Vehicle control device and vehicle control method

Abstract

To provide a vehicle control device and a vehicle control method that can realize reprogramming with functional separation ensured.SOLUTION: A vehicle control device according to the present application is a vehicle control device for controlling a vehicle by executing at least two control virtual machines having different functional safety levels, and includes a controller. The controller repeatedly executes a processing cycle in which the multiple control virtual machines are executed in a time-sharing manner, and causes a hypervisor to be executed during a non-execution time in the processing cycle in which the control virtual machines are not executed. When reprogramming the multiple control virtual machines via wireless communication, the controller reprograms each control virtual machine during the non-execution time.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a vehicle control device and a vehicle control method. [Background technology]

[0002] Conventionally, there is known a technology related to OTA (Over The Air) reprogramming, which rewrites a program in a vehicle remotely via wireless communication. Also, in OTA reprogramming, a technology has been disclosed in which a program in a virtual machine that virtualizes a vehicle's control device is rewritten while the vehicle is running (see, for example, Patent Document 1).

[0003] Furthermore, in this virtualization technology, multiple virtual machines with different functional safety levels may be integrated into a single device. In this case, functional separation (processing separation and memory separation) between the virtual machines makes it possible to integrate multiple virtual machines with different functional safety levels. This functional safety level is also called ASIL (Automotive Safety Integrity Level). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2020-52960 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in a device that integrates virtual machines with different functional safety levels, reprogramming must be separated between the virtual machines from the perspective of functional separation, and simultaneous reprogramming is not possible. As such, the conventional technology leaves room for improvement in terms of achieving reprogramming that ensures functional separation.

[0006] The present application has been made in view of the above, and aims to provide a vehicle control device and a vehicle control method that can realize reproducibility with functional separation ensured. [Means for solving the problem]

[0007] A vehicle control device according to the present application controls a vehicle by executing at least two control virtual machines with different functional safety levels, and includes a controller. The controller repeatedly executes a processing cycle in which the control virtual machines are executed in a time-sharing manner, and executes a hypervisor during a non-execution time in the processing cycle in which the control virtual machines are not executed. When reprogramming the control virtual machines via wireless communication, the controller reprograms each of the control virtual machines during the non-execution time. [Effects of the Invention]

[0008] According to one aspect of the embodiment, by performing reprogramming for each control virtual machine with a different functional safety level, the reprogramming of the control virtual machine can be performed separately for each functional safety level, thereby ensuring functional separation between the control virtual machines even during reprogramming. In other words, according to one aspect of the embodiment, reprogramming with ensuring functional separation can be realized. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram for explaining the configuration and operation of a vehicle control device according to an embodiment. [Figure 2] FIG. 2 is a diagram for explaining the configuration and operation of the vehicle control device according to the embodiment. [Figure 3] FIG. 3 is an explanatory diagram for explaining the reproductive process by the reproductive VM. [Figure 4] FIG. 4 is a diagram for explaining the repro process under time-division control. [Figure 5] FIG. 5 is a sequence diagram showing the procedure of the reprocessing process by the reprocessing tool. [Figure 6] FIG. 6 is a sequence diagram showing the procedure of the repro process by the OTA server. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of a vehicle control device and a vehicle control method will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. In the following, it is assumed that the vehicle control device according to the embodiments is installed in a vehicle.

[0011] 1 and 2 are diagrams illustrating the configuration and operation of a vehicle control device 1 according to an embodiment. The vehicle control device 1 executes a vehicle control method according to an embodiment. The vehicle control device 1 also implements multiple virtual machines that virtualize multiple control devices (e.g., ECUs: Electronic Control Units) that control the vehicle, and controls the vehicle by running the virtual machines. The vehicle control method also executes a processing step related to reprogramming, which rewrites the program of the virtual machine. As shown in FIGS. 1 and 2, the vehicle control device 1 according to an embodiment includes a wireless communication unit 2, a CAN (Controller Area Network) communication unit 3, a controller 4, and a storage unit 5.

[0012] The wireless communication unit 2 is a communication interface that performs wireless communication with the outside. The wireless communication unit 2 is communicably connected to an external device using a known communication standard related to wireless communication. FIG. 1 shows an example in which the wireless communication unit 2 is connected to an OTA server 100 that distributes a program for a control virtual machine (control VM). Note that the external device communicatively connected to the wireless communication unit 2 is not limited to the OTA server 100, and may be a terminal device such as a smartphone.

[0013] The CAN communication unit 3 is a communication interface that performs wired communication with the outside. The CAN communication unit 3 is connected to an external device via a wired CAN. FIG. 2 shows an example in which the CAN communication unit 3 is connected to a terminal device equipped with a repro tool 200. The repro tool 200 is software that distributes a program for reprogramming the entire control area 52 of the storage unit 5, which will be described later.

[0014] The controller 4 includes a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and various other circuits. The controller 4 may also be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0015] The controller 4 controls the operation of the vehicle control device 1 by the CPU executing a program stored in the ROM using the RAM as a work area.

[0016] The storage unit 5 includes a nonvolatile storage medium such as a nonvolatile memory, a flash memory, a hard disk drive, etc. As shown in FIG.

[0017] The repro area 51 is installed with repro software 511. The repro software 511 is software that is executed when the repro tool 200 is connected, and that rewrites (reprograms) the control area 52.

[0018] The control area 52 is implemented with an HV (hypervisor) 521, a repro VM (repro virtual machine) 522, a first control VM (control virtual machine) 523, and a second control VM 524. Specifically, the HV 521, the repro VM 522, the first control VM 523, and the second control VM 524 are implemented in separate memory areas within the control area 52.

[0019] The HV 521 is a control program that runs the repro VM 522, the first control VM 523, and the second control VM 524. Specifically, the HV 521 controls the startup and operation of the repro VM 522, the first control VM 523, and the second control VM 524.

[0020] The repro VM 522 is a program for rewriting (reprogramming) the programs of the first control VM 523 and the second control VM 524 implemented in the control area 52.

[0021] The first control VM 523 and the second control VM 524 are virtual machines that virtualize control devices that control the vehicle. Specifically, the first control VM 523 and the second control VM 524 are programs that simulate the operation of the control devices. Examples of the control VMs (the first control VM 523 and the second control VM 524) include an engine control device, body control devices such as lighting and doors, control devices such as meters, and navigation devices. Note that, hereinafter, they may be collectively referred to as control VMs unless otherwise distinguished.

[0022] The first control VM 523 and the second control VM 524 have different functional safety levels. The functional safety level is an Automotive Safety Integrity Level (ASIL), and there are five levels, mainly A to D and a Quality Management (QM) level below A. While FIG. 1 illustrates two control VMs (the first control VM 523 and the second control VM 524) with different functional safety levels as an example, there may be three or more control VMs. In this case, the functional safety levels of all three or more control VMs may be different, or any two of them may have the same functional safety level. In other words, at least two of the three or more control VMs have different functional safety levels. Furthermore, since the HV 521 performs overall management of virtualization, it has a functional safety level that is the highest among the virtual control programs (including the control VMs) that it runs, or at least equal to or higher than that.

[0023] The controller 4 controls the vehicle by time-sharing execution of the programs of the first control VM 523 and the second control VM 524 implemented in the control area 52. Note that the time-sharing control of the first control VM 523 and the second control VM 524 will be described later with reference to FIG.

[0024] Here, reprogramming (hereinafter referred to as reprogramming) of the control area 52 will be described with reference to Figures 1 and 2. Figure 1 shows a case where reprogramming is performed via wireless communication with an OTA server 100, and Figure 2 shows a case where reprogramming is performed via wired communication with a reprogramming tool 200.

[0025] As shown in FIG. 1, when the OTA server 100 is connected to the vehicle control device 1, a reprogramming request is input from the OTA server 100. This reprogramming request is a request for reprogramming that specifies only a portion of the control VMs, such as for fixing a defect in some of the control VMs or adding a function. When the reprogramming request is input, the vehicle control device 1 determines whether the reprogramming is possible and performs authentication processing, and then receives a new program to be updated from the OTA server 100. Note that the reprogramming possibility determination and authentication processing will be described later with reference to FIG. 6. Specifically, the vehicle control device 1 receives the program of the control VM specified in the reprogramming request and performs reprogramming that rewrites only the program of the control VM. In other words, when the OTA server 100 is connected, the vehicle control device 1 performs reprogramming for each control VM. Note that if there are multiple control VMs to be reprogrammed, the vehicle control device 1 receives the program for each control VM, and after reprogramming one control VM is completed, it receives the program for the next control VM.

[0026] Specifically, the controller 4 performs reprogramming for each control VM by running the reprogramming VM 522 using the hypervisor 521 during non-execution time when the first control VM 523 and the second control VM 524 are not being executed. In other words, the controller 4 performs control using the first control VM 523 and the second control VM 524, while performing reprogramming during the non-execution time when the control is not being performed. Details of the non-execution time will be described later with reference to FIG. 4.

[0027] In this way, by performing reprogramming during non-execution time, the vehicle control device 1 can perform reprogramming without interfering with the processing of the control VM (while performing vehicle control). Furthermore, by performing reprogramming for each control VM with a different functional safety level, the vehicle control device 1 can ensure functional separation between the control VMs even during reprogramming. In other words, the vehicle control device 1 can achieve reprogramming with functional separation ensured. Furthermore, in the present disclosure, by performing reprogramming during the execution time of the HV521, which has the highest functional safety level (non-execution time when the control VM is not executing, time occupied by the HV521), functional safety can be ensured regardless of the functional safety level of the control program (control VM) being reprogrammed.

[0028] Next, as shown in FIG. 2, when the reprogramming tool 200 is connected, the vehicle control device 1 receives a reprogramming request from the reprogramming tool 200. This reprogramming request is for reprogramming all control VMs, i.e., a request for reprogramming to rewrite the entire control area 52. Reprogramming by the reprogramming tool 200 is performed when the vehicle is stopped and control of the control VMs is not required. Specifically, the vehicle control device 1 determines whether reprogramming is possible and performs authentication processing, and switches the program reading target from the control area 52 to the reprogramming area 51. The vehicle control device 1 reads the reprogramming software 511 installed in the reprogramming area 51, receives the program for the control area 52 transferred from the reprogramming tool 200, and reprograms the entire control area 52. In other words, the controller 4 rewrites the HV 521, reprogramming VM 522, first control VM 523, and second control VM 524 installed in the control area 52. This allows all control VMs to be reprogrammed simultaneously.

[0029] In this way, the vehicle control device 1 of the embodiment combines a means for reprogramming the entire control area 52 using the reprogramming software 511 and a means for reprogramming individual control VMs using the reprogramming VM 522, thereby enabling more flexible virtual machine reprogramming processing.

[0030] If the vehicle control device 1 receives a reprocessing request from the OTA server 100 while reprocessing is being performed by the reprocessing tool 200, the vehicle control device 1 will not perform reprocessing by the OTA server 100. In other words, the vehicle control device 1 prohibits reprocessing by wireless communication while reprocessing is being performed by the reprocessing tool 200. This ensures that the entire control area 52 is rewritten. If the vehicle control device 1 receives a reprocessing request from the reprocessing tool 200 while reprocessing is being performed by the OTA server 100, it will switch to reprocessing by the reprocessing tool 200. In other words, the vehicle control device 1 prioritizes reprocessing by the reprocessing tool 200.

[0031] Next, the repro processing by the repro VM 522 will be specifically described with reference to Fig. 3. Fig. 3 is an explanatory diagram for explaining the repro processing by the repro VM 522. Fig. 3 shows an example in which the first control VM (rev2) 523b and the second control VM (rev2) 524b are newly written by OTA repro.

[0032] As shown in FIG. 3, the vehicle control device 1 has a virtual area VA, a first bank B1, and a second bank B2.

[0033] The virtual area VA is a virtual work area of the controller 4. Addresses from which each program (HV, repro VM, first control VM, second control VM) in the control area 52 is read are assigned to the virtual area VA.

[0034] The first bank B1 and the second bank B2 are logically divided memory areas in the control area 52. The first bank B1 is assigned to an HV 521 and a repro VM 522. The second bank B2 is assigned to a first control VM (rev1) 523a and a second control VM (rev1) 524a.

[0035] In this case, the controller 4 reads out and executes the HV 521, the first control VM (rev1) 523a, and the second control VM (rev1) 524a from the first bank B1 and the second bank B2 in a time-division manner in the virtual area VA. This allows the controller 4 to perform vehicle control using the first control VM (rev1) 523a and the second control VM (rev1) 524a.

[0036] Furthermore, when the vehicle control device 1 receives a repro request from the OTA server 100, the vehicle control device 1 additionally writes the first control VM (rev2) 523b and the second control VM (rev2) 524b to the second bank B2 using the repro VM 522. Note that writing to the first bank B1 is prohibited. This is because writing to the first bank B1 while the repro VM 522 of the first bank B1 is being executed may affect the operation of the repro VM 522. Furthermore, as will be described in detail later, the repro VM 522 is called during the execution of the HV 521, so writing to the same bank as the HV 521 is prohibited. For this reason, the controller 4 writes the program of the control VM to a bank different from the HV 521 and the repro VM 522. This makes it possible to avoid affecting the HV 521 and the repro VM 522 when writing the program of the control VM.

[0037] The write process by the repro VM 522 is performed using the time allocated to the HV 521 under time-sharing control. The write process by the repro VM 522 will now be described in detail with reference to FIG.

[0038] FIG. 4 is a diagram for explaining repro processing in time-sharing control. As shown in FIG. 4, each system cycle (processing cycle) includes the execution times of the first control VM (rev1) 523a, the second control VM (rev1) 524a, and the HV 521. In the example shown in FIG. 4, the controller 4 reads and executes programs into the virtual area VA for the pre-allocated execution times in the order of the first control VM (rev1) 523a, the second control VM (rev1) 524a, and the HV 521. The execution time of the HV 521 is allocated to the time for the HV 521 to perform abnormality monitoring processing of the entire system. In other words, the execution time of the HV 521 is a non-execution time during which the first control VM (rev1) 523a and the second control VM (rev1) 524a are not being executed.

[0039] When the controller 4 receives a repro request from the OTA server 100, it reads (calls) and executes the repro VM 522 in the virtual area VA during the execution time of the HV 521 in the system cycle.

[0040] Furthermore, when writing to the first control VM (rev2) 523b and the second control VM (rev2) 524b, the controller 4 performs the writing in units of control VMs. That is, the controller 4 performs the writing to the second control VM (rev2) 524b after completing the writing to the second bank B2 of the first control VM (rev2) 523b. Note that the writing to the second control VM (rev2) 524b may be performed first. Furthermore, as shown in FIG. 4, if the writing is not completed in one system cycle, the controller 4 calls the repro VM 522 again at the execution time of the HV 521 in the next system cycle to resume the writing.

[0041] That is, the controller 4 executes the HV 521 to perform reprogramming for each control VM during non-execution times when the first control VM (rev1) 523a and the second control VM (rev1) 524a are not being executed. That is, the controller 4 performs reprogramming via wireless communication when the vehicle is running within a system cycle in which the control VMs can be executed. This allows writing to the first control VM (rev2) 523b and the second control VM (rev2) 524b to be performed while performing vehicle control by the first control VM (rev1) 523a and the second control VM (rev1) 524a.

[0042] Returning to Figure 3, as described above, after completing writing of the first control VM (rev2) 523b and the second control VM (rev2) 524b to the second bank B2, the controller 4 executes the first control VM (rev2) 523b and the second control VM (rev2) 524b. Specifically, after completing the writing, the controller 4 changes the read destination in the virtual area VA to the first control VM (rev2) 523b and the second control VM (rev2) 524b at the next trip (the next time the IG is turned on).

[0043] The controller 4 deletes the first control VM (rev1) 523a and the second control VM (rev1) 524a from the second bank B2. Alternatively, the controller 4 may leave the first control VM (rev2) 523b and the second control VM (rev2) 524b in the second bank B2 for a predetermined period until it is confirmed that they are running normally.

[0044] Next, the processing procedure of the reproductive process according to the embodiment will be described with reference to Fig. 5 and Fig. 6. Fig. 5 is a sequence diagram showing the processing procedure of the reproductive process by the reproductive tool 200. Fig. 6 is a sequence diagram showing the processing procedure of the reproductive process by the OTA server 100.

[0045] First, the repro processing by the repro tool 200 will be explained using Fig. 5. As shown in Fig. 5, when the repro tool 200 is connected to the vehicle control device 1 by wire, it notifies the controller 4 of a session transition request (step S101). The session transition request is a request to switch the read target of the controller 4 from the control area 52 to the repro area 51, that is, a request for repro processing by the repro software 511.

[0046] Next, the controller 4 determines whether reproduction is possible in accordance with the session transition request, and notifies the reproduction tool 200 of the determination result (step S102). The reproduction possibility determination is a process of determining whether or not reproduction processing by the reproduction tool 200 is permitted, and specifically, a process of determining whether or not the vehicle speed is less than a threshold value (for example, 15 km / h). If the vehicle speed is equal to or greater than the threshold value, the controller 4 notifies that reproduction is not possible, and if the vehicle speed is less than the threshold value, it notifies that reproduction is possible.

[0047] Next, if the controller 4 determines that reprocessing is possible, it performs tool authentication of the reprocessing tool 200 (step S103). Specifically, the controller 4 determines whether the tool is legitimate based on information input from the reprocessing tool 200.

[0048] Next, after tool authentication, the repro tool 200 transfers the update program, i.e., the program that rewrites the entire control area 52, to the controller 4 (step S104). The controller 4 executes the repro software 511 installed in the repro area 51, and rewrites the entire control area 52 with the program transferred from the repro tool 200.

[0049] Next, when the rewriting of the entire control area 52 by the controller 4 is completed, the repro tool 200 requests the controller 4 to reset (step S105). Next, the controller 4 performs a reset in accordance with the reset request (step S106). After the reset, the controller 4 switches the read target from the repro area 51 to the control area 52. This completes the repro process by the repro tool 200.

[0050] Next, the reprocessing process by the OTA server 100 will be described with reference to Fig. 6. As shown in Fig. 6, when the OTA server 100 is connected to the vehicle control device 1 so as to be able to communicate wirelessly, it notifies the controller 4 of an OTA reprocessing write request (step S201). The OTA reprocessing write request is a request to the controller 4 to perform reprocessing by OTA, that is, to perform reprocessing on a control VM basis.

[0051] Next, the controller 4 determines whether reprocessing is possible in accordance with the OTA reprocessing write request, and notifies the OTA server 100 of the determination result (step S202). The reprocessing possibility determination is a process of determining whether or not reprocessing by the OTA server 100 is permitted, and more specifically, a process of determining whether or not reprocessing by the reprocessing tool 200 is currently being performed. If reprocessing by the reprocessing tool 200 is currently being performed, the controller 4 notifies that reprocessing is not possible, and if reprocessing by the reprocessing tool 200 is not currently being performed, the controller 4 notifies that reprocessing is possible.

[0052] Next, if the controller 4 determines that reprocessing is possible, it performs tool authentication of the reprocessing tool 200 (step S203). Specifically, the controller 4 determines whether the OTA server 100 is legitimate based on information input from the OTA server 100.

[0053] Next, after tool authentication, the OTA server 100 transfers the program to be updated, i.e., the program in units of control VMs, to the controller 4 (step S204). During the execution time (non-execution time) of the HV 521, the controller 4 executes the repro VM 522 implemented in the control area 52, and reprograms the control VM that is the reprogramming target of the control area 52. That is, as shown in FIG. 6, the controller 4 performs the reprogramming process with the read target set to the control area 52.

[0054] After completing the reprogramming of the control VM, the controller 4 controls the vehicle using the updated control VM at the start of the next trip. This completes the reprogramming process by the OTA server 100.

[0055] As described above, the vehicle control device 1 according to the embodiment is a vehicle control device that controls a vehicle by executing at least two control virtual machines with different functional safety levels, and includes a controller 4. The controller 4 repeatedly executes a processing cycle in which the multiple control virtual machines are executed in a time-sharing manner, and also executes a hypervisor during non-execution time in the processing cycle when the control virtual machines are not executed. When reprogramming the multiple control virtual machines via wireless communication, the controller 4 reprograms each control virtual machine during the non-execution time.

[0056] As a result, the vehicle control device 1 can ensure functional separation between the control virtual machines even during reprogramming by performing reprogramming for each control virtual machine with a different functional safety level. In other words, reprogramming with ensured functional separation can be achieved.

[0057] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0058] 1 Vehicle control device 2. Wireless Communication Unit 3 CAN communication section 4 Controller 5 Storage section 51 Reproduction area 52 Control Area 100 OTA servers 200 Repro Tools 511 Reprosoft 521 Hypervisor 522 Repro VM 523 First Control VM 524 Second Control VM B1 1st Bank B2 2nd Bank VA Virtual Area

Claims

1. A vehicle control device that controls a vehicle by executing at least two control virtual machines having different functional safety levels, a controller that repeatedly executes a processing cycle in which the plurality of control virtual machines are executed in a time-sharing manner, and executes a hypervisor during a non-execution time in the processing cycle in which the control virtual machines are not executed; The controller When the reprogramming of the plurality of control virtual machines is performed by wireless communication, the reprogramming is performed for each of the control virtual machines during the non-execution time. Vehicle control device.

2. The controller When connected to an external device via a wired connection, all of the control virtual machines are reprogrammed. The vehicle control device according to claim 1 .

3. The controller During the period when reprogramming is being performed by the external device connected by wire, reprogramming by wireless communication is prohibited. The vehicle control device according to claim 2.

4. The controller A repro virtual machine that performs reprogramming for each of the control virtual machines can be executed, The controller During the non-execution time, the repro virtual machine is operated to perform reprogramming. The vehicle control device according to claim 1 .

5. a storage unit having a first bank in which the hypervisor is implemented and a second bank in which the plurality of control virtual machines are implemented; The controller During the non-execution time, the new control virtual machine to be reprogrammed is added by writing it to the second bank, and after the writing is completed, the new control virtual machine is put into operation. The vehicle control device according to claim 1 .

6. The storage unit A repro virtual machine that performs reprogramming for each of the control virtual machines is installed in the first bank. The vehicle control device according to claim 5.

7. The controller When the vehicle is running, the reprogramming via wireless communication is permitted. The vehicle control device according to claim 1 .

8. A vehicle control method executed by a vehicle control device that controls a vehicle by executing at least two control virtual machines having different functional safety levels, comprising: a control step of repeatedly executing a processing cycle in which the plurality of control virtual machines are executed in a time-sharing manner, and executing a hypervisor during a non-execution time in the processing cycle in which the control virtual machines are not executed; The control step includes: When the reprogramming of the plurality of control virtual machines is performed via wireless communication, the reprogramming is performed for each of the control virtual machines during the non-execution time. Vehicle control method.

Images