Vehicle travel control system

Abstract

To provide a traveling control system of a vehicle for preventing the operation of an unintended function by unauthorized access from the outside.SOLUTION: A travel control system 1 of a vehicle M includes a plurality of control units 21 to 25 mounted on the vehicle, a determination control unit 26 to which control information of the plurality of control units is input, an in-vehicle communication network 20, and a control device 100 that wirelessly communicates with the vehicle and includes a backup control unit 21 in which the control information of the vehicle is stored. An abnormality signal is transmitted to the control device, and the control device transmits normal control information to the vehicle via the network environment to remotely operate the vehicle.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a vehicle driving control system that can cope with unauthorized access from outside. [Background technology]

[0002] In recent years, vehicles such as automobiles have been equipped with vehicle control devices that include multiple ECUs (Electronic Control Units). Various controls of the vehicle are performed based on predetermined programs by each ECU. Vehicles are also equipped with an in-vehicle communication network such as a Controller Area Network (CAN) that connects the multiple ECUs. The multiple ECUs are connected to each other via the in-vehicle communication network so that they can communicate with each other. Vehicles known as connected cars have also appeared, which connect the vehicle's status and the surrounding environment to a communication center and network environment via wireless communication.

[0003] Vehicles connected to such network environments require a security system to prevent unauthorized external access to the in-vehicle communication network to which multiple ECUs are connected. For example, Patent Document 1 discloses a technology for an in-vehicle communication network system in which a security ECU determines whether a frame transmitted from an ECU is unauthorized according to pre-stored rules. Furthermore, for example, Patent Document 2 discloses a vehicle remote control system in which an abnormality monitoring device collects and compares vehicle control logs and operator operation logs to determine whether the cause of the abnormality is a cyber attack or an abnormal operation by the operator. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2018-111468 [Patent Document 2] International Publication No. WO2022-049637 Summary of the Invention [Problem to be solved by the invention]

[0005] In vehicles connected to a network environment, there is a risk that multiple ECUs may be abnormally controlled due to unauthorized access, such as a cyberattack from outside. However, there is a limit to what the vehicle itself can do to protect itself against external hijacking or malicious manipulation. As a result, there is a risk that unintended functions may be activated in the vehicle.

[0006] In view of the above, an object of the present invention is to provide a vehicle driving control system that prevents unintended activation of functions due to unauthorized access from outside. [Means for solving the problem]

[0007] A vehicle driving control system according to one embodiment of the present invention comprises a plurality of control units mounted on a vehicle, a judgment control unit to which control information from the plurality of control units is input, an in-vehicle communication network to which the plurality of control units and the judgment control unit are connected, and a control device that communicates wirelessly with the vehicle via a network environment and has a backup control unit in which the control information from the vehicle is stored, wherein the judgment control unit counts the number of incompatibilities in the transmission and reception IDs of the control information transmitted and received by the plurality of control units via the in-vehicle communication network, and determines that an abnormality has occurred if the number of incompatibilities is greater than or equal to a predetermined threshold, and transmits an abnormality signal to the control device via the network environment, and the control device, upon receiving the abnormality signal, transmits normal control information to the vehicle via the network environment to remotely operate the vehicle. [Effects of the Invention]

[0008] According to the present invention, it is possible to provide a vehicle driving control system that prevents unintended activation of functions due to unauthorized access from outside. [Brief explanation of the drawings]

[0009] [Figure 1]FIG. 1 is a diagram illustrating a vehicle cruise control device and a vehicle control device that communicate with each other wirelessly via a network environment according to one embodiment of the present invention. [Figure 2] A block diagram showing the configuration of the vehicle's driving control system. [Figure 3] A block diagram showing the configuration of the vehicle's driving control system. [Figure 4] A block diagram showing each control unit, judgment control unit, warning lamp, transceiver, and vehicle control device that transmit and receive signals via the communication bus of the in-vehicle communication network. [Figure 5] A flowchart executed by a determination control unit of a vehicle driving control device. [Figure 6] A flowchart executed by a vehicle control device that receives an abnormality signal. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will be described below with reference to the drawings. The drawings relate to an embodiment of the present invention, and Fig. 1 is a diagram showing a cruise control device and a vehicle control device mounted on a vehicle, and Fig. 2 is a diagram showing the overall configuration of a cruise control system for a vehicle.

[0011] 1 and 2, a cruise control system 1 for a vehicle M according to this embodiment includes a cruise control device 10 mounted on the vehicle M and a vehicle control device 100 installed in an operation center outside the vehicle. The cruise control device 10 is mounted on the vehicle M. The vehicle control device 100 is connected to the cruise control devices 10 mounted on a plurality of vehicles M via a network environment NW via wireless communication. In other words, the vehicle M is a so-called connected car.

[0012] The vehicle control device 100 is connected to a network environment NW based on, for example, cloud computing or edge computing, or a network environment NW based on a road incidental facility network. The vehicle control device 100 sequentially integrates and updates road map information transmitted from the driving control device 10 of each vehicle M.

[0013] Then, the vehicle control device 100 transmits the updated road map information to each vehicle M. The vehicle control device 100 includes a transceiver 101 and an external operation server 102. The vehicle control device 100 is installed, for example, in an operation center for each region.

[0014] The external operation server 102 constitutes a road map boundary information integration system. The external operation server 102 integrates road map information collected from multiple vehicles M via a transceiver 101 connected to a network environment NW, and sequentially updates road map information surrounding the vehicle M on the road.

[0015] The road map information is mainly composed of road information, such as a dynamic map. The road map information has four layers of information: static information, semi-static information, and semi-dynamic information and dynamic information that mainly compose traffic information.

[0016] Static information consists of information that needs to be updated within one month, such as roads, road structures, lane information, road surface information, permanent traffic restrictions, etc. Semi-static information consists of information that needs to be updated within one hour, such as traffic restrictions due to road construction and events, wide-area weather information, and congestion forecasts.

[0017] Semi-dynamic information consists of information that must be updated, for example, within one minute, such as the actual traffic congestion situation and driving restrictions at the time of observation, as well as temporary driving obstructions such as fallen objects and obstacles, actual accident conditions, and narrow-area weather information.

[0018] Dynamic information consists of information that must be updated within one second, such as information transmitted / exchanged between moving objects, information on currently displayed traffic lights, information on pedestrians / motorcycles within intersections, and information on vehicles traveling straight through intersections.

[0019] Such road map information is maintained / updated periodically until the next information is received from each vehicle M. The updated road map information is then transmitted as appropriate to the cruise control device 10 of each vehicle via the transceiver 101.

[0020] The driving control device 10 of the vehicle M has a driving environment recognition unit 11 and a locator unit 12. The driving environment recognition unit 11 and the locator unit 12 are units for recognizing the driving environment outside the vehicle.

[0021] The driving control device 10 also includes a driving control unit (hereinafter referred to as "driving_ECU") 21, an engine control unit (hereinafter referred to as "E / G_ECU") 22, a transmission control unit (hereinafter referred to as "T / M_ECU") 23, a power steering control unit (hereinafter referred to as "PS_ECU") 24, a brake control unit (hereinafter referred to as "BK_ECU") 25, and a judgment control unit (hereinafter referred to as "judgment_ECU") 26.

[0022] These control units (ECUs) 21 to 26 are connected together with the driving environment recognition unit 11 and the locator unit 12 via a communication bus 20 of an in-vehicle communication network such as a CAN (Controller Area Network).

[0023] The driving environment recognition unit 11 is fixed, for example, to the center of the upper front part of the vehicle interior. The driving environment recognition unit 11 has a main camera 11a, a sub-camera 11b, an image processing unit (IPU) 11c, and a first driving environment recognition unit 11d. The main camera 11a and the sub-camera 11b are in-vehicle cameras (stereo cameras) that are external recognition devices.

[0024] The main camera 11a and the sub-camera 11b are, for example, autonomous sensors that sense the real space ahead of the vehicle M. The main camera 11a and the sub-camera 11b are, for example, arranged at positions symmetrical on either side of the center in the vehicle width direction, and capture stereo images of the area ahead of the vehicle M from different viewpoints.

[0025] The IPU 11c performs predetermined image processing on the forward traveling environment image information of the area ahead of the vehicle M captured by both cameras 11a and 11b. Then, the IPU 11c generates forward traveling environment image information (distance image information) including distance information calculated from the amount of deviation of the positions of the corresponding objects.

[0026] The first driving environment recognition unit 11d determines the lane markings that divide the road around the vehicle based on the distance image information received from the IPU 11c, etc. The first driving environment recognition unit 11d also determines the road curvature [1 / m] of the lane markings that divide the left and right of the road on which the vehicle is traveling (the host vehicle's driving lane) and the width between the left and right lane markings (lane width).

[0027] There are various known methods for determining the road curvature and lane width, but for example, the first driving environment recognition unit 11d recognizes the left and right lane markings by binarizing the road curvature based on the brightness difference based on the forward driving environment image information, and then determines the curvatures of the left and right lane markings for each predetermined section using a curve approximation formula based on the least squares method.

[0028] Furthermore, the first driving environment recognition unit 11d performs predetermined pattern matching on the distance image information, etc. The first driving environment recognition unit 11d then recognizes three-dimensional objects such as guardrails and curbs along the road, as well as pedestrians, motorcycles, and other vehicles other than motorcycles that are present on the road around the vehicle M.

[0029] Here, the first driving environment recognition unit 11d recognizes the type of three-dimensional object, the distance to the three-dimensional object, the speed of the three-dimensional object, the relative speed between the three-dimensional object and the vehicle, etc. Furthermore, a plurality of radar devices (for example, a left front-side radar device 11fl, a right front-side radar device 11fr, a left rear-side radar device 11rl, and a right rear-side radar device 11rr) are connected to the first driving environment recognition unit 11d. The left front-side radar device 11fl, the right front-side radar device 11fr, the left rear-side radar device 11rl, and the right rear-side radar device 11rr constitute an autonomous sensor.

[0030] The left front-side radar device 11fl and the right front-side radar device 11fr are provided, for example, on the left and right sides of the front bumper, respectively. These left front-side radar device 11fl and right front-side radar device 11fr monitor areas diagonally forward and to the left and right and to the sides of the vehicle M that cannot be monitored using images from the above-mentioned cameras 11a and 11b. The left front-side radar device 11fl and the right front-side radar device 11fr are disposed so that a portion of each monitoring area overlaps with the area monitored by the cameras 11a and 11b.

[0031] The left rear-side radar device 11rl and the right rear-side radar device 11rr are provided, for example, on the left and right sides of the rear bumper, respectively, and monitor the areas extending from the left and right sides to the rear of the vehicle M, which cannot be monitored by the above-mentioned left front-side radar device 11fl and right front-side radar device 11fr.

[0032] The left rear-side looking radar device 11rl and the right rear-side looking radar device 11rr are arranged so that their respective monitoring areas partially overlap each other and also partially overlap each other's areas.

[0033] Each of the radar devices 11fl, 11fr, 11rl, and 11rr is equipped with a millimeter-wave radar, a laser radar, a LIDAR (Light Detection and Ranging), etc. Each of the radar devices 11fl, 11fr, 11rl, and 11rr detects a plurality of reflection points on three-dimensional objects present around the vehicle M by receiving reflected waves of radar waves (radio waves, laser beams, etc.) emitted in the horizontal direction.

[0034] Each radar device 11fl, 11fr, 11rl, and 11rr recognizes a three-dimensional object by analyzing the relative positions and moving speeds of the detected multiple reflection points and performing grouping processing. Furthermore, each radar device 11fl, 11fr, 11rl, and 11rr sets the reflection point on the recognized three-dimensional object that is closest in straight-line distance to the vehicle as a representative point of the three-dimensional object. Note that the three-dimensional object recognized by each radar device 11fl, 11fr, 11rl, and 11rr in this way is called a radar object (radar OBJ).

[0035] In this way, information such as representative points related to the radar OBJ recognized by each of the radar devices 11fl, 11fr, 11rl, and 11rr is input to the first driving environment recognition unit 11d. This makes it possible for the first driving environment recognition unit 11d to recognize not only preceding vehicles and the like ahead of the vehicle M, but also vehicles running parallel to the sides of the vehicle M, intersecting vehicles approaching the vehicle M from a direction intersecting the vehicle's travel path at an intersection, and following vehicles behind the vehicle M.

[0036] Here, the first driving environment recognition unit 11d converts the recognized positions of the camera OBJ and radar OBJ into coordinates of, for example, an orthogonal coordinate system with the center of the vehicle M as the origin (a coordinate system with the Z axis representing the fore-and-aft direction of the vehicle and the X axis representing the width direction of the vehicle).

[0037] Furthermore, the first driving environment recognition unit 11d compares the camera OBJ with the radar OBJ, and recognizes a combination of the camera OBJ and the radar OBJ that matches based on a preset condition as a fusion object (fusion OBJ).

[0038] Locator unit 12 estimates the position of the vehicle on a road map. Locator unit 12 has locator calculation unit 13 that estimates the position of the vehicle. Sensors required for estimating the position of vehicle M (the vehicle position), such as longitudinal acceleration sensor 14, wheel speed sensor 15, gyro sensor 16, and GNSS receiver 17, are connected to the input side of locator calculation unit 13.

[0039] The longitudinal acceleration sensor 14 detects the longitudinal acceleration of the vehicle M. The wheel speed sensor 15 detects the rotational speed of each of the front, rear, left, and right wheels. The gyro sensor 16 detects the angular velocity or angular acceleration of the vehicle M. The GNSS receiver 17 receives positioning signals transmitted from multiple positioning satellites.

[0040] The driving control device 10 has a transceiver 18 for transmitting and receiving information to and from the vehicle control device 100. The transceiver 18 is connected to the driving environment recognition unit 11, the locator unit 12, and control units (ECUs) 21 to 25 via a communication bus 20 of an in-vehicle communication network.

[0041] Furthermore, a high-accuracy road map database 19 is connected to the locator calculation unit 13. The high-accuracy road map database 19 is a large-capacity storage medium such as an HDD. This high-accuracy road map database 19 stores high-accuracy road map information (dynamic map).

[0042] This high-precision road map information contains, for example, the same information as the road map information that is successively updated by the above-mentioned external operation server 102, as information required when controlling the travel of the vehicle M. That is, the high-precision road map information contains four layers of information consisting of static information and quasi-static information that mainly constitute road information, and quasi-dynamic information and dynamic information that mainly constitute traffic information.

[0043] Locator calculation unit 13 includes map information acquisition unit 13a, host vehicle position estimation unit 13b, and second driving environment recognition unit 13c. Map information acquisition unit 13a acquires route map information from the current location to the destination from map information stored in high-precision road map database 19, based on the destination set by the driver during automatic driving, for example.

[0044] The map information acquisition unit 13a also transmits the acquired route map information (lane data on the route map) to the vehicle position estimation unit 13b. The vehicle position estimation unit 13b acquires the position coordinates of the vehicle M based on the positioning signal received by the GNSS receiver 17.

[0045] Furthermore, the vehicle position estimation unit 13b performs map matching of the acquired position coordinates on the route map information.Then, the vehicle position estimation unit 13b estimates the vehicle position on the road map and recognizes the left and right lane markings that divide the vehicle's driving path (driving lane).In this way, the vehicle position estimation unit 13b acquires the road curvature of the center of the driving lane stored in the road map data.

[0046] Furthermore, in an environment where valid positioning signals from positioning satellites cannot be received due to reduced sensitivity of the GNSS receiver 17, such as when driving in a tunnel, the vehicle position estimation unit 13b switches to autonomous navigation for estimating the vehicle position and estimates the vehicle position on a road map.

[0047] That is, the vehicle position estimation unit 13b estimates the vehicle position on the road map from the vehicle speed calculated based on the wheel speed detected by the wheel speed sensor 15, the angular velocity detected by the gyro sensor 16, and the longitudinal acceleration detected by the longitudinal acceleration sensor 14. Then, the vehicle position estimation unit 13b determines the road type of the road on which the vehicle M is traveling, based on the estimated vehicle position on the road map.

[0048] The second driving environment recognition unit 13c updates the road map information stored in the high-precision road map database 19 to the latest state by using road map information acquired by external communication (roadside-to-vehicle communication and vehicle-to-vehicle communication) via the transceiver 18. This information update is performed not only on static information but also on quasi-static information, quasi-dynamic information, and dynamic information.

[0049] As a result, the road map information includes road and traffic information acquired through communication with the outside of the vehicle, and the road map information is updated in approximately real time with information on other vehicles and other moving objects traveling on the roads.

[0050] Furthermore, the second driving environment recognition unit 13c verifies the road map information based on the driving environment information recognized by the driving environment recognition unit 11. Then, the second driving environment recognition unit 13c updates the road map information stored in the high-precision road map database 19 to the latest state. This information update is performed not only on static information but also on quasi-static information, quasi-dynamic information, and dynamic information.

[0051] This allows real-time updates of information on moving objects such as other vehicles traveling on the road recognized by the traveling environment recognition unit 11. The updated road map information is then transmitted to the vehicle control device 100 and surrounding vehicles of the vehicle M through the network environment NW by road-to-vehicle communication, vehicle-to-vehicle communication, etc. via the transceiver 18.

[0052] Furthermore, the second driving environment recognition unit 13c recognizes, from the updated road map information, road map information of a set range centered on the vehicle position estimated by the vehicle position estimation unit 13b as second driving environment information.

[0053] Here, the range of the second driving environment information recognized by the second driving environment recognition unit 13c is wider than the range of the first driving environment information recognized by the first driving environment recognition unit 11d. The second driving environment recognition unit 13c recognizes, for example, road map information within a range of a 1 km radius from the vehicle position as the second driving environment information.

[0054] The travel_ECU 21 reads the first travel environment information recognized by the first travel environment recognition section 11d of the travel environment recognition unit 11 and the second travel environment information recognized by the second travel environment recognition section 13c of the locator unit 12, etc.

[0055] In addition, various switches and sensors such as a mode changeover switch, a steering torque sensor, a brake sensor, an accelerator sensor that detects the amount of accelerator pedal depression as a driving operation amount by the driver, and a yaw rate sensor are connected to the input side of the driving_ECU 21 (none of which are shown).

[0056] The mode selector switch allows the driver to switch automatic driving (cruise control) on / off. The steering torque sensor detects steering torque as a driving operation amount by the driver. The brake sensor detects the brake pedal depression amount as a driving operation amount by the driver. The yaw rate sensor detects the yaw rate acting on the vehicle.

[0057] The driving modes set in the travel_ECU 21 are a manual driving mode, a first driving control mode and a second driving control mode which are modes for driving control, and an evacuation mode. These driving modes can be selectively switched in the travel_ECU 21 based on the operation status of the mode selector switch, etc.

[0058] Here, the manual driving mode is a driving mode that requires the driver to maintain steering, and is a driving mode in which the vehicle is driven according to driving operations such as steering, acceleration, and braking by the driver.

[0059] Similarly, the first driving control mode is a driving mode that requires the driver to maintain steering. That is, the first driving control mode reflects the driver's driving operation and performs an appropriate combination of mainly adaptive cruise control (ACC), active lane keep centering (ALKC), and active lane keep bouncing (ALKC) controls through control of the E / G_ECU 22, PS_ECU 24, BK_ECU 25, etc. As a result, the first driving control mode is a so-called semi-automated driving mode that drives the vehicle M along a target driving route.

[0060] The second driving control mode does not require the driver to maintain steering, operate the accelerator, or operate the brakes, and mainly performs an appropriate combination of preceding vehicle following control, lane centering control, and lane departure suppression control through control of, for example, the E / G_ECU 22, the PS_ECU 24, the BK_ECU 25, etc. Thus, the second driving control mode is an autonomous driving mode in which the vehicle M is driven according to a target route (route map information).

[0061] The evacuation mode is a mode for automatically stopping the vehicle M on a roadside or the like, for example, when, while driving in the second driving control mode, driving in that mode cannot be continued and the driver is unable to take over driving operations (i.e., when it is not possible to transition to manual driving mode or the first driving control mode).

[0062] A throttle actuator 31 is connected to the output side of the E / G_ECU 22. This throttle actuator 31 opens and closes a throttle valve of an electronically controlled throttle provided in a throttle body of the engine. The throttle actuator 31 opens and closes the throttle valve in response to a drive signal from the E / G_ECU 22 to adjust the intake air flow rate, thereby generating a desired engine output.

[0063] The output side of the T / M_ECU 23 is connected to a hydraulic control circuit 32. In addition, various sensors such as a shift position sensor (not shown) are connected to the input side of the T / M_ECU 23. The T / M_ECU 23 performs hydraulic control for the hydraulic control circuit 32 based on an engine torque signal estimated by the E / G_ECU 22 and detection signals from the various sensors.

[0064] As a result, the T / M_ECU 23 operates friction engagement elements, pulleys, etc. provided in the automatic transmission. In this way, the T / M_ECU 23 shifts the engine output at a desired gear ratio. The T / M_ECU 23 also outputs signals such as shift position detected by various sensors to the travel_ECU 21.

[0065] An electric power steering motor 33, which is a drive source, is connected to the output side of the PS_ECU 24. This electric power steering motor 33 applies steering torque to a steering mechanism by the rotational force of the motor. During autonomous driving, the electric power steering motor 33 is controlled and operated by a drive signal from the PS_ECU 24.

[0066] As a result, lane centering control to maintain the vehicle M in the current lane and lane change control to move the vehicle M to an adjacent lane (lane change control for overtaking control, etc.) are executed.

[0067] A brake actuator 34 is connected to the output side of the BK_ECU 25. The brake actuator 34 adjusts the brake hydraulic pressure supplied to the brake wheel cylinders provided on the respective wheels.

[0068] The brake actuator 34 is driven by a drive signal from the BK_ECU 25. When this is done, the brake actuator 34 generates a braking force of the braking mechanism on each wheel via the brake wheel cylinder, forcing the vehicle to decelerate.

[0069] A warning lamp 35 is connected to the output side of the determination_ECU 26. This warning lamp 35 is, for example, a telltale provided on an instrument panel for notifying of an abnormality.

[0070] 3, the determination_ECU 26 has a control information data table 30 stored in its internal memory. The control information table 30 stores data of normal control information to which an ID (identifier) ​​corresponding to a transmission ID for identifying the control information is assigned. Note that the normal control information is a frame containing data to which an ID identical to the transmission / reception ID for identification when each of the control units 21 to 25 transmits and receives data is assigned.

[0071] The judgment_ECU 26 receives control information (data frames), which are various signals transmitted and received by the control units 21 to 25 via the communication bus 20 of the in-vehicle communication network. The judgment_ECU 26 then determines whether a transmission ID that identifies the input control information, a reception ID that identifies that the control information has been received, and the data content of the control information are normal.

[0072] Furthermore, the control units 21 to 25 on the transmitting side transmit control information identified by the transmission ID to the other control units 21 to 25 and the judgment_ECU 26. Then, the control units 21 to 25 on the receiving side receive the necessary control information and transmit the reception ID that matches the transmission ID to the control units 21 to 25 on the transmitting side and the judgment_ECU 26.

[0073] The vehicle control device 100 has a backup control unit (hereinafter referred to as "backup_ECU") 105 in the external operation server 102. This backup_ECU 105 also stores control information having a normal ID (identifier) ​​and data related to drive control of the vehicle M.

[0074] When the vehicle control device 100 receives a signal notifying an abnormality from the driving control device 10 of the vehicle M via wireless communication over the network environment NW, it remotely controls the vehicle M based on normal control information. At this time, the vehicle control device 100 remotely controls the vehicle M, for example, to execute an evacuation mode and automatically stop the vehicle M on a roadside or the like.

[0075] In addition, when an abnormality occurs in vehicle M, vehicle control device 100 may remotely control vehicle M to move to a place where it can be evacuated, such as a nearby gas station or store parking lot, or, if vehicle M has a destination set, may remotely execute a second driving control mode in which vehicle M is driven along a target route.

[0076] Here, a security system that protects the driving control system 1 of the vehicle M of this embodiment from abnormal control due to unauthorized access to the in-vehicle communication network caused by an external cyber attack or the like will be described.

[0077] In the cruise control device 10 mounted on the vehicle M, when the control units 21 to 25 are activated, the decision_ECU 26 executes a control routine shown in the flowchart of FIG.

[0078] The judgment_ECU 26 determines whether or not control information has been input from any of the control units (ECUs) 21 to 25 (S1). The control information output from the control units 21 to 25 is input to the other control units 21 to 25 and the judgment_ECU 26 via the communication bus 20 of the in-vehicle communication network. In other words, the control units 21 to 25 that output control signals are transmitting nodes.

[0079] When control information is input (step S1: YES), the judgment_ECU 26 refers to data in the control information table 30 corresponding to the transmission ID that identifies the input control information (S2). In step S2, the judgment_ECU 26 refers to data content assigned with an ID that is the same identifier as the transmission ID of the input control information from the control information table 30. If no control information is input (step S1: NO), the judgment_ECU 26 repeatedly executes the process of step S1.

[0080] The judgment_ECU 26 determines (S3) whether the data included in the input control information matches the data content of the control information table 30. In this step S3, the judgment_ECU 26 compares the data included in the control information identified by the transmission ID with the data content of the matching ID referenced from the control information table 30.

[0081] If the data included in the control information matches the data content of the control information table 30 (step S3: YES), the judgment_ECU 26 determines whether the received ID has been input from another control unit (ECU) 21-25 that requires the control information of the transmission ID (S4). At this time, the judgment_ECU 26 determines that the data of the control information input from any of the control units (ECU) 21-25 on the transmission side is normal.

[0082] If the input control information data and the data in the control information table 30 do not match (step S3: NO), the judgment_ECU 26 determines that the control information data is not normal, and proceeds to the abnormality judgment process in step S9, which will be described later.

[0083] The received IDs output from the control units 21 to 25 are input to the transmitting control units 21 to 25 and the determination_ECU 26 via the communication bus 20 of the in-vehicle communication network. That is, the control units 21 to 25 that output the received IDs are receiving-side nodes.

[0084] If the received ID is input (step S4: YES), the judgment_ECU 26 determines whether the received ID matches the transmitted ID (S5). In step S5, the judgment_ECU 26 determines whether the input received ID matches the transmitted ID of the control information.

[0085] If the received ID matches the transmitted ID (step S5: YES), the judgment_ECU 26 returns to the process of step S1 and repeats the subsequent processes. At this time, the judgment_ECU 26 determines that the received ID of the other control units (ECUs) 21 to 25 on the receiving side matches the transmitted ID of the control information, indicating a normal state. In other words, the judgment_ECU 26 determines that the in-vehicle communication network is in a normal state, with no unauthorized access to it due to an external cyber-attack or the like.

[0086] On the other hand, when the transmission ID and the reception ID do not match (step S5: NO), the determination_ECU26 transmits the normal transmission and reception ID of the control information (S6), and increments the mismatch counter C (S7). Note that the determination_ECU26 incorporates an electronic counter as the mismatch counter C that counts the number of mismatches internally.

[0087] At this time, the determination_ECU26 determines that the data of the control information input from any one of the transmission-side control units (ECUs) 21 to 25 is normal by the determination process in step S3, but determines that an error has occurred in that the reception ID of the other control units (ECUs) 21 to 25 that require the control information does not match the transmission ID.

[0088] Then, the determination_ECU26 transmits the normal transmission and reception ID of the control information to the control units (ECUs) 21 to 25 via the communication bus 20 of the in-vehicle communication network. Next, the determination_ECU26 determines whether the internal mismatch counter C is equal to or greater than a predetermined threshold value Cth (C≧Cth) (S8). Note that the predetermined threshold value Cth is set to an arbitrary number, for example, 8 to 12. When the internal mismatch counter C of the determination_ECU26 is less than the predetermined threshold value Cth (C<Cth) (step S8: NO), it returns to step S1 and repeatedly executes the subsequent processing.

[0089] In this way, the determination_ECU26 increases the value of the mismatch counter C when the transmission ID and the reception ID of the control information do not match between the control units (ECUs) 21 to 25. Here, when the mismatch counter C of the determination_ECU26 is less than the predetermined threshold value Cth (C<Cth), it is determined that a minor error has occurred between the control units (ECUs) 21 to 25.

[0090] On the other hand, when the mismatch counter C exceeds the predetermined threshold value Cth (step S8: YES), the determination_ECU26 determines an abnormality (S9) and lights the warning lamp 35 (S10). Note that when the data of the control information is not normal in step S3, the determination_ECU26 also determines an abnormality in step S9 and lights the warning lamp 35 in step S10.

[0091] Here, if the non-conformity counter C is equal to or greater than a predetermined threshold Cth (C≧Cth), the judgment_ECU 26 determines that a serious abnormality has occurred between each control unit (ECU) 21 to 25, such as unauthorized access to the in-vehicle communication network due to an external cyber attack or the like.

[0092] In other words, the judgment_ECU 26 determines that an abnormality is continuing, such as an external cyber attack causing the control information data or transmission ID from the transmitting control unit (ECU) 21-25 to be rewritten, or the receiving control unit (ECU) 21-25 receiving incorrect control information data and outputting a transmission ID.

[0093] Then, the determination_ECU 26 transmits an abnormality signal to the vehicle control device 100 (S11). The determination_ECU 26 outputs the abnormality signal to the communication bus 20 of the in-vehicle communication network. This abnormality signal is wirelessly transmitted from the transceiver 18 of the driving control device 10 to the transceiver 101 of the vehicle control device 100 via the network environment NW.

[0094] Then, the vehicle control device 100 executes a control routine shown in the flowchart of Fig. 6. The vehicle control device 100 receives an abnormality signal from the vehicle M (S21). In the vehicle control device 100, the transceiver 101 receives the abnormality signal transmitted from the driving control device 10 of the vehicle M via the network environment NW. This abnormality signal is input to the external operation server 102.

[0095] When an abnormality signal is input to the external operation server 102, the vehicle control device 100 acquires the position information of the vehicle M (S22). The vehicle control device 100 acquires the position information of the vehicle M based on the position coordinates transmitted from the driving control device 10 of the vehicle M via the network environment NW.

[0096] The vehicle control device 100 transmits control information for automatically stopping the vehicle M on a side strip or the like to the cruise control device 10 of the vehicle M (S23). The vehicle control device 100 here reads control information for the normal ID and data content from the backup_ECU 105 of the external operation server 102 in which the control information is stored, and transmits the control information for automatically stopping the vehicle M on a side strip or the like in evacuation mode based on the acquired position information of the vehicle M via the network environment NW to the cruise control device 10 of the vehicle M.

[0097] In this way, control information is input from the vehicle control device 100 to the driving control device 10 via the network environment NW, and the vehicle M is remotely controlled to automatically stop in an evacuation mode, such as on a shoulder strip. Note that the vehicle control device 100 may remotely control the vehicle M by transmitting control information for moving the vehicle M to an evacuation location such as a nearby gas station or store parking lot based on the vehicle M's position information to the driving control device 10 via the network environment NW. Furthermore, in the case of vehicle M for which a destination has been set, the vehicle control device 100 may remotely control the vehicle M by transmitting control information for executing a second driving control mode for driving the vehicle M along a target route to the destination to the driving control device 10 via the network environment NW.

[0098] As described above, in order to prevent the vehicle M from being taken over or maliciously operated by external access, the driving control system 1 of the vehicle M in this embodiment determines whether the transmission ID and data content of the control information of the transmitting control units (ECUs) 21 to 25 and the reception ID of the receiving control units (ECUs) 21 to 25 are normal by the determination_ECU 26 of the driving control device 10. The determination_ECU 26 counts the number of incompatibilities (errors) between the transmission and reception IDs of the control units (ECUs) 21 to 25.

[0099] The judgment_ECU 26 determines that an abnormality has occurred if the incompatibility counter C is equal to or greater than a predetermined threshold value Cth (C≧Cth) and the incompatibility (error) between the transmission and reception IDs continues repeatedly. The judgment_ECU 26 also determines that an abnormality has occurred if the data content of the control information of the transmission side control units (ECUs) 21 to 25 is incompatible.

[0100] When the judgment_ECU 26 of the vehicle M determines that an abnormality has occurred, the driving control system 1 of the vehicle M has the driving control device 10 communicate wirelessly with a vehicle control device 100 installed in an external operation center via a network environment NW, and the vehicle control device 100 remotely controls the vehicle M to prevent unintended function activation.

[0101] As explained above, the driving control system 1 of the vehicle M can prevent unintended activation of functions due to unauthorized access such as cyber attacks from the outside. Therefore, the vehicle M can be prevented from being taken over or maliciously operated from the outside.

[0102] The control units (ECUs) 21-26 and the vehicle control device 100 each have a processor including a central processing unit (CPU), and storage devices such as ROM and RAM. All or part of the processor's circuits may be implemented by software. For example, the CPU may read and execute various programs corresponding to the functions stored in ROM. All or part of the processor's functions may be implemented by logic circuits or analog circuits, and the processing of the various programs may be implemented by electronic circuits such as FPGAs.

[0103] The invention described in the above embodiments is not limited to those embodiments, and various modifications can be made in the implementation stage without departing from the gist of the invention. Furthermore, each of the above embodiments includes inventions at various stages, and various inventions can be extracted by appropriate combinations of the disclosed multiple constituent elements.

[0104] For example, if some constituent elements are deleted from all the constituent elements shown in each form, and the stated problem can still be solved and the stated effect can still be obtained, then the configuration from which these constituent elements have been deleted can be extracted as an invention. [Explanation of symbols]

[0105] 1...Drive control system 10...Traction control device 11...Driving environment recognition unit 11a...Main camera 11b...Sub camera 11d…First driving environment recognition section 11fl...Left front side radar device 11fr...Right front side radar device 11rl...Left rear side radar device 11rr...Right rear side radar device 12...Locator unit 13...Locator calculation unit 13a...Map information acquisition section 13b... Vehicle position estimation unit 13c…Second driving environment recognition section 14...Front and rear acceleration sensor 15...Wheel speed sensor 16...Gyro sensor 17...GNSS receiver 18...Transmitter / Receiver 19...High-precision road map database 20...Communication bus 21...Travel control unit (Travel_ECU) 22...Engine control unit (E / G_ECU) 23...Transmission control unit (T / M_ECU) 24...Power steering control unit (PS_ECU) 25...Brake control unit (BK_ECU) 26...Judgment control unit (Judgment_ECU) 30...Control information table 31...Throttle actuator 32...Hydraulic control circuit 33...Electric power steering motor 34...Brake actuator 35...Warning lamp 100...Vehicle control device 101...Transmitter / Receiver 102...External operation server 105...Backup control unit (Backup_ECU) M...Vehicle NW...Network environment

Claims

1. a plurality of control units mounted on the vehicle; a judgment control unit to which control information of the plurality of control units is input; an in-vehicle communication network to which the plurality of control units and the judgment control unit are connected; a control device that wirelessly communicates with the vehicle via a network environment and has a backup control unit in which the control information of the vehicle is stored; Equipped with the determination control unit counts the number of incompatibilities between transmission and reception IDs of the control information transmitted and received by the plurality of control units via the in-vehicle communication network, and determines that an abnormality has occurred when the number of incompatibilities is equal to or greater than a predetermined threshold, and transmits an abnormality signal to the control device via a network environment; A vehicle driving control system characterized in that the control device, upon receiving the abnormal signal, transmits normal control information to the vehicle via a network environment, thereby remotely operating the vehicle.

2. the determination control unit has a control information table in which the control information is stored, 2. The vehicle driving control system according to claim 1, wherein the control information table is referenced to determine that the control information data transmitted by the plurality of control units is incompatible, and the abnormality signal is transmitted to the control device.

3. Has a warning lamp, 3. The vehicle driving control system according to claim 1, wherein the judgment control unit turns on the warning lamp when it judges that the control information is abnormal.

4. 3. The vehicle driving control system according to claim 1, wherein the control device, upon receiving the abnormality signal, executes an evacuation mode by remote control, in which the vehicle is automatically stopped on a shoulder strip or the like.

Images