Vehicle control system

Abstract

To prevent any of a plurality of functions from being unable to be executed.SOLUTION: A vehicle control system 20 includes a plurality of functional ECUs 24 to 26 each having a memory 32 and a CPU 31. Each of the plurality of functional ECUs 24 to 26 transmits version information relating to its own software version. When at least one functional ECU receives the version information transmitted from another functional ECU, the at least one functional ECU determines executable functions among the plurality of functions on the basis of its own software version and the version represented by the version information, permits execution of the functions determined to be executable among the plurality of functions, and prohibits execution of the functions determined to be inexecutable.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a vehicle control system including a plurality of electronic control units. [Background technology]

[0002] Patent Document 1 discloses a vehicle control system equipped with multiple electronic control units. Each of the multiple electronic control units includes a CPU and a memory in which software executed by the CPU is stored. In the vehicle control system, if the combination of software versions of the multiple electronic control units is consistent, execution of multiple functions related to various vehicle driving modes, such as autonomous driving, is permitted. On the other hand, if the combination of software versions of the multiple electronic control units is inconsistent, execution of the multiple functions is prohibited. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2019-159399 Summary of the Invention [Problem to be solved by the invention]

[0004] In the above system, if the combination of software versions of the plurality of electronic control units is not consistent, the execution of the plurality of functions is uniformly prohibited. [Means for solving the problem]

[0005] A vehicle control system for solving the above problems includes a plurality of electronic control devices that store software for executing a plurality of functions related to vehicle operation. In the vehicle control system, each of the plurality of electronic control devices transmits version information regarding the version of the software stored therein. At least one of the plurality of electronic control devices receives the version information transmitted from another electronic control device other than itself, and upon receiving the version information transmitted from the other electronic control device, determines which of the plurality of functions are executable based on the version of the software stored therein and the version indicated by the version information. The system then permits execution of the functions determined to be executable, while prohibiting execution of the functions determined to be inexecutable. [Effects of the Invention]

[0006] The vehicle control system has the advantage of being able to prevent a situation in which all of the functions cannot be executed. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a configuration diagram showing a vehicle equipped with a vehicle control system according to an embodiment and a server capable of communicating with the vehicle. [Figure 2] FIG. 2 is a diagram showing an example of a correspondence table stored in the memory of the electronic control unit included in the vehicle control system of FIG. [Figure 3] FIG. 3 is a sequence diagram showing a processing flow when determining executable functions from among a plurality of functions in the vehicle control system of FIG. [Figure 4] FIG. 4 is a flowchart showing a series of processes executed by the CPU provided in the electronic control unit in the vehicle control system of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0008] An embodiment of a vehicle control system will be described below with reference to FIGS. 1 illustrates a vehicle 10 and a server 100 installed outside the vehicle. The vehicle 10 is equipped with a vehicle control system 20.

[0009] <server> The server 100 is a management server installed outside the vehicle 10. The server 100 manages software for a plurality of vehicles 10 that have been registered in advance. The server 100 transmits and receives various information to and from the vehicle 10 via an external vehicle network 200. The external vehicle network 200 is a wireless network. For example, the server 100 transmits update software for the vehicle 10 to the vehicle 10 in response to a request from the vehicle 10.

[0010] <Vehicle control system> The vehicle control system 20 includes a plurality of electronic control units configured to be able to transmit and receive information to and from each other via an in-vehicle network 21. Hereinafter, the electronic control units will be referred to as "ECUs." The plurality of ECUs includes a DCM 22 and an OTA master 23. "DCM" is an abbreviation for "Data Communication Module." "OTA" is an abbreviation for "Over The Air." The DCM 22 is a data communication module that communicates with the server 100 via an external vehicle network 200. The OTA master 23 manages the software of the plurality of ECUs, including itself.

[0011] The plurality of ECUs further includes a plurality of function ECUs 24, 25, and 26. For example, the plurality of function ECUs include the following ECUs. An ADAS-ECU that collects information to assist the driver of the vehicle 10 in driving operations.

[0012] An ECU that controls the power source of the vehicle 10, such as the engine or the traction motor. An ECU that controls the braking system of the vehicle 10. An ECU that controls an actuator that adjusts the steering of the wheels of the vehicle 10.

[0013] The DCM 22, the OTA master 23, and the multiple function ECUs 24, 25, and 26 each have a CPU 31 and a memory 32. The memory 32 stores software executed by the CPU 31. The multiple function ECUs 24, 25, and 26 can execute multiple functions related to the driving of the vehicle 10 by the CPU 31 executing the software in the memory 32. Examples of the multiple functions include an autonomous driving function, an automatic braking function for collision prevention, lane keep assist, and adaptive cruise control. The autonomous driving function may include at least one of an autonomous driving function of about level 2, an autonomous driving function of about level 3, an autonomous driving function of about level 4, and an autonomous driving function of about level 5.

[0014] The software stored in the memories 32 of the plurality of functional ECUs 24, 25, 26 is appropriately rewritten with the update software transmitted from the server 100. That is, in the plurality of functional ECUs 24, 25, 26, software is appropriately upgraded.

[0015] The above-mentioned multiple functions can be executed by multiple functional ECUs working together. In this case, if the software versions of the multiple functional ECUs are not consistent, at least some of the multiple functions may not be able to be executed.

[0016] 2 is stored in the memory 32 of each of the plurality of functional ECUs 24, 25, and 26. When software is updated in at least one of the plurality of functional ECUs 24, 25, and 26, the correspondence table 50 in the memory 32 of each of the plurality of functional ECUs 24, 25, and 26 is also updated.

[0017] For ease of understanding, the following description will be given assuming that there are three functional ECUs, the first ECU 24, the second ECU 25, and the third ECU 26, and that there are three functions.

[0018] Of the three functions, the first ECU 24 and the second ECU 25 are required to execute the first function, but the third ECU 26 is not. Of the three functions, all three function ECUs 24, 25, and 26 are required to execute the second and third functions.

[0019] FIG. 2 shows four patterns PT1, PT2, PT3, and PT4 as combination patterns of each software version. In pattern PT1, the software version is "1.0" in all of the first ECU 24, the second ECU 25, and the third ECU 26. In pattern PT1, all of the first function, the second function, and the third function can be executed.

[0020] That is, if the software version of both the first ECU 24 and the second ECU 25 is "1.0," it can be determined that the combination of the software version of the first ECU 24 and the software version of the second ECU 25 is consistent in terms of executing the first function. Also, if the software version of all three function ECUs 24, 25, and 26 is "1.0," it can be determined that the combination of the software version of the three function ECUs 24, 25, and 26 is consistent in terms of executing the second function and the third function.

[0021] In pattern PT2, the software versions of the first ECU 24 and the second ECU 25 are "1.0," and the software version of the third ECU 26 is "2.0." In pattern PT2, the first function and the second function can be executed, but the third function cannot be executed.

[0022] That is, if the software versions of the first ECU 24 and the second ECU 25 are "1.0" and the software version of the third ECU 26 is "2.0," it can be determined that the combination of the software versions of the three functional ECUs 24, 25, and 26 is compatible in terms of executing the second function. On the other hand, it can be determined that the combination of the software versions of the three functional ECUs 24, 25, and 26 is incompatible in terms of executing the third function.

[0023] In pattern PT3, the software version of the first ECU 24 is "1.0," and the software versions of the second ECU 25 and the third ECU 26 are "2.0." In the case of pattern PT3, none of the first function, the second function, and the third function can be executed.

[0024] That is, when the software version of the first ECU 24 is "1.0" and the software version of the second ECU 25 is "2.0," it can be determined that the combination of the software versions of the first ECU 24 and the second ECU 25 is incompatible in terms of executing the first function. When the software version of the first ECU 24 is "1.0" and the software versions of the second ECU 25 and the third ECU 26 are "2.0," it can be determined that the combination of the software versions of the three functional ECUs 24, 25, 26 is incompatible in terms of executing the second function and the third function.

[0025] In pattern PT4, the software version is "2.0" in all of the first ECU 24, the second ECU 25, and the third ECU 26. In pattern PT4, any of the first function, the second function, and the third function can be executed.

[0026] That is, if the software version of both the first ECU 24 and the second ECU 25 is "2.0", it can be determined that the combination of the software version of the first ECU 24 and the software version of the second ECU 25 is consistent in terms of executing the first function. Also, if the software version of all three function ECUs 24, 25, 26 is "2.0", it can be determined that the combination of the software version of the three function ECUs 24, 25, 26 is consistent in terms of executing the second function and the third function.

[0027] <Processing flow when permitting or prohibiting execution of a function> The flow of processing performed by the entire vehicle control system 20 when the execution of a function is permitted or prohibited will be described with reference to FIG.

[0028] First, when the power supply system of the vehicle 10 is turned on, the multiple function ECUs 24, 25, and 26 are activated (ST10). Then, the multiple function ECUs 24, 25, and 26 transmit their own control information to the other ECUs via the in-vehicle network 21. The control information includes version information, which is information about the version of software stored in their own memories 32. In this example, the control information transmitted by the first ECU 24 in step ST101 is received by the second ECU 25. The control information transmitted by the first ECU 24 in step ST102 is received by the third ECU 26. The control information transmitted by the second ECU 25 in step ST201 is received by the third ECU 26. The control information transmitted by the second ECU 25 in step ST202 is received by the first ECU 24. The control information transmitted by the third ECU 26 in step ST301 is received by the second ECU 25. The control information transmitted by the third ECU 26 in step ST302 is received by the first ECU 24.

[0029] When the transmission and reception of the control information is completed, each of the functional ECUs 24, 25, and 26 proceeds to the next process. In step ST103, the first ECU 24 executes a consistency determination process for determining whether or not the combination of software versions is consistent for each function. Then, in the first ECU 24, in the next step ST104, it is determined for each function whether or not to permit execution of the function.

[0030] Similarly, in step ST203, the second ECU 25 executes a consistency determination process similar to that in step ST103. Then, in the next step ST204, the second ECU 25 executes a process similar to that in step ST104.

[0031] Similarly, in step ST303, the third ECU 26 executes a consistency determination process similar to step ST103. Then, in the next step ST304, the third ECU 26 executes a process similar to step ST104.

[0032] 3, after step ST104, the first ECU 24 acquires the latest version of the software transmitted from the server 100. If the first ECU 24 is not reset, the CPU 31 in the first ECU 24 continues to execute the software of a version older than the latest version.

[0033] However, while the vehicle control system 20 is operating, the first ECU 24 may be reset for some reason and restarted (ST11). In this case, the CPU 31 in the first ECU 24 executes the latest version of the software. Then, the first ECU 24 transmits its own control information to the other ECUs 25 and 26 via the in-vehicle network 21. That is, the control information transmitted by the first ECU 24 in step ST106 is received by the second ECU 25. The control information transmitted by the first ECU 24 in step ST107 is received by the third ECU 26.

[0034] When the transmission and reception of the control information is completed, each of the functional ECUs 24, 25, and 26 proceeds to the next process. In step ST108, the first ECU 24 executes a consistency determination process similar to that in step ST103. Then, in the next step ST109, the first ECU 24 executes a process similar to that in step ST104.

[0035] Similarly, in step ST208, the second ECU 25 executes a consistency determination process similar to that in step ST203. Then, in the next step ST209, the second ECU 25 executes a process similar to that in step ST204.

[0036] Similarly, in step ST308, the third ECU 26 executes a consistency determination process similar to that in step ST303. Then, in the next step ST309, the third ECU 26 executes a process similar to that in step ST304.

[0037] <Processing details in the functional ECU> Referring to FIG. 4, a series of processes executed by the CPU 31 of the functional ECUs 24, 25, and 26 to determine whether to permit or prohibit the execution of a plurality of functions will be described.

[0038] When power supply to the function ECUs 24, 25, and 26 is started, in step S11, the CPU 31 executes a startup process to start up the function ECUs 24, 25, and 26. For example, in the startup process, the CPU 31 executes software in the memory 32. If multiple pieces of software are stored in the memory 32, the CPU 31 executes the latest version of the software.

[0039] In the next step S13, the CPU 31 determines whether or not the activation of the functional ECUs 24, 25, 26 has been successful. If it is determined that the activation has been successful (S13: YES), the CPU 31 proceeds to step S15. On the other hand, if it is determined that the activation has not been successful (S13: NO), the CPU 31 ends the series of processes shown in FIG.

[0040] In step S15, the CPU 31 transmits its own control information to the other ECUs via the in-vehicle network 21. At this time, the other ECUs include the DCM 22 and the OTA master 23 in addition to the other functional ECUs.

[0041] In the next step S17, the CPU 31 receives, via the in-vehicle network 21, the control information transmitted by the other functional ECUs. In the next step S19, the CPU 31 executes a consistency determination process. For example, the CPU 31 executes the consistency determination process using the correspondence table 50 shown in FIG.

[0042] Here, the consistency determination process executed by the CPU 31 of the first ECU 24 will be described. The CPU 31 determines whether the software version of the first ECU 24 and the software version of the second ECU 25 are consistent when executing the first function. The CPU 31 determines whether the software versions of the three functional ECUs 24, 25, and 26 are consistent when executing the second function. The CPU 31 determines whether the software versions of the three functional ECUs 24, 25, and 26 are consistent when executing the third function.

[0043] After executing the consistency determination process, the CPU 31 moves the process to step S21. In step S21, the CPU 31 sets a coefficient N to 1. In the next step S23, CPU 31 determines whether the versions of the Nth function are consistent based on the execution result of the consistency determination process. If it is determined that the versions of the Nth function are consistent (S23: YES), CPU 31 proceeds to step S25. In step S25, CPU 31 permits execution of the Nth function. Then, CPU 31 proceeds to step S29.

[0044] On the other hand, if it is determined in step S23 that the versions of the Nth function are inconsistent (S23: NO), CPU 31 proceeds to step S27. In step S27, CPU 31 prohibits execution of the Nth function. Then, CPU 31 proceeds to step S29.

[0045] In step S29, the CPU 31 determines whether the coefficient N is equal to or greater than the number of functions Nth. The number of functions Nth is the total number of functions. In this embodiment, the total number of functions is 3. If the coefficient N is less than the number of functions Nth (S29: NO), the CPU 31 proceeds to step S31. In step S31, the CPU 31 updates the coefficient N so that it increases by 1. Then, the CPU 31 proceeds to step S23.

[0046] On the other hand, in step S29, if the coefficient N is equal to or greater than the number Nth of functions (S29: YES), the CPU 31 proceeds to step S15. In other words, if the coefficient N is equal to or greater than the number Nth of functions, the CPU 31 can determine that it has completed determining whether or not all functions can be executed.

[0047] <Actions and Effects of This Embodiment> Each of the multiple function ECUs 24, 25, and 26 transmits version information related to the version of software stored therein to the in-vehicle network 21. Each of the multiple function ECUs 24, 25, and 26 receives version information transmitted from another function ECU other than itself. Each of the multiple function ECUs 24, 25, and 26 then determines which of the multiple functions it can execute based on the software version in its own memory 32 and the version indicated by the version information. Each of the multiple function ECUs 24, 25, and 26 permits activation of functions determined to be executable, and prohibits activation of functions determined to be inexecutable.

[0048] As a result, in the vehicle control system 20, execution of multiple functions is not uniformly prohibited when the software versions of the multiple functional ECUs 24, 25, and 26 are not consistent. In other words, the vehicle control system 20 can prevent a situation in which all of the multiple functions cannot be executed.

[0049] As described above, while the vehicle control system 20 is operating, for example, the first ECU 24 may acquire the latest version of the software. In this case, when the first ECU 24 is subsequently reset and restarted, the CPU 31 in the first ECU 24 executes the latest version of the software. Then, the first ECU 24 transmits version information indicating the latest version to the other functional ECUs 25 and 26. In this case, a consistency determination process is executed in each of the multiple ECUs 24, 25, and 26. As a result, a function that was executable before the first ECU 24 was reset may be prohibited from being executed. Furthermore, a function that was prohibited from being executed before the first ECU 24 was reset may be permitted to be executed.

[0050] <Example of change> The above embodiment can be modified as follows: The above embodiment and the following modifications can be combined with each other within the scope of technical compatibility.

[0051] The number of functional ECUs may be any number other than three, as long as it is two or more. The vehicle control system 20 may be configured such that one of the multiple functional ECUs functions as the OTA master.

[0052] Only some of the functional ECUs 24, 25, and 26 may execute the following processes (A1), (A2), and (A3). (A1) Receiving version information transmitted from other functional ECUs.

[0053] (A2) Determine which of a plurality of functions can be executed based on the software version stored in the ECU itself and the version indicated by the version information received from the other functional ECU.

[0054] (A3) Among multiple functions, functions that are determined to be executable are permitted to be activated, while functions that are determined to be inexecutable are prohibited from being activated. The ECU is not limited to an ECU that includes a CPU and a ROM and executes software processing. In other words, the ECU may have any of the following configurations (a), (b), and (c):

[0055] (a) An ECU has one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program code or instructions configured to cause the CPU to execute processes. Memory, i.e., computer-readable media, includes any available media that can be accessed by a general-purpose or special-purpose computer.

[0056] (b) The ECU has one or more dedicated hardware circuits that perform various processes. Examples of dedicated hardware circuits include application-specific integrated circuits (ASICs) or FPGAs. ASIC stands for "Application Specific Integrated Circuit," and FPGA stands for "Field Programmable Gate Array."

[0057] (c) The ECU includes one or more processors that execute some of the various processes in accordance with a computer program, and one or more dedicated hardware circuits that execute the remaining processes among the various processes.

[0058] <Technical philosophy> The technical ideas that can be understood from the above-described embodiment and modified examples will be described as supplementary notes. [Appendix 1] A vehicle control system including a plurality of electronic control units each having a memory in which software for executing a plurality of functions related to vehicle driving is stored and a CPU that executes the software, each of the plurality of electronic control devices is configured to transmit version information relating to a version of software stored in the memory of the electronic control device; At least one electronic control device among the plurality of electronic control devices is receiving the version information transmitted from another electronic control device other than the electronic control device itself; When receiving the version information transmitted from the other electronic control device, determining which of the plurality of functions can be executed based on the version of the software stored in the memory of the electronic control device itself and the version indicated by the version information; and permitting execution of a function determined to be executable among the plurality of functions, while prohibiting execution of a function determined to be inexecutable.

[0059] [Supplementary Note 2] In order to execute a first function among the plurality of functions, the first electronic control device and the second electronic control device among the plurality of electronic control devices are required, but the third electronic control device is not required; The first electronic control unit and the second electronic control unit are receiving the version information transmitted from one of the electronic control units; A vehicle control system as described in Appendix 1, which, when receiving the version information transmitted from one of the electronic control units, determines that the first function is executable if the combination of the software version of the first electronic control unit and the software version of the second electronic control unit is consistent, and determines that the first function is not executable if the combination is not consistent.

[0060] [Appendix 3] In order to execute a second function among the plurality of functions, the first electronic control unit, the second electronic control unit, and the third electronic control unit are required among the plurality of electronic control units; The first electronic control unit, the second electronic control unit, and the third electronic control unit are receiving the version information transmitted from an electronic control device other than itself; The vehicle control system according to claim 1 or 2, wherein when the version information transmitted from an electronic control unit other than the vehicle control unit itself is received, if the combination of the software version of the first electronic control unit, the software version of the second electronic control unit, and the software version of the third electronic control unit is consistent, the system determines that the second function is executable, and if the combination is inconsistent, the system determines that the second function is not executable.

[0061] The expression "at least one" used herein means "one or more" of the desired options. As an example, the expression "at least one" used herein means "only one option" or "both of two options" if the number of options is two. As another example, the expression "at least one" used herein means "only one option" or "any combination of two or more options" if the number of options is three or more. [Explanation of symbols]

[0062] 10...vehicle, 20...vehicle control system, 21...in-vehicle network, 22...DMC, 23...OTA master, 24-26...functional ECU (electronic control unit), 31...CPU, 32...memory, 100...server, 200...external vehicle network

Claims

1. A vehicle control system including a plurality of electronic control units that store software for executing a plurality of functions related to vehicle driving, Each of the plurality of electronic control devices transmits version information relating to a version of software stored therein; At least one electronic control device among the plurality of electronic control devices is receiving the version information transmitted from another electronic control device other than the electronic control device itself; When receiving the version information transmitted from the other electronic control device, determining which of the plurality of functions can be executed based on the version of the software stored in the electronic control device itself and the version indicated by the version information; Among the plurality of functions, the execution of the functions determined to be executable is permitted, while the execution of the functions determined to be inexecutable is prohibited. Vehicle control system.

2. In order to execute a first function among the plurality of functions, a first electronic control unit and a second electronic control unit among the plurality of electronic control units are required, but a third electronic control unit is not required; The first electronic control unit and the second electronic control unit are receiving the version information transmitted from one of the electronic control units; When the version information transmitted from one of the electronic control units is received, if a combination of a software version of the first electronic control unit and a software version of the second electronic control unit is consistent, the first function is determined to be executable, and if the combination is not consistent, the first function is determined to be inexecutable. The vehicle control system of claim 1 .

3. In order to execute a second function among the plurality of functions, the first electronic control unit, the second electronic control unit, and the third electronic control unit are required among the plurality of electronic control units, The first electronic control unit, the second electronic control unit, and the third electronic control unit are receiving the version information transmitted from an electronic control device other than itself; When receiving the version information transmitted from an electronic control unit other than itself, if a combination of the software version of the first electronic control unit, the software version of the second electronic control unit, and the software version of the third electronic control unit is consistent, it determines that the second function is executable, and if the combination is not consistent, it determines that the second function is not executable. The vehicle control system according to claim 2 .

Images