Control device, control method, control program, and vehicle

Abstract

To provide a control device that suppresses occurrence of contention between devices even when a device related to each of a plurality of applications accesses one storage unit.SOLUTION: A control device 22 receives data output from a plurality of applications. The control device 22 adjusts, on the basis of a predetermined condition, order in which a plurality of data output from the plurality of applications are stored in a storage 18.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a control device, a control method, a control program, and a vehicle. [Background technology]

[0002] Conventionally, a virtualization support device that improves the utilization efficiency of a processor is known (for example, Patent Document 1). The processor disclosed in Patent Document 1 arbitrates the execution order of multiple accelerators for multiple requests from a first and second application. Then, based on the arbitration, the processor uses one of the first and second information to control the setting of an input / output memory management unit, and causes one of the multiple requests to be executed by a corresponding one or more of the multiple accelerators based on the arbitration (for example, see [Abstract] of Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2021-051420 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, when multiple devices (e.g., CPUs: Central Processing Units) each executing multiple application software (hereinafter simply referred to as "applications") attempt to access a memory unit such as a storage device at approximately the same time to store data, a problem may arise as to which device's data should be given priority for storage.

[0005] The technology of Patent Document 1 arbitrates the execution order of multiple accelerators for multiple requests, but does not arbitrate the order in which data of multiple applications is stored in a storage unit such as a storage device.

[0006] For this reason, in the conventional technology, when multiple devices related to multiple applications access one storage unit almost simultaneously, there is a problem that contention may occur between the multiple devices. When multiple devices access one storage unit almost simultaneously, for example, consistency may be lost when updating data.

[0007] The present disclosure has been made in consideration of the above facts, and aims to suppress the occurrence of conflicts between devices even when multiple devices related to multiple applications access a single memory unit. [Means for solving the problem]

[0008] In order to achieve the above object, a first aspect of the present disclosure is a control device comprising: a receiving unit that receives data output from a plurality of applications; and an arbitration unit that arbitrates the order in which the plurality of data output from the plurality of applications are stored in a memory unit based on predetermined conditions.

[0009] A control device according to a first aspect of the present disclosure accepts data output from a plurality of applications. The control device arbitrates the order in which the data output from the plurality of applications is stored in a storage unit based on a predetermined condition. This makes it possible to suppress conflicts between devices even when a plurality of devices related to a plurality of applications access a single storage unit.

[0010] The predetermined condition in the second aspect of the present disclosure is a vehicle state condition representing a condition preset according to a vehicle state, the reception unit further receives the vehicle state, and the arbitration unit arbitrates the order in which the plurality of data accepted by the reception unit are stored in the storage unit based on the vehicle state accepted by the reception unit and the vehicle state condition. According to the second aspect of the present disclosure, even when a plurality of devices related to a plurality of applications access one storage unit according to the vehicle state of the vehicle in which the control device is installed, it is possible to suppress the occurrence of contention between devices.

[0011] The plurality of applications in the third aspect of the present disclosure include an autonomous driving application that is an application related to autonomous driving control, and a control system application that is an application related to vehicle control different from the autonomous driving control, and the vehicle state includes an autonomous driving mode that indicates that the vehicle is in an autonomous driving state, and the arbitration unit arbitrates the order in which the plurality of data are stored in the storage unit by storing data output from the autonomous driving application in priority to data output from the control system application in the storage unit when the vehicle state accepted by the acceptance unit is the autonomous driving mode, and storing data output from the control system application in priority to data output from the autonomous driving application in the storage unit when the vehicle state accepted by the acceptance unit is not the autonomous driving mode. According to the third aspect of the present disclosure, the order in which data is stored in the storage unit can be appropriately arbitrated depending on whether the vehicle state is in the autonomous driving mode or not.

[0012] The plurality of applications in the fourth aspect of the present disclosure further includes a multimedia application that is an application related to multimedia used in the vehicle, and the arbitration unit arbitrates the order in which the plurality of data are stored in the storage unit by causing the data output from the autonomous driving application to be stored in the storage unit in priority to the data output from the control application and the data output from the multimedia application when the vehicle state received by the reception unit is the autonomous driving mode, and causing the data output from the control application and the data output from the autonomous driving application to be stored in the storage unit in priority to the data output from the multimedia application when the vehicle state received by the reception unit is not the autonomous driving mode. According to the fourth aspect of the present disclosure, the order in which the data is stored in the storage unit can be appropriately arbitrated depending on whether the vehicle state is in the autonomous driving mode or not and the type of application.

[0013] The vehicle state in a fifth aspect of the present disclosure includes a vehicle factory mode indicating that the vehicle is in a factory and is being improved or repaired, and when the vehicle state accepted by the acceptance unit is the vehicle factory mode, the arbitration unit arbitrates the order in which the multiple pieces of data are stored in the storage unit by giving priority to data output from the control system application over data output from the autonomous driving application when the vehicle state accepted by the acceptance unit is the vehicle factory mode. According to the fifth aspect of the present disclosure, the order in which data is stored in the storage unit can be appropriately arbitrated depending on whether the vehicle state is the vehicle factory mode or not.

[0014] The arbitration unit of a sixth aspect of the present disclosure further arbitrates the order in which the plurality of data are stored in the storage unit and the order in which the data are read from the storage unit, by giving a higher priority to a process of storing data output from the application in the storage unit than a process of reading data from the storage unit when the vehicle state received by the reception unit is the vehicle factory mode, and giving a higher priority to a process of reading data from the storage unit than a process of storing data output from the application in the storage unit when the vehicle state received by the reception unit is the autonomous driving mode. According to the sixth aspect of the present disclosure, the process of storing data in the storage unit and the process of reading data from the storage unit can be appropriately arbitrated depending on the type of processing for data.

[0015] The data output from the multiple applications of the seventh aspect of the present disclosure includes key data for encrypting the data output from the applications and execution data used when executing the applications, and the arbitration unit arbitrates whether the key data or the execution data should be given priority to be stored in the storage unit based on the predetermined condition. According to the seventh aspect of the present disclosure, the process of storing data in the storage unit can be appropriately arbitrated depending on the type of data.

[0016] The predetermined condition in the eighth aspect of the present disclosure is a vehicle state condition representing a condition preset according to a vehicle state, and the reception unit further receives the vehicle state, which includes an autonomous driving mode representing that the vehicle is in an autonomous driving state and a vehicle factory mode representing that the vehicle is in a factory and is being improved or repaired, and the arbitration unit, when the vehicle state received by the reception unit is the vehicle factory mode, prioritizes a process of storing the key data in the storage unit over a process of storing the execution data in the storage unit, and when the vehicle state received by the reception unit is the autonomous driving mode, prioritizes a process of reading the execution data from the storage unit over a process of storing the key data in the storage unit, thereby further arbitrating an order in which the plurality of data are stored in the storage unit and an order in which the data are read from the storage unit. According to the eighth aspect of the present disclosure, the process of storing data in the storage unit and the process of reading data from the storage unit can be appropriately arbitrated according to the type of data and the type of process.

[0017] A ninth aspect of the present disclosure is a vehicle including the above-mentioned control device. According to the ninth aspect of the present disclosure, as in the first aspect, even when a plurality of devices related to a plurality of applications access one storage unit, it is possible to suppress the occurrence of conflicts between the devices.

[0018] The control method of the tenth aspect of the present disclosure is a control method in which a computer executes a process of accepting data output from a plurality of applications and arbitrating an order in which the plurality of data output from the plurality of applications are stored in a storage unit based on a predetermined condition. According to the tenth aspect of the present disclosure, similarly to the first aspect, even when a plurality of devices related to a plurality of applications access one storage unit, it is possible to suppress the occurrence of contention between devices.

[0019] The control program of the eleventh aspect of the present disclosure is a control program for causing a computer to execute a process of accepting data output from a plurality of applications and arbitrating an order in which the plurality of data output from the plurality of applications are stored in a storage unit based on a predetermined condition. According to the eleventh aspect of the present disclosure, similarly to the first aspect, even when a plurality of devices related to a plurality of applications access one storage unit, it is possible to suppress the occurrence of contention between devices. Effect of the Invention

[0020] As described above, according to the present disclosure, even when multiple devices related to multiple applications access one storage unit, it is possible to obtain an effect that the occurrence of contention between devices can be suppressed. [Brief description of the drawings]

[0021] [Figure 1] 1 is a block diagram showing an example of a schematic configuration of a control system according to an embodiment. [Diagram 2] FIG. 2 is a diagram for explaining access from a device to a storage; [Diagram 3] FIG. 2 is a diagram for explaining access from a device to a storage; [Figure 4] FIG. 4 is a diagram for explaining an example of a vehicle state condition. [Diagram 5] FIG. 2 is a diagram showing an example of a flow of processing performed in the control system according to the embodiment. [Figure 6] FIG. 2 is a diagram showing an example of a flow of processing performed in the control system according to the embodiment. [Figure 7] FIG. 2 is a diagram showing an example of a flow of processing performed in the control system according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

[0023] <Embodiment> Fig. 1 is a block diagram showing an example of a schematic configuration of a control system 10 according to an embodiment. As shown in Fig. 1, the control system 10 includes a plurality of Central Processing Units (CPUs) 12-1, 12-2, 12-3, and 12-4, a plurality of Hardware Security Modules (HSMs) 14-1, 14-2, and 14-3, a memory 16 as a temporary storage area, a storage 18 as an example of a non-volatile storage unit, and an Ethernet (registered trademark) switch (Eth / SW) 19 as a communication interface. The control system 10 is mounted on a vehicle (not shown).

[0024] The control system 10 is hardware having various components, which will be described later, mounted thereon. The control system 10 is also a processor.

[0025] The multiple CPUs 12-1, 12-2, 12-3, and 12-4, the multiple HSMs 14-1, 14-2, and 14-3, the memory 16, the storage 18, and the Eth / SW 19 are communicatively connected via a bus (not shown). Note that, below, any one of the multiple CPUs 12-1, 12-2, 12-3, and 12-4 will also be referred to simply as CPU 12. Also, below, any one of the multiple HSMs 14-1, 14-2, and 14-3 will also be referred to simply as HSM 14.

[0026] The HSM 14 is hardware for managing key data used when encrypting or decrypting data. The HSM 14 has a security function and is tamper-resistant. The HSM 14 stores key data, performs encryption or decryption calculations using the key data, generates key data, and generates random numbers.

[0027] The memory 16 is a storage device that can be directly accessed by the processor, the CPU 12. The memory 16 is also an example of a storage unit, since it temporarily stores frequently used data.

[0028] The storage 18 is realized by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, etc. The storage 18 as a storage medium stores programs for operating the control system 10. The multiple CPUs 12-1, 12-2, 12-3, and 12-4 constituting the control system 10 read various programs from the storage 18, expand the programs in the memory 16, and sequentially execute processes contained in the programs.

[0029] By multiple CPUs 12-1, 12-2, 12-3, and 12-4 of control system 10 sequentially executing various programs, the functions of the virtualization mechanism 20, multiple virtual machines 30-1, 30-2, 30-3, and 30-4, multiple Basic Software (BSW) 40-1, 40-2, and 40-3, central gateway (G / W) 50, control system application 60A, autonomous driving application 60B, and multimedia application 60C shown in FIG. 1 are realized.

[0030] In the following, any one of the plurality of virtual machines 30-1, 30-2, 30-3, and 30-4 will be simply referred to as a virtual machine 30. In the following, any one of the plurality of BSWs 40-1, 40-2, and 40-3 will be simply referred to as a BSW 40. In the following, any one of the control application 60A, the automatic driving application 60B, and the multimedia application 60C will be simply referred to as an application 60.

[0031] The virtualization mechanism 20 is realized by software that runs on the control system 10. The virtualization mechanism 20 is realized by multiple CPUs 12-1, 12-2, 12-3, and 12-4, which are the physical components of the control system 10. In addition, the function of a virtual machine 30 is realized on the virtualization mechanism 20.

[0032] The virtual machine 30 runs on the virtualization mechanism 20. The virtual machine 30 runs as a virtualized computer. The virtual machine 30 can mimic the operation of a computer and behave like a single piece of computer hardware.

[0033] The BSW 40 runs on the virtual machine 30. The BSW 40 has basic functions such as an operating system function and a communication function. Specifically, the BSW 40-1 runs on the virtual machine 30-2, the BSW 40-2 runs on the virtual machine 30-3, and the BSW 40-3 runs on the virtual machine 30-4.

[0034] The central G / W 50 runs on the virtual machine 30. The central G / W 50 relays data received from the outside.

[0035] The application 60 runs on the BSW 40. The application 60 is software that executes a specific process, and in this embodiment, as shown in Fig. 1, a control application 60A that is an application related to vehicle control different from automatic driving control, an automatic driving application 60B that is an application related to automatic driving control, and a multimedia application 60C that is an application related to multimedia used in the vehicle run.

[0036] Specifically, the control application 60A runs on the BSW 40-1, the automatic driving application 60B runs on the BSW 40-2, and the multimedia application 60C runs on the BSW 40-3.

[0037] Among the data transmitted from the application 60 to the outside, data that requires high security is encrypted by the HSM 14, and then the encrypted data is transmitted from the application 60 to the outside. Moreover, among the data that the application 60 receives from the outside, encrypted data is decrypted by the HSM 14 and then used in the application 60.

[0038] For example, data transmitted and received by the control application 60A is encrypted or decrypted by the HSM 14-1. Data transmitted and received by the autonomous driving application 60B is encrypted or decrypted by the HSM 14-2. Data transmitted and received by the multimedia application 60C is encrypted or decrypted by the HSM 14-3.

[0039] 1 access the storage 18 within a certain period of time, a conflict may occur between the CPUs 12-1, 12-2, 12-3, 12-4 and the HSMs 14-1, 14-2, 14-3. Specifically, when the CPU 12 that executes the application 60 shown in FIG. 1 and the HSM 14 that executes encryption or decryption processing on data access the memory 16 or the storage 18 within a certain period of time, a conflict may occur between the CPUs 12-1, 12-2, 12-3, 12-4 and the HSMs 14-1, 14-2, 14-3.

[0040] Considering such a point, for example, a measure may be taken to uniformly prioritize a certain application over other applications. However, in such a case, for example, when a high-priority application is executed while a low-priority application is being executed, the execution of the low-priority application may be interrupted, and the control system 10 may cause unexpected behavior. In addition, when a priority is set for an application, if a malfunction occurs in the high-priority application, the high-priority application may continue to occupy the storage 18.

[0041] Therefore, the control system 10 of the present embodiment arbitrates the order in which data output from a plurality of applications 60 is stored in the storage 18 based on the state of the vehicle (hereinafter simply referred to as the "vehicle state").

[0042] In this embodiment, the control device 22 operating on the virtualization mechanism 20 accepts the vehicle state. Then, the control device 22 arbitrates the order in which a plurality of data are stored in the storage 18 based on the vehicle state and a vehicle state condition that indicates a condition that is preset according to the vehicle state.

[0043] The data output from the multiple applications 60 includes key data for encrypting the data output from the applications 60 and execution data used when executing the applications 60. Therefore, the control device 22 arbitrates whether the key data or the execution data should be given priority for storage in the storage 18, based on the vehicle state and the vehicle state conditions. In the following, the process of storing data in the storage 18 is also simply referred to as "writing."

[0044] 2 and 3 are diagrams for explaining access from a device to the storage 18. FIG.

[0045] 2, when key data Key_A is output from the control application 60A, the HSM 14-1 acquires the key data Key_A and stores the key data Key_A in its own storage unit (not shown). The key data Key_A is used to encrypt or decrypt data transmitted between the control application 60A and an external device. The HSM 14-1 then loads the key data Key_A into the memory 16, and then writes the key data Key_A into the storage 18.

[0046] 2, when key data Key_C is output from the multimedia application 60C, the HSM 14-2 acquires the key data Key_C and stores the key data Key_C in its own storage unit (not shown). The key data Key_C is used to encrypt or decrypt data transmitted between the multimedia application 60C and an external device. The HSM 14-2 then loads the key data Key_C into the memory 16, and then writes the key data Key_C into the storage 18.

[0047] 2, when execution data related to autonomous driving is output from the autonomous driving application 60B, the CPU 12 corresponding to the virtual machine 30 running the autonomous driving application 60B temporarily deploys the execution data related to autonomous driving in the memory 16, and then writes the execution data related to autonomous driving to the storage 18. In addition, the CPU 12 corresponding to the virtual machine 30 running the autonomous driving application 60B reads out the execution data related to autonomous driving that has already been stored in the storage 18, and outputs it to the autonomous driving application 60B.

[0048] As described above, when devices related to each application (in the above example, HSM 14-1, HSM 14-2, and CPU 12) access the storage 18 in a natural manner, contention may occur between the devices. As a result, various performance requirements may not be met.

[0049] For example, when the vehicle is in an autonomous driving mode, the required performance requirement may be that the execution data is read from storage 18 or that the execution data is written to storage 18 within a predetermined time. Also, when the vehicle is in a vehicle factory mode, the required performance requirement may be that the key data is written to storage 18 within a predetermined time.

[0050] Therefore, in this embodiment, as shown in FIG. 3, the control device 22 operating on the virtualization mechanism 20 arbitrates the order in which data is stored in the storage 18 and the order in which data is read from the storage 18 based on the vehicle state, vehicle state conditions, data type, and processing type.

[0051] 1, the control device 22 functionally comprises a reception unit 24, a condition storage unit 25, and an arbitration unit 26. The functions of the control device 22 are realized by software.

[0052] The receiving unit 24 receives the vehicle state of the vehicle in which the control system 10 is mounted and data output from the application 60.

[0053] In this embodiment, an example will be described in which the vehicle state includes an autonomous driving mode, which indicates that the vehicle is in an autonomous driving state, and a vehicle factory mode, which indicates that the vehicle is in a factory and is being improved or repaired.

[0054] The condition storage unit 25 stores vehicle state conditions that indicate conditions that are set in advance according to the vehicle state. The vehicle state conditions are an example of a predetermined condition. In the vehicle state conditions, which data processing is to be prioritized according to the vehicle state is set in advance.

[0055] An example of a vehicle state condition is shown in Fig. 4. As shown in Fig. 4, the vehicle state condition associates the vehicle state with the priority of each process. For example, as shown in Fig. 4, when the vehicle state is the autonomous driving mode, the read process of the execution data of the autonomous driving application 60B from the storage 18 has the highest priority, and the write process of the key data to the storage 18 has the lowest priority. Also, as shown in Fig. 4, when the vehicle state is the vehicle factory mode, the write process of the key data to the storage 18 has the highest priority, and the read process of the execution data from the storage 18 has the lowest priority.

[0056] As shown in FIG. 4, the priority of each process can also be set for a failure mode that indicates a state in which the vehicle is malfunctioning and an Over-The-Air (OTA) mode that indicates a state in which the vehicle software is being updated.

[0057] The arbitration unit 26 arbitrates the order in which multiple data items output from multiple applications 60 are stored in the storage 18 based on the vehicle state accepted by the acceptance unit 24 and the vehicle state conditions stored in the condition memory unit 25.

[0058] Specifically, when the vehicle state accepted by the acceptance unit 24 is the autonomous driving mode, the arbitration unit 26 controls the execution data output from the autonomous driving application 60B to be stored in the storage 18 in priority to the execution data output from the control application 60A and the execution data output from the multimedia application 60C. Note that, when the vehicle state accepted by the acceptance unit 24 is the autonomous driving mode, the arbitration unit 26 controls the execution data output from the control application 60A to be stored in the storage 18 in priority to the execution data output from the multimedia application 60C.

[0059] Furthermore, when the vehicle state accepted by the acceptance unit 24 is not the autonomous driving mode, the arbitration unit 26 controls the execution data output from the control application 60A to be stored in the storage 18 in priority over the execution data output from the autonomous driving application 60B and the execution data output from the multimedia application 60C. Note that, when the vehicle state accepted by the acceptance unit 24 is not the autonomous driving mode, the arbitration unit 26 controls the execution data output from the autonomous driving application 60B to be stored in the storage 18 in priority over the execution data output from the multimedia application 60C.

[0060] Also, for example, when the vehicle state accepted by the acceptance unit 24 is the vehicle factory mode, the arbitration unit 26 controls the execution data output from the control application 60A to be stored in the storage 18 with priority over the execution data output from the autonomous driving application 60B and the execution data output from the multimedia application 60C. Also, for example, when the vehicle state accepted by the acceptance unit 24 is the vehicle factory mode, the arbitration unit 26 controls the execution data output from the autonomous driving application 60B to be stored in the storage 18 with priority over the execution data output from the multimedia application 60C.

[0061] The data output from the multiple applications 60 also includes key data for encrypting the data output from the applications 60. For this reason, the arbitration unit 26 arbitrates whether the key data or the execution data should be given priority for storage in the storage 18, based on the vehicle state and the vehicle state conditions.

[0062] When the vehicle state accepted by the acceptance unit 24 is the vehicle factory mode, the arbitration unit 26 controls so that the process of storing key data in the storage 18 is prioritized over the process of storing execution data in the storage 18. In addition, when the vehicle state accepted by the acceptance unit 24 is the autonomous driving mode, the arbitration unit 26 controls so that the process of reading data from the storage 18 is prioritized over the process of storing key data in the storage 18.

[0063] In this manner, the arbitration unit 26 arbitrates the order in which a plurality of data items are stored in the storage 18 and the order in which the data items are read from the storage 18 .

[0064] In the example shown in Fig. 1, four virtual machines 30 are shown, three BSWs 40 are shown, and three applications 60 are shown. In addition, in the example shown in Fig. 1, four CPUs 12 and three HSMs 14 are shown. However, the number of these components is not limited to the example shown in Fig. 1.

[0065] Next, the operation of the control system 10 of the embodiment will be described.

[0066] When the virtual machine 30 implemented by the CPU 12 of the control system 10 receives a request signal output from the application 60, the CPU 12 implementing the virtual machine 30 executes a control processing routine shown in FIG.

[0067] In step S50, the CPU 12 receives a request signal output from the application 60.

[0068] In step S52, the CPU 12 determines whether or not the request signal received in step S50 includes a request to update the key data. If the request signal includes a request to update the key data, the process proceeds to step S54. On the other hand, if the request signal does not include a request to update the key data, the process proceeds to step S58.

[0069] In step S54, the CPU 12 requests the HSM 14 to update the key data.

[0070] When the HSM 14 receives the update request output from the CPU 12, the HSM 14 stores the key data in its own storage unit (not shown).

[0071] In step S56, the CPU 12 requests the control device 22 to update the key data.

[0072] In step S58, the CPU 12 determines whether or not the request signal received in step S50 includes a request to access the storage 18. If the request signal includes a request to access the storage 18, the process proceeds to step S60. On the other hand, if the request signal does not include a request to access the storage 18, the process ends.

[0073] In step S60, the CPU 12 requests the control device 22 to read the execution data from the storage 18 or to write the execution data to the storage 18.

[0074] When a request signal for various processes is output to the control device 22 in step S56 or step S60, the CPU 12 corresponding to the control device 22 executes the control process routine shown in FIGS.

[0075] In step S100 of FIG. 6, the CPU 12, functioning as the reception unit 24 of the control device 22, receives the request signal output in the above step S56 or step S60.

[0076] In step S101, the CPU 12, functioning as the reception unit 24 of the control device 22, receives the current vehicle state.

[0077] In step S102, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads out the vehicle state condition from the condition storage unit 25.

[0078] In step S103, the CPU 12, functioning as the arbitration unit 26 of the control device 22, determines whether the vehicle state received in step S101 is the vehicle factory mode. If the vehicle state is the vehicle factory mode, the process proceeds to step S104. On the other hand, if the vehicle state is not the vehicle factory mode, the process proceeds to step S110 shown in FIG.

[0079] The CPU 12, functioning as the arbitration unit 26 of the control device 22, refers to the vehicle state conditions read out in step S102, and executes each process in the order of steps S104 to S108.

[0080] In step S104, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the key data output from the application 60 into the storage 18.

[0081] In step S106, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the execution data output from the application 60 into the storage 18.

[0082] In step S108, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads out the execution data from the storage 18 in response to the request from the application 60.

[0083] Thus, when the vehicle is in the vehicle factory mode, the vehicle is being improved or repaired, and various settings for the vehicle need to be made smoothly. For this reason, when the vehicle is in the vehicle factory mode, the priority of the process of writing various data to the storage 18 is set high. In particular, the priority of writing key data to the storage 18 is set to the highest. Note that, as shown in the processes of steps S104 to S108, when the vehicle is in the vehicle factory mode, the type of application 60 is not taken into consideration.

[0084] 7, the CPU 12, functioning as the arbitration unit 26 of the control device 22, determines whether the vehicle state received in step S101 is the autonomous driving mode. If the vehicle state is the autonomous driving mode, the process proceeds to step S112. On the other hand, if the vehicle state is not the autonomous driving mode, the process proceeds to step S120.

[0085] In step S112, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads execution data from the storage 18 in response to a request from the autonomous driving application 60B. Then, the CPU 12, functioning as the arbitration unit 26 of the control device 22, passes the read execution data to the autonomous driving application 60B.

[0086] In step S114, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the execution data output from the autonomous driving application 60B to the storage 18.

[0087] In step S116, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads out execution data from the storage 18 in response to a request from the control application 60A. Then, the CPU 12, functioning as the arbitration unit 26 of the control device 22, passes the read out execution data to the control application 60A.

[0088] In step S118, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the execution data output from the control application 60A into the storage 18.

[0089] In this way, when the vehicle state is in the autonomous driving mode, various processes for data related to the autonomous driving application 60B are given priority.

[0090] In step S120, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads execution data from the storage 18 in response to a request from the control application 60A. Then, the CPU 12, functioning as the arbitration unit 26 of the control device 22, passes the read execution data to the control application 60A.

[0091] In step S122, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the execution data output from the control application 60A into the storage 18.

[0092] In step S124, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads execution data from the storage 18 in response to a request from the autonomous driving application 60B. Then, the CPU 12, functioning as the arbitration unit 26 of the control device 22, passes the read execution data to the autonomous driving application 60B.

[0093] In step S126, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the execution data output from the autonomous driving application 60B to the storage 18.

[0094] In this way, when the vehicle is not in the autonomous driving mode, various processes on data related to the control application 60A are prioritized over various processes on data related to the autonomous driving application 60B.

[0095] In step S128, the CPU 12, functioning as the arbitration unit 26 of the control device 22, reads execution data from the storage 18 in response to a request from the multimedia application 60C. Then, the CPU 12, functioning as the arbitration unit 26 of the control device 22, passes the read execution data to the multimedia application 60C.

[0096] In step S130, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the execution data output from the multimedia application 60C into the storage 18.

[0097] In this way, whether the vehicle state is in autonomous driving mode or not, various processes for data related to the control application 60A and the autonomous driving application 60B are prioritized over various processes for data related to the multimedia application 60C.

[0098] In step S132, the CPU 12, functioning as the arbitration unit 26 of the control device 22, writes the key data output from the application 60 into the storage 18.

[0099] In this manner, when the vehicle state is not in vehicle factory mode, various processes on data related to application 60 take priority over the process of writing key data to storage 18 .

[0100] 6 and 7, the control device 22 may omit any of the processes in steps S104 to S108 in response to the request signal received in step S100. Also, the control device 22 may omit any of the processes in steps S112 to S132 in response to the request signal received in step S100.

[0101] For example, if the request signal does not include a request to update the key data, the processes of steps S104 and S132 are omitted. Also, for example, if the request signal does not include a request to access the storage 18, the processes of steps S106 to S108 and steps S112 to S130 are omitted.

[0102] Moreover, if the request signal does not include a request for data processing related to a specific application 60, the processing related to that application 60 is omitted. For example, if the request signal does not include a request for data processing related to the control application 60A, the processing of steps S116 to S118 and steps S120 to S122 are omitted.

[0103] As described above, the control device according to the embodiment accepts data output from multiple applications and arbitrates the order in which the multiple data output from the multiple applications are stored in the storage based on a predetermined condition. This makes it possible to suppress conflicts between devices even when multiple devices related to multiple applications access one storage unit.

[0104] In addition, since the vehicle state conditions described above can be freely set, the priority of each process can be flexibly changed. Furthermore, according to the control device according to the present embodiment, the priority of each process can be flexibly set according to the required performance requirements.

[0105] In the above embodiment, the processes performed by each device have been described as software processes performed by executing a program, but they may be hardware processes. Alternatively, they may be a combination of both software and hardware processes. Furthermore, the programs stored in the ROM may be stored in various storage media and distributed.

[0106] Furthermore, the present invention is not limited to the above-described embodiment, and can be implemented in various modifications other than the above-described embodiment without departing from the spirit and scope of the present invention.

[0107] In the present embodiment, the case where the autonomous driving mode and the vehicle factory mode exist as vehicle states has been described as an example, but the present invention is not limited to this. Priorities of each process may also be set for the manual driving mode indicating that the vehicle is in a manual driving state, the failure mode indicating that the vehicle is in a fault state, and the Over-The-Air (OTA) mode indicating that the on-board software is being updated.

[0108] In addition, in this embodiment, an example has been described in which there are multiple applications, such as a control application 60A, an autonomous driving application 60B, and a multimedia application 60C, but this is not limited to this, and other applications may be applied to this embodiment. [Explanation of symbols]

[0109] 10. Control System 16 Memory 18. Storage 20 Virtualization Mechanism 22 Control device 24 Reception Department 25 Condition memory section 26 Mediation Department 30 Virtual Machines 60 Applications 60A Control System Application 60B Autonomous Driving Applications 60C Multimedia Applications

Claims

1. A reception unit that receives data output from a plurality of applications; an arbitration unit that arbitrates an order in which the data output from the applications is stored in the storage unit based on a predetermined condition; Equipped with the predetermined condition is a vehicle state condition that represents a condition that is set in advance according to a vehicle state, The reception unit further receives the vehicle state, The arbitration unit arbitrates an order in which the plurality of data items accepted by the acceptance unit are to be stored in the storage unit, based on the vehicle state accepted by the acceptance unit and the vehicle state condition. Control device.

2. The plurality of applications include an autonomous driving application that is an application related to autonomous driving control, and a control system application that is an application related to vehicle control different from the autonomous driving control, The vehicle state includes an autonomous driving mode indicating that the vehicle is in an autonomous driving state; When the vehicle state accepted by the acceptance unit is the autonomous driving mode, the arbitration unit prioritizes data output from the autonomous driving application over data output from the control system application and stores the data in the storage unit, When the vehicle state accepted by the acceptance unit is not the autonomous driving mode, the data output from the control system application is stored in the storage unit in priority to the data output from the autonomous driving application, thereby arbitrating the order in which the plurality of data are stored in the storage unit. The control device according to claim 1 .

3. The plurality of applications further includes a multimedia application that is an application related to multimedia used in the vehicle; when the vehicle state accepted by the acceptance unit is the autonomous driving mode, the arbitration unit stores the data output from the autonomous driving application in the storage unit in priority to the data output from the control application and the data output from the multimedia application; When the vehicle state accepted by the accepting unit is not the autonomous driving mode, the data output from the control application and the data output from the autonomous driving application are stored in the storage unit in priority to the data output from the multimedia application, thereby arbitrating the order in which the plurality of data are stored in the storage unit. The control device according to claim 2.

4. the vehicle state includes a vehicle factory mode indicating that the vehicle is in a factory and that the vehicle is being upgraded or repaired; When the vehicle state accepted by the acceptance unit is the vehicle factory mode, the arbitration unit arbitrates an order in which the plurality of data are stored in the storage unit by storing the data output from the control system application in the storage unit with priority over the data output from the autonomous driving application. The control device according to claim 2 or 3.

5. The arbitration unit is When the vehicle state accepted by the accepting unit is the vehicle factory mode, a process of storing data output from the application in the storage unit is given priority over a process of reading data from the storage unit; When the vehicle state accepted by the accepting unit is the autonomous driving mode, a process of reading data from the storage unit is prioritized over a process of storing data output from the application in the storage unit. further adjusting an order in which the plurality of data are stored in the storage unit and an order in which the data are read from the storage unit; The control device according to claim 4.

6. A reception unit that receives data output from a plurality of applications; an arbitration unit that arbitrates an order in which the data output from the applications is stored in the storage unit based on a predetermined condition; Equipped with The data output from a plurality of applications includes key data for encrypting the data output from the applications and execution data used when executing the applications, the arbitration unit arbitrates, based on the predetermined condition, which of the key data and the execution data should be given priority to be stored in the storage unit; Control device.

7. the predetermined condition is a vehicle state condition that represents a condition that is set in advance according to a vehicle state, The reception unit further receives the vehicle state, The vehicle states include an autonomous driving mode that indicates that the vehicle is in an autonomous driving state, and a vehicle factory mode that indicates that the vehicle is in a factory and the vehicle is being upgraded or repaired; The arbitration unit is When the vehicle state accepted by the accepting unit is the vehicle factory mode, a process of storing the key data in the storage unit is given priority over a process of storing the execution data in the storage unit; When the vehicle state accepted by the accepting unit is the autonomous driving mode, a process of reading out the execution data from the storage unit is given a higher priority than a process of storing the key data in the storage unit. further adjusting an order in which the plurality of data are stored in the storage unit and an order in which the data are read from the storage unit; The control device according to claim 6.

8. A vehicle comprising the control device according to any one of claims 1 to 7.

9. Accepts data output from multiple applications, Arbitrating an order in which the data output from the applications is stored in the storage unit based on a predetermined condition; the predetermined condition is a vehicle state condition that represents a condition that is set in advance according to a vehicle state, Further accepting the vehicle state; When performing the arbitration, an order in which the received plurality of pieces of data are to be stored in the storage unit is arbitrated based on the received vehicle state and the vehicle state condition. A method of controlling how processing is executed by a computer.

10. Accepts data output from multiple applications, Arbitrating an order in which the data output from the applications is stored in the storage unit based on a predetermined condition; the predetermined condition is a vehicle state condition that represents a condition that is set in advance according to a vehicle state, Further accepting the vehicle state; When performing the arbitration, an order in which the received plurality of pieces of data are to be stored in the storage unit is arbitrated based on the received vehicle state and the vehicle state condition. A control program that causes a computer to execute processing.

11. Accepts data output from multiple applications, Arbitrating an order in which the data output from the applications is stored in the storage unit based on a predetermined condition; The data output from a plurality of applications includes key data for encrypting the data output from the applications and execution data used when executing the applications, When performing the arbitration, arbitration is performed based on the predetermined condition to determine whether the key data or the execution data should be given priority and stored in the storage unit. A method of controlling how processing is executed by a computer.

12. Accepts data output from multiple applications, Arbitrating an order in which the data output from the applications is stored in the storage unit based on a predetermined condition; The data output from a plurality of applications includes key data for encrypting the data output from the applications and execution data used when executing the applications, When performing the arbitration, arbitration is performed based on the predetermined condition to determine whether the key data or the execution data should be given priority and stored in the storage unit. A control program that causes a computer to execute processing.

Images