Analysis system and analysis method

Abstract

To accurately estimate, without prior information, communications related to changes in values of transmitted data of a target type from communication logs between multiple devices.SOLUTION: An analysis system is configured to retain a communication log that shows a time series of combinations of data types and values transmitted between multiple devices, specifically at the points where the values change, extract multiple logs, from the communication logs, in a period between the time corresponding to a first value of the target type of data and the time corresponding to a second value, extract communication sequences indicating one or more combinations of data types and values, and the order of occurrence of change points corresponding to each of the one or more combinations, from the multiple logs, and determine candidate sequences related to the change from the first value to the second value of the target type of data on the basis of the occurrence status of the extracted communication sequences in the multiple logs.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an analysis system and an analysis method.

Background Art

[0002] As background art in this technical field, there is Japanese Patent Application Laid-Open No. 2015-141663 (Patent Document 1). The failure analysis device described in Patent Document 1 includes module coupling degree information representing the coupling degree of software modules executed in an information processing device, one or more log information generated in the information processing device, and module-related log information associating the software modules. Based on these, a log coupling degree generation unit that sets the coupling degree of the software module for the log information related to a specific software module, a failure log acquisition unit that extracts log information related to a failure that occurred in the information processing device, and a failure analysis log generation unit that generates failure analysis log information related to a specific failure from the log information with the set coupling degree and the log information related to the failure (see the abstract).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the technology described in Patent Document 1, although information indicating the relationship between software modules is given in advance in the module-related log information, it may be difficult to define the relationship between modules. In such a case, the technology described in Patent Document 1 may not be able to extract logs related to failures.

[0005] Therefore, one aspect of the present invention accurately estimates, without prior information, communication related to changes in the values of transmission data of a target type from communication logs among a plurality of devices.

Means for Solving the Problems

[0006] To solve the above problems, one aspect of the present invention adopts the following configuration. An analysis system includes a processor and a memory. The memory holds a communication log showing a time series of combinations of the type and value of data transmitted among a plurality of devices using a predetermined protocol, the combination at the change point of the value among the combinations, target data information indicating the target type of data, and the first value and the second value of the data of the target type. The processor extracts a plurality of logs during a period between the time corresponding to the first value of the data of the target type and the time corresponding to the second value from the communication log, extracts a communication sequence determined by one or more combinations of the type and value of data and the order of occurrence of the change points corresponding to each of the one or more combinations from the extracted plurality of logs, determines a candidate sequence that is a communication sequence related to the change from the first value to the second value of the data of the target type based on the appearance status of the extracted communication sequence in the extracted plurality of logs, and generates data for displaying the candidate sequence.

Advantages of the Invention

[0007] According to one aspect of the present invention, it is possible to accurately estimate, without prior information, communication related to changes in the values of transmission data of a target type from communication logs among a plurality of devices.

[0008] Problems, configurations, and effects other than those described above will be clarified by the description of the following embodiments.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Mode for Carrying Out the Invention

[0010] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are basically given the same reference numerals, and repeated explanations are omitted. It should be noted that this embodiment is only an example for realizing the present invention and does not limit the technical scope of the present invention.

[0011] Vehicle systems in automobiles are complex, and a large number of ECUs (Electronic Control Units) cooperate to realize the functions of the vehicle system. It is difficult for the function developers of automobiles to understand the details of ECUs that they do not take charge of, and it is difficult to grasp the behavior of the vehicle system including the ECUs they are responsible for and the ECUs they are not responsible for.

[0012] Therefore, when a malfunction occurs in the vehicle system and it is assumed that the cause of the malfunction lies in an ECU that the function developer is not responsible for, it is difficult for the function developer to identify the cause. It is considered that if the behavior from a system perspective (the communication sequence between ECUs) can be inferred based on the communication log showing the result of the interaction between ECUs, the identification of the cause of the malfunction can be made more efficient.

Example

[0013] FIG. 1 is a block diagram showing an example of the functional configuration of an analysis system. The analysis system 100 analyzes a communication log showing the time series of CAN (Controller Area Network) data transmitted and received between a plurality of ECUs mounted on an automobile, and identifies candidates for a series of communications performed between the plurality of ECUs within a period specified by the value of a signal of a target type included in the CAN data. Note that a signal indicates individual information included in the payload of CAN data. The payload of one CAN data may include only the value of one type of signal, or may include the values of a plurality of types of signals.

[0014] For example, when the value of a target signal changes when a specific function is executed by any one of the ECUs, the analysis system 100 identifies a series of communication candidates that occur within a period including the timing at which the value of the target signal changes. Thus, the user of the analysis system 100 can infer communications and control processes by other ECUs related to the execution of the specific function. Hereinafter, a series of communications is also referred to as a communication sequence, and the candidate communication sequences identified by the analysis system 100 are also referred to as candidate sequences. Note that the communication sequence indicates one or more signals included in the CAN data and the transmission order of the one or more signals.

[0015] The analysis system 100 is connected to the test environment 200 via a network such as the Internet. The test environment 200 is an environment for verifying the operations of a plurality of ECUs, and may be realized by an automobile equipped with the plurality of ECUs or as a simulation environment on a computer for simulating the operations of the plurality of ECUs. The test environment 200 transmits a communication log indicating the time series of CAN data transmitted and received between the plurality of ECUs along with the operations of the plurality of ECUs to the analysis system 100.

[0016] Note that, for example, the analysis system 100 and the test environment 200 may be integrated. In this case, the communication between the analysis system 100 and the test environment 200 is omitted.

[0017] The analysis system 100 includes a user input unit 111, a log input unit 112, a communication log analysis unit 113, an estimation unit 114, and a display unit 119, all of which are functional units. The analysis system 100 also holds a communication log DB (DataBase) 131 and an estimated sequence DB 132.

[0018] The user input unit 111 receives inputs such as information necessary for analysis by the analysis system 100 and commands for the analysis system 100 according to inputs from the user to the input device of the analysis system 100. Specifically, for example, the user input unit 111 receives inputs of a DBC file (CAN database file), communication logs, information indicating a section including candidate sequences to be estimated, and information indicating the target communication logs.

[0019] The log input unit 112 receives inputs of the communication logs input to the user input unit 111 and the communication logs transmitted from the test environment 200 to the analysis system 100. The communication log analysis unit 113 acquires the communication logs from the log input unit 112, acquires the DBC file from the user input unit 111, executes the communication log analysis process described below on the acquired communication logs using the DBC file, and stores the communication logs on which the communication analysis logs have been executed in the communication log DB 131.

[0020] The estimation unit 114 acquires, for example, from the user input unit 111, information indicating a section including candidate sequences to be estimated and information indicating the target communication logs including the candidate sequences. The estimation unit 114 acquires the target communication logs from the communication log DB 131, analyzes the acquired communication logs to estimate candidate sequences, and outputs the estimation results to the display unit 119.

[0021] Further, the estimation unit 114 includes a sequence creation unit 115, a correlation analysis unit 116, a sequence estimation unit 117, and a display data generation unit 118, all of which are functional units. The sequence creation unit 115 creates a communication sequence to be analyzed by the correlation analysis unit 116 based on the communication logs acquired from the communication log DB 131 and the estimation results by the sequence estimation unit 117. The correlation analysis unit 116 analyzes the correlation between the communication sequence created by the sequence creation unit 115 and the target communication logs.

[0022] Based on the analysis result by the correlation analysis unit 116, the sequence estimation unit 117 estimates candidate sequences from the sequences created by the sequence creation unit 115. The display data generation unit 118 generates data for graphing the candidate sequences specified by the user with reference to the communication logs indicated by the communication log DB 131.

[0023] The display unit 119 displays the estimation result of the candidate sequences obtained from the estimation unit 114 on the display device of the analysis system 100.

[0024] The communication log DB 131 holds the communication logs (analysis results) after the communication log analysis process is executed by the communication log analysis unit 113. The estimated sequence DB 132 holds information indicating the candidate sequences estimated by the estimation unit 114.

[0025] FIG. 2 is a block diagram showing a hardware configuration example of the analysis system 100. The analysis system 100 is configured by, for example, a computer having a CPU (Central Processing Unit) 101, a memory 102, an auxiliary storage device 103, an input device 104, a display device 105, and a communication device 106.

[0026] The CPU 101 includes a processor and executes programs stored in the memory 102. The memory 102 includes a ROM (Read Only Memory) which is a non-volatile storage element and a RAM (Random Access Memory) which is a volatile storage element. The ROM stores invariant programs (e.g., BIOS (Basic Input / Output System)). The RAM is a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory) and temporarily stores programs executed by the CPU 101 and data used during program execution.

[0027] The auxiliary storage device 103 is a large-capacity and non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 101 and data used during program execution. That is, the program is read from the auxiliary storage device 103, loaded into the memory 102, and executed by the CPU 101.

[0028] The input device 104 is a device that receives input from an operator, such as a keyboard or a mouse. The display device 105 is a device that outputs the execution result of a program in a form visible to the operator, such as a display device or a printer.

[0029] The communication device 106 is a network interface device that controls communication with other devices according to a predetermined protocol. Further, the communication device 106 may include a serial interface such as USB (Universal Serial Bus).

[0030] Part or all of the programs executed by the CPU 101 may be provided to the analysis system 100 via a network from a removable medium (such as a CD-ROM or a flash memory), which is a non-transitory storage medium, or an external computer equipped with a non-transitory storage device, and stored in the non-volatile auxiliary storage device 103, which is a non-transitory storage medium. Therefore, the analysis system 100 preferably has an interface for reading data from a removable medium.

[0031] The analysis system 100 is a computer system configured physically on one computer or logically or physically on a plurality of computers, and may operate in separate threads on the same computer or on a virtual computer built on a plurality of physical computer resources.

[0032] CPU 101 includes each functional unit of the analysis system 100. For example, by operating according to the user input program loaded in the memory 102, the CPU 101 functions as the user input unit 111, and by operating according to the log input program loaded in the memory 102, the CPU 101 functions as the log input unit 112. Regarding the other functional units included in the CPU 101, the relationship between the program and the functional unit is the same.

[0033] Note that part or all of the functions performed by the functional units included in the CPU 101 may be realized by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0034] The auxiliary storage device 103 holds each DB that the analysis system 100 has. Note that part or all of the information stored in these DBs may be stored in the memory 102, or may be stored in a database connected to the analysis system 100.

[0035] Note that in this embodiment, the information used by the analysis system 100 may be represented in any data structure regardless of the data structure. For example, a data structure appropriately selected from a table, a list, a database, or a queue can store the information.

[0036] Note that when the test environment 200 is a simulation environment on a computer, for example, the hardware configuration of the test environment 200 is the same as the hardware configuration shown in FIG. 2.

[0037] FIG. 3 is a diagram showing an example of a communication log before analysis. The communication log 300 before analysis is a communication log input from the user input unit 111 or the test environment 200 to the log input unit 112, and is a communication log before the communication log analysis process by the communication log analysis unit 113 is executed.

[0038] In the pre - analysis communication log 300, for example, records indicating the CAN ID corresponding to the CAN data, the time when the CAN data was transmitted, and the payload of the CAN data are recorded as a time series in the order of the transmission time.

[0039] The CAN ID is an ID for identifying the type of CAN data. Note that the DBC file indicates the source ECU and destination ECU of the CAN data for each CAN ID, information on the data structure of the CAN data for each CAN ID, etc. Also, the information on the data structure indicated by the DBC file includes information indicating the type of signal included in the payload of the CAN data and information indicating the bit position where the value of the signal of that type is stored in the payload. Therefore, the signal (type and value) included in the CAN data can be specified from the CAN ID, the DBC file, and the payload.

[0040] Note that since the CAN data is transmitted periodically, information may be recorded in the pre - analysis communication log 300 even when the value of the signal has not changed. Therefore, the same value may be continuously transmitted for various types of signals.

[0041] FIG. 4 is a flowchart showing an example of the communication log analysis process. The communication log analysis process may be performed on the pre - analysis communication log 300 each time the pre - analysis communication log 300 is input to the communication log analysis unit 113, or may be performed on the pre - analysis communication log 300 that has already been input to the communication log analysis unit 113 at a predetermined period or at the timing when an instruction from the user is input. Also, before the communication log analysis process starts, it is assumed that the communication log analysis unit 113 has acquired the DBC file input to the user input unit 111 from the user input unit 111.

[0042] First, the communication log analysis unit 113 refers to the DBC file and generates time-series data for each type of signal from the pre-analysis communication log 300 (S401). Specifically, for example, the communication log analysis unit 113 refers to the DBC file and identifies the type of signal and the bit position where the value of the signal corresponding to each CAN ID included in the pre-analysis communication log 300 is stored. Further, the communication log analysis unit 113 acquires the value of the identified bit position (i.e., the value of the signal of the identified type) corresponding to the CAN ID corresponding to the payload from each payload included in the pre-analysis communication log 300.

[0043] Thereby, the communication log analysis unit 113 can acquire the type and value of the signal from each record of the pre-analysis communication log 300. When a single CAN data (one record of the pre-analysis communication log 300) contains the values of multiple types of signals, the communication log analysis unit 113 acquires the values of each type of signal from the single CAN data. The communication log analysis unit 113 generates time-series data at that time by associating the CAN ID, the type of the signal, the time when the CAN data including the signal was transmitted, and the value of the signal for each type of signal.

[0044] Subsequently, the communication log analysis unit 113 selects one type of unselected signal from the types of signals for which time-series data was generated in step S401 (S402). The communication log analysis unit 113 deletes from the time-series data the values that are the same as the value at the previous time in the time-series data of the signal corresponding to the type of signal selected in step S402 (S403). Thereby, the communication log analysis unit 113 can extract the timing (hereinafter also referred to as the change point) at which the value of the signal changes from the time-series data of the signal of the selected type.

[0045] The communication log analysis unit 113 determines whether all types of signals for which time-series data was generated in step S401 have been selected (S404). If the communication log analysis unit 113 determines that there are unselected signal types (S404: NO), it returns to step S402.

[0046] If the communication log analysis unit 113 determines that all types of signals have been selected (S404: YES), it combines the time-series data indicating the change points generated in step S403 for each type of signal into one time-series data, and sorts the records of the time-series data in ascending order of transmission time, and for those with the same transmission time, in ascending order of bit position (S405).

[0047] The communication log analysis unit 113 stores the sorted time-series data generated in step S405 as a change point log in the communication log DB131 (S406), and ends the communication log analysis process. In this embodiment, an example in which the communication log analysis unit 113 generates a change point log has been described, but the change point log may be stored in the communication log DB131 in advance.

[0048] Note that, for example, in the time-series data of a signal indicating a continuous value such as speed, almost all times can be change points. Therefore, in this embodiment, a signal indicating a continuous value may be excluded from the analysis target during candidate sequence estimation. Note that the communication log analysis unit 113 may convert the value of a signal indicating a continuous value such as speed into a discrete value by a predetermined method (for example, converting 0 km / h to 0, more than 0 km / h and 20 km / h or less to 1, more than 20 km / h and 40 km / h or less to 2, more than 40 km / h and 60 km / h or less to 3, more than 60 km / h to 3, etc.), and include it in the analysis target.

[0049] FIG. 5 is a flowchart showing an example of communication sequence estimation processing. Hereinafter, for convenience of explanation, a signal of type X and value n may be simply denoted as "X:n" or the like. Also, the order of signals in the communication sequence may be denoted by "→". For example, "X:n→Y:m" indicates that "Y:m" is transmitted after "X:n" in the communication sequence.

[0050] The estimation unit 114 acquires, from the user input unit 111, the signal information of the sequence estimation target for which the user input unit 111 has received an input (S501). The signal information of the sequence estimation target includes, for example, information indicating the type of the target signal and the change in the value of the target signal of that type.

[0051] The estimation unit 114 extracts, from the communication log DB 131, logs of a plurality of periods including the change in the value of the target signal indicated by the signal information of the sequence estimation target acquired in step S501 (S502). Hereinafter, the log extracted in step S502 is also referred to as an extraction log.

[0052] For example, when the signal information of the sequence estimation target is information indicating that A:0 changes to A:1 (the type of the target signal is A and its value changes from 0 to 1), in step S502, the estimation unit 114 determines, from the change point logs stored in the communication log DB 131, a plurality of periods (for example, all periods) in which the value of the signal of type A, which is the target signal, changes from 0 to 1, and extracts each of the logs for the specified periods (that is, the periods sandwiched between the time corresponding to A:0 and the time when A:1 is first transmitted after that time).

[0053] For example, when A:0 indicates that the collision damage mitigation brake operation is off and A:1 indicates that the collision damage mitigation brake operation is on, each extraction log is assumed to include the communication sequence performed during the period when the collision damage mitigation brake operation switches from the off state to the on state (the period during which a specific function is executed).

[0054] The correlation analysis unit 116 tabulates the (total) number of occurrences of each combination of signal type and value in all the extracted logs (S503). The sequence creation unit 115 deletes, from each of the extracted logs, combinations of signal type and value whose number of occurrences tabulated in step S503 is less than the total number of the extracted logs (S504).

[0055] For example, since it is assumed that each extracted log necessarily includes a communication sequence required when a specific function is executed, the sequence creation unit 115 deletes, in step S504, combinations of signal type and value whose number of occurrences is less than the total number of the extracted logs, that is, combinations not included in at least any of the extracted logs, so as not to include them in the candidate sequences.

[0056] The sequence estimation unit 117 determines, for each combination of signal type and value whose number of occurrences tabulated in step S503 is equal to or more than the total number of the extracted logs (that is, combinations not deleted in step S504), a sequence provisional candidate (S505). Hereinafter, the sequence provisional candidate is also simply referred to as a provisional candidate.

[0057] Note that the sequence creation unit 115 may determine provisional candidates (that is, combinations not deleted from the extracted logs) based on the number of occurrences (occurrence status) of each combination of signal type and value in each of the extracted logs. Specifically, for example, the correlation analysis unit 116 calculates the ratio of the number of extracted logs including the combination to the total number of the extracted logs for each combination of signal type and value, and the sequence creation unit 115 may determine, as provisional candidates, combinations whose ratio is equal to or more than a predetermined value (that is, may delete, from each of the extracted logs, combinations whose ratio is less than the predetermined value). As the predetermined value, for example, a value such as 0.9 can be adopted, but if the predetermined value is 1.0, only combinations included in all the extracted logs are determined as provisional candidates. Further, the sequence creation unit 115 may use, as provisional candidates, only combinations that satisfy both the above-described condition regarding the total number of occurrences and the above-described condition regarding the comparison result between the ratio and the predetermined value.

[0058] Also, in the above example, the total number of occurrences of each combination and the total number of logs are compared in steps S504 and S505. However, the total number of occurrences and the value obtained by multiplying the total number of logs by a predetermined weight (for example, 0.8 to 1.2) may be compared to determine the combination to be deleted and the provisional candidates.

[0059] The sequence estimation unit 117 determines whether the combination of the type and value of the signal transmitted immediately before the changed value of the target signal is among the provisional candidates determined in step S505 in all the extracted logs (which may be logs above a predetermined ratio) (S506).

[0060] When the sequence estimation unit 117 determines that the combination is among the provisional candidates (S506: YES), it determines the combination of the type and value of the signal transmitted immediately before (each) as a candidate sequence and deletes it from the provisional candidates (S507), and determines whether there are any remaining provisional candidates (S508). When the sequence estimation unit 117 determines that the combination is not among the provisional candidates (S506: NO), it proceeds to step S508.

[0061] When the sequence estimation unit 117 determines that there are remaining provisional candidates (S508: YES), sequence extension processing is executed (S509), and it returns to step S508. Details of the sequence extension processing will be described later with reference to FIG. 6. When the sequence estimation unit 117 determines that there are no remaining provisional candidates (S508: NO), it stores each of the determined candidate sequences in the estimated sequence DB 132 (S510) and ends the communication sequence estimation process.

[0062] Note that for each of the determined candidate sequences, the sequence estimation unit 117 may add, in front of the candidate sequence, the combination of the signal type and the value before the change indicated by the signal information in step S501, and add, behind the candidate sequence, the combination of the type and the value after the change, and save each of the candidate sequences with these combinations added to the estimated sequence DB 132.

[0063] Further, the sequence estimation unit 117 may associate the determined candidate sequence with the information indicating the change point log including the candidate sequence in the estimated sequence DB 132 and save them in the estimated sequence DB 132.

[0064] FIG. 6 is a flowchart showing an example of the sequence extension process. The sequence creation unit 115 selects one unselected temporary candidate (S601). The sequence creation unit 115 refers to each of the extraction logs including the currently selected temporary candidate, and specifies the combination of the signal type and the value that appears at a time later than the currently selected temporary candidate (if the selected temporary candidate includes a plurality of signals, the last signal among the plurality of signals) in the extraction log, and creates an additional temporary candidate, which is a sequence obtained by adding the specified combination behind the currently selected temporary candidate, for each of the specified combinations (S602).

[0065] However, in step S602, the sequence creation unit 115 does not create an additional temporary candidate to which the same combination as the combination of the type and the value of the last signal of the currently selected temporary candidate is added. That is, in the candidate sequence, signals having the same combination of type and value do not continue continuously.

[0066] The sequence creation unit 115 determines whether all the temporary candidates have been selected (S603). If the sequence creation unit 115 determines that there are unselected temporary candidates (S603: NO), it returns to step S601. When the sequence creation unit 115 determines that all the temporary candidates have been selected (S603: YES), the correlation analysis unit 116 totals the (total) number of occurrences of each additional temporary candidate in all the extraction logs (after the deletion process execution in step S504) (S604).

[0067] However, the correlation analysis unit 116 does not count those that cannot be a sequence in the extraction log when counting the number of occurrences in the extraction log of the additional temporary candidate. Specifically, for example, if the additional temporary candidate is B:1→C:1, and in a certain extraction log, after B:1 appears, C:1 appears, and then C:1 appears again (since it is logically impossible for C:1 to appear again without C:0 in between), only B:1→C1 between B:1 and the former C:1 is counted, and B:1→C1 between B:1 and the latter C:1 is not counted.

[0068] The sequence creation unit 115 updates each additional temporary candidate whose counted number of occurrences in step S604 is equal to or greater than the total number of extraction logs as a new temporary candidate (S605).

[0069] Note that the sequence creation unit 115 may determine the updated temporary candidates based on the number of occurrences (appearance status) of each additional temporary candidate in each extraction log, similar to step S505. Specifically, for example, the correlation analysis unit 116 calculates the ratio of the number of extraction logs containing the additional temporary candidate to the total number of extraction logs for each additional temporary candidate, and the sequence creation unit 115 may determine the additional temporary candidates whose ratio is equal to or greater than a predetermined value as temporary candidates. Also, the sequence creation unit 115 may use only the additional temporary candidates that satisfy both the condition regarding the total number of the above-mentioned number of occurrences and the condition regarding the comparison result between the above-mentioned ratio and the predetermined value as the updated temporary candidates.

[0070] Also, in the above example, in step S605, the total number of occurrences of each additional candidate is compared with the total number of logs. However, the total number of occurrences may be compared with the value obtained by multiplying the total number of logs by a predetermined weight (for example, 0.8 to 1.2), and the combination and candidate to be deleted may be determined.

[0071] The sequence estimation unit 117 determines whether, among the candidates updated in step S605, there is a combination of the type and value of the signal transmitted immediately before the value after the change of the target signal in all the extracted logs (which may be logs of a predetermined ratio or more) and is the last combination of the sequence indicated by the candidate (S606).

[0072] When the sequence estimation unit 117 determines that there is such a candidate (S606: YES), it determines each of the candidates as a candidate sequence, deletes them from the candidates (S607), and ends the sequence extension process. When the sequence estimation unit 117 determines that there is no such candidate (S606: NO), it ends the sequence extension process.

[0073] As described above, the aggregation target of the number of occurrences in step S503 is each combination of the type and value of the signal. Also, as described above, the aggregation target of the number of occurrences in step S604 is the additional candidate. Each additional candidate is determined by a plurality of combinations of the type and value of the signal and the transmission order of the plurality of combinations (the occurrence order of the change points of the signals of the types indicated by the plurality of combinations to the values indicated by the combinations).

[0074] Hereinafter, specific examples of the communication sequence estimation process and the sequence extension process will be described with reference to FIGS. 7 to 9. FIGS. 7 to 9 are examples when the signal information to be sequence-estimated acquired in step S501 indicates that the signal changes from A: 0 to A: 1.

[0075] FIG. 7 is an explanatory diagram showing a specific example of communication sequence estimation processing. In step S502, the estimation unit 114 extracts the extraction log 710, the extraction log 720, and the extraction log 730. Each of the extraction log 710, the extraction log 720, and the extraction log 730 shows a change point log in the period sandwiched between the time when A:0 was transmitted and the time when A:1 was first transmitted after that time.

[0076] The aggregation result 740 shows the total number of occurrences of each combination of signal type and value in the extraction log 710, the extraction log 720, and the extraction log 730, aggregated by the correlation analysis unit 116 in step S503.

[0077] Since the number of extraction logs in the example of FIG. 7 is 3, in step S504, the sequence creation unit 115 deletes from each of the extraction log 710, the extraction log 720, and the extraction log 730 the combinations of signal type and value for which the number of occurrences indicated by the aggregation result 740 is less than 3.

[0078] Also, in step S505, the sequence estimation unit 117 determines each combination of signal type and value for which the number of occurrences indicated by the aggregation result 740 is 3 or more as a provisional candidate. Further, although T:1 is determined as a provisional candidate in step S505, since it is the signal at the time immediately before the signal A changes to 1 in all of the extraction log 710, the extraction log 720, and the extraction log 730, in steps S506 and S507, the sequence estimation unit 117 deletes T:1 from the provisional candidates and determines it as the candidate sequence. Since 4 provisional candidates remain in the state of FIG. 7, the sequence extension process is executed again, that is, it transitions to the specific example of the sequence extension process of FIG. 8.

[0079] FIG. 8 is an explanatory diagram showing a specific example of sequence extension processing. The extraction log 711, the extraction log 721, and the extraction log 731 are the logs obtained by deleting from the extraction log 710, the extraction log 720, and the extraction log 730 the combinations of signal type and value for which the number of occurrences indicated by the aggregation result 740 is less than 3, respectively.

[0080] In step S601, the sequence creation unit 115 selects one unselected candidate from C:1, B:1, and D:1 remaining as provisional candidates in FIG. 7. First, assume that B:1 is selected.

[0081] In step S602, the sequence creation unit 115 refers to the extraction log 711, the extraction log 721, and the extraction log 731 respectively, and identifies C:1, R:0, D:1, T:1, and R:0 which are combinations with the values of the types of signals that appear after B:1, and creates B:1→C:1, B:1→R:0, B:1→D:1, and B:1→T:1, B:1→R:0 as additional candidates for B:1. As described above, candidates in which the same signal is added after the currently selected candidate are not generated. For example, even if B:1 appears after B:1 in at least one of the extraction log 711, the extraction log 721, and the extraction log 731, the additional candidate B:1→B:1 is not generated.

[0082] In this way, the sequence creation unit 115 creates additional candidates corresponding to each candidate. The aggregation result 750 indicates the total number of appearances of each additional candidate in the extraction log 711, the extraction log 721, and the extraction log 731 aggregated by the correlation analysis unit 116 in step S604.

[0083] For example, in the extraction log 711, after B:1 transmitted at time "13:06.3", there are C:1 transmitted at time "13:07.3" and C:1 transmitted at time "13:15.1". In such a case, when the correlation analysis unit 116 counts the number of appearances of the additional candidate B:1→C:1, the combination of B:1 transmitted at time "13:06.3" and C:1 transmitted at time "13:15.1" after C:1 transmitted at time "13:07.3" is not counted as the number of appearances of B:1→C:1.

[0084] Since the number of extraction logs in the example of FIG. 8 is 3, in step S605, the sequence estimation unit 117 updates, as new candidates, the additional candidate candidates for which the number of occurrences indicated by the aggregation result 750 is 3 or more. Further, although D:1→T:1 and B:1→T:1 are determined as candidates in step S605, since the last signals of D:1→T:1 and B:1→T:1 respectively are the signals at the time immediately before the signal A changes to 1 in all of the extraction logs 710, extraction logs 720, and extraction logs 730, in steps S606 and S607, the sequence estimation unit 117 deletes D:1→T:1 and B:1→T:1 respectively from the candidates and determines them as candidate sequences. In the state of FIG. 8, since two candidates remain, the sequence extension process is executed again, that is, the process transitions to the specific example of the sequence extension process of FIG. 9.

[0085] FIG. 9 is an explanatory diagram showing a specific example of the sequence extension process. In step S601, the sequence creation unit 115 selects one unselected candidate from B:1→D:1 and R:0→D:1 remaining as candidates in FIG. 8. First, assume that B:1→D:1 is selected.

[0086] In step S602, the sequence creation unit 115 refers to each of the extraction logs 711, extraction logs 721, and extraction logs 731, identifies C:1 and T:1 which are combinations with the values of the types of signals that appear after B:1→D:1, and creates B:1→D:1→C:1 and B:1→D:1→T:1 as additional candidates for B:1→D:1. As described above, candidates in which the same signal is added after the last signal of the candidate being selected are not generated.

[0087] In this way, the sequence creation unit 115 creates additional candidates corresponding to each candidate. The aggregation result 760 indicates the total number of occurrences of each additional candidate in the extraction logs 711, extraction logs 721, and extraction logs 731 aggregated by the correlation analysis unit 116 in step S604.

[0088] In the example of FIG. 9, since the number of extraction logs is 3, in step S605, the sequence estimation unit 117 updates an additional candidate whose appearance count indicated by the aggregation result 760 is 3 or more as a new candidate. Further, although B:1→D:1→T:1 and R:1→D:1→T:1 are determined as candidates in step S605, since the last signal of each of B:1→D:1→T:1 and R:1→D:1→T:1 is the signal at the time immediately before the signal A changes to 1 in all of the extraction logs 710, extraction logs 720, and extraction logs 730, in steps S606 and S607, the sequence estimation unit 117 deletes each of B:1→D:1→T:1 and R:1→D:1→T:1 from the candidates and determines them as candidate sequences.

[0089] In the state of FIG. 9, since there are no remaining candidates, the communication sequence estimation process ends. As described above, in FIG. 7, T:1, in FIG. 8, D:1→T:1 and B:1→T:1, and in FIG. 9, B:1→D:1→T:1 and R:1→D:1→T:1 are determined as candidate sequences.

[0090] Also, as described above, it is possible to add the target signal "A:0" before the value changes and the target signal "A:1" after the value changes in front of each candidate sequence. Therefore, for example, in FIGS. 7 to 9, five candidate sequences of A:0→T:1→A:1, A:0→D:1→T:1→A:1, A:0→B:1→T:1→A:1, A:0→B:1→D:1→T:1→A:1, and A:0→R:1→D:1→T:1→A:1 are stored in the estimated sequence DB132.

[0091] Furthermore, for each of the five candidate sequences, information indicating a change point log included in the communication log DB131 and including the candidate sequence is stored in the sequence DB132. Thereby, the change point log including each candidate sequence can be specified.

[0092] Figure 10 is a flowchart showing an example of display data generation processing. The user input unit 111 receives an input for specifying a candidate sequence to be graphically displayed (S1001). For example, the display data generation unit 118 obtains a list of candidate sequences from the estimated sequence DB 132 and transmits it to the display unit 119. The display unit 119 displays the list on the display device 105, and the user selects a candidate sequence to be graphically displayed from the displayed list.

[0093] The display data generation unit 118 refers to the estimated sequence DB 132, identifies a change point log including the candidate sequence specified in step S1001, and obtains the identified change point log from the communication log DB 131 (S1002).

[0094] Using the change point log obtained in step S1002, the display data generation unit 118 creates a graph with the value of the signal on the vertical axis and time on the horizontal axis for each type of signal included in the candidate sequence specified in step S1001 (S1003). Note that the user input unit 111 may further receive an input for specifying a type of signal not included in the candidate sequence specified in step S1001. In this case, the display data generation unit 118 also creates a graph with the value of the specified type of signal on the vertical axis and time on the horizontal axis.

[0095] The display data generation unit 118 adds a symbol indicating the relationship between signals between the graphs created for each type of signal (S1004). Details of the symbol indicating the relationship between signals will be described later. The display data generation unit 118 generates data for a display screen including the graph with the added symbol and transmits it to the display unit 119. The display unit 119 displays the display screen on the display device 105 based on the data (S1005), and the display data generation processing ends.

[0096] FIG. 11 is a diagram showing an example of the screen configuration of the display screen displayed in step S1005. The display screen 1100 includes, for example, a candidate sequence designation area 1110, a free selection signal designation area 1120, a candidate sequence list display area 1130, a graph display area 1140, and a signal type display area 1150.

[0097] The candidate sequence designation area 1110 is an area for receiving the designation of the candidate sequence to be the graph display target. The free selection signal designation area 1120 is an area for designating the types of signals not included in the candidate sequence designated in the candidate sequence designation area 1110. A list of candidate sequences is displayed in the candidate sequence list display area 1130, and the candidate sequences included in the list can be designated in the candidate sequence designation area 1110.

[0098] In the graph display area 1140, graphs in the change point log obtained in step S1002 corresponding to the types of signals included in the candidate sequence designated in the candidate sequence designation area 1110 and the types of signals designated in the free selection signal designation area 1120 are displayed.

[0099] In the example of FIG. 11, since candidate 1 "A:0→B:1→D:1→T:1→A:1" is designated in the candidate sequence designation area 1110, graphs 1141, 1142, 1143, and 1144 corresponding to each of the signal types A, B, D, and T included in candidate 1 are displayed in the graph display area 1140. Also, in the example of FIG. 11, since "U" is selected as the signal type in the free selection signal designation area 1120, the graph 1145 corresponding to U is displayed in the graph display area 1140. As described above, each graph displayed in the graph display area 1140 is a graph with the signal value on the vertical axis and the time on the horizontal axis.

[0100] In addition, the symbols indicating the relationship between signals displayed in the graph display area 1140 include, for example, an arrow 1146 and an arrow 1147. The arrow 1146 connects each change point of the signal indicated by the candidate sequence specified in the candidate sequence designation area 1110 between the graphs. Further, the arrow 1147 connects the time when the signal A, which is the target signal of the candidate sequence, changes to A:1 and the time of the graph 1145 corresponding to the type of signal selected in the freely selectable signal designation area 1120.

[0101] With each graph displayed in the graph display area 1140, the user can easily understand the relationship between the changes in the signals included in the candidate sequence and the changes in the freely selected signal. Further, the user can easily understand the relationship between the change points of the signals included in the candidate sequence by the arrow 1146 and the relationship between the change point of the target signal included in the candidate sequence and the freely selected signal by the arrow 1147.

[0102] In the signal type display area 1150, information indicating the signals included in the candidate sequence specified in the candidate sequence designation area 1110 and the types and names of the signals specified in the freely selectable signal designation area 1120 is displayed.

[0103] FIG. 12 is a diagram showing an example of the screen configuration of a display screen displayed when a malfunction occurs in the function corresponding to the change of the target signal. The display screen 1200 includes, for example, a candidate sequence designation area 1110, a freely selectable signal designation area 1120, a signal type display area 1150, a comparison result display area 1160, and a malfunction graph display area 1170.

[0104] The change point log during the period when a defect occurred in the function corresponding to the target change of the target signal (here, A:0 → A:1) is acquired from the communication log DB131 by the representation data generation unit 118. Note that the period may be specified, for example, by user input received by the user input unit 111 or by notification from the test environment 200 received by the log input unit 112. Since the change point log during the period when the defect occurred is likely not to include a normal communication sequence, it is desirable that it not be used in the communication sequence estimation process described above.

[0105] In the defect graph display area 1170, graphs in the change point log during the period when the defect occurred, corresponding to the types of signals included in the candidate sequence specified in the candidate sequence specification area 1110 and the types of signals specified in the freely selectable signal specification area 1120, are displayed.

[0106] In the example of FIG. 12, since candidate 1 “A:0 → B:1 → D:1 → T:1 → A:1” is specified in the candidate sequence specification area 1110, graphs 1171, 1172, 1173, and 1174 corresponding to the defects of each of A, B, D, and T, which are the types of signals included in candidate 1, are displayed in the defect graph display area 1170.

[0107] Also, in the example of FIG. 12, since “U” is selected as the type of signal in the freely selectable signal specification area 1120, a graph 1175 corresponding to the defect of U is displayed in the defect graph display area 1170. Each graph displayed in the defect graph display area 1170 is a graph with the signal value on the vertical axis and the time on the horizontal axis.

[0108] Furthermore, symbols indicating relationships between signals displayed in the malfunction graph display area 1170 include, for example, arrows 1176 and 1177. Arrow 1176 connects the change points of signals indicated by each graph during a malfunction in chronological order between the graphs. In other words, arrow 1176 indicates the order of occurrence in the log during the period when the malfunction occurred of the change points indicated by the combination of the data type and value included in the specified candidate sequence.

[0109] An arrow 1177 connects the time when the target signal A during a malfunction changed to A:1 and the corresponding time on the graph 1175 during a malfunction corresponding to the type of signal selected in the freely selected signal designation area 1120.

[0110] The comparison result display area 1160 displays the comparison result between the candidate sequence specified in the candidate sequence specification area 1110 and the sequence (fault sequence) indicated by the change points connected by the arrow 1176 in the fault graph display area 1170. When a fault occurs, some of the change points indicated by the combination of data type and value included in the specified candidate sequence may not occur. In other words, some or all of the combinations of data type and value included in the specified candidate sequence are the combinations of data type and value included in the fault sequence.

[0111] 11, the sequence "A:0→B:1→T:1→A:1→D:1" is indicated by arrow 1176, and this sequence and candidate 1 "A:0→B:1→D:1→T:1→A:1" are displayed in comparison result display area 1160. By comparing the candidate sequence in comparison result display area 1160 with the sequence at the time of the malfunction, the user can infer the cause of the malfunction in a specific function.

[0112] As described above, in the communication log analysis process, the analysis system 100 of this embodiment can generate logs limited to the timing when a function is executed, the timing when the environment surrounding the vehicle changes, etc., by extracting only the change points. Further, the analysis system 100 determines a candidate sequence based on the appearance status of signals and additional candidate signals in each extracted log during the period sandwiched between the target changes of the target signal, thereby highly accurately extracting a candidate sequence related to the target change of the target signal.

[0113] Note that the analysis target by the analysis system 100 of this embodiment is not limited to the communication log of CAN data transmitted and received between a plurality of ECUs. That is, the analysis system 100 may analyze a communication log indicating data transmitted and received between an arbitrary type of a plurality of devices by a predetermined communication protocol, and identify a candidate sequence occurring within a period specified by the value of the information of the target type included in the payload of the data.

[0114] Note that the present invention is not limited to the above-described embodiments, and includes various modifications. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Further, it is possible to add, delete, or replace other configurations for a part of the configuration of each embodiment.

[0115] Also, each of the above configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them, for example, by an integrated circuit. Further, each of the above configurations, functions, etc. may be realized in software by a processor interpreting and executing a program for realizing each function. Information such as a program, table, file, etc. for realizing each function can be stored in a memory, a recording device such as a hard disk, SSD (Solid State Drive), or a recording medium such as an IC card, SD card, DVD.

[0116] In addition, control lines and information lines show those considered necessary for explanation, and not all control lines and information lines are necessarily shown on the product. In reality, it may be considered that almost all components are interconnected.

Explanation of Signs

[0117] 100 Analysis system, 101 CPU, 102 Memory, 103 Auxiliary storage device, 104 Input device, 105 Display device, 106 Communication device, 111 User input section, 112 Log input section, 113 Communication log analysis section, 114 Estimation section, 115 Sequence creation section, 116 Correlation analysis section, 117 Sequence estimation section, 118 Display data generation section, 119 Display section, 131 Communication log DB, 132 Estimated sequence DB

Claims

1. An analysis system comprising: a processor and a memory, wherein the memory holds: a communication log showing a time series of combinations of the type and value of data transmitted between a plurality of devices using a predetermined protocol, the combination at the point of change of the value among the combinations; and target data information indicating the type of the target data and the first and second values of the data of the target type, wherein the processor: extracts a plurality of logs in a period between the time corresponding to the first value of the data of the target type and the time corresponding to the second value from the communication log; extracts a communication sequence determined by one or more combinations of the type and value of data and the order of occurrence of the change points corresponding to each of the one or more combinations from the plurality of extracted logs; determines, from the extracted communication sequences, a candidate sequence that is a communication sequence related to the change from the first value to the second value of the data of the target type based on the appearance status of the extracted communication sequences in the plurality of extracted logs; and generates data for displaying the candidate sequence.

2. The analysis system according to claim 1, wherein the processor: calculates the appearance status of each combination of the type and value of data in the plurality of extracted logs; performs a deletion process of deleting combinations of the type and value of data that do not satisfy a predetermined condition from the plurality of logs; and extracts the communication sequence from the plurality of logs after the deletion process is performed.

3. The analysis system according to claim 2, wherein the processor: determines each combination of the type and value of data that satisfies the predetermined condition as a provisional candidate sequence; performs a candidate sequence determination process of determining the candidate sequence from the provisional candidate sequences based on the combination of the type and value of data at the time immediately before the second value of the data of the target type is transmitted in the plurality of extracted logs, and deleting the determined candidate sequence from the provisional candidate sequences.

4. The analysis system according to claim 3, wherein the processor: repeatedly performs a sequence extension process until it is determined that no provisional candidate sequence remains; in the sequence extension process, Identify the log among the extracted plurality of logs that includes the provisional candidate sequence, In the identified log, create an additional provisional candidate sequence by adding the combination of the type and value of the data that appears at the time after the provisional candidate sequence, Calculate the occurrence status of the additional provisional candidate sequence in the extracted plurality of logs, Update the additional provisional candidate sequence that satisfies the predetermined condition as the new provisional candidate sequence, An analysis system that executes the candidate sequence determination process for the updated provisional candidate sequence.

5. The analysis system according to claim 1, Based on the comparison result between the total number of occurrences of the extracted communication sequence in the extracted plurality of logs and the number of the extracted plurality of logs, the processor determines the candidate sequence from the extracted communication sequence. An analysis system.

6. The analysis system according to claim 1, Based on the occurrence ratio of the extracted communication sequence in the extracted plurality of logs, the processor determines the candidate sequence from the extracted communication sequence. An analysis system.

7. The analysis system according to claim 1, The predetermined protocol is CAN (Controller Area Network), Each of the plurality of devices is an ECU (Electronic Control Unit) mounted on an automobile. An analysis system.

8. The analysis system according to claim 1, The processor, Identify the log that is the extraction source of the candidate sequence, For each type of data included in the candidate sequence, generate a graph showing the time change of the value of the data of that type in the identified log, Add relational information indicating the change point of the data of that type to the value indicated by the combination of the type and value of the data included in the candidate sequence and the order of occurrence of the change points indicated by the candidate sequence to the generated graph, An analysis system that generates data for displaying the graph with the added relational information.

9. The analysis system according to claim 1, The memory holds a malfunction log indicating the time series during the period when a malfunction occurred in the function corresponding to the change from the first value to the second value of the data of the target type, The processor, Identify the order of occurrence in the defect log of the change points indicated by the combination of data types and values included in the candidate sequence, Create a communication sequence indicating the combination of data types and values included in the candidate sequence and the order of occurrence of the identified change points as a defect sequence when the defect occurs, An analysis system that generates data for displaying the defect sequence.

10. An analysis method by an analysis system, The analysis system has a processor and a memory, The memory is, A communication log showing the time series of the combination of data types and values transmitted between a plurality of devices using a predetermined protocol, among the combinations of data types and values at the change points of the values, Holds target data information indicating the target type of data and the first and second values of the data of the target type, The analysis method is, The processor extracts a plurality of logs in the period between the time corresponding to the first value of the data of the target type and the time corresponding to the second value from the communication log, The processor extracts a communication sequence determined by one or more combinations of data types and values and the order of occurrence of change points corresponding to each of the one or more combinations from the plurality of extracted logs, The processor determines, from the extracted communication sequences, a candidate sequence that is a communication sequence related to the change from the first value to the second value of the data of the target type based on the appearance status of the extracted communication sequence in the plurality of extracted logs, An analysis method in which the processor generates data for displaying the candidate sequence.

Images