camera control device 3, the radar control device 4, and the sonar control device 5 respectively. The vehicle control device 1 determines the vehicle's forward movement, turning, and stopping based on these vehicle data and sensor data to achieve vehicle control. As shown in the figure, in the vehicle, multiple control devices and gateways are connected together using a network, and sensor data, vehicle data, etc. are communicated between the control devices, thereby achieving vehicle control. The communication of these networks is performed periodically or non-periodically.

[0063] Figure 3 1 is a flowchart showing an example of the processing sequence of the radar sensor information acquisition unit 101 in the first embodiment of the present invention. The radar sensor is used to acquire sensor information when driving on the road. For example, the radar sensor information acquisition unit 101 (radar device) acquires the external environment in front of the vehicle as sensor information in step S10102 of the figure, and outputs the sensor information in step S10103. It should be noted that the present invention is not limited to radar sensors, and other sensors such as light detection and ranging sensors can also be used instead (as a modified example).

[0064] Figure 4 10201 in the first embodiment of the present invention. As radar-based sensor information, there are sensor data (No. (1)) when there is an obstacle such as a pedestrian in front of the vehicle and an accident avoidance operation is required, and sensor data (No. (2)) when there is no obstacle such as a pedestrian in front of the vehicle and an accident avoidance operation is not required. It should be noted that the sensor information includes timestamp information.

[0065] Figure 5 1 is a flowchart showing an example of the processing sequence of the camera sensor information acquisition unit 103 in the first embodiment of the present invention. The camera sensor is used to acquire sensor information when driving on a road. For example, the camera sensor information acquisition unit 103 (camera device) acquires the external environment in front of the vehicle as sensor information in step S10302 of the figure, and outputs the sensor information in step S10303.

[0066] Figure 610401 in the first embodiment of the present invention. As sensor information based on the camera, there are sensor data (No. (1)) when there is an obstacle such as a pedestrian in front of the vehicle and an accident avoidance operation is required, and sensor data (No. (2)) when there is no obstacle such as a pedestrian in front of the vehicle and an accident avoidance operation is not required. It should be noted that the sensor information includes timestamp information.

[0067] Figure 7 1 is a flowchart showing an example of the processing sequence of the object detection unit (radar) 105 in the first embodiment of the present invention. Accident avoidance judgment is performed based on the acquired radar sensor information. For example, the object detection unit (radar) 105 (processor) acquires the radar sensor information 102 output by the radar sensor information acquisition unit 101 in step S10502 of the figure, performs object detection based on the radar sensor information in step S10503, judges the necessity of accident avoidance based on the object detection result in step S10504, and outputs the accident avoidance necessity flag in step S10505.

[0068] Figure 8 This is a diagram showing an example of object detection result (radar) 10601 in the first embodiment of the present invention. For example, there is a case where a vehicle in front of the vehicle is recognized (No. (1)) and a case where a pedestrian in front of the vehicle is recognized (No. (2)). It should be noted that the present invention does not limit the detection object.

[0069] Fig. 9 10701 is a diagram showing an example of an accident avoidance necessity flag (radar) in the first embodiment of the present invention. Based on the object detection result (radar) 10601, a vehicle accident is predicted and an accident avoidance necessity flag is determined. For example, there is a flag 0 (No. (1)) for a case where no obstacle (pedestrians, etc.) is recognized in front of the vehicle while the vehicle is traveling and there is no need to avoid an accident (avoid a collision), and a flag 1 (No. (2)) for a case where an obstacle is recognized in front of the vehicle while the vehicle is traveling and there is a need to avoid an accident (avoid a collision). It should be noted that the present invention also includes a case where an obstacle is recognized in front of the vehicle but there is no need to avoid an accident. It should be noted that the accident avoidance necessity flag includes timestamp information.

[0070] Fig.101 is a flowchart showing an example of the processing sequence of the object detection unit (Ver.N) 108 in the first embodiment of the present invention. Accident avoidance judgment is performed based on the acquired camera sensor information. For example, the object detection unit (Ver.N) 108 (processor) acquires the camera sensor information 104 output by the camera sensor information acquisition unit 103 in step S10802 of the figure, performs object detection based on the camera sensor information in step S10803, judges the necessity of accident avoidance based on the object detection result in step S10804, and outputs the accident avoidance necessity flag in step S10805.

[0071] Fig.11 This is a diagram showing an example of object detection result (Ver.N) 10901 in the first embodiment of the present invention. For example, there is a case where a vehicle in front of a vehicle is recognized (No.(1)) and a case where a pedestrian in front of a vehicle is recognized (No.(2)). It should be noted that the present invention does not limit the detection object.

[0072] Fig.12 1 is a diagram showing an example of an accident avoidance necessity flag (Ver.N) 11001 in the first embodiment of the present invention. Based on the object detection result (Ver.N) 10901, a vehicle accident occurrence prediction is performed and an accident avoidance necessity flag is determined. For example, there is a flag 0 (No.(1)) for a case where no obstacle (pedestrians, etc.) is recognized in front of the vehicle while the vehicle is traveling and there is no need to avoid an accident, and a flag 1 (No.(2)) for a case where an obstacle is recognized in front of the vehicle while the vehicle is traveling and there is a need to avoid an accident. It should be noted that the present invention also includes a case where an obstacle is recognized in front of the vehicle but there is no need to avoid an accident. It should be noted that the accident avoidance necessity flag includes timestamp information.

[0073] Fig.13 1 is a flowchart showing an example of the processing sequence of the object detection unit (Ver.N+1) 111 in the first embodiment of the present invention. Accident avoidance judgment is performed based on the acquired camera sensor information. For example, the object detection unit (Ver.N+1) 111 (processor) acquires the camera sensor information 104 output by the camera sensor information acquisition unit 103 in step S11102 of the figure, performs object detection based on the camera sensor information in step S11103, judges the necessity of accident avoidance based on the object detection result in step S11104, and outputs the accident avoidance necessity flag in step S11105.

[0074] Fig.14This is a diagram showing an example of object detection results (Ver.N+1) 11201 in the first embodiment of the present invention. For example, there is a case where a vehicle in front of a vehicle is recognized (No.(1)) and a case where a pedestrian in front of a vehicle is recognized (No.(2)). It should be noted that the present invention does not limit the detection object.

[0075] Fig.15 1 is a diagram showing an example of an accident avoidance necessity flag (Ver.N+1) 11301 in the first embodiment of the present invention. Based on the object detection result (Ver.N+1) 11201, a vehicle accident prediction is performed and the accident avoidance necessity flag is determined. For example, there is a flag 0 (No.(1)) for when an obstacle (pedestrians, etc.) is not recognized in front of the vehicle while the vehicle is traveling and there is no need to avoid an accident, and a flag 1 (No.(2)) for when an obstacle is recognized in front of the vehicle while the vehicle is traveling and there is a need to avoid an accident. It should be noted that the present invention also includes a situation where an obstacle is recognized in front of the vehicle but there is no need to avoid an accident. It should be noted that the accident avoidance necessity flag includes timestamp information.

[0076] Fig.16 1 is a flowchart showing an example of the processing sequence of the server sending unit 114 in the first embodiment of the present invention. The server sending unit 114 (processor and communication device) obtains each accident avoidance necessity flag in step S11402, obtains synchronized camera sensor information in step S11403, and sends the obtained information to the server in step S11404.

[0077] Fig.17 It is a diagram showing the overall configuration of a server system in the first embodiment of the present invention.

[0078] The server 6 includes a server receiving unit 115 , an accident avoidance necessity determination result 116 , camera sensor information 117 , a performance determination unit 118 , a determination performance 119 , a log output unit 120 , and log information 121 .

[0079] It should be noted that the server 6 is composed of, for example, a processor such as a CPU, a storage device such as a memory and a hard disk, a communication device corresponding to various communication standards, etc. The functions of the performance determination unit 118 and the like are implemented, for example, by the processor running software stored in the storage device. The same applies to the following other functions.

[0080] Fig.181 is a flowchart showing an example of the processing sequence in the server receiving unit 115 in the first embodiment of the present invention. For example, the server receiving unit 115 (processor and communication device) obtains the accident avoidance necessity result (accident avoidance necessity flag (radar) 107, accident avoidance necessity flag (Ver.N) 110, accident avoidance necessity flag (Ver.N+1) 113) and the camera sensor information 104 in step S11502, and outputs the accident avoidance necessity result (accident avoidance necessity flag (radar) 107, accident avoidance necessity flag (Ver.N) 110, accident avoidance necessity flag (Ver.N+1) 113) and the camera sensor information 104 in step S11503.

[0081] Fig.19116 is a diagram showing an example of the accident avoidance necessity determination result 11601 according to the first embodiment of the present invention. For example, there are cases where the accident avoidance necessity mark (radar) 107 is to be avoided and the accident avoidance necessity mark (Ver.N) 110 is to be avoided and the accident avoidance necessity mark (Ver.N+1) 113 is to be avoided (No.(1)), where the accident avoidance necessity mark (radar) 107 is to be avoided and the accident avoidance necessity mark (Ver.N) 110 is to be avoided and the accident avoidance necessity mark (Ver.N+1) 113 is not to be avoided (No.(2)), where the accident avoidance necessity mark (radar) 107 is to be avoided and the accident avoidance necessity mark (Ver.N) 110 is not to be avoided and the accident avoidance necessity mark (Ver.N+1) 113 is to be avoided (No.(3)), where the accident avoidance necessity mark (radar) 107 is to be avoided and the accident avoidance necessity mark (Ver.N) 110 is not to be avoided and the accident avoidance necessity mark (Ver.N+1) 113 is not to be avoided (No.(4)), The accident avoidance necessity mark (radar) 107 is not necessary to avoid and the accident avoidance necessity mark (Ver.N) 110 is necessary to avoid and the accident avoidance necessity mark (Ver.N+1) 113 is necessary to avoid (No.(5)), the accident avoidance necessity mark (radar) 107 is not necessary to avoid and the accident avoidance necessity mark (Ver.N) 110 is necessary to avoid and the accident avoidance necessity mark (Ver.N+1) 113 is not necessary to avoid (No.(6)), the accident avoidance necessity mark (radar) 107 is not necessary to avoid and the accident avoidance necessity mark (Ver.N) 110 is not necessary to avoid and the accident avoidance necessity mark (Ver.N+1) 113 is necessary to avoid (No.(7)), the accident avoidance necessity mark (radar) 107 is not necessary to avoid and the accident avoidance necessity mark (Ver.N) 110 is not necessary to avoid and the accident avoidance necessity mark (Ver.N+1) 113 is not necessary to avoid (No.(8)).

[0082] Fig. 20 11701 in the first embodiment of the present invention. As sensor information based on the camera, there are sensor data (No. (1)) when there is an obstacle such as a pedestrian in front of the vehicle and an accident avoidance operation is required, and sensor data (No. (2)) when there is no obstacle such as a pedestrian in front of the vehicle and an accident avoidance operation is not required. It should be noted that the sensor information includes timestamp information.

[0083] Fig.211 is a flowchart showing an example of the processing sequence of the performance judgment unit 118 in the first embodiment of the present invention. The performance of the software of Ver. N+1 is judged based on the accident avoidance necessity result. For example, the performance judgment unit 118 (processor) obtains the accident avoidance necessity judgment result 116 in step S11802, performs the performance judgment of the Ver. N+1 software in step S11803, and outputs the judgment performance of the Ver. N+1 software in step S11804. It should be noted that the present invention can use other information for performance judgment.

[0084] Fig. 22 This is a diagram showing an example of the determination performance 11901 in the first embodiment of the present invention. The performance of Ver. N+1 is represented by a combination of information of each accident avoidance necessity flag.

[0085] For example, when the accident avoidance necessity flag (radar) 107 is avoidance necessary, the accident avoidance necessity flag (Ver. N) 110 is avoidance necessary, and the accident avoidance necessity flag (Ver. N+1) 113 is avoidance necessary (No. (1)), the determination result is that the performance has not changed (success).

[0086] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates that the accident avoidance is necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that the accident avoidance is necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that the accident avoidance is not necessary (No. (2)) is performance degradation.

[0087] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates avoidance necessity, the accident avoidance necessity flag (Ver. N) 110 indicates avoidance non-necessity, and the accident avoidance necessity flag (Ver. N+1) 113 indicates avoidance necessity (No. (3)) is that performance is improved.

[0088] In the case where the accident avoidance necessity flag (radar) 107 is required to be avoided, the accident avoidance necessity flag (Ver.N) 110 is not required to be avoided, and the accident avoidance necessity flag (Ver.N+1) 113 is not required to be avoided (No. (4)), the judgment result is that there is no change in performance (marginal case).

[0089] In the case where the accident avoidance necessity flag (radar) 107 is not avoidable, the accident avoidance necessity flag (Ver.N) 110 is avoidable, and the accident avoidance necessity flag (Ver.N+1) 113 is avoidable (No.(5)), the judgment result is that there is no change in performance (marginal case).

[0090] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates that avoidance is not necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that avoidance is necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that avoidance is not necessary (No. (6)) is that performance is improved.

[0091] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates that avoidance is not necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that avoidance is not necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that avoidance is necessary (No. (7)) is performance degradation.

[0092] When the accident avoidance necessity flag (radar) 107 indicates that avoidance is not necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that avoidance is not necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that avoidance is not necessary (No. (8)), the judgment result is that there is no change in performance (success).

[0093] Fig.23 1 is a flowchart showing an example of the processing sequence of the log output unit 120 in the first embodiment of the present invention. For example, the log output unit 120 (processor) obtains the judgment performance 119 in step S12002, obtains the camera sensor information 117 synchronized with the judgment performance in step S12003, creates log information using the combination of the judgment performance 119 and the camera sensor information 117 when the judgment performance 119 is performance degradation and performance no change (edge ​​case) in step S12004, and outputs the log information in step S12005. It should be noted that, when the judgment performance 119 is other information, log information combined with the camera sensor information 117 can also be created.

[0094] Fig.24 1 is a diagram showing an example of log information 12101 in the first embodiment of the present invention. The log information includes performance judgment information and camera sensor information of the software of Ver. N+1. For example, when the performance 119 is judged to be unchanged (successful) (No. (1)), the log information is only performance unchanged (successful) information; when the performance 119 is judged to be improved (No. (2)), the log information is only performance improvement judgment information; when the performance 119 is judged to be degraded (No. (3)), the log information is performance improvement judgment information and camera sensor information; when the performance 119 is judged to be unchanged (marginal case) (No. (4)), the log information is performance unchanged (marginal case) judgment information and camera sensor information. It should be noted that the present invention does not limit the information contained in the log information to camera sensor information, but can include other information such as radar sensor information.

[0095] The main features of the first embodiment can be summarized as follows:

[0096] The vehicle control device 1 and the server 6 constitute a software verification system that verifies the new version (Ver. N+1) of the control software (software that realizes the object detection unit (Ver. N+1) 111 ).

[0097] The software verification system (server 6) detects degradation (performance degradation) of the control software of the new version (Ver.N+1) by using the first information (accident avoidance necessity flag (Ver.N) 110), the second information (accident avoidance necessity flag (Ver.N+1) 113), and the third information related to the control of the vehicle other than the first information and the second information (accident avoidance necessity flag (radar) 107).

[0098] Here, the first information (accident avoidance necessity flag (Ver.N) 110) is an output of the control software (software implementing the object detection unit (Ver.N) 108) of the current version (Ver.N) used for controlling the vehicle when the sensor data (camera sensor information 104) from the sensor (camera sensor information acquisition unit 103) mounted on the vehicle is used as input. In addition, the second information (accident avoidance necessity flag (Ver.N+1) 113) is an output of the control software (software implementing the object detection unit (Ver.N+1) 111) of the new version (Ver.N+1) not used for controlling the vehicle when the sensor data (camera sensor information 104) is used as input.

[0099] The software verification system (server 6 ) verifies (re-verifies) the new version of the control software using the sensor data (camera sensor information 104 ) when the degradation is detected.

[0100] By using the third information (accident avoidance necessity flag (radar) 107), the degradation detection performance can be improved. In addition, by using the sensor data (camera sensor information 104) when the degradation is detected, the control software can be verified quickly. As a result, the software that uses the vehicle sensor data as input can be easily improved.

[0101] The software verification system (server 6) judges it as degradation (performance degradation) when the first information (accident avoidance necessity flag (Ver.N) 110) and the second information (accident avoidance necessity flag (Ver.N+1) 113) are inconsistent, but the first information (accident avoidance necessity flag (Ver.N) 110) and the third information (accident avoidance necessity flag (radar) 107) are consistent.

[0102] By comparing the first information with the second information and comparing the first information with the third information, degradation of the control software can be reliably detected.

[0103] In this embodiment, the third information (accident avoidance necessity flag (radar) 107) is information indicating whether an accident needs to be avoided based on the radar sensor. The sensor mounted on the vehicle (outputting sensor data input to the control software) is a camera (camera sensor information acquisition unit 103).

[0104] By determining whether an accident needs to be avoided based on a highly accurate radar sensor, it is possible to improve the performance of detecting degradation in the control software that uses camera sensor data as input.

[0105] In detail, the software verification system uses the first information, the second information, and the third information to determine the performance changes of the new version of the software relative to the current version of the software, and uses the sensor data corresponding to the moment when the performance change is determined to verify the new version of the software.

[0106] By using the first information, the second information, and the third information, it is possible to more accurately determine the change in the performance of the new version of the software. As a result, it is possible to easily improve the software that uses the vehicle sensor data as input.

[0107] Specifically, when the first information, the second information, and the third information are information indicating that an accident needs to be avoided or has been avoided, the software verification system determines that there is no change in performance ( Fig. 22 No. (1)), when the first information and the third information are information indicating that the accident needs to be avoided or has been avoided, and the second information is information indicating that the accident does not need to be avoided or has not been avoided, it is judged that the performance is degraded ( Fig. 22 No. (2)), when the second information and the third information are information indicating that the accident needs to be avoided or has been avoided, and the first information is information indicating that the accident does not need to be avoided or has not been avoided, it is judged that the performance is improved ( Fig. 22 (3)), when the third information is information indicating that the accident needs to be avoided or has been avoided, and the first information and the second information are information indicating that the accident does not need to be avoided or has not been avoided, it is determined that there is no change in performance ( Fig. 22 No. (4)), when the first information and the second information are information indicating that the accident needs to be avoided or has been avoided, and the third information is information indicating that the accident does not need to be avoided or has not been avoided, it is judged that there is no change in performance ( Fig. 22(5)), when the first information is information indicating that the accident needs to be avoided or has been avoided, and the second information and the third information are information indicating that the accident does not need to be avoided or has not been avoided, it is judged that the performance is improved ( Fig. 22 (6)), when the second information is information indicating that the accident needs to be avoided or has been avoided, and the first information and the third information are information indicating that the accident does not need to be avoided or has not been avoided, it is judged that the performance is degraded ( Fig. 22 No. (7)), when the first information, the second information, and the third information are information indicating that the accident does not need to be avoided or that the accident has not been avoided, it is judged that there is no change in performance ( Fig. 22 No.(8)).

[0108] Here, the first information and the second information are information indicating the necessity or existence of accident avoidance based on sensor data, and the third information is information indicating the necessity or existence of accident avoidance based on data different from the sensor data. Fig.17 The performance determination unit 118 of the vehicle control device 1 (described later) may determine Fig.25 The performance judgment unit 122) judges.

[0109] The first information, the second information and the third information are two situations respectively, and therefore, the performance changes of the new version of the software in eight situations can be determined.

[0110] The software verification system will be Fig. 22 The sensor data corresponding to the results of the judgments of No. (2), (4), (5) and (7) are used as training data for situations where the new version of the software needs to be improved for machine learning, or Fig. 22 The sensor data corresponding to the results of the judgments of No. (1), (3), (6) and (8) are used as training data for situations where there is no need to improve the new version of the software for machine learning.

[0111] Since training data of a situation that needs improvement or training data of a situation that does not need improvement is acquired from the actual environment, the learning accuracy and the learning speed are improved.

[0112] As described above, the software verification system in this embodiment can detect the degradation of the new version of software by comparing the output of the current version of control software, the output of the new version of control software and other information related to vehicle control. As a result, the improvement of the new version of software can effectively collect data and re-verify the effect.

[0113] (Second Embodiment) Considering the Case of Storing Data

[0114] use Figure 25 to Figure 29 A vehicle control device and method according to a second embodiment of the present invention will be described.

[0115] The difference from the first embodiment is that instead of sending all the accident avoidance necessity flag (radar) 107, accident avoidance necessity flag (Ver.N) 110, accident avoidance necessity flag (Ver.N+1) 113 and camera sensor information 104 to the server, the performance judgment of the software of Ver.N+1 is performed in the vehicle control device 1 based on this information. In the second embodiment, the data volume of the log information shown in the first embodiment is reduced, which has the effect of reducing the communication volume. It should be noted that the same figure marks are marked with the same structure and sequence as the first embodiment, and the description thereof is omitted.

[0116] Fig.25 1 is a diagram showing the overall configuration of a vehicle control device 1 in a second embodiment of the present invention. In the second embodiment, the vehicle control device includes a performance determination unit 122 and a determination performance 123 , a log output unit 124 and log information 125 instead of a server transmission unit 114 .

[0117] Fig.26 1 is a flowchart showing an example of the processing sequence of the performance judgment unit 122 in the second embodiment of the present invention. The performance of the Ver.N+1 software is judged based on the accident avoidance necessity flag. For example, the performance judgment unit 122 (processor) obtains the accident avoidance necessity flag (radar) 107, the accident avoidance necessity flag (Ver.N) 110, and the accident avoidance necessity flag (Ver.N+1) 113 in step S12202, performs performance judgment of the Ver.N+1 software in step S12203, and outputs the judgment performance of the Ver.N+1 software in step S12204. It should be noted that the present invention can use other information for performance judgment.

[0118] Fig. 27 This is a diagram showing an example of the determination performance 12301 in the second embodiment of the present invention. The performance of Ver. N+1 is represented by a combination of information of each accident avoidance necessity flag.

[0119] For example, when the accident avoidance necessity flag (radar) 107 is avoidance necessary, the accident avoidance necessity flag (Ver. N) 110 is avoidance necessary, and the accident avoidance necessity flag (Ver. N+1) 113 is avoidance necessary (No. (1)), the determination result is that the performance has not changed (success).

[0120] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates that the accident avoidance is necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that the accident avoidance is necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that the accident avoidance is not necessary (No. (2)) is performance degradation.

[0121] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates avoidance necessity, the accident avoidance necessity flag (Ver. N) 110 indicates avoidance non-necessity, and the accident avoidance necessity flag (Ver. N+1) 113 indicates avoidance necessity (No. (3)) is that performance is improved.

[0122] In the case where the accident avoidance necessity flag (radar) 107 is required to be avoided, the accident avoidance necessity flag (Ver.N) 110 is not required to be avoided, and the accident avoidance necessity flag (Ver.N+1) 113 is not required to be avoided (No. (4)), the judgment result is that there is no change in performance (marginal case).

[0123] In the case where the accident avoidance necessity flag (radar) 107 is not avoidable, the accident avoidance necessity flag (Ver.N) 110 is avoidable, and the accident avoidance necessity flag (Ver.N+1) 113 is avoidable (No.(5)), the judgment result is that there is no change in performance (marginal case).

[0124] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates that avoidance is not necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that avoidance is necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that avoidance is not necessary (No. (6)) is that performance is improved.

[0125] The result of determination in the case where the accident avoidance necessity flag (radar) 107 indicates that avoidance is not necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that avoidance is not necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that avoidance is necessary (No. (7)) is performance degradation.

[0126] When the accident avoidance necessity flag (radar) 107 indicates that avoidance is not necessary, the accident avoidance necessity flag (Ver. N) 110 indicates that avoidance is not necessary, and the accident avoidance necessity flag (Ver. N+1) 113 indicates that avoidance is not necessary (No. (8)), the judgment result is that there is no change in performance (success).

[0127] Fig.281 is a flowchart showing an example of the processing sequence of the log output unit 124 in the second embodiment of the present invention. For example, the log output unit 124 (processor) obtains the judgment performance 123 in step S12402, obtains the camera sensor information 104 synchronized with the judgment performance in step S12403, creates log information using the combination of the judgment performance 123 and the camera sensor information 104 when the judgment performance 123 is performance degradation and performance no change (edge ​​case) in step S12404, and outputs the log information in step S12405. It should be noted that when the judgment performance 123 is other information, log information combined with the camera sensor information 104 can also be created.

[0128] Fig.29 1 is a diagram showing an example of log information 12501 in the second embodiment of the present invention. The log information includes performance judgment information and camera sensor information of the software of Ver. N+1. For example, when the performance 123 is judged to be unchanged (successful) (No. (1)), the log information is only performance unchanged (successful) information; when the performance 123 is judged to be improved (No. (2)), the log information is only performance improvement judgment information; when the performance 123 is judged to be degraded (No. (3)), the log information is performance improvement judgment information and camera sensor information; when the performance 123 is judged to be unchanged (marginal case) (No. (4)), the log information is performance unchanged (marginal case) judgment information and camera sensor information. It should be noted that the present invention does not limit the information contained in the log information to camera sensor information, but can include other information such as radar sensor information.

[0129] The main features of the second embodiment can also be summarized as follows:

[0130] The vehicle control device 1 includes: a degradation detection unit (performance judgment unit 122), which uses the first information (accident avoidance necessity flag (Ver.N) 110), the second information (accident avoidance necessity flag (Ver.N+1) 113), and the third information related to the control of the vehicle other than the first information and the second information (accident avoidance necessity flag (radar) 107) to detect the degradation (performance degradation) of the control software of the new version (Ver.N+1); and a log information adding unit (log output unit 124) to add log information related to the degradation to the sensor data (camera sensor information 104) at the moment when the degradation is detected by the degradation detection unit.

[0131] Here, the first information (accident avoidance necessity flag (Ver.N) 110) is the output of the control software of the current version (Ver.N) used for controlling the vehicle when the sensor data (camera sensor information 104) from the sensor (camera sensor information acquisition unit 103) mounted on the vehicle is used as input. In addition, the second information (accident avoidance necessity flag (Ver.N+1) 113) is the output of the control software of the new version (Ver.N+1) used for controlling the vehicle when the sensor data (camera sensor information 104) is used as input.

[0132] By adding log information related to degradation to sensor data (camera sensor information 104), it is easy to verify degradation using sensor data. As a result, it is easy to improve software that uses vehicle sensor data as input. It should be noted that the sensor data (camera sensor information 104) to which log information is added can also be uploaded to the server when the charging cable of the charger of the charging station is connected to the charging socket of the vehicle (electric vehicle, etc.).

[0133] As described above, the vehicle control device in this embodiment can select and reject camera sensor information by adopting a configuration in which the performance judgment of Ver.N+1 is performed inside the vehicle control device 1 and log information is created together with the camera sensor information. As a result, for example, the amount of communication data can be reduced when uploading log information to the server.

[0134] (Third Embodiment) Real-time Transmission

[0135] use Figure 30A to Figure 34 A vehicle control device and method according to a third embodiment of the present invention will be described.

[0136] The difference from the first embodiment is that instead of sending all the accident avoidance necessity flag (radar) 107, accident avoidance necessity flag (Ver.N) 110, accident avoidance necessity flag (Ver.N+1) 113 and camera sensor information 104 to the server, the performance of the Ver.N+1 software is judged in the vehicle control device 1 based on this information, and the log information is classified and sent in real time or non-real time according to the judgment result. In the third embodiment, it has the effect of suppressing the increase in processing load in the vehicle caused by sending data to the server while being able to quickly implement verification in the server. It should be noted that the same figure marks are marked with the same structure and sequence as the first embodiment, and their description is omitted.

[0137] Fig. 30A1 is a diagram showing the overall structure of the vehicle control device 1 in the third embodiment of the present invention. Compared with the first embodiment, the vehicle control device 1 in the third embodiment has a performance judgment unit 122, a judgment performance 123, a log output unit 124, log information 125, a real-time transmission unit 126, real-time transmission log information 127, a non-real-time transmission unit 128, and non-real-time transmission log information 129 instead of the server transmission unit 114. It should be noted that Fig. 30B As shown, the real-time transmission unit 126 , the real-time transmission log information 127 , the non-real-time transmission unit 128 , and the non-real-time transmission log information 129 may be provided in another electronic control device such as a TCU (Telematics Control Unit).

[0138] Fig.31 1 is a flowchart showing an example of the processing sequence of the real-time sending unit 126 in the third embodiment of the present invention. The real-time sending unit 126 (processor and communication device) obtains the log information 125 in step S12602, extracts the log data in the case where the software of Ver.N+1 is judged to be performance degradation or performance unchanged (edge ​​case) in step S12603, and sends the log data extracted in step S12604 in real time. It should be noted that the log information sent in real time in the present invention can be changed.

[0139] Fig.32 12701 in the third embodiment of the present invention. For example, the real-time log information sent includes judgment information and camera sensor information (No. (1)) when the performance of the software of Ver. N+1 is degraded, and judgment information and camera sensor information (No. (2)) when the performance of the software of Ver. N+1 is unchanged (edge ​​case). It should be noted that the present invention does not limit the information contained in the log information to the camera sensor information, and can include other information such as radar sensor information.

[0140] Fig.33: is a flowchart showing an example of the processing sequence of the non-real-time sending unit 128 in the third embodiment of the present invention. The non-real-time sending unit 128 (processor and communication device) obtains the log information 125 in step S12802, extracts the log data of the software of Ver.N+1 in step S12803 when it is judged that the performance is improved or the performance has not changed (successfully), and sends the extracted log data in non-real time in step S12804. For example, the log data is temporarily stored in the storage device in the vehicle in advance, so that the data is sent together when the vehicle is parked, thereby suppressing the increase in the processing load in the vehicle caused by sending data to the server. It should be noted that the log information sent non-real time in the present invention can be changed. In addition, non-real-time sending can also be performed when the processing load of the vehicle control device 1 is smaller than the specified value.

[0141] Fig.34 1 is a diagram showing an example of non-real-time sending log information 12901 in the third embodiment of the present invention. For example, the non-real-time sending log information includes judgment information (No. (1)) when the performance of the software of Ver. N+1 is unchanged (successful) and judgment information (No. (2)) when the performance of the software of Ver. N+1 is improved. It should be noted that in this embodiment, the non-real-time sending log information does not include camera sensor information, but may also include camera sensor information corresponding to the judgment result (judgment performance).

[0142] The main features of the third embodiment can also be summarized as follows:

[0143] The software verification system (vehicle control device 1) includes: a degradation detection unit (performance judgment unit 122) for detecting degradation, which is installed in the vehicle; a log information adding unit (log output unit 124), which is installed in the vehicle and adds log information related to degradation to the sensor data (camera sensor information 104) at the moment when the degradation is detected by the degradation detection unit (performance judgment unit 122); and a data sending unit (real-time sending unit 126, non-real-time sending unit 128), which is installed in the vehicle and sends the sensor data (camera sensor information 104) to which the log information is added to the server 6.

[0144] By sending the sensor data to which the log information is added to the server, verification can be performed using the sensor data for each log information on the server side.

[0145] It should be noted that if Fig. 30B As shown, the vehicle control device 1 used in the software verification system can also output sensor data (camera sensor information 104) with added log information to the data sending unit (real-time sending unit 126 and non-real-time sending unit 128 provided in the TCU) that sends the data to the server 6.

[0146] By not providing the vehicle control device 1 with a data transmission unit that transmits data to the server 6 , the manufacturing cost can be reduced.

[0147] The software verification system (vehicle control device 1) has a storage unit (storage device) mounted on the vehicle, which stores log information (real-time transmission log information 127, non-real-time transmission log information 129). In this embodiment, the data transmission unit (non-real-time transmission unit 128) sends the data (non-real-time transmission log information 129) stored in the storage unit to the server when the vehicle stops.

[0148] By transmitting data (non-real-time transmission log information 129) to the server when the vehicle is stopped, it is possible to ensure hardware resources for controlling the vehicle while it is running and suppress the processing load.

[0149] As described above, the vehicle control device in this embodiment can transmit log information in consideration of the processing load in the vehicle control device by adopting a configuration that divides the processing of transmitting log information into real-time and non-real-time. As a result, the hardware cost can be reduced.

[0150] (Fourth Embodiment) Specific Example of Accident Avoidance Sign Using Driver's Information

[0151] use Figures 35 to 40 A vehicle control device and method according to a fourth embodiment of the present invention will be described.

[0152] The difference from the first embodiment is that the accident avoidance operation sign is prepared using the driver input acquisition unit 130 and the driver input information 131 instead of the radar sensor information acquisition unit 101 and the radar sensor information 102. In the fourth embodiment, the following effects are achieved, namely, the accident occurrence situations that are difficult to be identified and judged by the vehicle-mounted sensor can be collected through the recognition and judgment of the driver, and can be applied to the evaluation and improvement of the software of Ver.N+1. It should be noted that the same figure numerals are marked with the same structure and sequence as the first embodiment, and the description thereof is omitted.

[0153] Fig.35 1 is a diagram showing the overall structure of a vehicle control device 1 in a fourth embodiment of the present invention. Compared with the first embodiment, the vehicle control device 1 in the fourth embodiment has a driver input acquisition unit 130 and driver input information 131 instead of the radar sensor information acquisition unit 101 and the radar sensor information 102, and has an accident avoidance operation detection unit 132, an accident avoidance operation detection result 133 and an accident avoidance operation flag (driver) 134 instead of the object detection unit (radar) 105, the object detection result (radar) 106 and the accident avoidance necessity flag (radar) 107.

[0154] Fig.36 1 is a flowchart showing an example of the processing sequence of the driver input acquisition unit 130 in the fourth embodiment of the present invention. The driver input acquisition unit 130 (accelerator opening sensor, brake pedaling amount sensor, steering angle sensor, etc.) acquires the driver input information in step S13002 and outputs the driver input information in step S13003.

[0155] Fig.37 13101 in the fourth embodiment of the present invention. For example, there are an accelerator input value (No. (1)), a brake input value (No. (2)), and a steering input value (No. (3)).

[0156] Fig.38 1 is a flowchart showing the processing sequence of the accident avoidance operation detection unit 132 in the fourth embodiment of the present invention. The accident avoidance operation detection unit 132 (processor) obtains the driver input information in step S13202, determines whether the driver input is an accident avoidance operation in step S13203, and outputs the determination result in step S13204. For example, the accident avoidance operation detection unit 132 determines whether there is an accident avoidance operation based on the change amount (time differential value) of the accelerator input value, the change amount (time differential value) of the brake input value, and the change amount (time differential value) of the steering input value.

[0157] Fig.39 13301 in the fourth embodiment of the present invention. For example, as the judgment result, there are no accident avoidance operation (No. (1)) and there is an accident avoidance operation (No. (2)).

[0158] Fig.40 1 is a diagram showing an example of the accident avoidance operation flag 13401 in the fourth embodiment of the present invention. For example, flag 0 (No. (1)) is when the result of the accident avoidance operation determined based on the driver input is that there is no accident avoidance operation, and flag 1 (No. (2)) is when the result of the accident avoidance operation determined based on the driver input is that there is an accident avoidance operation.

[0159] The main features of the fourth embodiment can also be summarized as follows:

[0160] The software verification system (server 6) detects degradation (performance degradation) of the control software of the new version (Ver.N+1) using the first information (accident avoidance necessity flag (Ver.N) 110), the second information (accident avoidance necessity flag (Ver.N+1) 113), and the third information related to the control of the vehicle other than the first information and the second information (accident avoidance operation flag (driver) 134). Here, the third information (accident avoidance operation flag (driver) 134) is information indicating whether the driver has performed an accident avoidance operation.

[0161] By using the third information (accident avoidance operation flag (driver) 134 ), the degradation detection performance can be improved.

[0162] The configuration and operation of the server 6 are the same as those of the first embodiment, and thus description thereof is omitted. The performance determination unit 122 , the determination performance 123 , the log output unit 124 , and the log information 125 may also be provided in the vehicle control device 1 as in the second embodiment.

[0163] As described above, the software verification system in this embodiment can compare the driver's judgment result with the output result of the control software by acquiring the accident avoidance operation flag based on the input information input by the driver. As a result, the effect of obtaining sensor data in the scene where the system is not operating correctly is produced.

[0164] According to the first to fourth embodiments of the present invention, a performance judgment of a new version of the software is performed, and the performance judgment is performed by comparing the running results of the old version of the software, the running results of the new version of the software, and the detected accident avoidance operation information, so that the data collection required for performance improvement can be achieved. In addition, sensor data is selected based on the judgment performance of the new version of the software, thereby reducing the amount of log information sent to the server. In addition, by dividing the processing into real-time transmission or non-real-time transmission when sending log information to the server, the hardware cost can be reduced by using data transmission that takes into account the processing load in the vehicle control device. In addition, by using driver input information for accident avoidance operation information, sensor data in scenarios where the system is not operating normally can be obtained.

[0165] It should be noted that the present invention is not limited to the above-mentioned embodiments, and includes various modified examples. For example, the above-mentioned embodiments are embodiments described in detail for easy understanding of the present invention, and are not limited to all the structures described. In addition, a part of the structure of a certain embodiment can be replaced with the structure of other embodiments, and in addition, the structure of other embodiments can be added to the structure of a certain embodiment. In addition, with respect to a part of the structure of each embodiment, other structures can be added, deleted, or replaced.

[0166] In addition, a part or all of the above-mentioned structures, functions, etc. may be realized by hardware, for example, in integrated circuit design. In addition, the above-mentioned structures, functions, etc. may be realized by software by interpreting and running the programs that realize the various functions by the processor. The information of the programs, tables, files, etc. that realize the various functions can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

[0167] Description of Reference Numerals

[0168] 1Vehicle Control Device

[0169] 2Gateway

[0170] 3 Camera control device

[0171] 4 Radar control device

[0172] 5Sonar control device

[0173] 6. Server

[0174] 101 Radar sensor information acquisition unit

[0175] 102 Radar sensor information

[0176] 103 Camera sensor information acquisition unit

[0177] 104 Camera sensor information

[0178] 105 Object detection unit (radar)

[0179] 106 Object Detection Results (Radar)

[0180] 107 Accident avoidance necessity sign (radar)

[0181] 108 Object Detection Unit (Ver.N)

[0182] 109 object detection results (Ver.N)

[0183] 110 accident avoidance necessity sign (Ver.N)

[0184] 111 Object Detection Unit (Ver.N+1)

[0185] 112 object detection results (Ver.N+1)

[0186] 113 Accident avoidance necessity mark (Ver.N+1)

[0187] 114 Server Sending Unit

[0188] 115 Server receiving unit

[0189] 116 Necessity judgment result of accident avoidance

[0190] 117 Camera sensor information

[0191] 118 Performance Judgment Department

[0192] 119 Judging Performance

[0193] 120 Log output unit

[0194] 121 log information

[0195] 122 Performance Judgment Department

[0196] 123 Judging Performance

[0197] 124 Log output unit

[0198] 125 Log information

[0199] 126 Real-time sending department

[0200] 127 Send log information in real time

[0201] 128 Non-real-time sending unit

[0202] 129 Send log information in non-real time

[0203] 130 Driver input acquisition unit

[0204] 131 Driver input information

[0205] 132 Accident Avoidance Operation Detection Department

[0206] 133 Accident avoidance operation test results

[0207] 134 Accident avoidance maneuver sign (driver).

Claims

1. A software verification system, wherein: detecting degradation of the new version of control software using first information, second information, and third information, wherein the first information is output of the current version of control software used for controlling the vehicle when sensor data from a sensor mounted on the vehicle is used as input, the second information is output of the new version of control software not used for controlling the vehicle when the sensor data is used as input, and the third information is information related to the control of the vehicle other than the first information and the second information; as well as The new version of control software is validated using the sensor data when the degradation is detected.

2. The software verification system according to claim 1, comprising: a degradation detection unit for detecting the degradation, which is mounted on the vehicle; a log information adding unit mounted on the vehicle and adding log information related to the degradation to the sensor data at the time when the degradation is detected by the degradation detecting unit; and A data transmission unit is mounted on the vehicle and transmits the sensor data to which the log information is added to a server.

3. The software verification system according to claim 2, wherein: A storage unit for storing the log information is provided, wherein the storage unit is mounted on the vehicle, The data transmission unit transmits the data stored in the storage unit to a server when the vehicle stops.

4. The software verification system according to any one of claims 1 to 3, wherein: When the first information and the second information do not match, and the first information and the third information match, it is determined that the information is degraded.

5. The software verification system according to claim 4, wherein: The third information is information indicating whether or not the driver has performed an accident avoidance operation.

6. The software verification system according to claim 4, wherein: The third information is information indicating whether an accident needs to be avoided based on the radar sensor. The sensor mounted on the vehicle is a camera.

7. A vehicle control device, which is a vehicle control device used in the software verification system according to claim 1, comprising: a degradation detection unit for detecting the degradation; a log information adding section that adds log information related to degradation to sensor data at a time when degradation is detected by the degradation detecting section; and The data sending unit sends the sensor data with the log information added thereto to the server.

8. A vehicle control device, which is a vehicle control device used in the software verification system according to claim 1, comprising: a degradation detecting section for detecting the degradation; and a log information adding unit that adds log information related to degradation to the sensor data at the time when the degradation is detected by the degradation detecting unit, The sensor data to which the log information is added is output to a data transmission unit that transmits the data to a server.

9. A vehicle control device comprising: a degradation detection unit that detects degradation of a new version of control software using first information, second information, and third information, the first information being an output of a current version of control software used for control of the vehicle when sensor data from a sensor mounted on the vehicle is input, the second information being an output of the new version of control software that is not used for control of the vehicle when the sensor data is input, and the third information being information related to control of the vehicle other than the first information and the second information; and A log information adding section that adds log information related to the degradation to the sensor data at the time when the degradation is detected by the degradation detecting section.

10. A software verification system, wherein: determining a change in performance of the new version of software relative to the current version of software using first information, second information, and third information, the first information being an output of the current version of software used for controlling the vehicle when sensor data from a sensor mounted on the vehicle is used as input, the second information being an output of the new version of software not used for controlling the vehicle when the sensor data is used as input, and the third information being information related to the control of the vehicle other than the first information and the second information; as well as The new version of the software is verified using sensor data corresponding to a time when it is determined that the performance has changed.

11. The software verification system according to claim 10, wherein: The first information and the second information are information indicating the necessity of avoiding an accident or the presence or absence of avoiding an accident based on the sensor data, The third information is information indicating the necessity of avoiding an accident or the presence or absence of avoiding an accident based on data different from the sensor data. (1) when the first information, the second information, and the third information are information indicating that the accident avoidance is necessary or has been performed, determining that the performance has not changed, (2) when the first information and the third information are information indicating that the accident avoidance is necessary or has been performed, and the second information is information indicating that the accident avoidance is unnecessary or has not been performed, determining that the performance has deteriorated; (3) when the second information and the third information are information indicating that the accident avoidance is necessary or has been performed, and the first information is information indicating that the accident avoidance is unnecessary or has not been performed, determining that the performance has been improved; (4) when the third information is information indicating that the accident avoidance is necessary or has been performed, and the first information and the second information are information indicating that the accident avoidance is unnecessary or has not been performed, it is determined that the performance has not changed; (5) when the first information and the second information are information indicating that the accident avoidance is necessary or has been performed, and the third information is information indicating that the accident avoidance is unnecessary or has not been performed, it is determined that the performance has not changed, (6) when the first information is information indicating that the accident avoidance is necessary or has been performed, and the second information and the third information are information indicating that the accident avoidance is unnecessary or has not been performed, determining that the performance has been improved; (7) when the second information is information indicating that the accident avoidance is necessary or has been performed, and the first information and the third information are information indicating that the accident avoidance is not necessary or has not been performed, determining that the performance is degraded, (8) When the first information, the second information, and the third information are information indicating that the accident avoidance is not necessary or has not been performed, it is determined that the performance has not changed.

12. The software verification system according to claim 11, wherein: The sensor data corresponding to the results of the judgments of (2), (4), (5) and (7) are used as training data for situations where the new version of the software needs to be improved, and machine learning is performed. Alternatively, the sensor data corresponding to the results of the judgments of (1), (3), (6) and (8) are used as training data for situations where there is no need to improve the new version of the software, and machine learning is performed.

Images