VEHICLE VERIFICATION SYSTEM

Abstract

A vehicle verification system is provided that is capable of constructing a virtual model of a vehicle while reducing the risk of the entire vehicle's configuration information being read through a security attack. Therefore, a vehicle verification system 1, which evaluates the functionality of a vehicle 2, comprises the following: a back-end server 3 located outside the vehicle 2; a plurality of first electronic control units 4 mounted on the vehicle 2 that store the vehicle 2's configuration information in a distributed manner; and a second electronic control unit 5, located on the vehicle 2, which receives partial configuration information from the plurality of first electronic control units 4, which is part of the vehicle 2's configuration information, and transmits this partial configuration information to the back-end server 3.The back-end server 3 stores the configuration information of the vehicle 2, updates the stored configuration information of the vehicle 2 using the partial configuration information received from the second electronic control unit 5, constructs a virtual model of the vehicle 2 using the updated configuration information of the vehicle 2, and evaluates the functionality of the vehicle 2 using the virtual model.

Description

Technical field

[0001] The present invention relates to the storage of data from an electronic control unit mounted on a vehicle, or from a system comprising the electronic control unit, and a system located inside and outside the vehicle that simulates and verifies the vehicle. State of the art

[0002] For example, PTL 1 is disclosed as a prior art document that reveals a technique for efficiently and accurately verifying an effect when a component of a vehicle is changed, a component is added, or software is updated. Citation list of patent literature

[0003] PTL 1: JP 2023-13183 A Summary of the invention: Technical problem

[0004] PTL 1 discloses a technique for acquiring data relating to the state of a vehicle, constructing a virtual model using the data, and accurately verifying the effect of adding or changing a component through virtual simulation using the virtual model. However, the technology described in PTL 1 has a problem: if data about the vehicle's state is aggregated at one location (a central ECU or a gateway ECU) and transmitted to an analysis server for constructing the virtual model, and the information transmitted to the analysis server for constructing the virtual model, or the information stored in the central ECU or gateway ECU, is read through some form of security attack, there is a risk that the entire state of the vehicle will be revealed.

[0005] The present invention was made with regard to the problems described above, and one of its objectives is to provide a vehicle verification system which is capable of constructing a virtual model of a vehicle while reducing the risk of the entire vehicle's configuration information being read out through a security attack. Solution to the problem

[0006] To solve the aforementioned problem, the present invention provides a vehicle verification system which evaluates the functionality of a vehicle, comprising: a back-end server located outside the vehicle; a plurality of first electronic control units mounted on the vehicle which store vehicle configuration information in a distributed manner;and a second electronic control unit, which is mounted on the vehicle, receives partial configuration information from the multitude of first electronic control units, which is part of the vehicle's configuration information, and transmits the partial configuration information to the back-end server, wherein the back-end server stores the vehicle's configuration information, updates the stored vehicle configuration information using the partial configuration information received from the second electronic control unit, constructs a virtual model of the vehicle using the updated vehicle configuration information, and evaluates the vehicle's functionality using the virtual model. Advantageous effects of the invention

[0007] According to the present invention, it is possible to construct the virtual model of the vehicle while reducing the risk of the entire vehicle's configuration information being read out through a security attack. Problems, configurations, and effects that differ from those described above are clarified by the following description of embodiments. Brief description of the drawings

[0008] They show: Fig. 1 a diagram showing a vehicle verification system according to a first embodiment of the present invention, Fig. 2 a diagram showing an example of configuration information for each component of a vehicle according to the first embodiment of the present invention, Fig. 3 a flowchart showing a processing of the vehicle verification system according to the first embodiment of the present invention, Fig. 4 a flowchart showing a first modification of the processing of the vehicle verification system according to the first embodiment of the present invention, Fig. 5 a flowchart showing a second modification of the processing of the vehicle verification system according to the first embodiment of the present invention, Fig. 6 a diagram showing a vehicle verification system according to a second embodiment of the present invention, Fig. 7 a diagram showing an example of historical / functional information of each component of a vehicle according to the second embodiment of the present invention, Fig. 8 a flowchart showing a processing of the vehicle verification system according to the second embodiment of the present invention, Fig. 9 a diagram showing a vehicle verification system according to a third embodiment of the present invention, and Fig. 10 a flowchart showing a processing of the vehicle verification system according to the third embodiment of the present invention. Description of embodiments

[0009] Embodiments of the present invention are described below with reference to the drawings. The same elements are designated by the same reference numerals in the drawings, and redundant descriptions are omitted. [First embodiment]

[0010] Fig. Figure 1 is a diagram showing a vehicle verification system according to a first embodiment of the present invention. Fig. 1 includes a vehicle verification system, a vehicle, and a back-end server (for example, an analysis server, a verification server, a cloud, or the like).

[0011] The vehicle 2, for example, has a plurality of electronic control units 4 (which are, for example, a domain ECU or a zone ECU and are referred to below as local ECUs) which are distributed for each zone (physical position) or domain (function), and an electronic control unit 5 (which is, for example, a central gateway, a communication control device or the like and is referred to below as central ECU) which carries out communication between the local ECU 4 and the outside of the vehicle.

[0012] The local ECU 4 comprises an end-device change extraction unit 4a, a configuration information storage unit 4b, and a configuration information transmission unit 4c. When a linking component (which is another electronic control unit, actuator, sensor, or the like, and is referred to below as a linking component) connected to the local ECU 4 is changed, the end-device change extraction unit 4a extracts its information (change information). The configuration information storage unit 4b stores configuration information of the local ECU 4 and updates the stored configuration information of the local ECU 4 using the change information extracted by the end-device change extraction unit 4a.The configuration information transmission unit 4c transmits the updated configuration information of the local ECU 4 via the central ECU 5 to the back-end server 3.

[0013] The central ECU 5 has a configuration information receiver unit 5a and a configuration information external transmission unit 5b. The configuration information receiver unit 5a receives the configuration information of the local ECU 4 from the configuration information transmission unit 4c of the local ECU 4. The configuration information external transmission unit 5b transmits the configuration information of the local ECU 4 received by the configuration information receiver unit 5a to the back-end server 3. However, the central ECU 5 does not aggregate, record, or combine the configuration information of the local ECU 4. This prevents the configuration information of the entire vehicle from being stored in a single specific ECU.

[0014] The back-end server 3 comprises a configuration information receiver 3a, a configuration information storage unit 3b, a virtual model construction unit 3c, and an impact verification unit 3d. The configuration information receiver 3a receives the configuration information of the local ECU 4 from the configuration information external transmission unit 5b. The configuration information storage unit 3b stores the configuration information of the vehicle 2 and updates the stored configuration information of the vehicle 2 using the configuration information of the local ECU 4 received by the configuration information receiver 3a. The virtual model construction unit 3c constructs a virtual model (digital twin) of the vehicle 2 using the configuration information of the vehicle 2 stored in the configuration information storage unit 3b.The impact verification unit 3d verifies the impact of the change in the configuration information of vehicle 2 by evaluating the functionality of vehicle 2 using the virtual model.

[0015] Fig. Figure 2 is a diagram illustrating an example of the configuration information for each component of the vehicle. The configuration information for a vehicle body includes an ID. The ECU configuration information includes an ID, a design (SoC, memory, communication line type, etc.), software (app, BSW / MW, OS), and a connection relationship (a connection component ID and a communication line ID). The communication line configuration information includes an ID, a type (Ethernet, CAN, etc.), a band, and a connection relationship (connection component ID). The sensor configuration information includes an ID, a sensor type, a control cycle, an output data set, and a connection relationship (connection component ID).The actuator configuration information includes an ID, actuator type, control cycle, input data set, and connection relationship (connection component ID). The application software (App) configuration information includes an ID, implementation type, required processing power, control cycle, ASIL, safety level, and version information. The base software (BSW) / middleware (MW) configuration information includes an ID, required processing power, and version information. The operating system (OS) configuration information includes an ID, required processing power, and version information.

[0016] Fig. Figure 3 is a flowchart illustrating the processing of the vehicle verification system 1 according to the present embodiment. In this process, if the change in the connection component is not valid, a user is offered the option of resetting the connection component to a state prior to the change.

[0017] First, the connection component of the local ECU 4 is changed in vehicle 2 (step S100).

[0018] Following step S100, the terminal change extraction unit 4a of the local ECU 4 extracts the change information from the connection component (step S101).

[0019] Following step S101, the configuration information storage unit 4b of the local ECU 4 updates the stored configuration information of the local ECU 4 using the change information from the linking component (step S102).

[0020] Following step S102, the configuration information transmission unit 4c of the local ECU 4 transmits the updated configuration information of the local ECU 4 to the central ECU 5 (step S103).

[0021] Following step S103, the configuration information external transfer unit 5b of the central ECU 5 transmits the updated configuration information of the local ECU 4 to the back-end server 3 (step S104).

[0022] Following step S104, the configuration information storage unit 4b of the back-end server 3 updates the stored configuration information of the vehicle 2 using the updated configuration information of the local ECU 4 (step S105).

[0023] Following step S105, the Virtual Model Construction Unit 3c of the back-end server 3 constructs a virtual model using the updated configuration information of vehicle 2 (step S106).

[0024] Following step S106, the impact verification unit 3d of back-end server 3 verifies the impact of the change in the connection component using the virtual model (step S107).

[0025] Following step S107, the impact verification unit 3d of back-end server 3 uses the verification result from step S107 to determine whether the change in the connection component is valid or not (step S108). The fact that the change in the connection component is valid means, for example, that the functionality of vehicle 2 is not affected by the change in the connection component.

[0026] In a case where the determination result of step S108 is No, the user is offered a suggestion to revert the connection component changed in step S100 to its state before the change (step S109), and the process returns to step S100.

[0027] If the result of step S108 is yes, the process is terminated.

[0028] Fig. Figure 4 is a flowchart illustrating a first modification of the processing of the vehicle verification system 1 according to the present embodiment. In this process, if the change in the connection component is not valid, the user is offered a suggestion to change a connection component that differs from the changed connection component. Fig. 4. Steps S100 to S108 are similar to those in Fig. 3, which is why their description is omitted.

[0029] In a case where the determination result in step S108 is No, the Virtual Model Construction Unit 3c of the back-end server 3 reconstructs the virtual model under the assumption that a connection component (another connection component) which differs from the connection component changed in step S100 has been changed (step S110).

[0030] Following step S110, the impact verification unit 3d of the back-end server 3 re-verifies the impact of the change in the connection component using the newly constructed virtual model (step S111).

[0031] Following step S111, the impact verification unit 3d of the back-end server 3 uses the reverification result from step S111 to determine whether the change in the connection component is valid or not (step S112).

[0032] In a case where the determination result of step S112 is No, the process returns to step S110.

[0033] In a case where the determination result of step S112 is yes, the user is offered a suggestion to change another connection component that was assumed to have been changed in step S110 (step S113), and the process is terminated.

[0034] Fig. Figure 5 is a flowchart to explain a second modification of the processing of the vehicle verification system 1 according to the present embodiment. In this process, if the change in the connection component is not valid, software relating to the modified connection component is changed. Fig. Steps S100 to S108 are similar to those in 5. Fig. 3, and therefore their description is omitted.

[0035] In a case where the determination result in step S108 is No, the Virtual Model Construction Unit 3c of the back-end server 3 reconstructs the virtual model by changing the software relating to the connection component changed in step S100 (step S114).

[0036] Following step S114, the impact verification unit 3d of the back-end server 3 re-verifies the impact of the change in the connection component using the newly constructed virtual model (step S115).

[0037] Following step S115, the impact verification unit 3d of the back-end server 3 uses the reverification result in step S115 to determine whether the change in the connection component in step S100 is valid or not (step S116).

[0038] In a case where the determination result of step S116 is No, the process returns to step S114.

[0039] In a case where the determination result of step S116 is yes, the back-end server 3 transfers the associated software changed in step S114 to vehicle 2 to update the associated software of vehicle 2 (step S117), and terminates the process. (Summary)

[0040] According to the first embodiment, a vehicle verification system 1, which evaluates the functionality of a vehicle 2, comprises: a back-end server 3 located outside the vehicle 2; a plurality of first electronic control units 4 mounted on the vehicle 2 which store configuration information of the vehicle 2 in a distributed manner; and a second electronic control unit 5, which is located on the vehicle 2, which receives partial configuration information (configuration information of a local ECU 4) from the plurality of first electronic control units 4, which is part of the configuration information of the vehicle 2, and transmits the partial configuration information to the back-end server 3.The back-end server 3 stores the configuration information of the vehicle 2, updates the stored configuration information of the vehicle 2 using the partial configuration information received from the second electronic control unit 5, constructs a virtual model of the vehicle 2 using the updated configuration information of the vehicle 2, and evaluates the functionality of the vehicle 2 using the virtual model.

[0041] According to the first embodiment designed as described above, the configuration information of the entire vehicle is not stored in a specific electronic control unit, and the information transmitted from the vehicle 2 to the back-end server 3 is limited to a portion (partial configuration information) of the vehicle 2's configuration information. This makes it possible to construct the virtual model of the vehicle 2 while reducing the risk of the entire vehicle's configuration information being read through a security attack. This, in turn, makes it possible to prevent additional security attacks and misuse of information.

[0042] Furthermore, according to the present embodiment, a plurality of first electronic control units 4 transmit information about a modified part of the vehicle 2's configuration information to the second electronic control unit 5. Since the information transmitted by the second electronic control unit 5 to the back-end server 3 is thus limited to the modified part of the entire vehicle's configuration information, it is possible to further reduce the risk of the entire vehicle's configuration information being read out. [Second embodiment]

[0043] A second embodiment of the present invention is described, focusing on the differences from the first embodiment.

[0044] Fig. Figure 6 is a diagram showing the vehicle verification system 1 according to the present embodiment. Fig. 6 indicates the local ECU 4 instead of the terminal change extraction unit 4a (shown in Fig. 1) A terminal state extraction unit 4d. The terminal state extraction unit 4d extracts history / operational information for each component. The history / operational information for each component corresponds to deterioration information for each component.

[0045] Fig. Figure 7 is a diagram illustrating an example of the history / operational information for each component of the vehicle. 2. The vehicle body history / operational information includes mileage, IGN ON / OFF time, and maintenance information. The ECU history / operational information includes activation / end time, average CPU utilization rate, maximum CPU utilization rate, average memory utilization rate, maximum memory utilization rate, average power consumption rate, maximum power consumption rate, average temperature, maximum temperature, operational degradation information, and a fault log. The communication line history / operational information includes usage band, average latency, maximum latency, packet loss rate, bit error rate, and operational degradation information.The sensor's history / operational information includes output data, access frequency, and wear / condition status. The actuator's history / operational information includes input data, input frequency, rapid input changes, and wear / condition status. The application software's (app's) history / operational information includes data corresponding to the application software being verified, update information, and an error log. The base software (BSW) / middleware (MW) and operating system (OS) history / operational information includes update information.

[0046] Fig. Figure 8 is a flowchart illustrating the processing of the vehicle verification system 1 according to the present embodiment. In this process, the user is presented with a suggestion to replace a connection component based on a deterioration state of the connection component.

[0047] First, the terminal state extraction unit 4d of the local ECU 4 extracts the history / functionality information of the connection component (step S200).

[0048] Following step S200, the configuration information storage unit 4b of the local ECU 4 stores the history / functionality information of the connection component (step S201).

[0049] Following step S201, the configuration information transmission unit 4c of the local ECU 4 transmits the configuration information and the history / functionality information of the connection component of the local ECU 4 to the central ECU 5 (step S202).

[0050] Following step S202, the configuration information external transmission unit 5b of the central ECU 5 transmits the configuration information and the history / functionality information of the connection component of the local ECU 4 to the back-end server 3 (step S203).

[0051] Following step S203, the configuration information storage unit 4b of the back-end server 3 updates the stored configuration information of the vehicle 2 using the configuration information and history / operational information of the connection component of the local ECU 4 (step S204).

[0052] Following step S204, the Virtual Model Construction Unit 3c of the back-end server 3 creates a virtual model using the updated configuration information of the vehicle 2 (step S205).

[0053] Following step S205, the impact verification unit 3d of back-end server 3 verifies the impact of a deterioration of the connection component using the virtual model (step S206).

[0054] Following step S206, the impact verification unit 3d of the back-end server 3 uses the verification result from step S206 to determine whether it is necessary to replace the connection component or not (step S207).

[0055] If this is not the case, the process will be terminated.

[0056] If this is the case, the user is offered a suggestion to replace the component (step S208), and the process is terminated. (Summary)

[0057] According to the second embodiment, the second electronic control unit 5 receives deterioration information (history / operational information) of a component connected to the plurality of first electronic control units 4 and transmits the deterioration information together with the partial configuration information to the back-end server 3, and the back-end server 3 updates the stored configuration information of the vehicle 2 using the deterioration information received from the second electronic control unit 5.

[0058] According to the second embodiment designed as described above, it is also possible, similar to the first embodiment, to construct the virtual model of the vehicle 2 while reducing the risk of the entire vehicle's configuration information being read through a security attack. Furthermore, the configuration information of the vehicle 2 stored in the back-end server 3 is updated using the configuration information and the history / operational information (deterioration information) of the connection component of the local ECU 4. The virtual model of the vehicle 2 is then constructed using this updated configuration information, making it possible to verify the impact of the deterioration of the connection component. [Third embodiment]

[0059] A third embodiment of the present invention is described, focusing on the differences from the first embodiment.

[0060] Fig. Figure 9 is a diagram showing the vehicle verification system 1 according to the present embodiment. Fig. 9 Each local ECU 4 has a configuration information storage unit 4b and a software update request unit 4e. The central ECU 5 has an update request receiving unit 5c and an update request external transmission unit 5d. The back-end server 3 has a configuration information receiving unit 3a instead (shown in Fig. 1) a software update request receiver 3e.

[0061] Fig.Figure 10 is a flowchart illustrating the processing of the vehicle verification system 1 according to the present embodiment. In this process, the update software, which has been verified using the virtual model, is transferred from the back-end server 3 to the vehicle 2, and the software of the vehicle 2 is updated.

[0062] First, the software update request unit 4e of the local ECU 4 transmits the configuration information of the local ECU 4 and a software update request to the central ECU 5 (step S300). The software update request is a software update request contained in the configuration information of the local ECU 4.

[0063] Following step S300, the update request external transmission unit 5d of the central ECU 5 transmits the configuration information of the local ECU 4 and the software update request to the back-end server 3 (step S301).

[0064] Following step S301, the software update request receiver unit 3e of the back-end server 3 confirms the software update information contained in the configuration information of the local ECU 4 (step S302).

[0065] Following step S302, the system checks whether update software is present or not (step S303). If not, the process terminates.

[0066] If this is the case, it is determined whether the update software has been verified using the virtual model or not (step S304).

[0067] If this is the case, the back-end server 3 transfers the update software to vehicle 2 to update the software of vehicle 2 (step S305), and the process is completed.

[0068] If this is not the case, the Virtual Model Construction Unit 3c of the back-end server 3 creates a virtual model using the configuration information of the vehicle 2 stored in the configuration information storage unit 4b (step S306).

[0069] Following step S306, the impact verification unit 3d of back-end server 3 verifies the impact of the update software using the virtual model (step S307).

[0070] Following step S307, the verification result of the impact of the update software is used to determine whether the software update is valid or not (step S308).

[0071] If this is the case, the process continues at step S305.

[0072] If this is not the case, the update software is modified (step S309), and the process returns to step S306. (Summary)

[0073] According to the third embodiment, the plurality of first electronic control units 4 transmit a software update request to the second electronic control unit 5 to request an update of software contained in the part configuration information. The second electronic control unit 5 transmits the software update request together with the part configuration information to the back-end server 3 when it receives the software update request from the plurality of first electronic control units 4. The back-end server 3 receives the software update request together with the part configuration information and transmits the update software, which has been verified using the virtual model, to the vehicle 2 if update software is available that is an updated version of the software contained in the part configuration information.

[0074] According to the third embodiment, as described above, it is also possible, similar to the first embodiment, to construct the virtual model of the vehicle 2 while reducing the risk of the entire vehicle's configuration information being read out through a security attack. Furthermore, the software of the first electronic control unit 4 can be updated with the update software, which has been verified using the virtual model of the vehicle 2.

[0075] It should be noted that the present invention is not limited to the embodiments described above and includes various modifications. For example, the embodiments described above have been described in detail to facilitate understanding of the present invention and are not necessarily limited to those that have all the described configurations. Furthermore, another configuration can be added to, removed from, or replaced by a part of any configuration in any embodiment.Furthermore, some or all of the configurations, functions, processing units, processing means, and the like described above can be implemented by hardware, for example, by designing them with an integrated circuit. Additionally, each of the configurations, functions, and the like described above can be implemented by software, with a processor interpreting and executing a program to perform each function. Information such as a program, a table, and a file for performing each function can be stored in a recording device such as memory, a hard disk drive, or a solid-state drive (SSD), or on a recording medium such as an IC card, an SD card, or a DVD. Reference symbol list 1 Vehicle verification system 2 vehicles 3 back-end servers 3a Configuration Information Receiver Unit 3b Configuration Information Storage Unit 3c Virtual Model Construction Unit 3D Impact Verification Unit 3e Software Update Request Receiving Unit 4 local ECUs (first electronic control units) 4a Terminal Change Extraction Unit 4b Configuration Information Storage Unit 4c Configuration Information Transmission Unit 4D terminal state extraction unit 4e Software Update Request Unit 5 central ECU (second electronic control unit) 5a Configuration Information Receiver Unit 5b Configuration Information External Transmission Unit 5c Update Request Receiver Unit 5d Update Request External Transfer Unit QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] JP 2023-13183 A

[0003]

Claims

[1] Vehicle verification system which evaluates the functionality of a vehicle, comprising: a back-end server located outside the vehicle; a large number of early electronic control units, which are mounted on the vehicle and store vehicle configuration information in a distributed manner; and A second electronic control unit, mounted on the vehicle, receives partial configuration information from the multitude of first electronic control units, which is part of the vehicle's configuration information, and transmits the partial configuration information to the back-end server. where the back-end server stores the vehicle's configuration information, the vehicle's stored configuration information is updated using the partial configuration information received from the second electronic control unit, a virtual model of the vehicle was constructed using the updated configuration information of the vehicle and The functionality of the vehicle was evaluated using the virtual model. [2] Vehicle verification system according to claim 1, wherein the plurality of first electronic control units transmit information about a modified part of the vehicle's configuration information to the second electronic control unit. [3] Vehicle verification system according to claim 1, wherein the second electronic control unit receives deterioration information from the multitude of first electronic control units regarding an actuating element connected to the multitude of first electronic control units and transmits the deterioration information together with the partial configuration information to the back-end server, and The back-end server updates the stored configuration information of the vehicle using the deterioration information received from the second electronic control unit. [4] Vehicle verification system according to claim 1, wherein The multitude of first electronic control units transmit a software update request to the second electronic control unit to request a software update, which is contained in the partial configuration information. The second electronic control unit transmits the software update request, along with the partial configuration information, to the back-end server when it receives the software update request from the multitude of first electronic control units, and The back-end server receives the software update request along with the part configuration information and transmits the update software to the vehicle, which has been verified using the virtual model if update software is available that is an updated version of the software contained in the part configuration information.

Images