VEHICLE CONTROL SYSTEM

Abstract

A vehicle control system is provided that is capable of ensuring reliability and utilizing an inactive verification resource during periods of non-verification. A vehicle control system 100 comprises a first processing unit 102, which stores a first vehicle control software and outputs a vehicle control signal through external information; a second processing unit 107, which stores a second software 108, the version of which is identical to or different from that of the first software 103, and outputs a vehicle control signal through external information; an output comparison unit 109, which compares an output of the first processing unit 102 with an output of the second processing unit 107; a transmitting unit 111, which outputs data to the server 115 according to a determination result of the output comparison unit 109; and a data path setup unit 104.which establishes a data path through outputs of the first processing unit 102 and the second processing unit 107, a software version check unit 106, which checks the versions of the first software 103 and the second software 108 and outputs a result to the data path setup unit 104, and a vehicle control unit 105, which controls a vehicle based on control data from the data path setup unit 104.

Description

Technical field

[0001] The present invention relates to a vehicle control system. background

[0002] The automated driving system contains several electronic control units (ECUs). Each of the multiple ECUs is equipped with control software for external detection, route planning, vehicle control, and the like, and the control software becomes increasingly complex as the automated driving system is further developed.

[0003] To realize a high-quality automated driving system, a highly complete verification procedure is required that includes test cases that rarely occur.

[0004] PTL 1 describes a technique for comparing the outputs of an older version of control software with those of a newer version, and for outputting information that indicates an inconsistency in the outputs. Furthermore, PTL 1 describes a technique in which an older control software unit and a newer control software unit perform detection processing, route planning, and control commands based on input sensor values. Citation list for patent literature

[0005] PTL 1: JP 2022-13187 A Overview of the invention Technical problem

[0006] PTL 1 describes a software verification procedure performed by comparing new and old software, but it includes a specific resource for verification that is currently unavailable. There is no mention of a method for its effective use.

[0007] Furthermore, in a case where a resource is effectively used for verification at the time of non-verification, a path to vehicle control is required, but on the other hand, a result of verification and evaluation in shadow mode is not used for vehicle control at the time of verification.

[0008] One objective of the present invention is to provide a vehicle control system that is able to effectively utilize a verification resource that is not working at the time of non-verification, while ensuring reliability. Solution to the problem

[0009] To achieve the above objective, the present invention is designed as follows.

[0010] A vehicle control system comprises: a first processing unit that stores initial software used to control a vehicle, uses external information from an external sensor as input, and outputs a control signal used to control the vehicle; a second processing unit that stores second software, either the same version as the first software or a different version, which uses external information as input and outputs a control signal related to the control of the vehicle; an output comparison unit that compares an output from the first processing unit with an output from the second processing unit; a transmission unit that outputs data to a server based on a determination result from the output comparison unit; and a data path setup unit.into which an output from the first processing unit and an output from the second processing unit are fed and which establishes a data path, a software version check unit, which checks the versions of the first software stored in the first processing unit and the second software stored in the second processing unit and outputs a check result to the data path build-up unit, and a vehicle control unit, which controls the vehicle based on control data from the data path build-up unit. Advantageous effects of the invention

[0011] By checking the new and old control software versions and switching the path to be used for vehicle control only when the versions are identical, it is possible to effectively utilize the verification resources that are not working at the time of non-verification while ensuring reliability, so that the output is not used for vehicle control at the time of verification. Brief description of the drawings [ Fig. 1] Fig. Figure 1 is a block diagram of a vehicle control system according to a first embodiment of the present invention. [ Fig. 2] Fig. Figure 2 is an operating sequence diagram of the vehicle control system according to the first embodiment of the present invention. [ Fig. 3] Fig. Figure 3 is a diagram illustrating a modification of the vehicle control system according to the first embodiment of the present invention. [ Fig. 4] Fig. Figure 4 is a block diagram of a vehicle control system according to a second embodiment of the present invention. [ Fig. 5] Fig. Figure 5 is an operating sequence diagram of the vehicle control system according to the second embodiment of the present invention. [ Fig. 6] Fig. Figure 6 is a block diagram of a vehicle control system according to a third embodiment of the present invention. [ Fig. 7] Fig. Figure 7 is an operating flow diagram of the vehicle control system according to the third embodiment of the present invention. [ Fig. 8] Fig. Figure 8 is a time diagram for the third embodiment of the present invention. [ Fig. 9] Fig. Figure 9 is a block diagram of a vehicle control system according to a fourth embodiment of the present invention. [ Fig. 10] Fig. Figure 10 is an operating flow diagram of the vehicle control system according to the fourth embodiment of the present invention. [ Fig. 11] Fig. Figure 11 is a comparison table for the fourth embodiment of the present invention. Description of the embodiments

[0012] In the following, embodiments of the present invention are described with reference to the drawings. [Versions](First version)

[0013] Fig. Figure 1 is a block diagram of a vehicle control system 100 according to a first embodiment of the present invention. The vehicle control system 100 comprises a sensor receiver unit 101, a first processing unit 102, a data reception path switching unit 104, a vehicle control unit 105 that controls the vehicle, a software version check unit 106, a second processing unit 107, an output comparison unit 109, a determination unit 110, a transmit / receive unit 111, a software update control unit 112, and a diagnostic unit 113. The diagnostic unit 113 determines whether the first processing unit 113 is operating normally or has failed.

[0014] Furthermore, the first processing unit 102 contains a first software unit 103 on which the current (version N) vehicle control software (first software) is installed and outputs a control signal used to control the vehicle. The second processing unit 107 contains a second software unit 108 on which either the current (version N) vehicle control software (first software) or a new (version N+1) vehicle control software, which differs from the current (version N) software (first software), is installed and outputs a control signal used to control the vehicle.

[0015] The data reception path switching unit 104 outputs the output result of the second processing unit 107 to the vehicle control unit 105 in a case where the vehicle control software installed in the second software unit (second software) 108 is identical to the vehicle control software installed in the first software unit (first software) 103 (non-verification). It does not output the output result of the second processing unit 107 to the vehicle control unit 105 in a case where the vehicle control software is different (verification). Consequently, since the output path from the second processing unit 107 to the vehicle control unit 105 can be rebuilt without affecting reliability at the time of verification, the verification resource can be effectively used at the time of non-verification.

[0016] Fig. Figure 2 is an operational flow diagram of the vehicle control system 100 according to the first embodiment of the present invention. It describes a processing sequence in a case where the verification resource is used to secure the vehicle control system 100 during the time of non-verification.

[0017] The software update control unit 112 receives update software from an external source via OTA (over-the-air) or similar means and updates the control software installed in the first software unit 103 and the second software unit 108 (step 201). Next, the software version check unit 106 verifies and compares the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 (step 202).In a case where the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are different, the software version check unit 106 determines that a verification mode exists to compare the vehicle control software installed (stored) in the first software unit 103 with the vehicle control software installed in the second software unit 108, and instructs a data transmission bus switching unit 301 not to establish the output path from the second software unit 108 to the data reception path switching unit 104. Next, the sensor receiving unit 101 receives sensor data from an external sensor 114 and sends the sensor data as an input sensor value to the first processing unit 102 and the second processing unit 107 (step 203).

[0018] The first software unit 103 executes the current version (version N) of the vehicle control software based on the input sensor value and sends the output result to the output comparison unit 109 and the data reception path switching unit 104 (step 205). The second software unit 108 executes a new version (version N+1) of the vehicle control software based on the input sensor value and sends an output result to the output comparison unit 109 (step 206). The data reception path switching unit 104 receives the output result from the first processing unit 102 and sends the output result to the vehicle control unit 105 (step 212).

[0019] In this case, the data reception path switching unit 104 establishes a path so that it does not receive the output result from the second processing unit 107. Specifically, the output result of the second processing unit 107 is not sent to the data reception path switching unit 104, or processing by the second software unit 108 is stopped. Note that the data reception path switching unit 104 can operate in such a way that it receives the output result from the second processing unit 107 and does not output the result to the vehicle control unit 105 at the time of verification.

[0020] As an advantage of the fact that the data reception path switching unit 104 does not receive the output result from the second processing unit 107, it is possible to avoid a data disturbance in the data reception path switching unit 104.

[0021] The vehicle control unit 105 performs processing such as recognition processing, route planning and control commands based on the vehicle control software output result and implements automatic driving.

[0022] Next, the output comparison unit 109 compares the output results of the first processing unit 102 and the second processing unit 107 and sends the comparison result to the determination unit 110 (step 209). Based on the comparison result, the determination unit 110 decides whether the input sensor value should be output (step 213). If it is determined that the input sensor value should be output, the transmit / receive unit 111 is instructed to output the input sensor value externally. The transmit / receive unit 111 converts the sensor value to be output into a suitable protocol and outputs the protocol to an external server 115 (step 216).

[0023] Furthermore, in a case where the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are identical, the software version test unit 106 determines the non-verification mode (step 202). At this time, in a case where the diagnostic unit 113 determines that the first processing unit 102 is normal (step 204), the data reception path switching unit 104 is instructed not to establish the output path from the second processing unit 107 (determining not to use the vehicle control software installed in the second software unit 108 as a backup).

[0024] Next, the sensor receiving unit 101 receives sensor data from an external sensor 114 and sends the sensor data as an input sensor value to the first processing unit 102 and the second processing unit 107 (step 207). The first software unit 103 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the output result to the data receiving path switching unit 104 (step 210). The data receiving path switching unit 104 receives the output result from the first processing unit 102 and sends the output result to the vehicle control unit 105 (step 214). If the first processing unit 102 is functioning normally, the data receiving path switching unit 104 establishes a path so that it does not receive the output result from the second processing unit 107.

[0025] Furthermore, in a case where the software version check unit 106 determines that the non-verification mode is set and the diagnostic unit 113 determines that the first processing unit 102 has failed (step 204), the data reception path switching unit 104 does not receive the data from the first processing unit 102 and establishes the output path from the second software unit 108.

[0026] Next, the sensor receiving unit 101 receives sensor data from an external sensor 114 and sends the sensor data as an input sensor value to the first processing unit 102 and the second processing unit 107 (step 208). The second software unit 108 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the output result to the data receiving path switching unit 104 (step 211). The data receiving path switching unit 104 receives the output result from the second processing unit 107 and sends the output result to the vehicle control unit 105 (step 215). In a case where the diagnostic unit 113 determines that the first processing unit 102 has failed, the data receiving path switching unit 104 does not receive the data from the first processing unit 102 and establishes a path to receive the data from the second processing unit 107.

[0027] As a result, it is possible to effectively utilize verification resources that are not working at the time of non-verification.

[0028] According to the first embodiment, it is possible to provide the vehicle control system 100 which is able to effectively utilize a verification resource that is not operating at the time of non-verification, while ensuring reliability by preventing an output from being used for vehicle control at the time of verification.

[0029] Note that the second processing unit 107 is designed to contain a second software unit 108, but can, as in Fig. Figure 3 shows that the device is designed to include a second software unit 108A for backup purposes, in addition to the second software unit 108. In the event that the second software unit 108 has failed, normal operation can be maintained by using the second software unit 108A as a backup.

[0030] Furthermore, in the first embodiment the first processing unit 102 and the second processing unit 107 are configured, but three or more processing units can be configured in the same way. (Second embodiment)

[0031] Next, a second embodiment of the present invention will be described.

[0032] Fig. Figure 4 is a block diagram of a vehicle control system 100 according to a second embodiment of the present invention. However, the server 115 is omitted. The difference to Fig. In the first embodiment, a data transmission path switching unit 301 is added, and the vehicle control software installed in the first software unit 103 and the vehicle control software installed in the second software unit 108 are different versions. The data transmission path switching unit 301 outputs the external sensor data (external information) to the first processing unit 102 and the second processing unit 107 in verification mode, in which the output comparison is performed. In non-verification mode, in which the vehicle control software installed in the first software unit 103 and the software installed in the second software unit 108 are the same version and the output comparison is not performed, the data transmission path switching unit 301 stops the output of the external sensor data to the second processing unit 107.

[0033] As a result, data transmission to the second processing unit 107 is omitted in a case where the version of the vehicle control software is identical and verification is not performed in the scene, thus reducing power consumption compared to a case where the second processing unit 107 is always in motion.

[0034] Fig. Figure 5 is an operating flow diagram of the vehicle control system 100 according to the second embodiment of the present invention. In contrast to Fig. In the first embodiment, if the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are different, the verification mode is determined in the software version test unit 106, and the data transmission path switching unit 301 is instructed to establish the input paths to the first processing unit 102 and the second processing unit 107. The data transmission path switching unit 301 receives the sensor data from the sensor receiving unit 101 and sends the sensor data as an input sensor value to the first processing unit 102 and the second processing unit 107 (step 401). Furthermore, if the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are identical, the software version test unit 106 determines the non-verification mode.

[0035] At this time, in a case where the diagnostic unit 113 determines that the first processing unit 102 is normal, the data transmission path switching unit 301 is instructed to establish only the input path to the first processing unit 102. The data transmission path switching unit 301 receives the sensor data from the sensor receiving unit 101 and sends the sensor data as an input sensor value to the first processing unit 102 (step 402).

[0036] Furthermore, if the software version test unit 106 determines that the non-verification mode is set, the data transmission path switching unit 301, in a case where the diagnostic unit 113 determines that the first processing unit 102 has failed, is instructed not to send any data to the first processing unit 102, and the data transmission bus switching unit 301 is instructed to establish a path to send data only to the second software unit 108. The data transmission path switching unit 301 receives the sensor data from the sensor receiving unit 101 and sends the sensor data as an input sensor value to the second processing unit 107 (step 403).

[0037] As a result, it is possible to effectively utilize verification resources that are not working at the time of non-verification.

[0038] In the second embodiment, similar to the first embodiment, it is also possible to provide the vehicle control system 100, which is able to effectively utilize a verification resource that is not operating at the time of non-verification, while ensuring reliability by preventing an output from being used for vehicle control at the time of verification.

[0039] Similar to the first embodiment, the second processing unit 107 can be configured as in Fig. 3 shown, designed to include the second software unit 108A as a backup in addition to the second software unit 108. (Third embodiment)

[0040] Next, a third embodiment of the present invention will be described.

[0041] Fig. Figure 6 is a block diagram of a vehicle control system 100 according to a third embodiment of the present invention. However, the server 115 is omitted. A difference to Fig. 4 of the second embodiment consists in that a processing data splitting unit 501 is added instead of the data transmission bus switching unit 301 and a unit 502 for summarizing processing data is added instead of the data reception bus switching unit 104.

[0042] In a case where the vehicle control software installed in the first software unit 103 and the vehicle control software installed in the second software unit 108 are the same version, the processing data splitting unit 501 splits the input external sensor data and sends the split data to the first processing unit 102 and the second processing unit 107. Similar to the data reception path switching unit 104, the processing data aggregation unit 502 establishes a path to receive the output result of the second processing unit 107, aggregates the output of the first processing unit 102 and the output of the second processing unit 107, and outputs the aggregated data to the vehicle control unit 105.

[0043] As a result, the first processing unit 102 and the second processing unit 107 perform the vehicle control processing in parallel in non-verification mode, in which the vehicle control software installed in the first software unit 103 and the vehicle control software installed in the second software unit 108 have the same version and no output comparison is performed, so that the processing speed can be increased.

[0044] Fig. Figure 7 is an operating flow diagram of the vehicle control system 100 according to the third embodiment of the present invention. In contrast to Fig. 5 of the second embodiment, in a case where the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are different, the verification mode is determined in the software version test unit 106, the processing data splitting unit 501 is instructed to establish the input paths to the first processing unit 102 and the second processing unit 107, and the processing data aggregation unit 502 is instructed not to establish the output path from the second processing unit 107.

[0045] The processing data distribution unit 501 receives the sensor data from the sensor receiving unit 101 and sends the sensor data as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 601). The first software unit 103 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the output result to the output comparison unit 109 and the unit 502 for summarizing processing data (step 205).

[0046] The second software unit 108 executes a new version (version N+1) of the vehicle control software based on the input sensor value and sends an output result to the output comparison unit 109 (step 206). The processing data aggregation unit 502 receives the output result from the first processing unit 102 and sends the output result to the vehicle control unit 105 (step 603). In doing so, the processing data aggregation unit 502 establishes a path so that it does not receive the output result from the second processing unit 107.

[0047] In particular, the output result of the second processing unit 107 is not sent to the unit 502 for summarizing processing data, or the processing by the second software unit 108 is stopped.

[0048] Note that the processing unit 502 can operate by receiving the output result from the second processing unit 107 and not outputting the result to the vehicle control unit 105 at the time of verification. As an advantage, the processing unit 502 does not receive the output result from the second processing unit 107, thus preventing data corruption within the processing unit 502.

[0049] Furthermore, in a case where the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are identical, the software version check unit 106 determines the non-verification mode, instructs the processing data splitting unit 501 to split the input sensor value for each time or for each input sensor and establish a path to be fed into the first processing unit 102 and the second processing unit 107, and instructs the processing data summarization unit 502 to establish an output path from the first processing unit 102 and the second processing unit 107 and to summarize and reconstruct the processing data.

[0050] Next, the processing data splitting unit 501 receives the sensor data from the sensor receiving unit 101, splits the sensor data for each time or for each input sensor, and sends the sensor data as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 602). The first software unit 103 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the output result to unit 502 for processing data summarization (step 210). The second software unit 108 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the output result to unit 502 for processing data summarization (step 211).The processing unit 502 receives the output results from the first processing unit 102 and the second processing unit 107, summarizes the output results of the first software unit 103 and the second software unit 108, and then sends the summarized output results to the vehicle control unit 105 (step 604).

[0051] Fig. Figure 8 is an example of a timing diagram for the processing data splitting process in the third embodiment of the present invention. For example, the processing of the processing data splitting unit 501, the first processing unit 102, the second processing unit 107, and unit 502 for summarizing processing data is described in a case where data from sensor value 0 to sensor value 3 are fed in as input sensor values.

[0052] In Fig. 8. The processing data splitting unit 501 splits the input sensor value such that sensor values ​​0 and 2 are sent to the first processing unit 102, and sensor values ​​1 and 3 are sent to the second processing unit 107. The split input sensor values ​​are then sent to both the first processing unit 102 and the second processing unit 107. The first processing unit 102 and the second processing unit 107 execute the vehicle control software of the current version (version N) based on the input sensor value and send the output result back to unit 502 for processing data aggregation.The processing unit 502, for summarizing processing data, arranges the output result sensor values ​​received from the first processing unit 102 and the second processing unit 107 in the order of sensor value 0 to sensor value 3, and summarizes and reconstructs the output result sensor values.

[0053] As described above, the processing speed can be increased because the input sensor value can be divided and processed for each time period. Although the division method has been described for each time period, the present invention is not specifically limited to this.

[0054] Furthermore, the processing speed can be similarly increased in a case where multiple external sensors are present, even if the external sensors are distributed among each input sensor. That is, in the third embodiment, as in the first embodiment, the following applies: Fig. Figure 2 shows that the second processing unit 107 is configured to include the second software unit 108A in addition to the second software unit 108. However, in the third embodiment, the second software unit 108A does not serve as a backup, but rather for further dividing and processing the sensor value. This configuration allows for further acceleration of the sensor value processing.

[0055] According to the third embodiment, an effect similar to that of the first embodiment can be achieved, and an effect can be achieved in which the processing of the sensor value can be further accelerated. (Fourth embodiment)

[0056] Next, a fourth embodiment of the present invention will be described.

[0057] Fig. Figure 9 is a block diagram of a vehicle control system 100 according to a fourth embodiment of the present invention. However, the server 115 is omitted. The difference to Fig. 6 of the third embodiment consists in the addition of an operating determination unit 801 and a third software unit (third software) 802, on which software of the same version as the vehicle control software installed in the first software unit 103 is installed, being added to the second processing unit 107.

[0058] It is assumed that the second software unit 108 is equipped with both a new vehicle control software (version N+1) and the different current software (version N).

[0059] The operating determination unit 801 determines, based on a specific condition (for example, vehicle state, driving environment, etc.), whether verification processing should be performed using the verification resource or whether the verification resource should be used as parallel processing of the vehicle control system. It then transmits to the software version check unit 106 whether a switchover should be performed. The software version check unit 106 instructs the second processing unit 107 to execute the second software unit 108 when performing verification, and instructs the second processing unit 108 to execute the third software unit 802 when performing parallel processing of the vehicle control system.

[0060] As a result, since the vehicle control software executed by the second processing unit 107 can be switched, it is possible to dynamically switch between verification mode and non-verification mode depending on the vehicle condition and the driving environment.

[0061] Fig. Figure 10 is an operating flow diagram of the electronic control unit according to the fourth embodiment of the present invention. As a difference to Fig. In the third embodiment, the operating determination unit 801 determines, based on a driving condition, environment, and the like of the vehicle, whether a switchover should be performed and sends a determination result to the software version test unit 106 (step 901). Furthermore, the software version test unit 106 confirms and compares the versions of the vehicle control software installed in the first software unit 103 and the third software unit 802 (step 903).In a case where the switching is not performed according to the determination result of the operating determination unit 801, or in a case where the versions of the vehicle control software installed in the first software unit 103 and the third software unit 802 are different, the software version check unit 106 determines that the mode is the verification mode, instructs the second processing unit 107 to execute the second software unit 108 (step 902), instructs the processing data splitting unit 501 to establish input paths to the first processing unit 102 and the second processing unit 107, and instructs the processing data aggregation unit 502 not to establish the output path from the second processing unit 107.

[0062] In a case where the switching is performed according to the determination result of the operating determination unit 801, and the versions of the vehicle control software installed in the first software unit 103 and the third software unit 802 are identical, the software version check unit 106 determines that the mode is the non-verification mode. Then, the software version check unit 106 instructs the second processing unit 107 to execute the third software unit 802 (step 904) and instructs the processing data splitting unit 501 to split the input sensor value for each time or sensor and establish paths to be fed into the first processing unit 102 and the second processing unit 107.Then the software version check unit 106 instructs the unit 502 to summarize processing data, to establish output paths from the first processing unit 102 and the second processing unit 107, and to summarize the processing data.

[0063] Next, the processing data splitting unit 501 receives the sensor data from the sensor receiving unit 101, splits the sensor data for each time or for each sensor, and sends the sensor data as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 602). The first software unit 103 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the result to unit 502 for processing data aggregation (step 210).

[0064] The third software unit 802 executes the vehicle control software of the current version (version N) based on the input sensor value and sends the output result to the processing data aggregation unit 502 (step 905). The processing data aggregation unit 502 receives the output results from the first processing unit 102 and the second processing unit 107, aggregates the output results from the first software unit 103 and the third software unit 802, and then sends the aggregated output results to the vehicle control unit 105 (step 906).

[0065] Fig. Figure 11 is a comparison table illustrating an example of certain conditions of the operating determination unit 801 in the fourth embodiment.

[0066] In Fig. Section 11 describes an example of a condition for whether a switchover is performed by the operating determination unit 801. For example, assuming the vehicle is driving normally while moving forward, verification processing A is performed, and assuming the vehicle is parked while moving backward, it is possible to dynamically switch to parallel processing B to speed up the control processing of the parking assist system or similar functions. Furthermore, it is also possible to use a procedure where verification processing A is performed during the day and the system switches to parallel processing B to increase the accuracy and processing speed of the automatic driving system at night when visibility is poor.

[0067] Note that these are in Fig.The conditions and switching procedures shown in section 11 are merely examples, and the conditions and switching procedures may also change depending on the situation in which verification is desired or the control processing speed is to be increased.

[0068] As a result, it is possible to effectively utilize verification resources that are not working at the time of non-verification.

[0069] That is, according to the fourth embodiment, it is possible to achieve an effect similar to that of the first embodiment, and it is possible to effectively utilize a verification resource that is not working at the time of non-verification.

[0070] Note that the data reception path switching unit 104 in the first and second embodiments and the unit 502 for summarizing processing data in the third and fourth embodiments have in common the establishment of a data path and can therefore be collectively referred to as the data path establishment unit. Reference symbol list 100 Vehicle control system 101 Sensor receiving unit 102 first processing unit 103 first software unit (first software) 104 Data receive path switching unit 105 Vehicle control unit 106 Software version test unit 107 second processing unit 108 second software unit (second software) 108A second software unit as backup (second software for backup) 109 Output comparison unit 110 units of determination 111 Transmit / receive unit 112 Software Update Control Unit 113 Diagnostic Unit 114 External Sensor 115 servers 301 Data transmission path switching unit 501 Processing Data Distribution Unit 502 Unit for summarizing processing data 801 Operating Unit 802 Third Software Unit (third software) QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] JP 2022-13187 A

[0005]

Claims

[1] Vehicle control system which features: a first processing unit that stores initial software used to control a vehicle, uses external information from an external sensor as input information, and outputs a control signal used to control the vehicle; a second processing unit that stores a second software, either the same version as the first software or a version different from the first software, which uses external information as input information and outputs a control signal relating to the control of the vehicle; an output comparison unit that compares an output of the first processing unit with an output of the second processing unit; a transmission unit that outputs data to a server based on a determination result of the output comparison unit; a data path construction unit into which an output from the first processing unit and an output from the second processing unit are fed and which constructs a data path; a software version check unit that checks versions of the first software stored in the first processing unit and the second software stored in the second processing unit and outputs a check result to the data path assembly unit; and a vehicle control unit that controls the vehicle based on control data from the data path body unit. [2] Vehicle control system according to claim 1, wherein the data path assembly unit is a data receiving path switching unit which, in a case where the second software stored in the second processing unit is identical to the first software stored in the first processing unit, outputs an output result of the second processing unit to the vehicle control unit, and in a case where the second software stored in the second processing unit differs from the first software stored in the first processing unit, does not output an output result of the second processing unit to the vehicle control unit. [3] Vehicle control system according to claim 2, comprising: a data transmission path switching unit that receives the external information from the external sensor and switches a data transmission path to the first processing unit and the second processing unit, wherein The data transmission path switching unit, in a verification mode where the first software stored in the first processing unit and the second software stored in the second processing unit are different versions, outputs external information to the first processing unit and the second processing unit, and compares the first software stored in the first processing unit and the second software stored in the second processing unit. In a case of non-verification mode, where the first software stored in the first processing unit and the second software stored in the second processing unit are different versions, the data transmission path switching unit stops outputting external information to the second processing unit and the first software stored in the first processing unit and the second software stored in the second processing unit are not compared. [4] Vehicle control system according to claim 1, comprising: a processing data splitting unit that splits the input external information in a case where the first software stored in the first processing unit and the second software stored in the second processing unit have the same version, and sends split data to the first processing unit and the second processing unit, wherein The data path construction unit is a unit for summarizing processing data, which constructs a path to receive an output result from the second processing unit, summarizes an output from the first processing unit and an output from the second processing unit, and outputs summarized data to a vehicle control unit. [5] Vehicle control system according to claim 1, wherein The second processing unit stores a second software program different from the first software program and a third software program of the same version as the first software program. the vehicle control system features: a processing data splitting unit that splits the input external information in a case where the first software is executed by the first processing unit and the third software is executed by the second processing unit, and sends split data to the first processing unit and the second processing unit, and sends the input external information to the first processing unit and the second processing unit in a case where the first software is executed by the first processing unit and the second software is executed by the second processing unit; and an operating unit that, based on external information, determines the software to be executed by the second processing unit, and The data path construction unit is a unit for summarizing processing data which, in a case where the first software is executed by the first processing unit and the third software is executed by the second processing unit, establishes a path to receive an output result from the second processing unit, summarizes an output from the first processing unit and an output from the second processing unit, outputs the summarized data to the vehicle control unit, and, in a case where the first software is executed by the first processing unit and the second software is executed by the second processing unit, does not establish an output path from the second processing unit. [6] Vehicle control system according to claim 2 or 3, comprising: a diagnostic unit that determines whether the first processing unit is normal or defective, wherein the diagnostic unit is trained to perform the following: Instructing the data path construction unit not to receive data from the second processing unit in a case where the first processing unit is normal; and Instructing the data path construction unit not to receive data from the first processing unit and to construct an output path from the second processing unit in a case where the latter has failed. [7] Vehicle control system according to claim 2 or 3, wherein the second processing unit contains a second software as a backup of the second software.

Images