Updating verification method, updating verification system, and updating verification program

Abstract

To provide an updating verification method which can specify that abnormal updating is performed at an early stage, when a machine learning model is upgraded as updating of a vehicle control device.SOLUTION: An updating verification method allows a computer to execute: acquisition of a first verification number indicating the number of objects around a vehicle recognized during a predetermined period or with a predetermined distance, or the number of driving determinations in a generated travel plan by an upgraded machine learning model; acquisition of a second verification number indicating the number of objects around a vehicle recognized during a predetermined period or with a predetermined distance, or the number of driving determinations in a generated travel plan by a machine learning model of a version prior to upgrading, by referring to log data; and verification whether or not the updating is normal by comparison of the first verification number with the second verification number.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to a technology for verifying updates to a vehicle control device, and more particularly to a control device that performs automatic driving control of a vehicle by using a machine learning model. [Background technology]

[0002] In recent years, various technologies have been proposed for utilizing machine learning models as artificial intelligence (AI) in the field of vehicle control. For example, the following Patent Document 1 is a document disclosing a technology for utilizing machine learning models in the field of vehicle control. In addition, the following Patent Documents 2 to 4 are documents showing the technical level in this technical field. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-067762 A [Patent Document 2] JP 2019-139734 A [Patent Document 3] Patent Publication No. 2021-089632 [Patent Document 4] International Publication No. 2016 / 157278 Summary of the Invention [Problem to be solved by the invention]

[0004] Among vehicle controls, autonomous driving control in particular is expected to improve control performance by utilizing machine learning models in each of the functions of recognition, judgment, and operation. When a machine learning model is used, the machine learning model may be upgraded when updating the control device that controls autonomous driving. It is expected that the new version of the machine learning model will be distributed to each vehicle that is the target of the update after performance is confirmed through offline verification and evaluation using experimental vehicles.

[0005] However, in machine learning models, inference results can change significantly in response to small changes in input. In addition, it is assumed that each vehicle has different sensor conditions. For this reason, depending on the vehicle, the machine learning model after the upgrade may not function properly, and the update may not be normal.

[0006] One objective of the present disclosure is to provide a technology that makes it possible to quickly identify when an abnormal update has been performed when upgrading a machine learning model in consideration of the above-mentioned problems. [Means for solving the problem]

[0007] A first aspect of the present disclosure relates to an update verification method for verifying, by a computer, an update of a control device that performs automatic driving control of a vehicle using a machine learning model. Here, the computer is configured to be able to access one or more storage devices that store log data related to an inference result by the machine learning model. The update includes upgrading the machine learning model. The machine learning model performs at least one of recognizing a situation around the vehicle or generating a driving plan for automatic driving control.

[0008] The update verification method relating to the first aspect is executed by a computer to obtain a first verification number indicating the number of objects around the vehicle recognized by the upgraded machine learning model within a specified period or distance or the number of driving decisions in the generated driving plan, referencing log data to obtain a second verification number indicating the number of objects around the vehicle recognized by the machine learning model of the version before the update within a specified period or distance or the number of driving decisions in the generated driving plan, and verifying whether the update is normal by comparing the first verification number with the second verification number.

[0009] A second aspect of the present disclosure relates to an update verification system that verifies an update of a control device that performs automatic driving control of a vehicle using a machine learning model. Here, the update includes upgrading the machine learning model. The machine learning model performs at least one of recognizing a situation around the vehicle or generating a driving plan for automatic driving control.

[0010] An update verification system according to a second aspect includes one or more processors and one or more storage devices that store log data related to an inference result by a machine learning model. The one or more processors are configured to execute a process of acquiring a first verification number indicating the number of objects around the vehicle recognized by the machine learning model after the version update within a predetermined period or a predetermined distance or the number of driving decisions in the generated driving plan, a process of acquiring a second verification number indicating the number of objects around the vehicle recognized by the machine learning model of a version before the update within a predetermined period or a predetermined distance or the number of driving decisions in the generated driving plan, by referring to the log data, and a process of verifying whether the update is normal by comparing the first verification number with the second verification number.

[0011] A third aspect of the present disclosure relates to an update verification program for causing a computer to execute an update of a control device that performs automatic driving control of a vehicle by using a machine learning model. The update verification program according to the third aspect is configured to cause a computer to execute the update verification method according to the first aspect. Effect of the Invention

[0012] According to the present disclosure, it is possible to verify an update of a control device without requiring special or additional verification, thereby making it possible to quickly identify that an abnormal update has been performed. [Brief description of the drawings]

[0013] [Figure 1] FIG. 2 is a diagram illustrating an example of a configuration related to automatic driving control of a vehicle. [Diagram 2] FIG. 2 is a diagram illustrating an example of the configuration of a control device according to the present embodiment. [Diagram 3] 1 is a diagram illustrating a configuration of an update verification system according to an embodiment of the present invention. [Figure 4] FIG. 1 is a diagram for explaining an update verification method according to an embodiment of the present invention. [Diagram 5] 4 is a flowchart showing a process executed by a processor according to the embodiment. [Figure 6] FIG. 11 is a diagram for explaining a comparison between a first verification number and a second verification number. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] 1. Control device The update verification method according to the present embodiment verifies an update for a control device that performs automatic driving control of a vehicle by using a machine learning model. The following describes a control device that is a target of the update verification method according to the present embodiment.

[0015] FIG. 1 is a diagram showing an example of a configuration related to automatic driving control of a vehicle 1 performed by a target control device. Automatic driving refers to automatically performing at least one of steering, acceleration, and deceleration of the vehicle 1 without the driver's operation. Automatic driving control is a concept that includes not only fully automatic driving control, but also risk avoidance control, lane keep assist control, and the like. The operator may be a driver who rides in the vehicle 1, or a remote operator who remotely operates the vehicle 1.

[0016] The vehicle 1 includes a sensor group 10, a recognition unit 20, a planner 30, a control amount calculation unit 40, and a traveling device 50.

[0017] The sensor group 10 includes a recognition sensor 11 used to recognize the situation around the vehicle 1. Examples of the recognition sensor 11 include a camera, a LIDAR (Laser Imaging Detection and Ranging), a radar, and the like. The sensor group 10 may further include a status sensor 12 that detects the status of the vehicle 1, a position sensor 13 that detects the position of the vehicle 1, and the like. Examples of the status sensor 12 include an acceleration sensor, a yaw rate sensor, and the like. Examples of the position sensor 13 include a GNSS (Global Navigation Satellite System) sensor.

[0018] The sensor detection information SEN is information obtained by the sensor group 10. For example, the sensor detection information SEN includes images captured by a camera. As another example, the sensor detection information SEN may include point cloud information obtained by a LIDAR. The sensor detection information SEN may include vehicle state information indicating the state of the vehicle 1. The sensor detection information SEN may include position information indicating the position of the vehicle 1.

[0019] The recognition unit 20 receives the sensor detection information SEN. The recognition unit 20 recognizes the situation around the vehicle 1 based on the information obtained by the recognition sensor 11. For example, the recognition unit 20 recognizes objects around the vehicle 1. Examples of objects include pedestrians, other vehicles, white lines, road structures, fallen objects, traffic lights, intersections, signs, etc. The recognition result information RES indicates the recognition result by the recognition unit 20. For example, the recognition result information RES includes object information indicating the relative position and relative speed of the object with respect to the vehicle 1.

[0020] The planner 30 receives the recognition result information RES from the recognition unit 20. The planner 30 may also receive vehicle state information, position information, and map information. The planner 30 generates a driving plan for the vehicle 1 based on the received information. The driving plan may be for reaching a preset destination, or for avoiding risks. As the driving plan, driving decisions such as maintaining the current driving lane, changing lanes, overtaking, turning right or left, steering, accelerating, decelerating, and stopping are given. Furthermore, the planner 30 generates a target trajectory TRJ required for the vehicle 1 to travel according to the driving plan. The target trajectory TRJ includes a target position and a target speed.

[0021] The control amount calculation unit 40 receives the target trajectory TRJ from the planning unit 30. The control amount calculation unit 40 calculates a control amount CON required for the vehicle 1 to follow the target trajectory TRJ. It can also be said that the control amount CON is a control amount required to reduce the deviation between the vehicle 1 and the target trajectory TRJ. The control amount CON includes at least one of a steering control amount, a driving control amount, and a braking control amount.

[0022] The traveling device 50 includes a steering device 51, a driving device 52, and a braking device 53. The steering device 51 steers the wheels. The driving device 52 is a power source that generates a driving force. Examples of the driving device 52 include an engine and an electric motor. The braking device 53 generates a braking force. The traveling device 50 receives a control amount CON from the control amount calculation unit 40. The traveling device 50 operates the steering device 51, the driving device 52, and the braking device 53 according to the steering control amount, the driving control amount, and the braking control amount, respectively. This causes the vehicle 1 to travel so as to follow the target trajectory TRJ.

[0023] The recognition unit 20 includes at least one of a rule-based model and a machine learning model. The rule-based model performs recognition processing based on a predetermined set of rules. Examples of the machine learning model include a neural network (NN), a support vector machine (SVM), a regression model, a decision tree model, and the like. The NN may be a convolutional neural network (CNN), a recurrent neural network (RNN), or a combination thereof. The type of each layer, the number of layers, and the number of nodes in the NN are arbitrary. The machine learning model is generated in advance through machine learning. The recognition unit 20 performs recognition processing by inputting the sensor detection information SEN to the model.

[0024] Similarly, the planning unit 30 includes at least one of a rule-based model and a machine learning model. The planning unit 30 performs planning processing by inputting the recognition result information RES to the model.

[0025] Similarly, the control amount calculation unit 40 also includes at least one of a rule-based model and a machine learning model. The control amount calculation unit 40 performs a control amount calculation process by inputting the target trajectory TRJ to the model.

[0026] Two or more of the recognition unit 20, the planner 30, and the control amount calculation unit 40 may be integrally configured. All of the recognition unit 20, the planner 30, and the control amount calculation unit 40 may be integrally configured (end-to-end configuration). For example, the recognition unit 20 and the planner 30 may be integrally configured by a NN that outputs a target trajectory TRJ from the sensor detection information SEN. Even in the case of an integral configuration, intermediate products such as recognition result information RES and target trajectory TRJ may be output. For example, when the recognition unit 20 and the planner 30 are integrally configured by a NN, the recognition result information RES may be the output of an intermediate layer of the NN.

[0027] The recognition unit 20, the planning unit 30, and the control amount calculation unit 40 constitute an "automatic driving control unit" that controls the automatic driving of the vehicle 1. In this embodiment, at least one of the recognition unit 20 and the planning unit 30 includes a machine learning model. That is, the machine learning model performs at least one of recognizing the surrounding situation of the vehicle 1 or generating a driving plan. When the machine learning model recognizes the surrounding situation of the vehicle 1, the inference result by the machine learning model is, for example, an object recognized on an image. Or, it is an object recognized on a spatial map around the vehicle 1. Also, when the machine learning model generates a driving plan, the inference result by the machine learning model is, for example, a driving judgment that constitutes the driving plan. The automatic driving control unit performs automatic driving control of the vehicle 1 using the machine learning model.

[0028] 2 is a diagram showing a configuration example of a target control device 200. The control device 200 is mounted on the vehicle 1 and performs automatic driving control of the vehicle 1. The control device 200 has at least the functions of the automatic driving control unit described above. The control device 200 may be configured to be able to communicate with the sensor group 10 and the traveling device 50.

[0029] The control device 200 includes one or more processors 210 (hereinafter simply referred to as processor 210) and one or more storage devices 220 (hereinafter simply referred to as storage device 220). The processor 210 executes various processes according to a computer program. The computer program may be stored in the storage device 220. The storage device 220 stores various information. The recognition unit 20, the planning unit 30, and the control amount calculation unit 40 may be realized by a single processor 210 or may be realized by separate processors 210.

[0030] The model data 221 is data of a model included in the recognition unit 20, the planning unit 30, and the control amount calculation unit 40. As described above, in this embodiment, at least one of the recognition unit 20 and the planning unit 30 includes a machine learning model. The model data 221 is stored in the storage device 220 and used for automatic driving control.

[0031] The control device 200 is configured to be able to perform updates for the purpose of improving control performance, adding functions, and the like. For example, the control device 200 is configured to acquire a computer program for updating via a communication network and install the acquired computer program. In particular, an update of the control device 200 may include upgrading the machine learning model. In this case, the control device 200 acquires a new version of the machine learning model and replaces the machine learning model included in the model data 221 with the acquired new version of the machine learning model.

[0032] During execution of the autonomous driving control, the processor 210 collects log data LOG related to the autonomous driving control using the machine learning model. The processor 210 stores the log data LOG collected during execution of the autonomous driving control in the storage device 220. The log data LOG may be a log of data for time changes or a log of data for the position of the vehicle 1.

[0033] The management server 102 is a database server that manages the database 103. The management server 102 can also be considered as a storage device that stores the database 103. The management server 102 communicates with one or more vehicles 1 via a communication network. In this embodiment, during execution of the autonomous driving control or after the autonomous driving control is terminated, the processor 210 of the vehicle 1 uploads a part of the log data LOG stored in the local storage device 220 to the management server 102. In particular, the processor 210 is configured to upload at least the log data LOG related to the inference result by the machine learning model to the management server 102. The log data LOG related to the inference result by the machine learning model may include version information of the machine learning model at the time the log data LOG was collected.

[0034] The management server 102 acquires log data LOG uploaded from one or more vehicles 1. Then, the management server 102 manages the acquired log data LOG in a database 103. The database 103 manages at least log data LOG related to inference results by a machine learning model for each vehicle. For example, the database 103 manages the log data LOG in association with a vehicle ID.

[0035] 2. Update Verification System The update verification method according to the present embodiment is realized by processing executed by a computer. Fig. 3 is a diagram showing an example of a hardware configuration of an update verification system 100 that realizes the update verification method according to the present embodiment.

[0036] The update verification system 100 includes a processing unit 101 and a management server 102 .

[0037] The processing unit 101 is a computer including one or more processors 110 (hereinafter simply referred to as processor 110) and one or more storage devices 120 (hereinafter simply referred to as storage devices 120). The processing unit 101 is configured to be able to communicate with the management server 102 and the control device 200. In particular, the processor 110 is configured to be able to communicate with the management server 102 and access the database 103. The processing unit 101 may be a computer mounted on the vehicle 1, or may be a computer outside the vehicle 1 configured to be able to communicate with the vehicle 1.

[0038] The processor 110 executes various processes. In particular, the processor 110 executes a process for verifying an update of the control device 200 (hereinafter referred to as an "update verification process"). The update verification process will be described in detail later. The processor 110 may be configured, for example, with a central processing unit (CPU) including an arithmetic unit, a register, and the like. The storage device 120 stores various information required for the processor 110 to execute processes. The storage device 120 may be configured, for example, with a recording medium such as a read only memory (ROM), a random access memory (RAM), a hard disk drive (HDD), or a solid state drive (SSD).

[0039] The storage device 120 stores a computer program 121 and verification data 122 .

[0040] The computer program 121 is executed by the processor 110. Various processes by the processing unit 101 may be realized by cooperation between the processor 110, which executes the computer program 121, and the storage device 120. The computer program 121 may be recorded in a computer-readable recording medium.

[0041] The verification data 122 is data used in the update verification process. As described later, examples of the verification data 122 include log data LOG acquired from the control device 200, log data LOG acquired from the management server 102, and the like.

[0042] 3. How to verify the update A description will now be given of an update verification method realized by the above-described update verification system 100. Fig. 4 is a diagram for explaining the update verification method according to this embodiment.

[0043] 4, first, an update of the control device 200 is executed (S210). Here, it is assumed that the update of the control device 200 includes upgrading the machine learning model.

[0044] After the update is performed, the control device 200 collects log data LOG (S220). The collected log data LOG includes an inference result based on the machine learning model after the version upgrade.

[0045] Next, the control device 200 transmits a verification request for requesting verification of the update to the processing unit 101 (S230). The verification request may include ID information of the vehicle 1 and version information of the machine learning model before and after the update. Furthermore, the control device 200 may be configured to transmit log data LOG collected within a predetermined period or a predetermined distance after the update is executed together with the verification request.

[0046] When the processor 110 of the processing unit 101 receives a verification request from the control device 200, it checks the requested verification content (S110). For example, the processor 110 checks the ID of the vehicle 1 equipped with the control device 200 to be verified, checks the versions of the machine learning model before and after the update, and so on.

[0047] Next, the processor 110 requests log data from the management server 102 according to the verified content (S120).

[0048] Particularly in step S120, the processor 110 requests log data (hereinafter also referred to as "first log data") regarding inference results for a predetermined period (or a predetermined distance) by the updated machine learning model collected in the control device 200 to be verified. For example, the processor 110 requests log data to specify the ID of the vehicle 1 in which the control device 200 to be verified is mounted, the version of the updated machine learning model, and the period (or distance). However, the processor 110 may be configured to acquire the first log data directly from the control device 200 to be verified.

[0049] Further, in step S120, the processor 110 requests log data (hereinafter also referred to as "second log data") related to an inference result for a predetermined period (or a predetermined distance) by the machine learning model of the version before the update. For example, the processor 110 requests log data to specify the version of the machine learning model before the update and the period (or distance). The second log data does not have to be log data collected in the control device 200 to be verified. In other words, the second log data may be log data uploaded to the management server 102 from another vehicle 1. The processor 110 may also be configured to request multiple second log data by specifying multiple periods (or distances) or by specifying multiple other vehicles 1.

[0050] When the management server 102 receives a request for log data from the processing unit 101, it checks the request content (S121) and transmits the corresponding log data to the processing unit 101 (S122).

[0051] The processor 110 of the processing unit 101 acquires log data from the management server 102 (S130). The processor 110 stores the acquired first log data and second log data in the storage device 120 as verification data 122. Thereafter, the processor 110 executes an update verification process based on the first log data and the second log data (S140).

[0052] FIG. 5 is a flow chart showing the steps executed by processor 110 in the update verification process.

[0053] In step S141, the processor 110 acquires a first validation number and a second validation number from the first log data and the second log data, respectively. When the machine learning model recognizes the surroundings of the vehicle 1, the first validation number is the number of objects around the vehicle 1 recognized by the machine learning model in the first log data (for example, the number of bounding boxes surrounding the objects recognized on the image). The second validation number is the number of objects around the vehicle 1 recognized by the machine learning model in the second log data. When the machine learning model generates a driving plan, the first validation number and the second validation number may each be the number of driving decisions in the driving plan generated by the machine learning model in the first log data and the second log data, respectively. Note that when a plurality of second log data are acquired, the processor 110 may acquire the second validation number for each of the second log data.

[0054] Next, in step S142, the processor 110 compares the acquired first verification number with the acquired second verification number.

[0055] The number of objects around the vehicle 1 recognized by the machine learning model and the number of driving decisions in the generated driving plan are one of the indicators showing the performance of the inference results by the machine learning model. In particular, if the update is normal, it is considered that these numbers do not change significantly before and after the update. Considering that the pre-update version of the machine learning model has already been fully operated, if these numbers change significantly before and after the update, there is a risk that the machine learning model after the upgrade does not function well.

[0056] For example, when the first verification number and the second verification number indicate the number of recognized objects around the vehicle 1, if the first verification number is extremely larger than the second verification number, there is a possibility that the number of erroneous detections is increasing rapidly. Conversely, when the first verification number is extremely smaller than the second verification number, there is a possibility that the number of undetected objects is increasing rapidly. Similarly, when the first verification number and the second verification number indicate the number of driving decisions in the generated travel plan, if the first verification number changes extremely with respect to the second verification number, there is a possibility that the number of erroneous decisions or undetected objects is increasing rapidly.

[0057] In this way, by comparing the first verification number with the second verification number, it is possible to verify whether the update is normal or not. In particular, the first verification number and the second verification number can be acquired from log data collected during execution of the autonomous driving control of the vehicle 1. That is, according to this embodiment, it is possible to verify the update of the control device 200 without requiring special or additional verification. This makes it possible to quickly identify that an abnormal update has been performed.

[0058] If the first verification number has changed drastically with respect to the second verification number (S143; Yes), the processor 110 determines that the update is not normal (S144) and ends the process. On the other hand, if the first verification number has not changed drastically with respect to the second verification number (S143; No), the processor 110 determines that the update is normal (S145) and ends the process.

[0059] As described above, the processor 110 executes the update verification process. In the update verification process, the comparison between the first verification number and the second verification number can be performed, for example, as follows.

[0060] One is to check the magnitude of the difference between the number of first verification numbers per unit time (or unit distance) and the number of second verification numbers per unit time (or unit distance). FIG. 6(A) is a conceptual diagram showing an example of comparing the first verification numbers and the second verification numbers by checking the magnitude of the difference. In FIG. 6(A), the number of first verification numbers per unit time (or unit distance) and the number of second verification numbers per unit time (or unit distance) are each indicated by a dashed line. In this case, the processor 110 can determine that the update is abnormal when the magnitude of the difference exceeds a predetermined threshold.

[0061] Another is to perform a comparison based on statistical data obtained from the second verification numbers when acquiring a plurality of second verification numbers. FIG. 6(B) is a conceptual diagram showing an example of a case where the first verification number and the second verification number are compared based on statistical data obtained from the plurality of second verification numbers. In this case, the processor 110 calculates a statistical model regarding the number of objects around the vehicle 1 recognized by the machine learning model and the number of driving decisions in the generated driving plan based on the plurality of second verification numbers, and when it is determined that there is a significant difference between the first verification number and the calculated statistical model, it can determine that the update is abnormal.

[0062] 4 again, the processor 110 of the processing unit 101 executes the update verification process, and then transmits the verification result to the control device 200 (S150). The control device 200 receives the verification result transmitted from the processing unit 101 (S160).

[0063] The control device 200 may be configured to perform processing depending on the received verification result. For example, the control device 200 may be configured to roll back to the state before the update when the control device 200 receives a verification result indicating that the update is determined to be abnormal.

[0064] As described above, the update verification system and the update verification method according to the present embodiment are realized. Also, as described above, the update verification program according to the present embodiment is realized by the computer program 121 that causes the processor 110 to execute processing. [Explanation of symbols]

[0065] 1 vehicle, 100 update verification systems, 110 processors, 120 storage device, 121 computer program, 200 control device

Claims

1. An update verification method for verifying an update of a control device that performs automatic driving control of a vehicle by using a machine learning model, comprising: The computer is configured to be able to access one or more storage devices that store log data related to inference results by the machine learning model; The update includes upgrading the machine learning model; The machine learning model performs at least one of recognizing the situation around the vehicle or generating a driving plan for automatic driving control, The update verification method includes: Obtaining a first verification number indicating the number of objects around the vehicle recognized by the upgraded machine learning model within a predetermined period or a predetermined distance or the number of driving decisions in the generated driving plan; Referencing the log data to obtain a second verification number indicating the number of objects around the vehicle recognized by the machine learning model of the version before the update within a predetermined period or a predetermined distance, or the number of driving decisions in the generated driving plan; verifying whether the update is normal by comparing the first verification number with the second verification number; by said computer. How to verify updates.

2. 2. The method of claim 1 , further comprising: Verifying whether the update is normal includes determining that the update is abnormal when a magnitude of a difference between the number of the first verification numbers per unit time or unit distance and the number of the second verification numbers per unit time or unit distance exceeds a predetermined threshold value. Characterized by How to verify updates.

3. An update verification system for verifying an update to a control device that performs automatic driving control of a vehicle using a machine learning model, one or more processors; One or more storage devices for storing log data related to the inference results of the machine learning model; Including, The update includes upgrading the machine learning model; The machine learning model performs at least one of recognizing the situation around the vehicle or generating a driving plan for automatic driving control, The one or more processors: A process of acquiring a first verification number indicating the number of objects around the vehicle recognized by the upgraded machine learning model within a predetermined period or a predetermined distance or the number of driving decisions in the generated driving plan; A process of obtaining a second verification number indicating the number of objects around the vehicle recognized by the machine learning model of the version before the update within a predetermined period or a predetermined distance, or the number of driving decisions in the generated driving plan, by referring to the log data; verifying whether the update is normal by comparing the first verification number with the second verification number; It is configured to run Update verification system.

4. An update verification program that causes a computer to verify an update of a control device that performs automatic driving control of a vehicle using a machine learning model, The computer is configured to be able to access one or more storage devices that store log data related to inference results by the machine learning model; The update includes upgrading the machine learning model; The machine learning model performs at least one of recognizing the situation around the vehicle or generating a driving plan for automatic driving control, The update verification program includes: A process of acquiring a first verification number indicating the number of objects around the vehicle recognized by the upgraded machine learning model within a predetermined period or a predetermined distance or the number of driving decisions in the generated driving plan; A process of obtaining a second verification number indicating the number of objects around the vehicle recognized by the machine learning model of the version before the update within a predetermined period or a predetermined distance, or the number of driving decisions in the generated driving plan, by referring to the log data; verifying whether the update is normal by comparing the first verification number with the second verification number; The computer is configured to execute Update verification program.

Images