Control device, control method and program

Abstract

To suppress execution of processing performed in cooperation between a plurality of control devices in a state where software inconsistency has occurred.SOLUTION: When an electric vehicle enters an IG ON state, a representative ECU and a cooperative ECU start up, and when there is a software update, a startup storage area is switched in each ECU. Startup check processing is started in the representative ECU and the cooperative ECU, version information is transmitted from the cooperative ECU, and a version check is performed by the representative ECU. A startup signal is transmitted from the representative ECU, and normal processing is started based on the version check and the startup signal in the representative ECU and the cooperative ECU. When the representative ECU receives the version information from the cooperative ECU after starting the normal processing, the representative ECU transmits an abnormal signal and stops system processing.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a control device constituting a vehicle system, a control method thereof, and a program for executing the control method. [Background technology]

[0002] A vehicle is equipped with an on-board system that is composed of a plurality of actuators and a plurality of control devices that control each of the actuators. Each of the plurality of control devices is equipped with software, and each of the plurality of control devices executes the software to control the actuators, thereby implementing each function of the vehicle. After the vehicle is supplied to the market, an update program is provided, for example, by OTA (Over The Air), and the software is updated. This allows the functions of the vehicle to be modified or functions to be added. For example, to modify or add functions that are performed in cooperation between a plurality of control devices, such as various driving assistance systems such as autonomous driving, it is necessary to update the software of all the control devices concerned, and it is also necessary to confirm whether the update has been performed appropriately in each control device.

[0003] For example, JP 2019-159399 A (Patent Document 1) discloses a technology in which, when the vehicle is powered on, a specific on-board unit among multiple on-board units acquires the software version held by the other on-board units, compares its own software version with the acquired software version, and determines the consistency of the software versions. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-159399 A Summary of the Invention [Problem to be solved by the invention]

[0005] The execution of the updated software may be performed, for example, at the next startup of the in-vehicle system in order to switch over from the pre-update software in multiple ECUs at the same time. In this case, whether the software has been properly updated will also be confirmed at the next startup of the in-vehicle system.

[0006] However, if some of the multiple control devices restart due to some malfunction such as a momentary power interruption before the next startup of the in-vehicle system, the updated software will be executed only in the restarted part of the control devices. In this case, software inconsistencies such as version mismatches will occur between the multiple control devices at least until the next startup of the in-vehicle system. If software inconsistencies occur, there is a possibility that the processes performed in cooperation between the multiple control devices cannot be executed appropriately.

[0007] The present disclosure has been made to solve the above-mentioned problems, and an object of the present disclosure is to suppress the execution of processing that is performed in coordination between multiple control devices when a software inconsistency occurs. [Means for solving the problem]

[0008] (1) A control device according to an aspect of the present disclosure is a control device constituting a system of a vehicle, and includes a storage unit that stores first software for executing a predetermined process, and a control unit that executes the first software. The predetermined process includes a first process that realizes a first function of the vehicle in cooperation with another control device constituting the system of the vehicle. The control device and the other control device are configured to update the software at startup if there is a software update. At startup of the control device, before executing the first software, the control unit receives information about second software including a program for executing the first process stored in the other control device from the other control device, and executes a startup check process including a confirmation process that confirms the consistency between the first software and the second software. When the control unit receives information about the second software from the other control device after starting execution of the first software, the control unit stops or does not permit execution of the first process.

[0009] According to the above configuration, the control device executes a startup check process at startup and checks the consistency between the first software and the second software by the check process. The control device and the other control device are configured to update the software at startup if there is a software update, so if the consistency can be confirmed by the startup check process, it can be said that the consistency of the software is maintained as long as the control device is running thereafter. However, if information about the second software is received from the other control device after the execution of the first software has started, it is assumed that the other control device has restarted. The other device may have updated the second software due to the restart. That is, there is a possibility that the first software and the second software are not consistent. If the control unit receives information about the second software from the other control device after the execution of the first software has started, the control unit stops or does not permit the execution of the first process, so that if the first process is being executed, the first process is stopped, and if the first process is not being executed, the first process is not executed thereafter. Therefore, it is possible to prevent the first process from being executed in a state in which the first software and the second software are inconsistent.

[0010] (2) In one embodiment, the information about the second software is version information about the second software. In the startup check process, the control unit checks the consistency based on a combination of the version of the first software and the version of the second software.

[0011] According to the above configuration, since the software consistency is confirmed based on the software version, the software consistency can be confirmed with high accuracy.

[0012] (3) In one embodiment, the control unit permits execution of the first process if the result of the confirmation process is consistent, and does not permit execution of the first process if the result of the confirmation process is inconsistent.

[0013] According to the above configuration, it is possible to prevent the first process from being executed in a state where an inconsistency occurs between software versions.

[0014] (4) In one embodiment, during the startup check process, if the control unit fails to receive information regarding the second software within a predetermined time from starting the startup check process, the control unit does not allow execution of the first process.

[0015] If information about the second software is not received within a predetermined time from the start of the startup check process, it is assumed that some abnormality has occurred in the system. In this case, by disallowing execution of the first process, it is possible to prevent the first process from being executed in an abnormal state.

[0016] (5) In one embodiment, in the startup check process, the control unit transmits a signal including information indicating the result of the confirmation process to another control device.

[0017] For example, the other control device determines whether or not the first process can be executed based on information indicating the result of the confirmation process from the control device. A signal including information indicating the result of the confirmation process is transmitted from the control device to the other control device, allowing the other control device to determine whether or not the first process can be executed.

[0018] (6) In an embodiment, the predetermined process further includes a second process in which the control device independently realizes a second function of the vehicle. The control unit permits execution of the first process and the second process when a result of the confirmation process indicates a match, disallows execution of the first process and permits execution of the second process when a result of the confirmation process indicates a mismatch, and disallows execution of the first process and the second process when information on the second software cannot be received within a certain time period after starting the startup check process.

[0019] According to the above configuration, if the result of the confirmation process is inconsistent, the first process in cooperation with other control devices is not permitted, while the second process performed by the control device alone is permitted. Even if the result of the confirmation process is inconsistent, the execution of the second process that can be performed is permitted, thereby preventing excessive restriction on the execution of the process. In addition, if it is expected that an abnormality will occur in the system, such as not receiving information about the second software within a certain time after starting the startup check process, the first process and the second process are not permitted, thereby preventing the execution of inappropriate processes.

[0020] (7) A control device according to another aspect of the present disclosure is a control device constituting a system of a vehicle, and includes a storage unit that stores software for executing a predetermined process, and a control unit that executes the software. The predetermined process includes a first process that cooperates with another control device mounted on the vehicle to realize a function of the vehicle. The control device and the other control device are configured to update the software at startup if there is a software update. The control unit executes a startup check process before executing the software at startup of the control device. In the startup check process, the control unit transmits information about the software to the other control device, receives a first signal indicating a result of a confirmation process that confirms the software consistency between the control device and the other control device, which is performed by the other control device using the information about the software, and determines whether or not to execute the first process based on the first signal. When the control unit receives a second signal from the other control device indicating that there is a possibility that the software between the control device and the other control device has become inconsistent after the software execution has started, the control unit stops or does not permit the execution of the first process.

[0021] According to the above configuration, the control unit of the control device executes a startup check process at startup, transmits information about the software to the other control device, and receives a first signal indicating the result of the confirmation process from the other control device in response. The control unit can then check the consistency with the software based on the first signal and appropriately determine whether or not the first process can be executed. After the software starts to be executed, if the control unit receives a second signal from the other control device indicating that there may be a software inconsistency between the control device and the other control device, the control unit stops or does not permit execution of the first process. This makes it possible to prevent the first process from being executed in a state where a software inconsistency has occurred.

[0022] (8) In one embodiment, the control unit transmits information about the software to other control devices at predetermined intervals during the startup check process.

[0023] In a configuration in which the information about the software is transmitted once, for example, in the event of a temporary communication error, the information about the software may not be acquired by other control devices. With the above configuration, it is possible to increase the possibility that the information about the software of other control devices can be acquired in the event of a temporary communication error.

[0024] (9) In one embodiment, when the control unit receives a first signal during a startup check process, the control unit stops transmitting information about the software.

[0025] According to the above configuration, since the transmission of the information related to the software is stopped after the first signal is received, the case where the information related to the software is transmitted thereafter can be, for example, when the control device is restarted. The control device is configured to update the software at the time of startup. Therefore, when the information related to the software is received after the first signal is transmitted, the other control device can be made to recognize the possibility of a software inconsistency.

[0026] (10) In one embodiment, the information about the software includes version information of the software.

[0027] According to the above configuration, since the software consistency is confirmed based on the software version, the software consistency can be confirmed with high accuracy.

[0028] (11) In one embodiment, the control unit permits execution of the first process when the first signal indicates that the result of the confirmation process is consistent, and does not permit execution of the first process when the first signal indicates that the result of the confirmation process is inconsistent.

[0029] According to the above configuration, it is possible to prevent the first process from being executed in a state where an inconsistency occurs between software versions.

[0030] (12) In one embodiment, in a startup check process, if the control unit does not receive a first signal within a predetermined time after sending information about the software, the control unit does not allow execution of the first process.

[0031] If the first signal is not received within a predetermined time after the transmission of the information about the software, it is assumed that some abnormality has occurred in the system. In this case, by disallowing the execution of the first process, it is possible to prevent the first process from being executed in an abnormal state.

[0032] (13) In an embodiment, the predetermined processing further includes a second processing in which the control device independently realizes a second function of the vehicle. The control unit permits execution of the first processing and the second processing when the first signal indicates that the result of the confirmation processing is consistent, does not permit execution of the first processing and permits execution of the second processing when the first signal indicates that the result of the confirmation processing is inconsistent, and does not permit execution of the first processing and the second processing when the first signal is not received within a certain time after transmitting the information related to the software.

[0033] According to the above configuration, if the result of the confirmation process is inconsistent, the first process in cooperation with other control devices is not permitted, while the second process performed by the control device alone is permitted. Even if the result of the confirmation process is inconsistent, the execution of the second process that can be performed is permitted, thereby preventing excessive restriction on the execution of the process. In addition, if it is expected that an abnormality will occur in the system, such as the first signal not being received within a certain time after the transmission of information related to the software, the first process and the second process are not permitted, thereby preventing the execution of inappropriate processes.

[0034] (14) A control method according to another aspect of the present disclosure is a control method for a control device that configures a system of a vehicle and is implemented with first software for executing a predetermined process. The predetermined process includes a first process for implementing a function of the vehicle in cooperation with another control device that configures the system. The control device and the other control device are configured to update the software at startup if there is a software update. The control method includes the steps of: receiving, at startup of the control device, information about second software including a program for executing the first process stored in the other control device, and executing a startup check process including a confirmation process for confirming consistency between the first software and the second software, before executing the first software, and stopping or not allowing execution of the first process when information about the second software is received from the other control device after starting execution of the first software.

[0035] (15) A recording medium according to another aspect of the present disclosure records a program for executing the control method described in (14) above.

[0036] (16) A control method according to another aspect of the present disclosure is a control method for a control device that configures a system of a vehicle and is implemented with software for executing a predetermined process. The predetermined process includes a first process for implementing a function of the vehicle in cooperation with another control device mounted on the vehicle. The control device and the other control device are configured to update the software at startup when there is a software update. The control method includes a step of executing a startup check process before executing the software at startup of the control device. The step of executing the startup check process includes a step of transmitting information about the software to the other control device, a step of receiving a first signal indicating a result of a confirmation process for confirming the consistency of the software between the control device and the other control device, which is performed by the other control device using the information about the software, and a step of determining whether or not the first process can be executed based on the first signal. The control method further includes a step of stopping or not permitting execution of the first process when a second signal indicating that there is a possibility that the software between the control device and the other control device has become inconsistent after the execution of the software has started is received from the other control device.

[0037] (17) A recording medium according to another aspect of the present disclosure records a program for executing the control method described in (16) above. Effect of the Invention

[0038] According to the present disclosure, in a state in which a software inconsistency occurs, it is possible to suppress the execution of processes that are performed in cooperation between a plurality of control devices. [Brief description of the drawings]

[0039] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a communication system. [Diagram 2] 1 is a diagram illustrating an example of a configuration of an electric vehicle according to an embodiment. [Diagram 3] FIG. 11 is a diagram for explaining combination information of software product numbers (versions). [Figure 4]4 is a diagram for explaining an example of operations performed by a representative ECU and a cooperative ECU; FIG. [Diagram 5] 11 is a diagram for explaining functions that are permitted depending on the result of a version check; FIG. [Figure 6] 10 is a diagram for explaining another example of the operation performed between the representative ECU and the cooperative ECU; FIG. [Figure 7] 10 is a flowchart showing a procedure of a startup check process executed by a representative ECU. [Figure 8] 5 is a flowchart showing a procedure of processing executed by a representative ECU during execution of normal processing; [Figure 9] 10 is a flowchart showing a procedure of a startup check process executed by a link ECU. [Figure 10] 5 is a flowchart showing a procedure of a process executed by a link ECU during execution of a normal process; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0040] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference characters and their description will not be repeated.

[0041] 1 is a diagram illustrating an example of the configuration of a communication system 1. The communication system 1 includes a communication network 6, a management server 7, and an electric vehicle 100. The electric vehicle 100 is configured to be able to communicate with the management server 7 via the communication network 6.

[0042] The management server 7 is, for example, a computer including a CPU (Central Control Unit), various memories, and a communication interface. The management server 7 provides update information for various software to the multiple vehicles, and manages the update status of various software stored in each of the multiple vehicles. FIG. 1 shows an electric vehicle 100, which is one of the multiple vehicles, as an example. In the following description, information exchanged between the management server 7 and the electric vehicle 100 will be described, but the same applies to information exchanged between the management server 7 and other vehicles, and detailed description thereof will not be repeated.

[0043] In a storage device (not shown) of the management server 7, for example, identification information (hereinafter also referred to as "vehicle ID") that is unique information for identifying the electric vehicle 100 is stored in advance. The various software stored in the electric vehicle 100 includes, for example, control programs stored in each of a plurality of ECUs (Electronic Control Units) mounted on the electric vehicle 100. The management server 7 manages the identification information including the version information of the various software for each ECU of the electric vehicle 100. In the storage device of the management server 7, the version information of the software of a representative ECU included in the electric vehicle 100 and the version information of the software of the other ECUs are stored in association with the vehicle ID, as described below. The management server 7 manages the version information of the software using a unique product number. When the management server 7 provides update information to the electric vehicle 100, the management server 7 manages the update status of the various software in the electric vehicle 100 using the product number corresponding to the provided update information.

[0044] For example, when software with a new part number (new version) is prepared, management server 7 requests electric vehicle 100 to update the software, or provides software with the new part number to electric vehicle 100 in response to a request from electric vehicle 100.

[0045] Next, a specific configuration of the electric vehicle 100 in this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram that shows an example of the configuration of the electric vehicle 100 in this embodiment. As shown in Fig. 2, the electric vehicle 100 includes a representative ECU 200, association ECUs 210 and 220, a DCM (Data Communication Module) 230, an ADS (Autonomous Driving System) 240, a communication bus 250, and a drive device 260. The representative ECU 200, the association ECUs 210 and 220, and the ADS 240 are communicatively connected via the communication bus 250.

[0046] The representative ECU 200 is an ECU that instructs the linkage ECUs 210 and 220 to switch to software with an updated part number, which will be described later, and manages the update status of the software of each ECU, including the representative ECU 200 itself.

[0047] Representative ECU 200 includes a CPU 201 and a memory 202. CPU 201 executes a program stored in memory 202, thereby executing various controls on a control target (e.g., DCM 230, etc.) of representative ECU 200. Memory 202 includes a first storage area 202A and a second storage area 202B. A control program for starting representative ECU 200 is stored in both first storage area 202A and second storage area 202B. Representative ECU 200 sets either first storage area 202A or second storage area 202B as a startup storage area (e.g., first storage area 202A), and at startup, executes the control program stored in the set startup storage area to start up. When representative ECU 200 receives update information from management server 7 via DCM 230, representative ECU 200 stores a control program updated using the update information in an update storage area (e.g., second storage area 202B) which is a storage area other than the storage area set as the startup storage area. When the updated program is stored in the update storage area (e.g., second storage area 202B), representative ECU 200 sets the update storage area as the startup storage area at the next startup, and also instructs associated ECU 210 (described later) to set the update storage area as the startup storage area at the next startup.

[0048] Therefore, when the electric vehicle 100 is turned on (power on) by a start-up operation or the like by a user after the IG is turned off (power off), the representative ECU 200 and the linkage ECUs 210, 220 each execute the updated control program stored in the startup storage area and start up. Note that the storage area that was set as the startup storage area until the startup is set as an update storage area. Hereinafter, changing the startup storage area and setting it anew may be referred to as switching the startup storage area.

[0049] The representative ECU 200 acquires the product number (version) of the updated software stored in the associated ECUs 210 and 220 from the management server 7 or the associated ECUs 210 and 220 , and stores the product number (version) in the memory 202 .

[0050] The DCM 230 is an in-vehicle communication module configured to be capable of wireless communication with the management server 7. The DCM 230 is configured to be capable of two-way data communication with the management server 7 in response to control signals from the representative ECU 200. The DCM 230 is connected to the representative ECU 200. The representative ECU 200 transmits information about the electric vehicle 100, various requests, and the like to the management server 7 and receives update information for various software from the management server 7 via the DCM 230.

[0051] The linkage ECU 210 includes a CPU 211 and a memory 212. The CPU 211 executes a program stored in the memory 212, thereby executing various controls on a control target (for example, the drive device 260, etc.) of the linkage ECU 210. The memory 212 includes a third storage area 212A and a fourth storage area 212B. A control program for starting up the linkage ECU 210 is stored in both the third storage area 212A and the fourth storage area 212B. The linkage ECU 210 sets one of the third storage area 212A and the fourth storage area 212B as a startup storage area, and at startup, executes the control program stored in the set startup storage area to start up. When the linkage ECU 210 receives update information from the management server 7 via the DCM 230 and the representative ECU 200 and receives an instruction to switch the startup storage area from the representative ECU 200, the linkage ECU 210 sets the update storage area as the startup storage area at the next startup.

[0052] The linkage ECU 220 is different from the linkage ECU 210 in the detection targets of sensors, the control targets (for example, a steering system, a brake system, etc.), and the control operations. The other configurations of the linkage ECU 220 are similar to those of the linkage ECU 210. Therefore, detailed description of the linkage ECU 220 will not be repeated. In the following description, when there is no particular distinction between the linkage ECU 210 and the linkage ECU 220, they may be collectively referred to simply as "linkage ECUs."

[0053] The drive device 260 is connected to the association ECU 210, and performs a drive operation to drive the electric vehicle 100 in response to a control signal from the association ECU 210. The drive device 260 includes, for example, a motor generator, a power storage device, and a PCU (Power Control Unit) (none of which are shown). The power storage device includes, for example, a secondary battery such as a nickel-metal hydride battery or a lithium-ion battery having a liquid or solid electrolyte, or a DC power source such as a capacitor. The PCU converts DC power from the power storage device to AC power and supplies it to the motor generator, or converts AC power generated in the motor generator to DC power and supplies it to the power storage device. The motor generator is a drive source for the electric vehicle 100 and also a power generation source, and drives the drive wheels to rotate or generates power by the rotation of the drive wheels. The drive device 260 may further include an internal combustion engine as a drive source or power generation source.

[0054] The ADS 240 is configured to be able to perform autonomous driving of the electric vehicle 100. Specifically, the ADS 240 acquires information (surrounding environment) indicating the state of the electric vehicle 100 from the representative ECU 200, the association ECUs 210 and 220, and various sensors, and creates a driving plan using the acquired information, a destination, etc. The ADS 240 outputs various control requests for driving the electric vehicle 100 according to the created driving plan to the representative ECU 200 and the association ECUs 210 and 220 that control various actuators including the drive unit 260.

[0055] In this embodiment, ADS240 is described as being built into electric vehicle 100, but it may also be configured as an autonomous driving kit that can be attached to a predetermined position, such as the roof top of electric vehicle 100, and can be removed from electric vehicle 100.

[0056] The electric vehicle 100 is driven in either an automatic driving mode in which automatic driving can be performed according to a control request from the ADS 240, or a manual driving mode in which driving can be performed according to various operations (accelerator operation, brake operation, steering operation) by a user. Various actuators mounted on the electric vehicle 100 are controlled by at least one of the representative ECU 200 and the cooperation ECUs 210 and 220. In the present embodiment, a configuration in which the multiple ECUs mounted on the electric vehicle 100 include the representative ECU 200 and the cooperation ECUs 210 and 220 has been described as an example, but the number of cooperation ECUs included in the multiple ECUs can be changed as appropriate. The number of cooperation ECUs included in the multiple ECUs may be one, or may be three or more.

[0057] In the electric vehicle 100 having the above configuration, the representative ECU 200 and the cooperation ECUs 210, 220 execute software to realize various functions of the electric vehicle 100. The functions of the electric vehicle 100 include, for example, functions realized by the representative ECU 200 and the cooperation ECUs 210, 220 cooperating to execute processing (hereinafter also referred to as "system functions"), and functions realized by each of the representative ECU 200 and the cooperation ECUs 210, 220 independently executing processing without cooperating with other ECUs (hereinafter also referred to as "independent functions").

[0058] Here, the software stored in each of the representative ECU 200 and the association ECUs 210, 220 can be updated using update information received from the management server 7, thereby modifying existing functions and adding new functions. In order to properly execute functions (particularly system functions) according to the updated software, the representative ECU 200 executes a "start-up check process" for checking whether or not a combination of product numbers (versions) of software executed in the representative ECU 200 and the association ECUs 210, 220 is consistent after, for example, the IG is turned on. When the representative ECU 200 and the association ECUs 210, 220 are started up by turning the IG on, the start-up check process is executed first, and after the start-up check process is completed, the software for realizing each function is executed.

[0059] The representative ECU 200 determines that the combination of part numbers is consistent when, for example, the combination of part numbers (versions) of the software in the representative ECU 200 and the associated ECUs 210, 220 is a predetermined combination. The representative ECU 200 acquires combination information of the part numbers of the software in the representative ECU 200 and the associated ECUs 210, 220 from the management server 7 and stores the information in the memory 212.

[0060] 3 is a diagram for explaining combination information of software product numbers (versions). The combination information includes combinations of pre-update and post-update versions in the representative ECU 200 and the associated ECUs 210 and 220. The representative ECU 200 acquires the combination information together with the update information from the management server 7 via the DCM 230, and stores the combination information in the memory 202.

[0061] For example, in the combination of versions before the update, the software version of the representative ECU 200 is A00001, the software version of the associating ECU 210 is B00001, and the software version of the associating ECU 220 is C00001. For example, in the combination of versions after the update, the software version of the representative ECU 200 is A00002, the software version of the associating ECU 210 is B00002, and the software version of the associating ECU 220 is C00002.

[0062] As described above, the functions of the electric vehicle 100 include system functions and independent functions. In order to properly realize the system functions, it is important that the product numbers (versions) of software are consistent between the representative ECU 200 and the linkage ECUs 210 and 220.

[0063] In the startup check process, before executing the software stored in the startup storage area, the representative ECU 200 acquires product number information (version information) of the software stored in the startup storage area from each of the association ECUs 210, 220. Before executing the software stored in the startup storage area, each of the association ECUs 210, 220 transmits the product number information (version information) of the software stored in the startup storage area to the representative ECU 200. The representative ECU 200 checks the combination information for the product number of the software stored in its own startup storage area and the product number specified by the acquired version information. If the combination matches, the representative ECU 200 determines that the startup storage area has been appropriately switched in each ECU (the representative ECU 200 and the association ECUs 210, 220).

[0064] If the combination matches, the representative ECU 200 permits the execution of processing for realizing a system function (hereinafter also referred to as "system processing") and processing for realizing an individual function (hereinafter also referred to as "individual processing"). If the combination does not match, the representative ECU 200 permits the execution of individual processing but does not permit system processing. A specific description will be given with reference to FIG. 4. Note that the system processing corresponds to an example of a "first processing" according to the present disclosure. The individual processing corresponds to an example of a "second processing" according to the present disclosure.

[0065] Fig. 4 is a diagram for explaining an example of the operations performed by the representative ECU 200 and the linkage ECUs 210 and 220. Fig. 4 shows an operation sequence between the representative ECU 200 and the linkage ECUs.

[0066] In S1, a start-up operation for starting up the system of the electric vehicle 100 is performed by the user, and the electric vehicle 100 enters an IG-on state. When the IG-on state is entered, power is supplied to the representative ECU 200 and the association ECUs 210 and 220, and the representative ECU 200 and the association ECUs 210 and 220 start up. At this time, if there is a software update, the start-up storage area is switched in each ECU.

[0067] In S10 and S20, the representative ECU 200 and the association ECUs 210, 220 each start a startup check process. In each of the representative ECU 200 and the association ECUs 210, 220, the startup check process is executed only once at startup until the electric vehicle 100 enters an IG off state.

[0068] When the startup check process is started in S21, each of the association ECUs 210, 220 transmits product number information (version information) indicating the product number (version) of the software stored in the startup storage area to the representative ECU 200. Each of the association ECUs 210, 220 transmits the version information to the representative ECU 200 at predetermined intervals. Note that a known technique can be used to acquire the product number (version) of the software stored in the startup storage area, and a detailed description thereof will not be provided.

[0069] In S11, after the representative ECU 200 is switched to the IG-on state, the representative ECU 200 executes a version check by receiving the version information from each of the associated ECUs 210, 220 for the first time. In the version check, the representative ECU 200 determines whether the combination of the versions is consistent based on whether the combination of the part numbers (versions) of the software stored in its own (representative ECU 200) startup storage area and the part numbers (versions) specified by the version information received from each of the associated ECUs 210, 220 is a predetermined combination. More specifically, the representative ECU 200 determines the consistency of the version combination by referring to the combination information ( FIG. 3 ) between the software version stored in its own startup storage area and the version specified by the acquired version information. For example, the representative ECU 200 determines that there is consistency when the version of the software stored in its own startup storage area is A00002, the version specified by the version information received from the association ECU 210 is B00002, and the version specified by the version information received from the association ECU 220 is C00002. For example, the representative ECU 200 determines that there is no consistency (mismatch) when the version of the software stored in its own startup storage area is A00002 but the version specified by the version information received from the association ECU 210 is B00001 or the version specified by the version information received from the association ECU 220 is C00001. Furthermore, when the representative ECU 200 does not receive version information from at least one of the association ECUs 210 and 220 (timeout occurs) despite the elapse of a predetermined time after starting the startup check process of S10, it determines that there is an abnormality. The version check corresponds to an example of a "confirmation process" according to the present disclosure.

[0070] In S12, the representative ECU 200 generates a startup signal based on the result of the version check (including a timeout). The startup signal includes any one of a first startup signal, a second startup signal, and a third startup signal. If the representative ECU 200 determines that there is consistency in the version check, it generates a first startup signal including information indicating consistency. If the representative ECU 200 determines that there is no consistency in the version check, it generates a second startup signal including information indicating inconsistency. If the representative ECU 200 determines that there is an abnormality in the version check, it generates a third startup signal including information indicating the abnormality. The representative ECU 200 transmits the generated startup signal to the linked ECUs 210, 220.

[0071] In step S22, when the association ECUs 210 and 220 receive the activation signal, the association ECUs 210 and 220 stop transmitting the version information to the representative ECU 200. After this, the association ECUs 210 and 220 stop transmitting the version information to the representative ECU 200.

[0072] In S13 and S23, the representative ECU 200 and each of the cooperation ECUs 210, 220 start the startup process. Specifically, the representative ECU 200 starts the startup process based on the result of the version check. Each of the cooperation ECUs 210, 220 starts the startup process based on the startup signal. Functions to be permitted are determined in advance in association with the result of the version check and the startup signal.

[0073] Fig. 5 is a diagram for explaining functions that are permitted depending on the result of a version check. Fig. 5 shows the correspondence between the result of a version check and functions (first to third functions) that are permitted depending on the result.

[0074] The first function is a function (system function) that is realized by the representative ECU 200 and the cooperation ECUs 210, 220 executing processing in cooperation with each other, for example, an adaptive cruise control function. The second function is a system function, for example, a pre-crash safety (automatic braking) function. The third function is a function (single function) that is realized by the cooperation ECU 210 executing processing independently without cooperation with other ECUs, for example, a parking assistance function. Note that in this embodiment, the first to third functions are exemplified as the functions of the electric vehicle 100 described above, but the functions of the electric vehicle 100 are not limited to these. For example, the functions may include a function that is realized by the representative ECU 200 executing processing independently without cooperation with other ECUs, and a function that is realized by the cooperation ECU 220 executing processing independently without cooperation with other ECUs.

[0075] (1) If the version check results in a match, the representative ECU 200 sets all of the first to third functions to an permitted state. Upon receiving the first activation signal, each of the association ECUs 210, 220 sets all of the first to third functions to an permitted state. The first activation signal includes a command to set all of the first to third functions to an permitted state, and each of the association ECUs 210, 220 sets all of the first to third functions to an permitted state in accordance with the first activation signal. Alternatively, each of the association ECUs 210, 220 may set all of the first to third functions to an permitted state based on information indicating the match that is included in the first activation signal.

[0076] (2) If the result of the version check indicates an inconsistency, the representative ECU 200 sets the first function and the second function to a non-permitted state and sets the third function to a permitted state. That is, the representative ECU 200 sets the system function to a non-permitted state and sets the independent function to a permitted state. The system function is a function that is realized by the representative ECU 200 and the cooperation ECUs 210 and 220 executing processes in cooperation with each other, and therefore may not be executed appropriately in a state in which there is an inconsistency in the software. On the other hand, the independent function is a function that is realized by independently executing processes without cooperation with other ECUs, and therefore can be executed appropriately even if there is an inconsistency in the software. Thus, the first function and the second function are disabled and the third function is enabled. Upon receiving the second start-up signal, each of the cooperation ECUs 210 and 220 sets the first function and the second function to a non-permitted state and sets the third function to a permitted state. The second activation signal includes an instruction to set the first function and the second function to a non-permitted state and the third function to a permitted state, and each of the cooperation ECUs 210, 220 sets the first function and the second function to a non-permitted state and the third function to a permitted state in accordance with the second activation signal. Alternatively, each of the cooperation ECUs 210, 220 may set the first function and the second function to a non-permitted state and the third function to a permitted state based on information indicating an inconsistency included in the second activation signal.

[0077] (3) If the result of the version check is abnormal, the representative ECU 200 sets all of the first to third functions to a disallowed state. Upon receiving the third activation signal, each of the association ECUs 210, 220 sets all of the first to third functions to a disallowed state. The third activation signal includes a command to set all of the first to third functions to a disallowed state, and each of the association ECUs 210, 220 sets all of the first to third functions to a disallowed state in accordance with the third activation signal. Alternatively, each of the association ECUs 210, 220 may set all of the first to third functions to a disallowed state based on information indicating an abnormality included in the third activation signal.

[0078] 4 again, in S14 and S24, the representative ECU 200 and the cooperative ECUs 210, 220 each start a process including execution of a permitted function (hereinafter also referred to as "normal process"). The representative ECU 200 and the cooperative ECUs 210, 220 each do not start a process for executing a prohibited function. Therefore, if the result of the version check is inconsistent or abnormal, the process for executing the system function is not started.

[0079] After the electric vehicle 100 is brought into the IG on state as described above, the representative ECU 200 and the association ECUs 210, 220 each start processing.

[0080] During the execution of the process, the associated ECU may be restarted due to some malfunction such as a momentary interruption in the power supply that supplies power to the associated ECU. In this case, the restarted associated ECU may switch the startup storage area. Then, even if consistency is confirmed in the startup check process, an inconsistent state may occur thereafter. Therefore, focusing on the fact that the restarted associated ECU starts the startup check process and transmits version information, when the representative ECU 200 receives the version information after the startup process, the representative ECU 200 executes a process to stop or not permit system processing. In the following, it is assumed that the associated ECU 210 has been restarted.

[0081] In S25, when some malfunction such as a momentary interruption of the power supply that supplies power to the association ECU 210 occurs, the association ECU 210 is restarted.

[0082] In S26, the cooperation ECU 210 starts the start-up check process. Then, in S27, the linkage ECU 210 that has started the startup check process transmits product number information (version information) indicating the product number of the software stored in the startup storage area to the representative ECU 200. The linkage ECU 210 transmits the version information to the representative ECU 200 at predetermined intervals.

[0083] In S15, the representative ECU 200 acquires the version information from the association ECU 210. When the representative ECU 200 receives the version information after starting (during) execution of the normal process, the representative ECU 200 determines that an unauthorized restart has occurred in the association ECU 210 that has transmitted the version information. The representative ECU 200 then transmits an abnormality signal to the association ECUs 210, 220 without performing a version check. The abnormality signal is a signal equivalent to the third activation signal. That is, the abnormality signal includes at least information indicating an abnormality. The abnormality signal may further include a command to set all of the first to third functions to an unauthorized state. The representative ECU 200 may be configured to transmit the third activation signal.

[0084] In S28, when the linkage ECU 210 receives the abnormality signal, the linkage ECU 210 stops transmitting the version information. When the linkage ECU 220 receives the abnormality signal, the linkage ECU 220 skips the processes of S28 and S29 and executes the process of S30.

[0085] In S29, the association ECU 210 starts the start-up process based on the abnormality signal. The process at this time is similar to the start-up process in S23 when the association ECU 210 receives the third start-up signal.

[0086] In S16 and S30, each of the representative ECU 200 and the cooperative ECUs 210, 220 stops or does not permit system processing. Specifically, if the representative ECU 200 and the cooperative ECU 220 have been executing system processing, they execute a sequence for stopping the system processing, and stop the system processing. If the representative ECU 200 and the cooperative ECU 220 have not been executing system processing, they do not start the system processing thereafter. Note that the representative ECU 200 and the cooperative ECU 220 continue to execute the independent processing. The cooperative ECU 210 does not start the system processing, but starts processing for executing the independent function.

[0087] Although the case where the cooperative ECU is restarted has been described with reference to FIG. 4, the case where the representative ECU 200 is restarted may also occur.

[0088] Fig. 6 is a diagram for explaining another example of the operation performed by the representative ECU 200 and the association ECUs 210, 220. Fig. 6 shows an operation sequence between the representative ECU 200 and the association ECU 210. While Fig. 4 explains an example in which the association ECU 210 is restarted, Fig. 6 explains an example in which the representative ECU 200 is restarted. Fig. 6 is obtained by changing the processing from S14 and S24 onwards from the sequence in Fig. 4. Therefore, the processing from S14 and S24 onwards will be explained.

[0089] In S40, when some malfunction such as a momentary interruption of the power supply that supplies power to the representative ECU 200 occurs, the representative ECU 200 is restarted.

[0090] In S41, the representative ECU 200 starts the startup check process. In S42, the representative ECU 200 waits for version information to be transmitted from the associated ECUs 210 and 220. However, since the associated ECUs 210 and 220 have not been restarted, each of the associated ECUs 210 and 220 does not transmit version information. Therefore, a predetermined time elapses (timeout occurs) after the start of the startup check process without transmitting any version information.

[0091] In S43, the representative ECU 200 detects that a predetermined time has elapsed since the start of the startup check process without transmitting the version information, and determines that an abnormality has occurred. Then, the representative ECU 200 transmits an abnormality signal to the association ECUs 210 and 220.

[0092] In S44, representative ECU 200 does not start system processing, but starts processing for executing an independent function.

[0093] In S30, if the cooperation ECUs 210 and 220 were executing the system processing, they execute a sequence for stopping the system processing, and stop the system processing. If the cooperation ECUs 210 and 220 were not executing the system processing, they do not start the system processing thereafter. Note that the cooperation ECUs 210 and 220 continue to execute the independent processing.

[0094] Fig. 7 is a flowchart showing the procedure of the startup check process executed by representative ECU 200. The process of the flowchart in Fig. 7 is started upon startup of representative ECU 200. Each step of Fig. 7 and the flowchart in Fig. 8 described later will be described as being realized by software processing by representative ECU 200, but some or all of the steps may be realized by hardware (electrical circuitry) created within representative ECU 200.

[0095] In S50, the representative ECU 200 starts the startup check process and receives version information from the associated ECUs 210 and 220.

[0096] In S51, the representative ECU 200 determines whether or not it has received version information from all of the target ECUs. In this embodiment, the target ECUs are the associated ECUs 210 and 220. If the representative ECU 200 has not received version information from at least one of the associated ECUs 210 and 220 (NO in S51), the process proceeds to S52. If the representative ECU 200 has received version information from both the associated ECUs 210 and 220 (YES in S51), the process proceeds to S54.

[0097] In S52, representative ECU 200 determines whether a predetermined first time has elapsed since the start of the startup check process. If the first time has not elapsed (NO in S52), representative ECU 200 returns the process to S50. If the first time has elapsed (YES in S52), representative ECU 200 determines a timeout and proceeds to S53.

[0098] In S53, the representative ECU 200 determines that some abnormality has occurred and determines to prohibit execution of the system processing. Furthermore, the representative ECU 200 determines to prohibit execution of the individual processing. Then, the representative ECU 200 generates a third start-up signal including information indicating the abnormality, and proceeds to S58. The representative ECU 200 may include a command to prohibit execution of the system processing and the individual processing in the third start-up signal.

[0099] In S54, the representative ECU 200 reads the combination information from the memory 202. The representative ECU 200 determines the consistency of the combination by checking the combination information against the product numbers (versions) of the software stored in its own startup storage area and the product numbers (versions) identified by the version information received from each of the associated ECUs 210 and 220 in S50.

[0100] In S55, representative ECU 200 determines whether all versions match as a result of the comparison in S54. If representative ECU 200 determines that all versions match (YES in S55), it proceeds to S56. If representative ECU 200 determines that there is an inconsistency (NO in S55), it proceeds to S57. The processes of S52, S54, and S55 correspond to a version check.

[0101] In S56, the representative ECU 200 determines that the software is consistent and decides to permit execution of the system processing. Then, the representative ECU 200 generates a first start-up signal including information indicating the consistency, and the process proceeds to S58. The representative ECU 200 may include in the first start-up signal a command to permit execution of the system processing and the independent processing.

[0102] In S57, the representative ECU 200 determines that there is a software inconsistency, and decides to not permit execution of the system processing. The representative ECU 200 decides to permit execution of the individual processing. The representative ECU 200 generates a second start-up signal including information indicating the inconsistency, and proceeds to S58. The representative ECU 200 may include in the second start-up signal a command to not permit execution of the system processing and permit execution of the individual processing.

[0103] In S58, the representative EU 200 transmits an activation signal (the first activation signal, the second activation signal, or the third activation signal) to the association ECUs 210 and 220.

[0104] Fig. 8 is a flowchart showing the procedure of processing executed by representative ECU 200 during normal processing. The processing of the flowchart in Fig. 8 is executed in parallel with normal processing (system processing or independent processing), and is called from the main routine for each control period and executed repeatedly.

[0105] In S60, the representative ECU 200 determines whether or not the version information has been received from the associated ECUs 210, 220. If the representative ECU 200 determines that the version information has not been received (NO in S60), the representative ECU 200 returns the process to the main routine. If the representative ECU 200 determines that the version information has been received (YES in S60), the representative ECU 200 advances the process to S61.

[0106] In S61, the representative ECU 200 determines that the linked ECU that transmitted the version information has restarted, and determines to stop or not permit execution of the system process. Furthermore, the representative ECU 200 determines to prohibit execution of the independent process. Then, the representative ECU 200 generates an abnormality signal, and the process proceeds to S63.

[0107] In S62, the representative ECU 200 transmits an abnormality signal to the association ECUs 210 and 220.

[0108] Fig. 9 is a flowchart showing the procedure of the startup check process executed by the associated ECU. The process of the flowchart in Fig. 9 is started when the associated ECU is started. Each step of Fig. 9 and the flowchart in Fig. 10 described later will be described as being realized by software processing by the associated ECU, but a part or all of the steps may be realized by hardware (electrical circuitry) created in the associated ECU.

[0109] In S70, the link ECU starts a startup check process and transmits version information to the representative ECU 200.

[0110] In S71, the linkage ECU determines whether or not an activation signal has been received from the representative ECU 200. If the linkage ECU determines that an activation signal has not been received from the representative ECU 200 (NO in S71), the linkage ECU proceeds to S72. If the linkage ECU determines that an activation signal has been received from the representative ECU 200 (YES in S71), the linkage ECU proceeds to S74.

[0111] In S72, the associated ECU determines whether a predetermined second time has elapsed since the start of the startup check process. The second time can be set to, for example, a time equal to or greater than the above-mentioned first time. If the second time has not elapsed (NO in S72), the associated ECU returns the process to S70. If the second time has elapsed (YES in S72), the associated ECU determines a timeout and proceeds to S73.

[0112] In step S73, the link ECU determines that some abnormality has occurred and determines to prohibit the execution of the system process. The link ECU further determines to prohibit the execution of the independent process.

[0113] In S74, the linkage ECU determines whether the activation signal received in S71 is the first activation signal. If the linkage ECU determines that the first activation signal has been received (YES in S74), the process proceeds to S75. If the linkage ECU determines that the first activation signal has not been received (NO in S74), the process proceeds to S76.

[0114] In S75, the linkage ECU determines to permit execution of the system process based on the first start-up signal. Also, the linkage ECU determines to permit execution of the independent process based on the first start-up signal.

[0115] In S76, the linkage ECU determines whether the activation signal received in S71 is the second activation signal. If the linkage ECU determines that the second activation signal has been received (YES in S76), the process proceeds to S77. If the linkage ECU determines that the second activation signal has not been received (NO in S76), the process proceeds to S73.

[0116] In S77, the linkage ECU determines to prohibit the execution of the system process based on the second start signal, and determines to permit the execution of the independent process based on the first start signal.

[0117] Fig. 10 is a flowchart showing the procedure of processing executed by the linked ECU during normal processing. The processing of the flowchart in Fig. 10 is executed in parallel with normal processing (system processing or independent processing), and is called from the main routine for each control period and executed repeatedly.

[0118] In S80, the linkage ECU determines whether or not an abnormality signal has been received from the representative ECU 200. If the linkage ECU determines that an abnormality signal has not been received (NO in S80), the linkage ECU returns the process to the main routine. If the linkage ECU determines that an abnormality signal has been received (YES in S80), the linkage ECU advances the process to S81.

[0119] In step S81, the link ECU determines to prohibit the execution of the system process. Furthermore, the link ECU determines to prohibit the execution of the independent process.

[0120] As described above, when the electric vehicle 100 is in the IG-on state and the representative ECU 200 and the cooperation ECUs 210 and 220 are started, the start-up check process is executed once in each of the representative ECU 200 and the cooperation ECUs 210 and 220 before executing software for implementing various functions. Then, after the start-up check process, whether or not various processes (system processes and individual processes) can be executed is determined based on the result of the start-up check process, and normal processing is started. After the start of the normal processing, if either the representative ECU 200 or the cooperation ECU is restarted, an abnormality signal is transmitted from the representative ECU 200 and the system processing is stopped. If the cooperation ECU is restarted, an abnormality signal is transmitted from the representative ECU 200 to the cooperation ECU due to the representative ECU 200 receiving version information during normal processing. If the representative ECU 200 is restarted, an abnormality signal is transmitted from the representative ECU 200 to the cooperation ECU due to the representative ECU 200 not receiving version information and timing out. In this way, if a startup check process is performed before the software is executed and a software inconsistency may occur due to a restart or the like, an abnormality signal is sent and system processing is not permitted in the representative ECU 200 and the linked ECUs, thereby preventing system processing from being executed in a state in which a software inconsistency has occurred.

[0121] Furthermore, by executing the startup check process once at startup, unless a restart or the like occurs, version information is not sent from the associated ECU to the representative ECU 200 after the startup process. Therefore, when the representative ECU 200 receives version information from the associated ECU during processing execution, it can determine that an abnormality has occurred without performing a version check. This makes it possible to reduce computational resources compared to a case in which version information is periodically received and a version check is performed.

[0122] Furthermore, when a software inconsistency occurs, system processing is not permitted, while individual processing is permitted. By permitting the execution of individual processing that can be performed even when a software inconsistency occurs, excessive restrictions on the execution of processing can be suppressed.

[0123] Furthermore, if the representative ECU 200 does not receive the version information within a first time from the start of the startup check process, or if the linked ECU does not receive the startup signal within a second time from the transmission of the version information, it is assumed that some abnormality has occurred. In this case, by disallowing the execution of the system process and the individual process, it is possible to prevent the system process and the individual process from being executed in an abnormal state.

[0124] [Variations] In the embodiment, in the startup check process, the link ECU periodically transmits the version information to the representative ECU 200. However, in the startup check process, the link ECU may be configured to transmit a signal indicating that the link ECU has been started to the representative ECU 200, and transmit the version information in response to a request from the representative ECU 200.

[0125] When the electric vehicle 100 is in the IG on state, power is supplied to the representative ECU 200 and the cooperation ECUs 210, 220, and the representative ECU 200 and the cooperation ECUs 210, 220 are started up. Then, the representative ECU 200 and the cooperation ECUs 210, 220 each start a start-up check process.

[0126] When the startup check process is started, each of the associated ECUs 210, 220 transmits a signal indicating that it has started up to the representative ECU 200. When the representative ECU 200 receives a signal indicating that it has started up during the startup check process, it transmits a request to transmit version information to the associated ECU that is the source of the signal.

[0127] When each of the linkage ECUs 210, 220 receives a request to transmit the version information, it transmits the version information to the representative ECU 200. The representative ECU 200 uses the version information to execute the version check described in the embodiment. After starting the startup check process, each of the linkage ECUs 210, 220 does not start the startup process until it receives a startup signal from the representative CU 200. The subsequent process is the same as in the embodiment, and therefore will not be described repeatedly.

[0128] Furthermore, after starting the normal processing, when the representative ECU 200 receives a signal indicating that it has been started from at least one of the associated ECUs, it determines that some abnormality has occurred and transmits an abnormality signal to the associated ECUs 210 and 220. The subsequent processing is similar to that in the embodiment, and therefore will not be described repeatedly.

[0129] As described above, the configuration of the modified example can also achieve the same effects as those of the embodiment.

[0130] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present disclosure is defined by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0131] 1 communication system, 6 communication network, 7 management server, 100 electric vehicle, 200 representative ECU, 201 CPU, 202 memory, 202A first storage area, 202B second storage area, 210, 220 linked ECU, 212 memory, 212A third storage area, 212B fourth storage area, 250 communication bus, 260 drive device.

Claims

1. A control device constituting a system of a vehicle, a storage means for storing first software for implementing a first function of the vehicle in cooperation with other control devices constituting the system; A control device comprising: a control means for stopping or not allowing execution of the first software when information regarding a second software stored in the other control device to realize the first function during execution of the first software is received from the other control device, the information being for confirming consistency between the first software and the second software.

2. the information about the second software is version information about the second software, The control device according to claim 1 , wherein the control means checks the consistency based on a combination of the version of the first software and the version of the second software.

3. The control means When a result of the process of checking the consistency is a consistency, execution of a first process for implementing the first function in cooperation with the other control device is permitted; The control device according to claim 1 , wherein when a result of the confirmation process indicates a mismatch, execution of the first process is not permitted.

4. The control means When the control device is started, a start-up check process including the confirmation process is executed; 4. The control device according to claim 3, wherein, in the startup check process, if information about the second software is not received within a predetermined time from the start of the startup check process, execution of the first process is not permitted.

5. The control device according to claim 4 , wherein the control means transmits a signal including information indicating a result of the confirmation process to the other control device in the startup check process.

6. the first software is configured to execute a first process and a second process; the first process is a process for realizing the first function in cooperation with the other control device, the second process is a process in which the control device alone realizes a second function of the vehicle, The control means When the control device is started, a start-up check process including the confirmation process is executed; In the startup check process, when a result of the confirmation process is a match, execution of the first process and the second process is permitted; When a result of the confirmation process is inconsistent in the startup check process, the execution of the first process is not permitted and the execution of the second process is permitted; A control device as described in any one of claims 1 to 5, wherein if information regarding the second software is not received within a predetermined time after starting the startup check process, execution of the first process and the second process is not permitted.

7. A control method for a control device constituting a system of a vehicle, the control device being implemented with first software for implementing a first function of the vehicle in cooperation with other control devices constituting the system; determining whether or not information regarding second software stored in the other control device for implementing the first function has been received from the other control device during execution of the first software, the information being for verifying consistency between the first software and the second software; and stopping or not permitting execution of the first software when information for confirming the consistency is received.

8. A program for executing a control method for a control device constituting a system of a vehicle, the control device being implemented with first software for implementing a first function of the vehicle in cooperation with other control devices constituting the system; The control method includes: determining whether or not information regarding second software stored in the other control device for implementing the first function has been received from the other control device during execution of the first software, the information being for verifying consistency between the first software and the second software; and when information for confirming the consistency is received, stopping or not permitting execution of the first software.

Images