Vehicle control system

Abstract

A vehicle control system is provided with a plurality of functional system ECUs each having a memory and a CPU. Each of the plurality of functional system ECUs transmits version information relating to the version of the own software. When the at least one function system ECU receives the version information transmitted from the other function system ECU, the at least one function system ECU determines an executable function among the plurality of functions on the basis of the version of the software of the at least one function system ECU and the version indicated by the version information, and permits execution of the function determined to be executable among the plurality of functions. The execution of the function determined to be non-executable is prohibited.

Description

Technical Field

[0001] The present disclosure relates to a vehicle control system including a plurality of electronic control units. Background Art

[0002] Japanese Patent Application Laid-Open No. 2019-159399 discloses a vehicle control system including a plurality of electronic control units. Each of the plurality of electronic control units includes a CPU and a memory that stores software executed by the CPU. In the vehicle control system, when combinations of versions of software of the plurality of electronic control units match, execution of a plurality of functions related to various vehicle travels such as autonomous driving is permitted. On the other hand, when combinations of versions of software of the plurality of electronic control units do not match, execution of the above-described plurality of functions is prohibited.

[0003] In the above-described system, when combinations of versions of software of the plurality of electronic control units do not match, execution of the above-described plurality of functions is uniformly prohibited. Summary of the Invention

[0004] In one aspect of the present disclosure, a vehicle control system is a system including a plurality of electronic control units that store software for executing a plurality of functions related to travel of a vehicle. In the vehicle control system, each of the plurality of electronic control units includes a circuit that executes a process of transmitting version information related to a version of software stored in itself. A circuit of at least one of the plurality of electronic control units is configured to execute the following processes: receiving the version information transmitted from an electronic control unit other than itself, that is, another electronic control unit; when receiving the version information transmitted from the other electronic control unit, determining an executable function among the plurality of functions based on a version of software stored in itself and the version indicated by the version information; and permitting execution of the determined executable function among the plurality of functions and prohibiting execution of the determined non-executable function. Brief Description of the Drawings

[0005] Figure 1 is a configuration diagram of a vehicle including a vehicle control system according to an embodiment and a server capable of communicating with the vehicle.

[0006] Figure 2 is a diagram showing Figure 1 an example of a correspondence table stored in a memory of an electronic control unit included in the vehicle control system.

[0007] Figure 3 is a diagram showing Figure 1 a timing chart of a process for determining an executable function among a plurality of functions in the vehicle control system.

[0008] Figure 4 It represents a flowchart of a series of processes executed by the CPU included in an electronic control unit in a vehicle control system Figure 1 as shown in Figure 1 . Detailed implementation mode

[0009] Hereinafter, an implementation mode of the vehicle control system will be described based on Figures 1 to 4 Figures 1 to 4 .

[0010] Figure 1 It shows vehicle 10 and server 100 installed outside the vehicle. Vehicle 10 is equipped with vehicle control system 20.

[0011] <Server>

[0012] Server 100 is an administrative server installed outside vehicle 10. Server 100 manages software related to a plurality of pre-registered vehicles 10. Server 100 exchanges various information with vehicle 10 via an external vehicle network 200. The external vehicle network 200 is for wireless communication. For example, server 100 sends update software for the vehicle 10 to vehicle 10 according to a request from vehicle 10.

[0013] <Vehicle control system>

[0014] Vehicle control system 20 is equipped with a plurality of electronic control units configured to be able to exchange information with each other via an in-vehicle network 21. Hereinafter, the electronic control unit will be referred to as "ECU". The plurality of ECUs include DCM 22 and OTA manager 23. "DCM" is an abbreviation for "Data Communication Module". "OTA" is an abbreviation for "Over The Air". DCM 22 is a data communication module that communicates with server 100 via external vehicle network 200. OTA manager 23 manages the software of a plurality of ECUs including itself.

[0015] The plurality of ECUs further include a plurality of functional system ECUs 24, 25, 26. For example, the plurality of functional system ECUs include ECUs as shown below.

[0016] · An ADAS-ECU that collects information for assisting the driving operation of the driver of vehicle 10, etc.

[0017] · An ECU that controls the power sources of vehicle 10 such as an engine and a driving motor.

[0018] · An ECU that controls the braking device of vehicle 10.

[0019] · An ECU that controls an actuator that adjusts the steering of the wheels of vehicle 10.

[0020] The DCM 22, the OTA manager 23, and the multiple functional system ECUs 24, 25, and 26 each have a CPU 31 and a memory 32. Software executed by the CPU 31 is stored in the memory 32. The multiple functional system ECUs 24, 25, and 26 can execute multiple functions related to the running of the vehicle 10 by the CPU 31 executing the software in the memory 32. As the multiple functions, for example, functions such as autonomous driving, automatic braking for collision avoidance, lane keeping assist, and adaptive cruise control can be cited. In addition, the function of autonomous driving may include at least one of the functions of autonomous driving at level 2 of autonomous driving, the function of autonomous driving at level 3 of autonomous driving, the function of autonomous driving at level 4 of autonomous driving, and the function of autonomous driving at level 5 of autonomous driving.

[0021] The software stored in the memories 32 of the multiple functional system ECUs 24, 25, and 26 can be appropriately rewritten as update software sent from the server 100. That is, in the multiple functional system ECUs 24, 25, and 26, the version upgrade of the software can be appropriately performed.

[0022] Here, the above-mentioned multiple functions can be executed through the cooperation of the multiple functional system ECUs. At this time, when the versions of the software in the multiple functional system ECUs do not match, sometimes at least a part of the multiple functions cannot be executed.

[0023] In view of this, a correspondence table 50 as shown is stored in the memories 32 of the multiple functional system ECUs 24, 25, and 26 respectively. If the software is updated in at least one of the multiple functional system ECUs 24, 25, and 26, the correspondence table 50 in the memories 32 of the multiple functional system ECUs 24, 25, and 26 is also updated. Figure 2 Shown as above.

[0024] Hereafter, for the convenience of understanding the specification, it is assumed that there are 3 functional system ECUs, namely the first ECU 24, the second ECU 25, and the third ECU 26, and the number of functions is 3 for explanation.

[0025] To execute the first function among the 3 functions, the first ECU 24 and the second ECU 25 among the 3 functional system ECUs 24, 25, and 26 are required, and the third ECU 26 is not required. To execute the second function and the third function among the 3 functions, all of the 3 functional system ECUs 24, 25, and 26 are required.

[0026] In Figure 2 Four modes PT1, PT2, PT3, and PT4 are shown as the combination modes of the versions of each software.

[0027] In mode PT1, the software version in any one of the first ECU 24, the second ECU 25, and the third ECU 26 is "1.0". In the case of mode PT1, the first function, the second function, and the third function can all be executed.

[0028] That is, when the software version in any one of the first ECU 24 and the second ECU 25 is "1.0", in terms of executing the first function, it can be determined that the combination of the software versions of the first ECU 24 and the second ECU 25 matches. In addition, when the software version in any one of the three functional system ECUs 24, 25, and 26 is "1.0", in terms of executing the second function and the third function, it can be determined that the combination of the software versions of the three functional system ECUs 24, 25, and 26 matches.

[0029] In mode PT2, the software versions of the first ECU 24 and the second ECU 25 are "1.0", and the software version of the third ECU 26 is "2.0". In the case of mode PT2, the first function and the second function can be executed, while the third function cannot be executed.

[0030] That is, when the software versions of the first ECU 24 and the second ECU 25 are "1.0" and the software version of the third ECU 26 is "2.0", in terms of executing the second function, it can be determined that the combination of the software versions of the three functional system ECUs 24, 25, and 26 matches. On the other hand, in terms of executing the third function, it can be determined that the combination of the software versions of the three functional system ECUs 24, 25, and 26 does not match.

[0031] In mode PT3, the software version of the first ECU 24 is "1.0", and the software versions of the second ECU 25 and the third ECU 26 are "2.0". In the case of mode PT3, none of the first function, the second function, and the third function can be executed.

[0032] That is, when the software version of the first ECU 24 is "1.0" and the software version of the second ECU 25 is "2.0", in terms of executing the first function, it can be determined that the combination of the software versions of the first ECU 24 and the second ECU 25 does not match. When the software version of the first ECU 24 is "1.0" and the software versions of the second ECU 25 and the third ECU 26 are "2.0", in terms of executing the second function and the third function, it can be determined that the combination of the software versions of the three functional system ECUs 24, 25, and 26 does not match.

[0033] In mode PT4, the software version in any one of the first ECU 24, the second ECU 25, and the third ECU 26 is "2.0". In the case of mode PT4, the first function, the second function, and the third function can all be executed.

[0034] That is, when the software version in any one of the first ECU 24 and the second ECU 25 is "2.0", it can be determined that the combination of the software versions of the first ECU 24 and the second ECU 25 matches in terms of executing the first function. In addition, when the software version in any one of the three functional system ECUs 24, 25, and 26 is "2.0", it can be determined that the combination of the software versions of the three functional system ECUs 24, 25, and 26 matches in terms of executing the second function and the third function.

[0035] <Process flow when allowing or prohibiting function execution>

[0036] Refer to Figure 3 , and the process flow of the entire vehicle control system 20 when allowing function execution or prohibiting execution will be described.

[0037] First, if the power system of the vehicle 10 is turned on, the multiple functional system ECUs 24, 25, and 26 are started (ST10). Then, the multiple functional system ECUs 24, 25, and 26 send their control information to other ECUs via the in-vehicle network 21. The control information includes information related to the software version stored in their own memory 32, that is, version information. In this example, the control information sent by the first ECU 24 in step ST101 is received by the second ECU 25. The control information sent by the first ECU 24 in step ST102 is received by the third ECU 26. The control information sent by the second ECU 25 in step ST201 is received by the third ECU 26. The control information sent by the second ECU 25 in step ST202 is received by the first ECU 24. The control information sent by the third ECU 26 in step ST301 is received by the second ECU 25. The control information sent by the third ECU 26 in step ST302 is received by the first ECU 24.

[0038] If the transmission and reception of such control information are completed, each of the multiple functional system ECUs 24, 25, and 26 proceeds to the next process.

[0039] In the first ECU 24, in step ST103, a matching determination process is executed to determine whether the combination of the software versions matches for each function. Moreover, in the first ECU 24, in the next step ST104, it is determined whether to allow function execution for each function.

[0040] Similarly, in the second ECU 25, in step ST203, the same matching determination process as the above step ST103 is performed. Moreover, in the second ECU 25, in the next step ST204, the same process as the above step ST104 is performed.

[0041] Similarly, in the third ECU 26, in step ST303, the same matching determination process as the above step ST103 is performed. Moreover, in the third ECU 26, in the next step ST304, the same process as the above step ST104 is performed.

[0042] In Figure 3 In the example shown, after step ST104, the first ECU 24 acquires the software of the latest version sent from the server 100. When the first ECU 24 is not reset, in the first ECU 24, the CPU 31 continues to execute the software of a version older than the latest version.

[0043] However, when the vehicle control system 20 is operating, sometimes for some reason the first ECU 24 is reset and the first ECU 24 is restarted (ST11). In this case, in the first ECU 24, the CPU 31 executes the software of the latest version. Then, the first ECU 24 sends its own control information to the other ECUs 25 and 26 via the in-vehicle network 21. That is, the control information sent by the first ECU 24 in step ST106 is received by the second ECU 25. The control information sent by the first ECU 24 in step ST107 is received by the third ECU 26.

[0044] If the transmission and reception of such control information are completed, each of the multiple functional system ECUs 24, 25, and 26 proceeds to the next process.

[0045] In the first ECU 24, in step ST108, the same matching determination process as the above step ST103 is performed. Moreover, in the first ECU 24, in the next step ST109, the same process as the above step ST104 is performed.

[0046] Similarly, in the second ECU 25, in step ST208, the same matching determination process as the above step ST203 is performed. Moreover, in the second ECU 25, in the next step ST209, the same process as the above step ST204 is performed.

[0047] Similarly, in the third ECU 26, in step ST308, the same matching determination process as the above step ST303 is performed. Moreover, in the third ECU 26, in the next step ST309, the same process as the above step ST304 is performed.

[0048] <Content processed in the function ECU>

[0049] Refer to Figure 4 and describe a series of processes executed by the CPUs 31 of the function system ECUs 24, 25, and 26 to determine the permission or prohibition of the execution of multiple functions.

[0050] When the power supply to the function system ECUs 24, 25, and 26 is started, in step S11, the CPU 31 executes a startup process for starting the function system ECUs 24, 25, and 26. For example, in the startup process, the CPU 31 executes the software in the memory 32. When there are multiple software programs stored in the memory 32, the CPU 31 executes the software of the latest version.

[0051] In the following step S13, the CPU 31 determines whether the startup of the function system ECUs 24, 25, and 26 is successful. If it is determined that the startup is successful (S13: Yes), the CPU 31 moves the process to step S15. On the other hand, if it is determined that the startup is not successful (S13: No), the CPU 31 ends Figure 4 the series of processes shown.

[0052] In step S15, the CPU 31 sends its own control information to other ECUs through the in-vehicle network 21. At this time, other ECUs include not only other function system ECUs but also the DCM 22 and the OTA manager 23.

[0053] In the next step S17, the CPU 31 receives the control information sent by other function system ECUs through the in-vehicle network 21.

[0054] In the following step S19, the CPU 31 executes a matching determination process. For example, the CPU 31 uses Figure 2 the corresponding table 50 shown to execute the matching determination process.

[0055] Here, the matching determination process executed by the CPU 31 of the first ECU 24 is described. The CPU 31 determines whether the software version of the first ECU 24 matches the software version of the second ECU 25 when executing the first function. The CPU 31 determines whether the software versions of the three function system ECUs 24, 25, and 26 match when executing the second function. The CPU 31 determines whether the software versions of the three function system ECUs 24, 25, and 26 match when executing the third function.

[0056] If the CPU 31 has executed the matching determination process, it moves the process to step S21. In step S21, the CPU 31 sets the coefficient N to 1.

[0057] In the subsequent step S23, the CPU 31 determines whether the version matches for the Nth function based on the execution result of the above-mentioned matching determination process. When it is determined that the version matches for the Nth function (S23: Yes), the CPU 31 moves the process to step S25. In step S25, the CPU 31 allows the execution of the Nth function. Further, the CPU 31 moves the process to step S29.

[0058] On the other hand, in step S23, when it is determined that the version does not match for the Nth function (S23: No), the CPU 31 moves the process to step S27. In step S27, the CPU 31 prohibits the execution of the Nth function. Further, the CPU 31 moves the process to step S29.

[0059] In step S29, the CPU 31 determines whether the coefficient N is equal to or greater than the number of functions Nth. The number of functions Nth is the total number of functions. In the present embodiment, the total number of functions is 3. When the coefficient N is less than the number of functions Nth (S29: No), the CPU 31 moves the process to step S31. In step S31, the CPU 31 updates the coefficient N by incrementing it by 1. Further, the CPU 31 moves the process to step S23.

[0060] On the other hand, in step S29, when the coefficient N is equal to or greater than the number of functions Nth (S29: Yes), the CPU 31 moves the process to step S15. That is, when the coefficient N is equal to or greater than the number of functions Nth, the CPU 31 has completed the determination of whether all functions can be executed.

[0061] <Function and Effect of the Present Embodiment>

[0062] Each of the plurality of function system ECUs 24, 25, 26 transmits version information related to the version of the software stored in itself to the in-vehicle network 21. Each of the plurality of function system ECUs 24, 25, 26 receives the version information transmitted from other function system ECUs other than itself. Further, each of the plurality of function system ECUs 24, 25, 26 discriminates executable functions among the plurality of functions based on the version of the software in its own memory 32 and the version indicated by the version information from other function system ECUs. Each of the plurality of function system ECUs 24, 25, 26 allows the start of the functions discriminated as executable among the plurality of functions, while prohibiting the start of the functions discriminated as non-executable.

[0063] Accordingly, in the vehicle control system 20, when the versions of the software of the plurality of function system ECUs 24, 25, 26 do not match, the execution of the plurality of functions is not uniformly prohibited. That is, the vehicle control system 20 can suppress the situation where none of the plurality of functions can be executed.

[0064] As described above, sometimes while the vehicle control system 20 is operating, for example, the first ECU 24 obtains the latest version of the software. In this case, if the first ECU 24 is reset and then restarted, the CPU 31 in the first ECU 24 executes the latest version of the software. Then, the first ECU 24 sends version information indicating the latest version to the other functional system ECUs 25 and 26. In this case, a matching determination process is executed in each of the multiple ECUs 24, 25, and 26. As a result, the execution of a function that was executed before the first ECU 24 was reset may be prohibited. In addition, there are also cases where the execution of a function that was prohibited from being executed before the first ECU 24 was reset is permitted.

[0065] <Change Example>

[0066] The above-described embodiment can be implemented by being changed as follows. The above-described embodiment and the following change examples can be implemented in combination with each other within a range where there is no technical contradiction.

[0067] · The number of functional system ECUs only needs to be two or more, and can be any number other than three.

[0068] · The vehicle control system 20 can be configured such that one of the multiple functional system ECUs functions as an OTA manager.

[0069] · Only a part of the multiple functional system ECUs 24, 25, and 26 may execute the following processes (A1), (A2), and (A3).

[0070] (A1) Receive version information sent from other functional system ECUs.

[0071] (A2) Based on the version of the software stored in itself and the version indicated by the version information received from other functional system ECUs, determine the executable functions among the multiple functions.

[0072] (A3) Permit the start of the functions determined to be executable among the multiple functions, and prohibit the start of the functions determined to be non-executable.

[0073] · The ECU is not limited to a structure that includes a CPU and a ROM to execute software processing. That is, the ECU can be any of the following structures (a), (b), and (c).

[0074] (a) The ECU includes one or more processors that execute various processes according to a computer program. The processors include memories such as a CPU, a RAM, and a ROM. The memory stores program codes or instructions configured to cause the CPU to execute processes. The memory, that is, the computer-readable medium, includes all available media that can be accessed by a general or dedicated computer.

[0075] (b) The ECU has one or more dedicated hardware circuits that perform various processes. As the dedicated hardware circuits, for example, application-specific integrated circuits, that is, ASICs or FPGAs, can be cited. Among them, ASIC is the abbreviation of "Application Specific Integrated Circuit", and FPGA is the abbreviation of "Field Programmable Gate Array".

[0076] (c) The ECU has one or more processors that perform a part of various processes according to a computer program and one or more dedicated hardware circuits that perform the remaining processes of the various processes.

[0077] Herein, the expression "at least one" used in this specification means "more than one" of the desired options. As an example, if the number of options is two, the expression "at least one" used in this specification means "only one option" or "both of the two options". As another example, if the number of options is three or more, the expression "at least one" used in this specification means "only one option" or "any combination of two or more options".

Claims

1. A vehicle control system includes a plurality of electronic control units that store software for executing a plurality of functions related to the running of a vehicle. Among them, each of the plurality of electronic control units includes a circuit that performs a process of transmitting version information related to the version of the software stored in itself. The circuit of at least one electronic control unit among the plurality of electronic control units is configured to perform the following processes: receive the version information transmitted from other electronic control units other than itself; when receiving the version information transmitted from the other electronic control units, determine the executable functions among the plurality of functions based on the version of the software stored in itself and the version indicated by the version information; and allow the execution of the functions determined to be executable among the plurality of functions, and prohibit the execution of the functions determined to be non-executable.

2. The vehicle control system according to claim 1, wherein to execute the first function among the plurality of functions, the first electronic control unit and the second electronic control unit among the plurality of electronic control units are required, and the third electronic control unit is not required. The circuits of the first electronic control unit and the second electronic control unit are configured to perform the following processes respectively: receive the version information transmitted from other electronic control units other than itself; when receiving the version information transmitted from the other electronic control units, determine that the first function is executable when the combination of the version of the software of the first electronic control unit and the version of the software of the second electronic control unit matches, and on the other hand, determine that the first function is non-executable when the combination does not match.

3. The vehicle control system according to claim 1 or 2, wherein to execute the second function among the plurality of functions, the first electronic control unit, the second electronic control unit, and the third electronic control unit among the plurality of electronic control units are required. The circuits of the first electronic control unit, the second electronic control unit, and the third electronic control unit are configured to perform the following processes respectively: receive the version information transmitted from other electronic control units other than itself; when receiving the version information transmitted from the other electronic control units, determine that the second function is executable when the combination of the version of the software of the first electronic control unit, the version of the software of the second electronic control unit, and the version of the software of the third electronic control unit matches, and on the other hand, determine that the second function is non-executable when the combination does not match.

Images