Vehicle control system and vehicle control method

Abstract

To provide a vehicle control system capable of performing a shadow mode testing to compare output data of multiple pieces of software with heavy loads.SOLUTION: A vehicle control system 1 comprises a calculation unit 11, a comparative criterion data storage unit 13, and a performance / quality evaluation unit 17, where the calculation unit executes the calculation of first control software 101 when a vehicle is in a first state and executes the calculation of second control software 102 when the vehicle is in a second state, the comparative criterion data storage unit stores input data which are inputted into the first control software 101 and the second control software 102 respectively from a sensor 2, and stores output data outputted by the arithmetic operations executed by the first control software 101 and the second control software 102 using the input data as input, and the performance / quality evaluation unit evaluates the performance of the second control software 102 based on the difference between the output data outputted respectively by the first control software 101 and the second control software 102, which are read from the comparative criterion data storage unit 13.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a vehicle control system and a vehicle control method. [Background technology]

[0002] To verify the performance and safety of a program installed in an on-board electronic control unit (ECU), a verification technique called shadow testing or shadow mode testing is effective. Shadow testing or shadow mode testing involves running a program to be verified and checking its output values ​​while the vehicle is running. In verification using shadow testing or shadow mode testing, for example, a verified program is run normally while the program to be verified is run in the background. The output values ​​of the verified program and the program to be verified are then compared to confirm the performance and safety of the program to be verified.

[0003] At this time, the output values ​​of the program being verified are not used to operate actuators such as the accelerator or brake. Therefore, even if a malfunction occurs in the program being verified, it will not affect the operation of the vehicle while it is in motion. As a result, it is possible to evaluate the performance and safety of the program being verified while maintaining driver safety. In addition, in recent years, technology using AI (Artificial Intelligence) has been provided to ECUs to process a variety of input data. AI is capable of performing processing in which the correspondence between input data and output data is not uniquely determined. Therefore, developers need to verify what kind of output data is generated by AI processing performed while the vehicle is in motion.

[0004] Therefore, the techniques described in Patent Documents 1 to 3 for verifying programs including AI and the like are known. Patent Document 1 states, "Based on the deviation between the output variables from real tests on / with a real bench tester or a real roller test stand and the output variables from virtual tests on a virtual bench tester or a virtual roller test stand, it can be estimated whether or not a discriminant function responsive to the test conditions exists. Then, it can be estimated whether or not the control and / or adjustment of the vehicle can be tampered with depending on whether or not the discriminant function exists."

[0005] Patent document 2 also states that "The inspection device automatically creates an inspection scenario including an inspection program for verifying a defect (inspection item) in an on-board device simply by selecting the defect. The inspection device can also write the created inspection scenario to a storage medium."

[0006] Furthermore, Patent Document 3 states that "By comparing the operations that a program driven by a program execution control unit sequentially calls in response to environmental information with the order of operations defined in a behavior verification scenario, it is possible to evaluate or verify a program on its own, without using a simulator or an actual adaptive control device." [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Japanese Patent Application Laid-Open No. 2018-190349 [Patent Document 2] Japanese Patent Application Laid-Open No. 2015-190956 [Patent Document 3] WO 18 / 180143 Summary of the Invention [Problem to be solved by the invention]

[0008] The technology described in Patent Document 1 is primarily used to inspect the software of an automobile's control device when simulating the operation of the automobile, but the process of simulating the behavior of a running automobile requires a computer device with higher performance than an on-board ECU, and therefore the software described in Patent Document 1 cannot be run on an on-board ECU.

[0009] Furthermore, in the technology described in Patent Document 2, an inspection program is executed by an on-board device. When the inspection of the on-board device is completed, the storage medium on which the inspection results are written is removed from the on-board device and connected to an inspection device, allowing a method of dealing with a malfunction of the on-board device to be selected. For this reason, even if this technology is applied to a vehicle that is actually running, addressing the malfunction of the on-board device will be delayed.

[0010] Furthermore, the multiple application programs described in Patent Document 3 include one or more defined actions, one or more action plans, and one or more action verification scenarios, and can be mixed on the same autonomous vehicle. However, the computational processing power of multi-core processors installed in embedded control system products such as automobiles is limited. Due to the constraints on on-board computing resources, it is difficult to run high-load programs such as autonomous driving programs simultaneously on each processor core, and the number of executable programs has been limited.

[0011] The present invention has been made in view of the above circumstances, and has as its object to enable shadow mode testing in which output values ​​of a plurality of control software programs are compared. [Means for solving the problem]

[0012] In order to solve the above problems, for example, the configurations described in the claims are adopted. The present application includes a plurality of means for solving the above-mentioned problems. As an example, the vehicle control system of the present invention includes a calculation unit that executes calculations of first control software when the vehicle is in a first state and executes calculations of second control software when the vehicle is in a second state, input data input from a sensor to the first control software and the second control software, and A The input data is used as input and the output is generated by the operation performed. No. 1 Output data and a storage unit for storing the first control software and a storage unit for storing the first control software; is out I exerted my strength No. 1 The output data, Second output data output by the second control software through the operation executed using the input data as input. an evaluation unit for evaluating the performance of the second control software by comparing the performance of the second control software with the performance of the second control software; input data to the first control software , and the first control software output No. 1 From the output data , the first control software is known to make an erroneous judgment by input data and first output data Selected input data and No. 1 Save the output data to the storage unit Along with Second control software by evaluation unit The performance of evaluation do For should be left in The first control software outputs data to be stored in the storage unit as an important scenario. No. 1 The system includes a selection unit that makes a selection based on the output data, a state determination unit that determines whether the vehicle is in a first state or a second state based on the availability of computational resources on which the computation unit operates, and a change unit that changes the control software that causes the computation unit to execute calculations when the state determination unit determines that there are no available computational resources to first control software, and changes the control software that causes the computation unit to execute calculations when it determines that there are available computational resources to second control software. [Effects of the Invention]

[0013] According to the present invention, shadow mode testing is possible in which the vehicle executes calculations of first control software in a first state, executes calculations of second control software in a second state, and compares the output data obtained to evaluate the performance of the second control software. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is a block diagram showing an example of the overall configuration of a vehicle control system according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a diagram showing an example of state transitions of the vehicle control system according to the first embodiment of the present invention. [Figure 3] FIG. 3 is a diagram showing an example of a data flow in state A of the vehicle control system according to the first embodiment of the present invention. [Figure 4] 5 is a flowchart showing an example of a processing procedure of a comparison reference data selection unit according to the first exemplary embodiment of the present invention. [Figure 5] FIG. 3 is a diagram showing an example of a data flow when determining a state transition in the vehicle control system according to the first embodiment of the present invention. [Figure 6] 5 is a flowchart showing an example of a processing procedure of a state determination unit according to the first embodiment of the present invention. [Figure 7] FIG. 4 is a diagram showing an example of a data flow in state B of the vehicle control system according to the first embodiment of the present invention. [Figure 8] 5 is a flowchart showing an example of a processing procedure of a performance / quality evaluation unit according to the first embodiment of the present invention. [Figure 9] 10 is a flowchart illustrating an example of a processing procedure of an important scenario identification unit according to the first exemplary embodiment of the present invention. [Figure 10] FIG. 10 is a diagram showing an example of the overall configuration of a vehicle control system according to a second embodiment of the present invention. [Figure 11] FIG. 10 is a diagram showing an example of communication data transmitted and received between a vehicle control system according to a second embodiment of the present invention and a cloud server. [Figure 12] FIG. 10 is a diagram showing an example of the overall configuration of a vehicle control system according to a third embodiment of the present invention. [Figure 13]FIG. 10 is a diagram showing an example of state transitions of a vehicle control system according to a third embodiment of the present invention. [Figure 14] FIG. 10 is a diagram showing an example of a data flow in one state (state C) of the vehicle control system according to the third embodiment of the present invention. [Figure 15] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer according to each embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functions or configurations are designated by the same reference numerals, and redundant description will be omitted.

[0016] The vehicle control system according to the present invention is configured such that sensors and actuators are connected to each other. The vehicle control system receives sensor data as input values ​​from the sensors and outputs output values ​​from the vehicle control system to the actuators. However, it should be noted that the present invention is widely applicable to vehicle control systems equipped with control software, regardless of the input source and output destination configuration.

[0017] [First embodiment] 1 is a block diagram showing an example of the overall configuration of a vehicle control system 1 according to a first embodiment. The vehicle control system 1 is a system installed in an autonomously driven vehicle, and multiple electronic control units (ECUs) are connected via a network.

[0018] The vehicle control system 1 is connected to a sensor 2 and an actuator 3 via a bus (BUS). The vehicle control system 1 receives sensor data (e.g., image data) from the sensor 2 (e.g., an imaging sensor) as input to the vehicle control system 1, and sends output data (e.g., control data) of the vehicle control system 1 to the actuator 3.

[0019] The vehicle control system 1 has control software 10, a calculation unit 11, a comparison reference data selection unit 12, a comparison reference data storage unit 13, a state determination unit 14, a processing program modification unit 15, an evaluation software execution instruction unit 16, a performance / quality evaluation unit 17, and an important scenario identification unit 18.

[0020] The control software 10 includes first control software 101 and second control software 102. The first control software 101 is verified software and is executed when the vehicle is in operation. Both the first control software 101 and the second control software 102 have high processing loads and cannot be executed simultaneously by the calculation unit 11. For this reason, the second control software 102 is software to be verified and is executed when the vehicle control system 1 is idle.

[0021] The calculation unit (calculation unit 11) executes calculations of the first control software (first control software 101) when the vehicle is in a first state, and executes calculations of the second control software (second control software 102) when the vehicle is in a second state. Both the first control software 101 and the second control software 102 have high processing loads and cannot be executed simultaneously by the calculation unit 11. However, by changing the control software executed by the calculation unit 11 according to the state of the vehicle, it is possible to verify the operation of the second control software 102 without interfering with the autonomous driving of the vehicle. Therefore, the vehicle control system 1 causes the calculation unit 11 to execute calculations of either the first control software 101 or the second control software 102 in accordance with a processing program change instruction from the processing program change unit 15. FIG. 1 shows the calculation unit 11 executing the second control software 102. In this specification, the first control software 101 and the second control software 102 are used in the same sense as programs.

[0022] Here, an example of state transitions in the vehicle control system 1 will be described. Fig. 2 is a diagram showing an example of state transitions of the vehicle control system 1 according to the first embodiment. The initial node indicated by a black circle in the upper left of Fig. 2 indicates that the driver has turned on the vehicle power and that processing by the vehicle control system 1 has started.

[0023] The vehicle control system 1 has two states: state A and state B. First, an example of internal processing when the vehicle control system 1 is in state A will be described. State A is a state in which the vehicle is performing autonomous driving. An overview of the operation of the vehicle control system 1 in state A is shown in the upper part of FIG.

[0024] In state A, the vehicle control system 1 receives sensor data 20 from the sensor 2, which is input to the vehicle control system 1. Then, the calculation unit 11 executes the first control software 101 and outputs the first control software output data 1010 to the actuator 3. For example, when the first control software 101 receives image data as the sensor data 20, it performs processing to recognize objects reflected in the image and generates control signals necessary for the operation of the vehicle.

[0025] Furthermore, the first control software 101 may use, for example, a sensor fusion function to recognize the lane of the road on which the vehicle is traveling, the positions of other surrounding vehicles, etc., using sensor data 20 obtained from each sensor 2, and generate a control signal to instruct the actuator 3 to accelerate or brake the vehicle. Furthermore, the first control software 101 may determine the lane on which the vehicle is traveling based on the result of image recognition, and generate an operation signal to operate the steering. These signals are output to the actuator 3 as first control software output data 1010.

[0026] The storage unit (comparison reference data storage unit 13) stores input data input from the sensor (sensor 2) to the first control software (first control software 101) and the second control software (second control software 102), respectively, and output data output by the first control software (first control software 101) and the second control software (second control software 102) as a result of calculations performed using the input data as input. For example, the comparison reference data storage unit 13 stores sensor data 20 and first control software output data 1010. Therefore, the comparison reference data storage unit 13 stores a set of input data and output data used by the first control software 101. Storing each piece of data in the comparison reference data storage unit 13 allows the second control software 102 to perform processing similar to that of the first control software 101 after processing by the first control software 101, or allows developers to extract and verify the data.

[0027] Next, an example of internal processing when the vehicle control system 1 is in state B will be described. For example, when the vehicle control system 1 is idle, it transitions from state A to state B. The idle time is determined, for example, when the vehicle control system 1 detects the brake being applied, and when the vehicle stops, it transitions from state A to state B. In addition, when a vehicle traveling on a highway operates in autonomous driving mode, the vehicle control system 1 is assumed to operate in state A, and when a vehicle traveling on a general road requires the driver's operation, the vehicle control system 1 transitions to state B and operates. Furthermore, when the vehicle is stopped in a parking lot and the on-board battery is being charged, the vehicle control system 1 may operate in state B. An overview of the operation of the vehicle control system 1 in state B, to which the vehicle control system 1 transitions from state A, is shown in the lower part of FIG. 2.

[0028] In state B, the calculation unit 11 and the comparison reference data storage unit 13 are used in common with state A. However, in state B, the performance / quality evaluation unit 17 operates.

[0029] The calculation unit 11 receives the sensor data 20 stored in the comparison reference data storage unit 13 and executes the second control software 102. Then, the calculation unit 11 outputs the second control software output data 1020 to the performance / quality evaluation unit 17. Note that in state B, the second control software output data 1020 is not output to the actuator 3, and therefore the actuator 3 is not operated by the second control software output data 1020. For example, when switching from automatic driving to manual driving, the vehicle control system 1 transitions to state B. If the vehicle control system 1 is idle during manual driving, data on the amount of brake depression when the driver depresses the brake is transmitted to the actuator 3, and the brake is applied.

[0030] The evaluation unit (performance / quality evaluation unit 17) compares the output data output by the first control software (first control software 101) and the second control software (second control software 102), respectively, read from the storage unit (comparison reference data storage unit 13), to evaluate the performance of the second control software (second control software 102). For example, the performance / quality evaluation unit 17 performs shadow mode testing by comparing and evaluating the difference between the first control software output data 1010 and the second control software output data 1020 stored in the comparison reference data storage unit 13. The first control software 101 and the second control software 102, which output data to be compared and evaluated by the performance / quality evaluation unit 17, are executed in different states, State A and State B, respectively. This eliminates the need to operate multiple control software programs in parallel in the vehicle control system 1. As a result, the vehicle control system 1 does not require a high-performance ECU that enables simultaneous processing of multiple control software programs.

[0031] Next, an example of processing performed by the vehicle control system 1 will be described with reference to FIGS. FIG. 3 is a diagram showing an example of a data flow in state A of the vehicle control system 1 according to the first embodiment.

[0032] As described above, the vehicle control system 1 receives the sensor data 20 from the sensor 2. The calculation unit 11 receives the sensor data 20 output from the sensor 2 as input data, executes the first control software 101 , and outputs the first control software output data 1010 .

[0033] The selection unit (comparison reference data selection unit 12) selects input data and output data for the evaluation unit (performance / quality evaluation unit 17) to evaluate the second control software (second control software 102) from the input data input to the first control software (first control software 101) and the output data output by the first control software (first control software 101), and stores the selected input data and output data in the storage unit (comparison reference data storage unit 13). Therefore, the selection unit (comparison reference data selection unit 12) selects data to be stored in the storage unit (comparison reference data storage unit 13) as important scenarios for the evaluation unit (performance / quality evaluation unit 17) to evaluate the second control software (second control software 102), based on the output data output by the first control software (first control software 101).

[0034] For example, the comparison reference data selection unit 12 receives the sensor data 20 and the first control software output data 1010 and selects data necessary as verification data for the second control software 102 to be verified. The comparison reference data selection unit 12 then outputs the selected sensor data 21 and the selected first control software output data 1011 to the comparison reference data storage unit 13. Data necessary for verification data includes, for example, data input to the first control software 101. However, storing all of the data output from the sensor 2 as the sensor data 20 requires a huge amount of storage capacity. Therefore, for example, data that is known to cause the first control software 101 to make an erroneous judgment when input to the first control software 101 is selected. An example of this data is an image captured by the sensor 2 of a truck with a picture of a person painted on the rear door of the van body. If the first control software 101 receives such an image as input data and erroneously judges the picture of a person to be a real person, then verification is performed to determine how the second control software 102 would make the judgment.

[0035] In addition, even if the first control software 101 processes an image captured by the sensor 2 in a rainy or backlit environment, it may not be able to correctly detect people, vehicles, etc. that appear in the image. In this case, too, it is verified how the second control software 102 detects an image that the first control software 101 was unable to correctly detect. In this way, by using only a portion of the sensor data 21 selected from the sensor data 20 to verify the operation of the software group possessed by the control software 10, it is possible to reduce the recording capacity of the recording medium for storing the sensor data 20.

[0036] The comparison reference data storage unit 13 internally stores the selected sensor data 21 and the selected first control software output data 1011. Here, the data selected from the sensor data 20 and the first control software output data 1010 stored in the comparison reference data storage unit 13 shown in Fig. 2 become the selected sensor data 21 and the selected first control software output data 1011 described in Fig. 3.

[0037] Next, the details of the processing of the comparison reference data selection unit 12 will be described. 4 is a flowchart showing an example of the processing procedure of the comparison reference data selection unit 12 according to the first embodiment. Each flowchart from FIG. 4 onwards represents an example of the vehicle control method of the vehicle control system 1.

[0038] First, the comparison reference data selection unit 12 receives the sensor data 20 that is input to the first control software 101 and the first control software output data 1010 (S1).

[0039] Next, the comparison reference data selection unit 12 determines whether the sensor data 20 and the first control software output data 1010 received in step S1 should be used in shadow mode testing (S2). If the comparison reference data selection unit 12 determines that these data should be used in shadow mode testing (YES in S2), the sensor data 20 and the first control software output data 1010 are data that should be saved, and so the process proceeds to step S3. Examples of data that can be saved include image data captured in bad weather and image data that has been erroneously detected by the first control software 101.

[0040] In step S3, the comparison reference data selection unit 12 instructs the comparison reference data storage unit 13 to store the sensor data 20 and the first control software output data 1010 received in step S1 (S3), and then ends this process. As a result, the sensor data 20 and the first control software output data 1010 are stored in the comparison reference data storage unit 13.

[0041] On the other hand, if the comparison reference data selection unit 12 determines in step S2 that the data should not be used in the shadow mode testing (NO in S2), the process ends without performing any particular processing. In this case, the sensor data 20 and the first control software output data 1010 received in step S1 are not saved.

[0042] Next, the flow of data when determining the state transition of the vehicle control system 1 will be described. FIG. 5 is a diagram showing an example of a data flow when determining a state transition in the vehicle control system 1 according to the first embodiment.

[0043] The state determination unit (state determination unit 14) determines whether the vehicle is in the first state or the second state based on the availability of computational resources on which the calculation unit (calculation unit 11) operates. Here, the state determination unit (state determination unit 14) determines whether the computational resources on which the calculation unit (calculation unit 11) operates are available based on at least one of the range of provision of the autonomous driving service, whether the vehicle is in charging mode, whether the vehicle is stopped, or load information of the computer installed in the vehicle, and determines whether the evaluation unit (performance / quality evaluation unit 17) can evaluate the second control software (second control software 102). The range of provision of the autonomous driving service refers to a scene in which the vehicle is driving autonomously, for example, when the vehicle is driving on a highway. Furthermore, a vehicle being in charging mode refers to a state in which a charger is connected to a stopped vehicle and an on-board battery (not shown) is being charged. Furthermore, a vehicle being stopped refers to a state in which the vehicle is waiting at a traffic light or temporarily stopped on the shoulder of the road. The computer load information is information obtained by measuring the load on the computer 60 shown in Fig. 15, which will be described later. Since the vehicle state is determined in this manner, the second control software 102 is executed in a state where automatic driving of the vehicle is not hindered.

[0044] Then, the change unit (processing program change unit 15) changes the control software by which the calculation unit (calculation unit 11) executes calculations when the state determination unit (state determination unit 14) determines that there are no available calculation resources to first control software (first control software 101), and changes the control software by which the calculation unit (calculation unit 11) executes calculations when it determines that there are available calculation resources to second control software (second control software 102). The processing program changed by the processing program change unit 15 is either the first control software 101 or the second control software 102.

[0045] In this way, the processing program change unit 15 determines whether to transition from state A to state B, or conversely, from state B to state A, based on the presence or absence of an available time in the vehicle control system 1 determined by the state determination unit 14. Then, the state determination unit 14 generates the available time determination result as state determination result data 140. The state determination result data 140 is data including the state determination result of the data calculated by the calculation unit 11. Software to be executed by the calculation unit 11 is selected after the state of the vehicle is determined, so that even if the vehicle is in state A, the processing of the second control software 102 does not interrupt and cause a disruption to the autonomous driving. Furthermore, even if the processing of the second control software 102 is being performed in state B, if the vehicle is determined to be in state A, the processing of the first control software 101 is quickly restored, and the autonomous driving of the vehicle is not disrupted.

[0046] Next, the processing of the state determination unit 14 will be described in detail. FIG. 6 is a flowchart showing an example of a processing procedure of the state determination unit 14 according to the first embodiment.

[0047] First, the state determination unit 14 acquires (S11) computational resource utilization information of the vehicle control system 1. The computational resource utilization information is, for example, information such as the load rate and memory utilization rate of the computer 60 (see FIG. 15 described later) of the vehicle control system 1.

[0048] Next, the state determination unit 14 determines whether there are sufficient free computational resources in the vehicle control system 1 based on the computational resource usage rate information (S12). If the state determination unit 14 determines that there are not sufficient free computational resources (NO in S12), it outputs state determination result data 140 indicating that the program to be processed by the calculation unit 11 of the vehicle control system 1 is the first control software 101 (S13), and ends this process.

[0049] On the other hand, if the state determination unit 14 determines that there are sufficient free computational resources (YES in S12), it outputs state determination result data 140 indicating that the program to be processed by the calculation unit 11 of the vehicle control system 1 is the second control software 102 (S14), and ends this process. The selected data is used in the processing of the second control software 102, which is executed when there are free computational resources. Therefore, the amount of data required for processing by the second control software 102 is reduced, and less computational resources are consumed than with the first control software 101.

[0050] Thereafter, the processing program change unit 15 shown in FIG. 5 changes the program to be processed by the calculation unit 11 of the vehicle control system 1 to either the first control software 101 or the second control software 102, depending on the contents of the state determination result data 140 generated by the state determination unit 14.

[0051] The execution instruction unit (evaluation software execution instruction unit 16) instructs the calculation unit (calculation unit 11) to execute calculations using the second control software (second control software 102) modified by the modification unit (processing program modification unit 15) and inputting the input data stored as an important scenario in the storage unit (comparison reference data storage unit 13). The execution of calculations by the second control software 102 is not performed immediately after the vehicle switches to state B, but the execution of calculations by the second control software 102 is started upon instruction from the evaluation software execution instruction unit 16. For this reason, the processing of the second control software 102 is not started before post-processing etc. in state A is completed, and unnecessary data used in the processing in state A is not mixed into the processing of the second control software 102.

[0052] When transitioning from state B to state A, the state determination unit 14 also determines whether there are available computational resources, and if there are no available computational resources, the processing program change unit 15 changes the program processed by the calculation unit 11 to the first control software 101. Then, the evaluation software execution instructing unit 16 instructs the start of execution of the calculation of the first control software 101 in state A.

[0053] Next, the flow of data in the vehicle control system 1 in state B will be described. FIG. 7 is a diagram showing an example of a data flow in another state (state B) of the vehicle control system 1 according to the first embodiment.

[0054] The comparison reference data storage unit 13 outputs the selected first control software output data 1011 and the selected sensor data 21 stored therein as shown in FIG.

[0055] When the calculation unit 11 receives the selected sensor data 21, it executes and processes the second control software 102. Then, the second control software 102 outputs second control software output data 1020.

[0056] The performance and quality evaluation unit 17 receives the selected first control software output data 1011 and second control software output data 1020, evaluates the performance and quality of both data and each control software that outputs both data, and outputs evaluation result data 170. Here, performance and quality refer to, for example, the functionality of the first control software 101 and the second control software 102 and the validity of the output results. The functionality of the first control software 101 and the second control software 102 refers to the function itself of each software, such as an object detection function or a trajectory generation function for an autonomous vehicle. The performance and quality evaluation unit 17 then evaluates whether the executed function of each software satisfies the required function. For example, the object detection function is evaluated as to whether objects such as people and signs can be correctly detected, and the trajectory generation function is evaluated as to whether a trajectory can be correctly generated so that the vehicle travels on the roadway rather than the sidewalk. The validity of the output result refers to the result of an evaluation by the performance and quality evaluation unit 17 of whether the intended output result was obtained by executing the software. The data and the performance and quality of the control software evaluated by the performance / quality evaluation unit 17 are collectively referred to as "performance evaluation."

[0057] The important scenario identification unit (important scenario identification unit 18) receives the evaluation results from the evaluation unit (performance / quality evaluation unit 17), the input data and output data selected by the selection unit (comparison reference data selection unit 12), and the output data output by the second control software (second control software 102). Based on the evaluation results, the important scenario identification unit 18 identifies data to be stored in the storage unit (comparison reference data storage unit 13) as important scenarios. For example, the important scenario identification unit 18 receives the selected sensor data 21, the selected first control software output data 1011, the selected second control software output data 1020, and the evaluation result data 170. The important scenario identification unit 18 then determines whether each piece of data is important based on the content of each piece of data received. Here, a scenario refers to a pattern of input data and output data input to each piece of software. An important scenario that a developer wants to keep for later verification is also called an "important scenario." Identifying important scenarios eliminates the need to store a huge amount of input and output data in the comparison reference data storage unit 13, thereby preventing storage capacity from becoming overwhelmed.

[0058] Then, the important scenario identification unit (important scenario identification unit 18) identifies an important scenario that includes the output data of the first control software (first control software 101) and the output data of the second control software (second control software 102), for which the evaluation results are evaluated as inconsistent. By using the identified important scenario, the important scenario identification unit 18 can easily compare the differences that have occurred in the output data of the first control software 101 and the second control software 102. For example, the important scenario identification unit 18 checks whether the performance of the second control software 102 has improved compared to the first control software 101. If the performance has not improved, the important scenario identification unit 18 discards the selected sensor data 21, the selected first control software output data 1011, and the selected second control software output data 1020. In this case, the newly developed second control software 102 is distributed to the vehicle, and the calculations of this second control software 102 are executed.

[0059] Furthermore, a developer of the vehicle control system 1 may wish to directly check the contents of the data regardless of the evaluation results. Furthermore, depending on the AI ​​control software that performs the calculation process, different decisions may be made on the same input data (e.g., image data), resulting in different output data being output. Such input and output data are data that developers would like to use in developing the control software. In this case, the important scenario identification unit 18 may also retain the input data to the second control software 102 that was used when the performance and quality evaluation unit 17 evaluated the performance of the second control software 102.

[0060] Next, the processing of the performance / quality evaluation unit 17 will be described in detail. FIG. 8 is a flowchart showing an example of the processing procedure of the performance / quality evaluation unit 17 according to the first embodiment.

[0061] First, the performance / quality evaluation unit 17 receives the selected first control software output data 1011 (S21), and then receives the second control software output data 1020 (S22).

[0062] Next, the performance / quality evaluation unit 17 compares the selected first control software output data 1011 with the second control software output data 1020, evaluates the comparison result, and generates evaluation result data 170 (S23).The performance / quality evaluation unit 17 then outputs the evaluation result data 170 (S24), and ends this process.

[0063] For example, assume that when a truck approaches the host vehicle from the front, the first control software 101, which has the function of detecting objects from an image, can recognize the truck from the image and the position where the sensor 2 is installed. Furthermore, if the second control software 102, using the image used by the first control software 101 to identify the vehicle as an input, recognizes the vehicle approaching from the front as a truck, just like the first control software 101, the performance / quality evaluation unit 17 can determine that the evaluation of the object detection function of the second control software 102 is good or that the performance of the object detection function has not deteriorated. However, there is a possibility that the first control software 101 and the second control software 102 may recognize the size of the vehicle differently from the image. In this case, if the first control software 101 mistakenly recognizes the vehicle as a wagon and the second control software 102 correctly recognizes the vehicle as a truck, the performance / quality evaluation unit 17 can evaluate that the performance of the object detection function of the second control software 102 has improved.

[0064] Next, the details of the processing of the important scenario identification unit 18 shown in FIG. 1 will be described. FIG. 9 is a flowchart showing an example of the processing procedure of the important scenario identification unit 18 according to the first embodiment.

[0065] First, the important scenario identification unit 18 receives the selected sensor data 21, the selected first control software output data 1011, and the selected second control software output data 1020 (S31).

[0066] Next, the important scenario identification unit 18 receives the evaluation result data 170 (S32). Next, the important scenario identification unit 18 determines whether or not each piece of received data is important based on the evaluation result data 170 (S33).

[0067] If the important scenario identification unit 18 determines that the received data is important data (YES in S33), it stores each piece of data in the vehicle control system 1 (S34) and terminates this processing. The data stored in the vehicle control system 1 includes the selected sensor data 21, the selected first control software output data 1011, and the selected second control software output data 1020, as well as evaluation result data 170. The data stored in the vehicle control system 1 is copied to a portable storage medium such as a USB memory, for example, and used by developers to verify the contents of the data or to develop new software.

[0068] On the other hand, if the important scenario identification unit 18 determines that the received data is not important (NO in S33), it does not store each piece of data in the vehicle control system 1 and ends this processing.

[0069] In the vehicle control system 1 according to the first embodiment described above, the control software groups of the control software 10 process the same selected sensor data 21 at different times. Here, the comparison reference data storage unit 13 stores only specific data as sensor data 20, rather than all input data from the sensor 2. The data stored by the vehicle control system 1 is the timing when the control software groups to be compared in the performance / quality evaluation unit 17 calculate output data or when a specific operation is performed by the driver. The performance / quality evaluation unit 17 then executes the second control software 102 for verification using the sensor data 20 stored in the comparison reference data storage unit 13 at a time different from the timing when the output value is calculated or the timing when the specific operation is performed, and compares the second control software output data 1020 with the first control software output data 1010. Therefore, the vehicle control system 1 does not require a high-performance ECU. Furthermore, the vehicle control system 1 is capable of shadow mode testing even for high-load programs.

[0070] Furthermore, not only is the second control software 102 operated when simulating the operation of the vehicle, but the second control software 102 is also operated in the background using input data obtained from the actual vehicle. This allows the second control software 102 to be verified without compromising the safety of the actual vehicle while it is running.

[0071] The second control software 102 may be software with a different AI learning model from that of the first control software 101 or software capable of reducing the CPU load. Alternatively, software that corrects errors contained in the first control software 101 that is already in operation may be verified as the second control software 102. Since such verification is performed in the vehicle control system 1 mounted on an actual vehicle, where unexpected data is likely to be input, the performance and quality evaluation unit 17 can verify the quality of the second control software 102 using various variations of input data (sensor data 20). For example, if the CPU load rate of the first control software 101 is 80% and the CPU load rate of the second control software 102 is 70%, the developer may consider using the software used as the second control software 102 as the first control software 101.

[0072] Furthermore, if second control software output data 1020 of similar quality to the first control software output data 1010 can be obtained even when second control software 102 with a lighter processing load than the first control software 101 used in the vehicle control system 1 is used, it is possible to replace the software used as the second control software 102 with the first control software 101 executed during autonomous driving. By replacing the first control software 101 with software with a lighter processing load in this way, it is possible to reduce the computational processing during autonomous driving, which involves a huge amount of calculation, and the consumption of computational resources.

[0073] [Modification of the first embodiment] Here, when the first control software (first control software 101) is running and it is determined that there is an error in the output result of the first control software (first control software 101), the important scenario identification unit (important scenario identification unit 18) stores the data identified as the important scenario in the storage unit (comparison reference data storage unit 13). Therefore, when the processing result of the first control software 101, which should normally be normal, is abnormal, the developer can verify the data identified as the important scenario and the processing content of the first control software 101.

[0074] Therefore, when the selection unit (comparison standard data selection unit 12) finds a discrepancy between the result obtained by performing sensor fusion processing to combine multiple input data input from multiple types of sensors (sensor 2) and the output data output by the first control software (first control software 101) after performing a calculation, it determines that there is an error in the output result of the first control software (first control software 101). For example, image recognition software alone may not be able to determine whether an image recognition result is a false positive. Sensor fusion is a technology for determining image recognition results using information obtained from multiple different sensors. For example, when a LiDAR (Light Detection and Ranging) sensor is used, it is assumed that whether a person is standing in front of the vehicle can be determined using image data captured and output by a camera or point cloud data output from the LiDAR. Here, if a person is recognized as standing based on image data output from the camera but not based on point cloud data obtained from the LiDAR, then either the image data or the point cloud data, or both, are incorrectly recognized. On the other hand, if the second control software 102 can recognize that a person is standing based on either the image data or the point cloud data, then the second control software 102 correctly recognized the person. Therefore, if the first control software 101 does not have the function of detecting objects using sensor fusion, the comparison reference data selection unit 12 can determine whether the output result of the first control software 101 is incorrect by acquiring the evaluation result data 170 and the second control software output data 1020. By using the sensor fusion technique in this way, it is possible to determine whether the output result of the first control software 101 is correct or incorrect based on the recognition results of data obtained from a plurality of sensors.

[0075] If a mismatch occurs between the output of the first control software 101 and the output of the second control software 102 due to sensor fusion during autonomous driving, the vehicle is controlled to take a safer action (for example, stop the vehicle) by assuming that there is a person standing in front of the vehicle. However, if there is actually no person standing in front of the vehicle, the first control software 101 or the second control software 102 that recognized that there is a person standing must be tested again.

[0076] In addition, if the selection unit (comparison standard data selection unit 12) finds a discrepancy between the vehicle's driving log acquired by the vehicle and the output data output by the first control software (first control software 101) after performing a calculation, it determines that there is an error in the output result of the first control software (first control software 101). The vehicle control system 1 constantly acquires the vehicle's position by using a GPS (Global Positioning System) navigation system, calculations based on the number of tire rotations, etc., and stores the vehicle's driving log. If the first control software 101 has a function for calculating a vehicle trajectory plan, the comparison reference data selection unit 12 compares the vehicle trajectory plan calculated by the first control software 101 with the actual driving log. If the vehicle trajectory plan deviates from the actual driving log, the comparison reference data selection unit 12 determines that there is an error in the trajectory plan, i.e., the output data of the first control software 101.

[0077] In addition, if the selection unit (comparison standard data selection unit 12) finds a discrepancy between the map data held by the vehicle and the output data output by the first control software (first control software 101) after performing a calculation, it determines that there is an error in the output result of the first control software (first control software 101). As described above, the vehicle position calculated by the first control software 101 may indicate that the vehicle is traveling on a location other than a road, even though the vehicle position acquired by the vehicle control system 1 indicates that the vehicle is traveling on a road. In this case, the comparison reference data selection unit 12 determines that there is an error in the vehicle position calculated by the first control software 101, i.e., the output data of the first control software 101, relative to the map data.

[0078] [Second embodiment] Next, a vehicle control system and method according to a second embodiment of the present invention will be described. The vehicle control system according to the second embodiment differs from the first embodiment in that the vehicle control system 1 is connected to a cloud server via an external vehicle network. As a result, the functions, processes, and data storage that were performed within the vehicle control system 1 in the first embodiment are instead processed by the cloud server. Note that the same components as those in the first embodiment are denoted by the same reference numerals, and their description will be omitted.

[0079] FIG. 10 is a diagram showing an example of the overall configuration of a vehicle control system 1 according to the second embodiment. The vehicle control system 1 is connected to the cloud server 4 via an external vehicle network N. With this configuration, for example, it becomes possible to distribute the second control software 102 to be verified from the cloud server 4 to the vehicle control system 1 using an OTA (Over The Air) function. The second control software 102 received by the vehicle control system 1 from the cloud server 4 is stored in the control software 10.

[0080] The calculation unit (calculation unit 11) executes the calculation of the second control software (second control software 102) received from the cloud server (cloud server 4) via the network (external vehicle network N), and transmits to the cloud server (cloud server 4) the evaluation results by the evaluation unit (performance / quality evaluation unit 17) that have been identified as important scenarios by the important scenario identification unit (important scenario identification unit 18), the input data and output data selected by the selection unit (comparison standard data selection unit 12), and the output data by the second control software (second control software 102).

[0081] The vehicle control system 1 may discard the second control software 102 after the operation verification has been completed. Therefore, by not storing the second control software 102 in the vehicle control system 1, it is possible to reduce the computational resources of the vehicle control system 1. Furthermore, the cloud server 4 can provide new software to vehicles after they have been shipped from the vehicle manufacturer, facilitating software upgrades and vehicle function improvements.

[0082] FIG. 11 is a diagram showing an example of communication data transmitted and received between the vehicle control system 1 and the cloud server 4 according to the second embodiment.

[0083] The second control software 102 is delivered as a program to be verified by shadow mode testing from the cloud server 4 to the vehicle control system 1. Therefore, it is different from the first embodiment in that it is not necessary to store the program to be verified in advance in the vehicle control system 1.

[0084] Furthermore, the vehicle control system 1 transmits the post-selection sensor data 21, the post-selection first control software output data 1011, the post-selection second control software output data 1020, and the evaluation result data 170 to the cloud server 4. This makes it possible to perform performance and quality evaluation similar to that performed by the performance and quality evaluation unit 17, for example, within the cloud server 4. It is also possible to compare the evaluation results processed by the cloud server 4 using the data received from the vehicle control system 1 with the evaluation result data 170 received from the vehicle control system 1. It is also possible to perform processing similar to that performed by the important scenario identification unit 18 within the cloud server 4. As a result, this differs from the first embodiment in that it is possible to simplify the processing within the vehicle control system 1.

[0085] In the vehicle control system 1 according to the second embodiment described above, there is no need to store the second control software 102 in advance, and the second control software 102 is distributed from the cloud server 4 at the timing when verification is desired. Therefore, the vehicle control system 1 can be verified using the latest second control software 102.

[0086] Furthermore, each piece of data used in the vehicle control system 1 is transmitted to the cloud server 4. The cloud server 4 can then use each piece of received data to perform processing such as performance and quality evaluation. This allows the vehicle control system 1 to be configured without the performance and quality evaluation unit 17 and the important scenario identification unit 18.

[0087] Furthermore, the vehicle control system 1 can store the trained program downloaded from the cloud server 4 in the control software 10 as second control software 102 and evaluate the performance of this second control software 102. This trained program is, for example, a program created by AI. Therefore, the cloud server 4 can verify the safety of the trained program in the vehicle control systems 1 installed in many vehicles and obtain verification results corresponding to various driving scenarios. If the accuracy of the output results of the second control software 102 is lower than that of the first control software 101, the developer can decide not to use the second control software 102 or to modify it.

[0088] It is preferable that even input and output data determined to contain an error in the output result of the first control software 101 be stored in the comparison reference data storage unit 13. Such data is later uploaded from the comparison reference data storage unit 13 to the cloud server 4, allowing the developer to obtain the input and output data and verify its contents. Furthermore, if it is determined that there is an error in the output result of the first control software 101, this can be useful for the developer in developing software that improves the functions of the first control software 101. For this reason, it is preferable that the cloud server 4 collects the first control software output data 1010 from a large number of vehicles and the evaluation result data 170 of the second control software 102 that accompanies this output data.

[0089] Then, the developer verifies each piece of data stored in the cloud server 4, and delivers control software that has improved the defects in the first control software 101 to the vehicle as second control software 102, and the performance of the second control software 102 can be verified again using shadow mode testing.

[0090] [Third embodiment] Next, a vehicle control system and method according to a third embodiment of the present invention will be described. The vehicle control system according to the third embodiment differs from the first embodiment in that the vehicle control system 1 is connected to the driver operation sensor 5 via a bus.

[0091] FIG. 12 is a diagram showing an example of the overall configuration of a vehicle control system 1 according to the third embodiment. As described above, the vehicle control system 1 is connected to the driver operation sensor 5 . The driver operation sensor 5 detects the operation of the driver who drives the vehicle and outputs an operation signal to the vehicle control system 1. The driver's operation includes, for example, steering wheel operation and brake depression by the driver, and the driver's operation amount includes operation amounts such as steering wheel operation angle and brake depression amount.

[0092] As described above, in the vehicle control system 1 according to the first embodiment, the actuator 3 is operated using the first control software output data 1010. On the other hand, in the configuration of the vehicle control system 1 according to the third embodiment, the amount of operation performed by the driver is obtained via the driver operation sensor 5 and transmitted to the actuator 3. In this way, the process for operating the actuator 3 by autonomous driving according to the first embodiment is replaced by the process by driver operation according to the third embodiment, and the vehicle is controlled.

[0093] Therefore, the evaluation unit (performance / quality evaluation unit 17) compares driver operation data input while the vehicle is traveling with output data output by a calculation performed using input data input from a sensor (sensor 2) to the second control software (second control software 102), thereby evaluating the performance of the second control software (second control software 102). Therefore, the vehicle control system 1 according to the third embodiment replaces the processing using the first control software output data 1011 and the second control software output data 1020 selected by the performance / quality evaluation unit 17 according to the first embodiment with the driver operation amount obtained via the driver operation sensor 5 and the second control software output data 1020 as comparison reference data for shadow mode testing. The output data of the first control software 101 according to the first embodiment does not need to be used for the operation of the actuator 3, and vehicle driving is controlled based on the steering operation and brake depression amount by the driver, which are output data from the driver operation sensor 5.

[0094] 13 is a diagram showing an example of state transition of the vehicle control system 1 according to the third embodiment. Here, it is assumed that the vehicle control system 1 has transitioned to state C.

[0095] In the calculation unit 11 of the vehicle control system 1, the second control software 102 is calculated using the output value of the sensor 2. When the vehicle control system 1 transitions to state C, the performance / quality evaluation unit 17 directly receives the driver operation data 50, which is the output value of the driver operation sensor 5. The performance / quality evaluation unit 17 also receives the second control software output data 1020 calculated by the calculation unit 11 using the second control software 102. This performance / quality evaluation unit 17 differs from the first embodiment in that it evaluates the performance and quality of the second control software 102 and is capable of performing shadow mode testing.

[0096] FIG. 14 is a diagram showing an example of a data flow in one state (state C) of the vehicle control system 1 according to the third embodiment.

[0097] As described above, the driver operation sensor 5 outputs the amount of operation by the driver, such as the amount of steering wheel operation or the amount of brake pedal depression, as the driver operation data 50. On the other hand, the sensor 2 outputs the sensing result as the sensor data 20.

[0098] The calculation unit 11 performs calculation processing on the second control software 102 based on the received sensor data 20, and outputs second control software output data 1020. The performance / quality evaluation unit 17 receives the driver operation data 50 and the second control software output data 1020. Then, the performance / quality evaluation unit 17 evaluates the performance and quality of the second control software 102 based on the comparison result of both data, and outputs evaluation result data 170.

[0099] The important scenario identification unit 18 receives the driver operation data 50, the sensor data 20, the second control software output data 1020, and the evaluation result data 170, and identifies an important scenario based on the contents of the evaluation result data 170. As described above, the performance / quality evaluation unit 17 differs from the first embodiment in that it can evaluate the performance and quality of the second control software 102 by using the driver operation data 50 instead of the first control software 101.

[0100] In the vehicle control system 1 according to the third embodiment described above, the driver operation data 50 is used instead of the first control software 101 to evaluate the performance and quality of the second control software 102, which is calculated while the vehicle is traveling. In this way, the vehicle control system 1 is able to perform shadow mode testing while the vehicle is traveling (state C).

[0101] For example, while the driver of the vehicle is performing driving operations, the vehicle control system 1 sets the vehicle state to state C and executes the second control software 102 in the background. Then, the performance / quality evaluation unit 17 compares and evaluates in real time the driver operation data 50 obtained by the driver's driving with the second control software output data 1020 output by the second control software 102. For this reason, the performance / quality evaluation unit 17 can evaluate the performance and quality of the second control software 102 by checking the degree of agreement between the vehicle trajectory when, for example, the driver, while driving the vehicle, spots a fallen object or the like ahead and coasts, and the vehicle trajectory generated by the second control software 102 after recognizing an image.

[0102] <Computer hardware configuration> Next, the hardware configuration of the computer 60 that constitutes the vehicle control system 1 will be described. 15 is a block diagram showing an example of the hardware configuration of the calculator 60. The calculator 60 is an example of hardware used as a computer that can operate as the vehicle control system 1 according to this embodiment.

[0103] The computer 60 includes a CPU (Central Processing Unit) 61, a ROM (Read Only Memory) 62, and a RAM (Random Access Memory) 63, each connected to a bus 64. The computer 60 further includes a non-volatile storage 65 and a network interface 66.

[0104] The CPU 61 reads out program code of software that realizes each function according to this embodiment from the ROM 62, loads it into the RAM 63, and executes it. Variables, parameters, etc. generated during the calculation process of the CPU 61 are temporarily written to the RAM 63, and these variables, parameters, etc. are read out by the CPU 61 as appropriate. However, an MPU (Micro Processing Unit) may be used instead of the CPU 61. The functions of the calculation unit 11, comparison reference data selection unit 12, etc. shown in FIG. 1 etc. are realized by the CPU 61.

[0105] The nonvolatile storage 65 may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a flexible disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, or a nonvolatile memory. This nonvolatile storage 65 stores an operating system (OS), various parameters, and programs for operating the computer 60. The ROM 62 and nonvolatile storage 65 store programs, data, and the like required for the CPU 61 to operate, and are used as examples of computer-readable, non-transitory storage media that store programs executed by the computer 60. The control software 10 and comparison reference data storage unit 13 shown in FIG. 1 and other figures are configured in the nonvolatile storage 65.

[0106] The network interface 66 may be, for example, a network interface card (NIC), and various data may be transmitted and received between devices via a local area network (LAN) or dedicated line connected to the terminal of the NIC. For example, interfaces with the sensors 2 and actuators 3 and communication with the cloud server 4 are performed through the network interface 66. Furthermore, communication between the vehicle control system 1 and the sensors 2 and actuators 3 is performed, for example, via a controller area network (CAN).

[0107] The present invention is not limited to the above-described embodiments, and it goes without saying that various other applications and modifications are possible without departing from the gist of the claims. For example, the above-described embodiments have described the configuration of the device and system in detail and specifically in order to clearly explain the present invention, and are not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of the embodiments described here with the configuration of other embodiments, and it is also possible to add the configuration of one embodiment to the configuration of another embodiment. Furthermore, it is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations. In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0108] 1...vehicle control system, 2...sensor, 3...actuator, 10...control software, 11...calculation unit, 12...comparison reference data selection unit, 13...comparison reference data storage unit, 14...state judgment unit, 15...processing program modification unit, 16...evaluation software execution instruction unit, 17...performance / quality evaluation unit, 18...important scenario identification unit, 20...sensor data, 21...sensor data after selection, 101...first control software, 102...second control software, 140...state judgment result data, 170...evaluation result data, 1010...first control software output data, 1011...first control software output data after selection, 1020...second control software output data

Claims

1. a calculation unit that executes calculations of first control software when the vehicle is in a first state and executes calculations of second control software when the vehicle is in a second state; a storage unit that stores input data input from a sensor to the first control software and the second control software, and first output data output by the first control software through an operation performed using the input data as input; an evaluation unit that compares the first output data output by the first control software, which is read from the storage unit, with second output data output by the second control software through an operation executed by using the input data as input, to evaluate performance of the second control software; a selection unit that selects, from the input data input to the first control software and the first output data output by the first control software, the input data and the first output data that are known to cause an erroneous judgment by the first control software, in order for the evaluation unit to evaluate the performance of the second control software, and stores the selected input data and the first output data in the storage unit, and also selects, based on the first output data output by the first control software, data to be stored in the storage unit as an important scenario that should be retained in order for the evaluation unit to evaluate the performance of the second control software; a state determination unit that determines whether the vehicle is in the first state or the second state based on availability of computational resources on which the calculation unit operates; a change unit that sets the control software by which the arithmetic unit executes calculations to the first control software when it is determined by the state determination unit that there is no available computational resource, and changes the control software by which the arithmetic unit executes calculations to the second control software when it is determined that there is available computational resource. Vehicle control system.

2. an execution instruction unit that uses the second control software changed by the change unit to instruct the calculation unit to execute calculations using the input data stored in the storage unit as the important scenario as an input; The vehicle control system of claim 1 .

3. an important scenario identification unit that receives the evaluation result by the evaluation unit, the input data and the first output data selected by the selection unit, and the second output data output by the second control software, and identifies data to be stored in the storage unit as an important scenario based on the evaluation result; The vehicle control system of claim 1 .

4. The important scenario identification unit identifies the important scenario including the first output data of the first control software and the second output data of the second control software, for which the evaluation result is evaluated as being inconsistent. The vehicle control system according to claim 3 .

5. The important scenario identification unit stores data identified as the important scenario in the storage unit when the first control software is running and it is determined that there is an error in the output result of the first control software. The vehicle control system according to claim 3 .

6. When the selection unit finds a discrepancy between a result obtained by performing a sensor fusion process to combine the plurality of pieces of input data input from the plurality of types of sensors and the first output data output by the first control software after executing a calculation, the selection unit determines that there is an error in the output result of the first control software. The vehicle control system according to claim 5 .

7. When the selection unit finds a discrepancy between the vehicle travel log acquired by the vehicle and the first output data output by the first control software after executing a calculation, the selection unit determines that there is an error in the output result of the first control software. The vehicle control system according to claim 5 .

8. When the selection unit finds a mismatch between the map data held by the vehicle and the first output data output by the first control software after executing a calculation, the selection unit determines that there is an error in the output result of the first control software. The vehicle control system according to claim 5 .

9. The state determination unit determines whether or not there are available computational resources for the operation unit to operate based on at least one of the range of provision of an autonomous driving service, whether the vehicle is in a charging mode, whether the vehicle is stopped, or load information of a computer installed in the vehicle, and determines whether the evaluation unit is able to evaluate the second control software. The vehicle control system of claim 1 .

10. The calculation unit executes the calculation of the second control software received from the cloud server via a network, and transmits to the cloud server the evaluation result by the evaluation unit that has been identified as the important scenario by the important scenario identification unit, the input data and the first output data selected by the selection unit, and the second output data by the second control software. The vehicle control system according to claim 3 .

11. a process of executing, by a calculation unit, a calculation of first control software when the vehicle is in a first state, and executing, by a calculation unit, a calculation of second control software when the vehicle is in a second state; a process of storing, in a storage unit, input data input from a sensor to the first control software and the second control software, and first output data output by the first control software through an operation performed using the input data as input; a process of evaluating the performance of the second control software by an evaluation unit by comparing the first output data output by the first control software, which is read from the storage unit, with second output data output by the second control software through an operation executed using the input data as input; a process in which, in order for the evaluation unit to evaluate the performance of the second control software, a selection unit selects, from the input data input to the first control software and the first output data output by the first control software, the input data and the first output data that are known to cause an erroneous judgment by the first control software, and stores the selected input data and the first output data in the storage unit; a process of selecting, by the selection unit, data to be stored in the storage unit as an important scenario to be retained in order for the evaluation unit to evaluate the performance of the second control software, based on the first output data output by the first control software; a process of determining, by a state determination unit, whether the vehicle is in the first state or the second state based on availability of computational resources on which the calculation unit operates; a process of changing the control software by which the arithmetic unit executes calculations to the first control software when it is determined by the state determination unit that there is no available computational resource, and changing the control software by which the arithmetic unit executes calculations to the second control software when it is determined that there is available computational resource. Vehicle control method.

Images