Control device, control method, and program

Abstract

To suppress execution of processing performed in cooperation between a plurality of control devices in a state where software inconsistency has occurred.SOLUTION: When an electric vehicle enters an IG ON state, a representative ECU and a cooperative ECU start up, and when there is a software update, a startup storage area is switched in each ECU. Startup check processing is started in the representative ECU and the cooperative ECU, version information is transmitted from the cooperative ECU, and a version check is performed by the representative ECU. A startup signal is transmitted from the representative ECU, and normal processing is started based on the version check and the startup signal in the representative ECU and the cooperative ECU. When the representative ECU receives the version information from the cooperative ECU after starting the normal processing, the representative ECU transmits an abnormal signal and stops system processing.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to a control device that constitutes a vehicle system, a control method thereof, and a program for executing the control method. [Background technology]

[0002] A vehicle is equipped with an on-board system that includes multiple actuators and multiple control devices that control each of the actuators. Each of the multiple control devices is equipped with software, and each of the multiple control devices executes the software to control the actuators, thereby realizing various vehicle functions. After a vehicle is released to the market, the software is updated by receiving an update program, for example, via OTA (Over The Air). This allows the vehicle's functions to be modified or added. For example, modifying or adding functions that are performed in cooperation between multiple control devices, such as various driving assistance systems such as autonomous driving, requires updating the software of all applicable control devices, and it is also necessary to confirm that the updates have been performed appropriately in each control device.

[0003] For example, Japanese Patent Application Laid-Open Publication No. 2019-159399 (Patent Document 1) discloses a technology in which, when the vehicle's power is turned on, a specific onboard device, which is one of multiple onboard devices, acquires the software version held by the other onboard devices, compares its own software version with the acquired software version, and determines the consistency of the software versions. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2019-159399 Summary of the Invention [Problem to be solved by the invention]

[0005] The updated software may be executed the next time the in-vehicle system is started, for example, to switch over from the pre-update software to multiple ECUs simultaneously. In this case, whether the software update was performed properly will also be confirmed the next time the in-vehicle system is started.

[0006] However, if some of the control devices restart due to a malfunction such as a power outage before the next startup of the in-vehicle system, the updated software will be executed only in the restarted control devices. In this case, software inconsistencies such as version mismatches will occur between the multiple control devices, at least until the next startup of the in-vehicle system. If software inconsistencies occur, it may be impossible to properly execute processes that are coordinated between the multiple control devices.

[0007] The present disclosure has been made to solve the above-mentioned problem, and the purpose of the present disclosure is to suppress the execution of processing that is performed in cooperation between multiple control devices when a software inconsistency occurs. [Means for solving the problem]

[0008] (1) A control device according to an aspect of the present disclosure is a control device constituting a system of a vehicle, and includes a storage unit that stores first software for executing predetermined processing, and a control unit that executes the first software. The predetermined processing includes a first processing that implements a first function of the vehicle in cooperation with another control device constituting the system of the vehicle. The control device and the other control device are configured to update the software at startup if a software update is available. When starting up the control device, before executing the first software, the control unit receives information about second software, including a program for executing the first processing stored in the other control device, from the other control device, and executes a startup check process that includes a confirmation process for confirming consistency between the first software and the second software. If the control unit receives information about the second software from the other control device after starting execution of the first software, the control unit stops or prohibits execution of the first processing.

[0009] According to the above configuration, the control device performs a startup check process upon startup and checks the consistency between the first software and the second software through the check process. The control device and the other control device are configured to update their software upon startup if a software update is available. Therefore, if the consistency is confirmed through the startup check process, it can be said that the software consistency is maintained as long as the control device is running. However, if information regarding the second software is received from the other control device after the first software has started to run, it is assumed that the other control device has restarted. The restart may result in the other device updating the second software. In other words, the first software and the second software may not be consistent. If the control unit receives information regarding the second software from the other control device after the first software has started to run, it stops or prohibits execution of the first process. If the first process is currently running, the first process is stopped, and if the first process is not currently running, the first process is not executed thereafter. This prevents the first process from being executed when the first software and the second software are inconsistent.

[0010] (2) In one embodiment, the information about the second software is version information of the second software. In the startup check process, the control unit checks the compatibility based on a combination of the version of the first software and the version of the second software.

[0011] According to the above configuration, software consistency is confirmed based on the software version, so that software consistency can be confirmed with high accuracy.

[0012] (3) In one embodiment, the control unit allows the execution of the first process if the result of the confirmation process is consistent, and does not allow the execution of the first process if the result of the confirmation process is inconsistent.

[0013] According to the above configuration, it is possible to prevent the first process from being executed in a state where an inconsistency occurs in the software versions.

[0014] (4) In one embodiment, if the control unit does not receive information about the second software within a predetermined time from the start of the startup check process, the control unit does not allow the first process to be executed.

[0015] If information about the second software is not received within a predetermined time after the start of the startup check process, it is assumed that some kind of abnormality has occurred in the system. In this case, by disallowing execution of the first process, it is possible to prevent the first process from being executed in an abnormal state.

[0016] (5) In one embodiment, the control unit transmits a signal including information indicating the result of the confirmation process to the other control device during the startup check process.

[0017] For example, the other control device determines whether or not the first process can be executed based on information indicating the result of the confirmation process from the control device. A signal including information indicating the result of the confirmation process is transmitted from the control device to the other control device, allowing the other control device to determine whether or not the first process can be executed.

[0018] (6) In one embodiment, the predetermined process further includes a second process in which the control device independently realizes a second function of the vehicle. If the result of the confirmation process is a match, the control unit permits execution of the first process and the second process, if the result of the confirmation process is a mismatch, the control unit disallows execution of the first process and permits execution of the second process, and if information about the second software is not received within a certain time period after starting the startup check process, the control unit disallows execution of the first process and the second process.

[0019] According to the above configuration, if the result of the confirmation process is inconsistent, the first process that cooperates with other control devices is disallowed, while the second process that is performed by the control device alone is permitted. Even if the result of the confirmation process is inconsistent, the execution of the second process, which can be performed, is permitted, thereby preventing excessive restrictions on the execution of processes. Furthermore, if it is anticipated that an abnormality will occur in the system, such as the failure to receive information about the second software within a certain time after the start of the startup check process, the first process and the second process are disallowed, thereby preventing the execution of inappropriate processes.

[0020] (7) A control device according to another aspect of the present disclosure is a control device constituting a vehicle system, and includes a storage unit that stores software for executing predetermined processing and a control unit that executes the software. The predetermined processing includes a first processing that realizes a vehicle function in cooperation with another control device installed in the vehicle. The control device and the other control device are configured to update the software at startup if a software update is available. The control unit performs a startup check processing at startup of the control device before executing the software. In the startup check processing, the control unit transmits information about the software to the other control device, receives a first signal indicating the result of a verification processing performed by the other control device using the information about the software to verify software consistency between the control device and the other control device, and determines whether to execute the first processing based on the first signal. If the control unit receives a second signal from the other control device indicating a possibility of software inconsistency between the control device and the other control device after the software has started to be executed, the control unit stops or does not permit execution of the first processing.

[0021] According to the above configuration, the control unit of the control device executes a startup check process at startup, transmits information about the software to the other control device, and receives a first signal indicating the result of the confirmation process from the other control device in response. The control unit then checks the consistency with the software based on the first signal and can appropriately determine whether or not to execute the first process. After the software execution has started, if the control unit receives a second signal from the other control device indicating that there may be a software inconsistency between the control device and the other control device, the control unit stops or does not permit execution of the first process. This makes it possible to prevent the first process from being executed in a state where a software inconsistency has occurred.

[0022] (8) In one embodiment, the control unit transmits information about the software to other control devices at predetermined intervals during the startup check process.

[0023] In a configuration in which information about the software is transmitted only once, there is a possibility that the information about the software will not be acquired by other control devices if, for example, a temporary communication error occurs. With the above configuration, it is possible to increase the possibility that information about the software of other control devices can be acquired if a temporary communication error occurs.

[0024] (9) In one embodiment, when the control unit receives the first signal during the startup check process, the control unit stops sending information about the software.

[0025] According to the above configuration, since the transmission of information related to the software is stopped after receiving the first signal, a case in which information related to the software is subsequently transmitted can be considered, for example, when the control device is restarted. The control device is configured to update the software upon startup. Therefore, when the other control device receives information related to the software after transmitting the first signal, the other control device can be made aware of the possibility of a software inconsistency.

[0026] (10) In one embodiment, the information about the software includes version information of the software.

[0027] According to the above configuration, software consistency is confirmed based on the software version, so that software consistency can be confirmed with high accuracy.

[0028] (11) In one embodiment, the control unit allows execution of the first process when the first signal indicates that the result of the confirmation process is consistent, and does not allow execution of the first process when the first signal indicates that the result of the confirmation process is inconsistent.

[0029] According to the above configuration, it is possible to prevent the first process from being executed in a state where an inconsistency occurs in the software versions.

[0030] (12) In one embodiment, if the control unit does not receive the first signal within a predetermined time after sending information about the software during the startup check process, the control unit does not allow the first process to be executed.

[0031] If the first signal is not received within a predetermined time after the transmission of the software-related information, it is assumed that some kind of abnormality has occurred in the system. In this case, by disallowing the execution of the first process, it is possible to prevent the first process from being executed in an abnormal state.

[0032] (13) In one embodiment, the predetermined processing further includes a second processing in which the control device independently realizes a second function of the vehicle. The control unit permits execution of the first processing and the second processing when the first signal indicates that the result of the verification processing is consistent, prohibits execution of the first processing and permits execution of the second processing when the first signal indicates that the result of the verification processing is inconsistent, and prohibits execution of the first processing and the second processing when the first signal is not received within a certain time period after transmitting the information related to the software.

[0033] According to the above configuration, if the result of the confirmation process is inconsistent, the first process in cooperation with other control devices is disallowed, while the second process performed by the control device alone is permitted. Even if the result of the confirmation process is inconsistent, the execution of the second process, which can be performed, is permitted, thereby preventing excessive restrictions on the execution of processes. Furthermore, if it is expected that an abnormality will occur in the system, such as the first signal not being received within a certain time after the transmission of information related to software, the first process and the second process are disallowed, thereby preventing the execution of inappropriate processes.

[0034] (14) A control method according to another aspect of the present disclosure is a control method for a control device that configures a system of a vehicle and that is implemented with first software for executing predetermined processing. The predetermined processing includes a first processing that implements a vehicle function in cooperation with other control devices that configure the system. The control device and the other control devices are configured to update the software at startup if a software update is available. The control method includes the steps of, at startup of the control device, receiving information about second software, including a program for executing the first processing stored in the other control device, from the other control device before executing the first software, and performing a startup check process that includes a confirmation process for confirming consistency between the first software and the second software, and, after starting execution of the first software, stopping or disallowing execution of the first processing if information about the second software is received from the other control device.

[0035] (15) A recording medium according to another aspect of the present disclosure records a program for executing the control method described in (14) above.

[0036] (16) According to another aspect of the present disclosure, there is provided a control method for a control device that configures a vehicle system and is implemented with software for executing predetermined processing. The predetermined processing includes a first processing that implements a vehicle function in cooperation with another control device installed in the vehicle. The control device and the other control device are configured to update the software at startup if a software update is available. The control method includes a step of performing a startup check processing at startup of the control device before executing the software. The step of performing the startup check processing includes a step of transmitting information about the software to the other control device, a step of receiving a first signal indicating the result of a verification processing performed by the other control device using the information about the software to verify software consistency between the control device and the other control device, and a step of determining whether the first processing can be executed based on the first signal. The control method further includes a step of stopping or disallowing execution of the first processing when a second signal indicating a possibility of software inconsistency between the control device and the other control device is received from the other control device after the software execution has started.

[0037] (17) A recording medium according to another aspect of the present disclosure records a program for executing the control method described in (16) above. [Effects of the Invention]

[0038] According to the present disclosure, when a software inconsistency occurs, it is possible to suppress the execution of processes that are performed in cooperation between a plurality of control devices. [Brief explanation of the drawings]

[0039] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a communication system. [Figure 2] 1 is a diagram illustrating an example of the configuration of an electric vehicle according to an embodiment. [Figure 3] FIG. 10 is a diagram for explaining combination information of software product numbers (versions). [Figure 4]3 is a diagram for explaining an example of operations performed by a representative ECU and a link ECU; FIG. [Figure 5] FIG. 10 is a diagram illustrating functions that are permitted depending on the result of a version check. [Figure 6] 10 is a diagram for explaining another example of the operation performed by the representative ECU and the link ECU. FIG. [Figure 7] 10 is a flowchart showing the procedure of a start-up check process executed by a representative ECU. [Figure 8] 10 is a flowchart showing the procedure of processing executed by a representative ECU during execution of normal processing. [Figure 9] 10 is a flowchart showing the procedure of a startup check process executed by a linked ECU. [Figure 10] 10 is a flowchart showing a procedure of a process executed by a link ECU during execution of a normal process. DETAILED DESCRIPTION OF THE INVENTION

[0040] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals, and description thereof will not be repeated.

[0041] 1 is a diagram illustrating an example of the configuration of a communication system 1. The communication system 1 includes a communication network 6, a management server 7, and an electric vehicle 100. The electric vehicle 100 is configured to be able to communicate with the management server 7 via the communication network 6.

[0042] The management server 7 is a computer including, for example, a CPU (Central Control Unit), various memories, and a communication interface. The management server 7 provides update information for various software to the multiple vehicles and manages the update status of various software stored in each of the multiple vehicles. FIG. 1 shows an electric vehicle 100, which is one of the multiple vehicles, as an example. In the following explanation, information exchanged between the management server 7 and the electric vehicle 100 will be described, but the same applies to information exchanged between the management server 7 and other vehicles, and detailed explanations thereof will not be repeated.

[0043] A storage device (not shown) of the management server 7 stores in advance, for example, identification information (hereinafter also referred to as "vehicle ID") that is unique information for identifying the electric vehicle 100. The various software stored in the electric vehicle 100 includes, for example, control programs stored in each of a plurality of ECUs (Electronic Control Units) mounted on the electric vehicle 100. The management server 7 manages identification information including version information of the various software for each ECU of the electric vehicle 100. As will be described later, the storage device of the management server 7 stores version information of software for a representative ECU included in the electric vehicle 100 and version information of software for other ECUs in association with the vehicle ID. The management server 7 manages the version information of the software using a unique product number. When update information is provided to the electric vehicle 100, the management server 7 manages the update status of the various software in the electric vehicle 100 using the product number corresponding to the provided update information.

[0044] For example, when software with a new product number (new version) is prepared, the management server 7 requests the electric vehicle 100 to update the software, or provides the electric vehicle 100 with the software with the new product number in response to a request from the electric vehicle 100.

[0045] Next, a specific configuration of the electric vehicle 100 according to the present embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram that schematically shows an example of the configuration of the electric vehicle 100 according to the present embodiment. As shown in Fig. 2, the electric vehicle 100 includes a representative ECU 200, association ECUs 210 and 220, a DCM (Data Communication Module) 230, an ADS (Autonomous Driving System) 240, a communication bus 250, and a drive device 260. The representative ECU 200, the association ECUs 210 and 220, and the ADS 240 are communicatively connected via the communication bus 250.

[0046] The representative ECU 200 is an ECU that instructs the linkage ECUs 210 and 220 to switch to software with an updated part number, which will be described later, and manages the update status of the software of each ECU, including the representative ECU 200 itself.

[0047] Representative ECU 200 includes a CPU 201 and a memory 202. CPU 201 executes a program stored in memory 202, thereby performing various controls on a control target (e.g., DCM 230, etc.) of representative ECU 200. Memory 202 includes a first storage area 202A and a second storage area 202B. Control programs for starting representative ECU 200 are stored in both first storage area 202A and second storage area 202B. Representative ECU 200 sets either first storage area 202A or second storage area 202B as a startup storage area (e.g., first storage area 202A), and at startup, executes the control program stored in the set startup storage area to start up. When representative ECU 200 receives update information from management server 7 via DCM 230, it stores the control program updated using the update information in an update storage area (for example, second storage area 202B), which is a storage area other than the storage area set as the startup storage area. When the updated program is stored in the update storage area (for example, second storage area 202B), representative ECU 200 sets the update storage area as the startup storage area at the next startup, and also instructs linkage ECU 210, which will be described later, to set the update storage area as the startup storage area at the next startup.

[0048] Therefore, when the electric vehicle 100 is turned on (powered on) by a user's startup operation or the like after the IG is turned off (powered off), the representative ECU 200 and the linkage ECUs 210, 220 each execute the updated control program stored in the startup storage area and start up. Note that the storage area that was set as the startup storage area up until the startup is set up as an update storage area. Hereinafter, changing the startup storage area and setting it up anew may be referred to as switching the startup storage area.

[0049] The representative ECU 200 acquires the product number (version) of the updated software stored in the association ECUs 210 and 220 from the management server 7 or the association ECUs 210 and 220 and stores the acquired product number (version) in the memory 202.

[0050] The DCM 230 is an in-vehicle communication module configured to be capable of wireless communication with the management server 7. The DCM 230 is configured to be capable of two-way data communication with the management server 7 in response to control signals from the representative ECU 200. The DCM 230 is connected to the representative ECU 200. The representative ECU 200 transmits information about the electric vehicle 100, various requests, and the like to the management server 7, and receives update information for various software from the management server 7, via the DCM 230.

[0051] The association ECU 210 includes a CPU 211 and a memory 212. The CPU 211 executes programs stored in the memory 212, thereby performing various controls on a control target (e.g., the drive device 260) of the association ECU 210. The memory 212 includes a third storage area 212A and a fourth storage area 212B. Control programs for starting up the association ECU 210 are stored in both the third storage area 212A and the fourth storage area 212B. The association ECU 210 sets either the third storage area 212A or the fourth storage area 212B as a startup storage area, and at startup, executes the control program stored in the set startup storage area. When the association ECU 210 receives update information from the management server 7 via the DCM 230 and the representative ECU 200 and receives an instruction from the representative ECU 200 to switch the startup storage area, the association ECU 210 sets the update storage area as the startup storage area for the next startup.

[0052] The cooperation ECU 220 differs from the cooperation ECU 210 in the detection targets of sensors, the control targets (for example, a steering system, a brake system, etc.), and the control operations. The other configurations of the cooperation ECU 220 are similar to those of the cooperation ECU 210. Therefore, detailed description of the cooperation ECU 220 will not be repeated. Note that, hereinafter, when there is no need to particularly distinguish between the cooperation ECU 210 and the cooperation ECU 220, they may be collectively referred to simply as "cooperation ECUs."

[0053] The drive device 260 is connected to the linkage ECU 210 and performs a drive operation to drive the electric vehicle 100 in response to a control signal from the linkage ECU 210. The drive device 260 includes, for example, a motor generator, a power storage device, and a PCU (Power Control Unit) (none of which are shown). The power storage device includes, for example, a secondary battery such as a nickel-metal hydride battery or a lithium-ion battery having a liquid or solid electrolyte, or a DC power source such as a capacitor. The PCU converts DC power from the power storage device to AC power and supplies it to the motor generator, and converts AC power generated by the motor generator into DC power and supplies it to the power storage device. The motor generator is a drive source and a power generation source for the electric vehicle 100, and drives the drive wheels to rotate or generates power through the rotation of the drive wheels. The drive device 260 may further include an internal combustion engine as a drive source or a power generation source.

[0054] The ADS 240 is configured to be able to perform autonomous driving of the electric vehicle 100. Specifically, the ADS 240 acquires information (surrounding environment) indicating the state of the electric vehicle 100 from the representative ECU 200, the linkage ECUs 210 and 220, and various sensors, and creates a driving plan using the acquired information, destination, etc. The ADS 240 outputs various control requests for driving the electric vehicle 100 according to the created driving plan to the representative ECU 200 and the linkage ECUs 210 and 220, which control various actuators including the drive unit 260.

[0055] In this embodiment, ADS240 is described as being built into electric vehicle 100, but it may also be configured as an autonomous driving kit that can be attached to a predetermined position, such as the rooftop of electric vehicle 100, and that can be removed from electric vehicle 100.

[0056] The electric vehicle 100 is driven in either an automatic driving mode in which automatic driving can be performed in accordance with a control request from the ADS 240, or a manual driving mode in which driving can be performed in accordance with various operations (accelerator operation, brake operation, steering operation) by the user. The various actuators mounted on the electric vehicle 100 are controlled by at least one of the representative ECU 200 and the cooperation ECUs 210, 220. In the present embodiment, a configuration in which the multiple ECUs mounted on the electric vehicle 100 include the representative ECU 200 and the cooperation ECUs 210, 220 has been described as an example, but the number of cooperation ECUs included in the multiple ECUs can be changed as appropriate. The number of cooperation ECUs included in the multiple ECUs may be one, or may be three or more.

[0057] In the electric vehicle 100 having the above configuration, the representative ECU 200 and the cooperation ECUs 210, 220 execute software to realize various functions of the electric vehicle 100. The functions of the electric vehicle 100 include, for example, functions (hereinafter also referred to as "system functions") that are realized by the representative ECU 200 and the cooperation ECUs 210, 220 cooperating to execute processing, and functions (hereinafter also referred to as "individual functions") that are realized by the representative ECU 200 and the cooperation ECUs 210, 220 independently executing processing without cooperating with other ECUs.

[0058] Here, the software stored in each of the representative ECU 200 and the association ECUs 210, 220 can be updated using update information received from the management server 7, thereby modifying existing functions and adding new functions. In order to properly execute functions (particularly system functions) based on this updated software, the representative ECU 200 executes a "startup check process" after, for example, turning on the IG to check whether the combination of product numbers (versions) of the software executed in the representative ECU 200 and the association ECUs 210, 220 is consistent. When the representative ECU 200 and the association ECUs 210, 220 are started up by turning on the IG, the start-up check process is first executed, and after the start-up check process is completed, the software for realizing each function is executed.

[0059] For example, the representative ECU 200 determines that the combination of part numbers is consistent when the combination of part numbers (versions) of the software in the representative ECU 200 and the association ECUs 210 and 220 is a predetermined combination. The representative ECU 200 acquires information on the combination of part numbers of the software in the representative ECU 200 and the association ECUs 210 and 220 from the management server 7 and stores the information in the memory 212.

[0060] 3 is a diagram for explaining combination information of software product numbers (versions). The combination information includes combinations of pre-update and post-update versions of the representative ECU 200 and the linked ECUs 210 and 220. The representative ECU 200 acquires the combination information together with the update information from the management server 7 via the DCM 230, and stores the combination information in the memory 202.

[0061] For example, in the combination of versions before the update, the software version of the representative ECU 200 is A00001, the software version of the association ECU 210 is B00001, and the software version of the association ECU 220 is C00001. For example, in the combination of versions after the update, the software version of the representative ECU 200 is A00002, the software version of the association ECU 210 is B00002, and the software version of the association ECU 220 is C00002.

[0062] As described above, the functions of the electric vehicle 100 include system functions and stand-alone functions. In order to properly realize the system functions, it is important that the software product numbers (versions) are consistent between the representative ECU 200 and the linkage ECUs 210 and 220.

[0063] In the startup check process, before executing the software stored in the startup storage area, the representative ECU 200 acquires product number information (version information) of the software stored in the startup storage area from each of the association ECUs 210, 220. Before executing the software stored in the startup storage area, each of the association ECUs 210, 220 transmits the product number information (version information) of the software stored in the startup storage area to the representative ECU 200. The representative ECU 200 checks the combination information for the product number of the software stored in its own startup storage area and the product number identified by the acquired version information. If the combination matches, the representative ECU 200 determines that the startup storage area has been switched appropriately in each ECU (the representative ECU 200 and the association ECUs 210, 220).

[0064] If the combination matches, the representative ECU 200 permits the execution of processing for realizing a system function (hereinafter also referred to as "system processing") and processing for realizing an individual function (hereinafter also referred to as "individual processing"). If the combination does not match, the representative ECU 200 permits the execution of individual processing but does not permit system processing. This will be described in detail with reference to FIG. 4. The system processing corresponds to an example of a "first processing" according to the present disclosure. The individual processing corresponds to an example of a "second processing" according to the present disclosure.

[0065] Fig. 4 is a diagram for explaining an example of the operations performed by the representative ECU 200 and the association ECUs 210 and 220. Fig. 4 shows an operation sequence between the representative ECU 200 and the association ECUs.

[0066] In S1, a user performs a startup operation to start up the system of the electric vehicle 100, and the electric vehicle 100 enters an IG-on state. When the IG is in the IG-on state, power is supplied to the representative ECU 200 and the association ECUs 210 and 220, and the representative ECU 200 and the association ECUs 210 and 220 start up. At this time, if there is a software update, the startup storage area is switched in each ECU.

[0067] In S10 and S20, the representative ECU 200 and the association ECUs 210, 220 each start a startup check process. In the representative ECU 200 and the association ECUs 210, 220, the startup check process is executed once only at startup until the electric vehicle 100 enters the IG off state.

[0068] In S21, when the startup check process is started, each of the association ECUs 210, 220 transmits product number information (version information) indicating the product number (version) of the software stored in the startup storage area to the representative ECU 200. Each of the association ECUs 210, 220 transmits the version information to the representative ECU 200 at predetermined intervals. Note that a known technique can be used to acquire the product number (version) of the software stored in the startup storage area, and a detailed description thereof will not be provided.

[0069] In S11, after the representative ECU 200 has entered the IG-on state, the representative ECU 200 performs a version check upon receiving the version information from each of the association ECUs 210 and 220 for the first time. In the version check, the representative ECU 200 determines whether the combination of the software product numbers (versions) stored in its own startup storage area and the product numbers (versions) identified by the version information received from each of the association ECUs 210 and 220 is a predetermined combination, thereby determining whether the combination of the versions is consistent. More specifically, the representative ECU 200 determines whether the combination of the software version stored in its own startup storage area and the version identified by the acquired version information is consistent with the combination information ( FIG. 3 ). For example, if the software version stored in the representative ECU 200's startup storage area is A00002, the version identified by the version information received from the association ECU 210 is B00002, and the version identified by the version information received from the association ECU 220 is C00002, the representative ECU 200 determines that the software is consistent. For example, if the software version stored in the representative ECU 200's startup storage area is A00002 but the version identified by the version information received from the association ECU 210 is B00001 or the version identified by the version information received from the association ECU 220 is C00001, the representative ECU 200 determines that the software is inconsistent (mismatched). Furthermore, if the representative ECU 200 has not received version information from at least one of the association ECUs 210 and 220 (timeout occurred) despite the elapse of a predetermined time since starting the startup check process of S10, the representative ECU 200 determines that an abnormality has occurred. The version check corresponds to an example of a "confirmation process" according to the present disclosure.

[0070] In S12, the representative ECU 200 generates a startup signal based on the result of the version check (including a timeout). The startup signal includes any one of a first startup signal, a second startup signal, and a third startup signal. If the representative ECU 200 determines that there is consistency in the version check, it generates a first startup signal including information indicating consistency. If the representative ECU 200 determines that there is no consistency in the version check, it generates a second startup signal including information indicating inconsistency. If the representative ECU 200 determines that there is an abnormality in the version check, it generates a third startup signal including information indicating the abnormality. The representative ECU 200 transmits the generated startup signal to the linked ECUs 210 and 220.

[0071] In step S22, when the association ECUs 210 and 220 receive the activation signal, they stop transmitting the version information. After this, the association ECUs 210 and 220 do not transmit the version information to the representative ECU 200.

[0072] In S13 and S23, the representative ECU 200 and each of the cooperation ECUs 210 and 220 start the startup process. Specifically, the representative ECU 200 starts the startup process based on the result of the version check. Each of the cooperation ECUs 210 and 220 starts the startup process based on the startup signal. The functions to be permitted are predetermined in association with the result of the version check and the startup signal.

[0073] Fig. 5 is a diagram for explaining functions that are permitted depending on the result of the version check. Fig. 5 shows the correspondence between the result of the version check and the functions (first to third functions) that are permitted depending on the result.

[0074] The first function is a function (system function) that is realized by the representative ECU 200 and the cooperation ECUs 210, 220 executing processing in cooperation with each other, such as an adaptive cruise control function. The second function is a system function, such as a pre-crash safety (automatic braking) function. The third function is a function (single function) that is realized by the cooperation ECU 210 executing processing independently without cooperation with other ECUs, such as a parking assistance function. Note that in this embodiment, the first to third functions are exemplified as the functions of the electric vehicle 100 described above, but the functions of the electric vehicle 100 are not limited to these. For example, the functions may include a function that is realized by the representative ECU 200 executing processing independently without cooperation with other ECUs, and a function that is realized by the cooperation ECU 220 executing processing independently without cooperation with other ECUs.

[0075] (1) If the result of the version check is a match, the representative ECU 200 sets all of the first to third functions to an permitted state. Upon receiving the first activation signal, each of the association ECUs 210, 220 sets all of the first to third functions to an permitted state. The first activation signal includes a command to set all of the first to third functions to an permitted state, and each of the association ECUs 210, 220 sets all of the first to third functions to an permitted state in accordance with the first activation signal. Alternatively, each of the association ECUs 210, 220 may set all of the first to third functions to an permitted state based on information indicating a match that is included in the first activation signal.

[0076] (2) If the result of the version check indicates an inconsistency, the representative ECU 200 sets the first and second functions to a non-permitted state and sets the third function to a permitted state. That is, the representative ECU 200 sets the system function to a non-permitted state and sets the independent function to a permitted state. The system function is realized by the representative ECU 200 and the linkage ECUs 210 and 220 executing processes in cooperation with each other, and therefore may not be executed properly if there is an inconsistency in the software. On the other hand, the independent function is realized by executing processes independently without cooperation with other ECUs, and therefore can be executed properly even if there is an inconsistency in the software. Therefore, the first and second functions are disabled and the third function is permitted. Upon receiving the second activation signal, each of the linkage ECUs 210 and 220 sets the first and second functions to a non-permitted state and sets the third function to a permitted state. The second activation signal includes an instruction to set the first function and the second function to a non-permitted state and the third function to a permitted state, and each of the cooperation ECUs 210, 220 sets the first function and the second function to a non-permitted state and the third function to a permitted state in accordance with the second activation signal. Alternatively, each of the cooperation ECUs 210, 220 may set the first function and the second function to a non-permitted state and the third function to a permitted state based on information indicating an inconsistency included in the second activation signal.

[0077] (3) If the result of the version check is abnormal, the representative ECU 200 sets all of the first to third functions to a disabled state. Upon receiving the third activation signal, each of the association ECUs 210, 220 sets all of the first to third functions to a disabled state. The third activation signal includes a command to set all of the first to third functions to a disabled state, and each of the association ECUs 210, 220 sets all of the first to third functions to a disabled state in accordance with the third activation signal. Alternatively, each of the association ECUs 210, 220 may set all of the first to third functions to a disabled state based on information indicating an abnormality included in the third activation signal.

[0078] 4 again, in S14 and S24, the representative ECU 200 and the cooperation ECUs 210, 220 each start processing including the execution of the permitted function (hereinafter also referred to as "normal processing"). The representative ECU 200 and the cooperation ECUs 210, 220 each do not start processing for executing the prohibited function. Therefore, if the result of the version check is inconsistent or abnormal, the processing for executing the system function is not started.

[0079] After the electric vehicle 100 is brought into the IG-on state as described above, the representative ECU 200 and the cooperation ECUs 210 and 220 each start processing.

[0080] During the execution of the process, the associated ECU may be restarted due to some malfunction, such as a momentary interruption in the power supply that supplies power to the associated ECU. In this case, the restarted associated ECU may switch the startup storage area. As a result, even if consistency is confirmed in the startup check process, an inconsistent state may occur thereafter. Therefore, focusing on the fact that the restarted associated ECU starts the startup check process and transmits version information, if the representative ECU 200 receives the version information after the startup process, the representative ECU 200 executes a process to stop or prohibit system processing. In the following, it is assumed that the associated ECU 210 has been restarted.

[0081] In S25, when some malfunction occurs, such as a momentary interruption of the power supply that supplies power to the cooperation ECU 210, the cooperation ECU 210 is restarted.

[0082] In S26, the cooperation ECU 210 starts the start-up check process. Then, in S27, the association ECU 210 that has started the startup check process transmits product number information (version information) indicating the product number of the software stored in the startup storage area to the representative ECU 200. The association ECU 210 transmits the version information to the representative ECU 200 at predetermined intervals.

[0083] In S15, the representative ECU 200 acquires version information from the association ECU 210. When the representative ECU 200 receives the version information after starting (during) execution of normal processing, the representative ECU 200 determines that an unauthorized restart has occurred in the association ECU 210, which is the sender of the version information. The representative ECU 200 then transmits an abnormality signal to the association ECUs 210, 220 without performing a version check. The abnormality signal is a signal equivalent to the third activation signal. That is, the abnormality signal includes at least information indicating an abnormality. The abnormality signal may further include a command to set all of the first to third functions to an unauthorized state. The representative ECU 200 may be configured to transmit the third activation signal.

[0084] In S28, when the linkage ECU 210 receives the abnormality signal, it stops transmitting the version information. Note that when the linkage ECU 220 receives the abnormality signal, it skips the processes of S28 and S29 and executes the process of S30.

[0085] In S29, the association ECU 210 starts the start-up process based on the abnormality signal, which is the same as the start-up process in S23 when the association ECU 210 receives the third start-up signal.

[0086] In S16 and S30, the representative ECU 200 and the cooperation ECUs 210, 220 each stop or prohibit system processing. Specifically, if the representative ECU 200 and the cooperation ECU 220 were executing system processing, they execute a sequence to stop the system processing, thereby stopping the system processing. If the representative ECU 200 and the cooperation ECU 220 were not executing system processing, they do not start system processing thereafter. Note that the representative ECU 200 and the cooperation ECU 220 continue to execute independent processing. The cooperation ECU 210 does not start system processing, but starts processing to execute an independent function.

[0087] Although the case where the linked ECU is restarted has been described with reference to FIG. 4, the case where the representative ECU 200 is restarted may also occur.

[0088] 6 is a diagram for explaining another example of the operation performed by the representative ECU 200 and the association ECUs 210, 220. FIG. 6 shows an operation sequence between the representative ECU 200 and the association ECU 210. While FIG. 4 describes an example in which the association ECU 210 restarts, FIG. 6 describes an example in which the representative ECU 200 restarts. In FIG. 6, the processing from S14 and S24 onwards is changed from the sequence in FIG. 4. Therefore, the processing from S14 and S24 onwards will be described.

[0089] In S40, when some malfunction occurs, such as a momentary interruption of the power supply that supplies power to the representative ECU 200, the representative ECU 200 is restarted.

[0090] In S41, the representative ECU 200 starts the start-up check process. In S42, the representative ECU 200 waits for version information to be transmitted from the association ECUs 210 and 220. However, because the association ECUs 210 and 220 have not restarted, each of the association ECUs 210 and 220 does not transmit version information. Therefore, a predetermined time elapses (timeout occurs) after the start of the startup check process without transmitting any version information.

[0091] In S43, the representative ECU 200 detects that a predetermined time has elapsed since the start of the startup check process without transmitting the version information, and determines that an abnormality has occurred. Then, the representative ECU 200 transmits an abnormality signal to the association ECUs 210 and 220.

[0092] In S44, representative ECU 200 does not start system processing, but starts processing for executing a stand-alone function.

[0093] In S30, if the cooperation ECUs 210 and 220 were executing system processing, they execute a sequence for stopping the system processing, and stop the system processing. If the cooperation ECUs 210 and 220 were not executing system processing, they do not start the system processing thereafter. Note that the cooperation ECUs 210 and 220 continue to execute independent processing.

[0094] Fig. 7 is a flowchart showing the procedure of the startup check process executed by representative ECU 200. The process of the flowchart in Fig. 7 is started upon startup of representative ECU 200. Each step in Fig. 7 and the flowchart in Fig. 8 described below will be explained as being implemented by software processing by representative ECU 200, but some or all of the steps may also be implemented by hardware (electrical circuits) created within representative ECU 200.

[0095] In S50, the representative ECU 200 starts the startup check process and receives version information from the linkage ECUs 210 and 220.

[0096] In S51, the representative ECU 200 determines whether or not it has received version information from all of the target ECUs. In this embodiment, the target ECUs are the association ECUs 210 and 220. If the representative ECU 200 has not received version information from at least one of the association ECUs 210 and 220 (NO in S51), the process proceeds to S52. If the representative ECU 200 has received version information from both the association ECUs 210 and 220 (YES in S51), the process proceeds to S54.

[0097] In S52, representative ECU 200 determines whether a predetermined first time has elapsed since the start of the startup check process. If representative ECU 200 determines that the first time has not elapsed (NO in S52), it returns the process to S50. If representative ECU 200 determines that the first time has elapsed (YES in S52), it determines that a timeout has occurred, and proceeds to S53.

[0098] In S53, representative ECU 200 determines that some abnormality has occurred and determines to prohibit execution of system processing. Furthermore, representative ECU 200 determines to prohibit execution of individual processing. Then, representative ECU 200 generates a third activation signal including information indicating the abnormality, and proceeds to S58. Representative ECU 200 may include a command to prohibit execution of system processing and individual processing in the third activation signal.

[0099] In S54, the representative ECU 200 reads the combination information from the memory 202. The representative ECU 200 checks the combination information against the product numbers (versions) of the software stored in its own startup storage area and the product numbers (versions) identified by the version information received from each of the cooperative ECUs 210 and 220 in S50, thereby determining the consistency of the combination.

[0100] In S55, representative ECU 200 determines whether all versions match as a result of the comparison in S54. If representative ECU 200 determines that all versions match (YES in S55), it proceeds to S56. If representative ECU 200 determines that there is an inconsistency (NO in S55), it proceeds to S57. The processes of S52, S54, and S55 correspond to a version check.

[0101] In S56, representative ECU 200 determines that the software is consistent and decides to permit execution of the system processing. Representative ECU 200 then generates a first activation signal including information indicating the consistency, and proceeds to S58. Representative ECU 200 may include in the first activation signal a command to permit execution of the system processing and the independent processing.

[0102] In S57, representative ECU 200 determines that there is a software inconsistency and decides to prohibit the execution of system processing. However, representative ECU 200 decides to permit the execution of individual processing. Representative ECU 200 generates a second activation signal including information indicating the inconsistency, and proceeds to S58. Representative ECU 200 may include in the second activation signal a command to prohibit the execution of system processing and permit the execution of individual processing.

[0103] In S58, the representative EU 200 transmits an activation signal (the first activation signal, the second activation signal, or the third activation signal) to the association ECUs 210 and 220.

[0104] 8 is a flowchart showing the procedure of processing executed by representative ECU 200 during normal processing. The processing of the flowchart in FIG. 8 is executed in parallel with normal processing (system processing or independent processing), is called from the main routine at each control cycle, and is executed repeatedly.

[0105] In S60, representative ECU 200 determines whether or not it has received version information from cooperative ECUs 210 and 220. If representative ECU 200 determines that it has not received version information (NO in S60), it returns the process to the main routine. If representative ECU 200 determines that it has received version information (YES in S60), it proceeds to S61.

[0106] In S61, the representative ECU 200 determines that the linked ECU that transmitted the version information has restarted, and determines to stop or prohibit the execution of the system processing. Furthermore, the representative ECU 200 determines to prohibit the execution of the independent processing. Then, the representative ECU 200 generates an abnormality signal, and the process proceeds to S63.

[0107] In S62, the representative ECU 200 transmits an abnormality signal to the association ECUs 210 and 220.

[0108] Fig. 9 is a flowchart showing the procedure of the startup check process executed by the linked ECU. The process of the flowchart in Fig. 9 starts when the linked ECU is started. Each step of Fig. 9 and the flowchart in Fig. 10 described later will be described as being realized by software processing by the linked ECU, but some or all of the steps may also be realized by hardware (electrical circuits) created within the linked ECU.

[0109] In S70, the link ECU starts the startup check process and transmits version information to the representative ECU 200.

[0110] In S71, the linkage ECU determines whether or not it has received an activation signal from the representative ECU 200. If it determines that it has not received an activation signal from the representative ECU 200 (NO in S71), the linkage ECU proceeds to S72. If it determines that it has received an activation signal from the representative ECU 200 (YES in S71), the linkage ECU proceeds to S74.

[0111] In S72, the associated ECU determines whether a predetermined second time has elapsed since the start of the startup check process. The second time can be set, for example, to a time equal to or greater than the first time. If the second time has not elapsed (NO in S72), the associated ECU returns the process to S70. If the second time has elapsed (YES in S72), the associated ECU determines a timeout and proceeds to S73.

[0112] In step S73, the linkage ECU determines that some abnormality has occurred and determines to prohibit the execution of system processing. Furthermore, the linkage ECU determines to prohibit the execution of independent processing.

[0113] In S74, the linkage ECU determines whether the activation signal received in S71 is the first activation signal. If the linkage ECU determines that the first activation signal has been received (YES in S74), the process proceeds to S75. If the linkage ECU determines that the first activation signal has not been received (NO in S74), the process proceeds to S76.

[0114] In step S75, the linkage ECU determines to permit execution of the system process based on the first activation signal. Also, the linkage ECU determines to permit execution of the independent process based on the first activation signal.

[0115] In S76, the linkage ECU determines whether the activation signal received in S71 is the second activation signal. If the linkage ECU determines that the second activation signal has been received (YES in S76), the process proceeds to S77. If the linkage ECU determines that the second activation signal has not been received (NO in S76), the process proceeds to S73.

[0116] In step S77, the cooperation ECU determines to prohibit the execution of the system process based on the second activation signal, and determines to permit the execution of the independent process based on the first activation signal.

[0117] 10 is a flowchart showing the procedure of processing executed by the linked ECU during normal processing. The processing of the flowchart in FIG. 10 is executed in parallel with normal processing (system processing or independent processing), and is called from the main routine every control cycle and executed repeatedly.

[0118] In S80, the linkage ECU determines whether or not an abnormality signal has been received from the representative ECU 200. If the linkage ECU determines that an abnormality signal has not been received (NO in S80), the linkage ECU returns the process to the main routine. If the linkage ECU determines that an abnormality signal has been received (YES in S80), the linkage ECU proceeds to S81.

[0119] In step S81, the linkage ECU determines to prohibit the execution of the system process and further determines to prohibit the execution of the independent process.

[0120] As described above, when the electric vehicle 100 is in the IG-on state and the representative ECU 200 and the cooperation ECUs 210 and 220 are started, a startup check process is executed once in each of the representative ECU 200 and the cooperation ECUs 210 and 220 before software for implementing various functions is executed. After the startup check process, whether various processes (system processes and individual processes) can be executed is determined based on the results of the startup check process, and normal processing is started. After the start of normal processing, if either the representative ECU 200 or the cooperation ECU is restarted, an abnormality signal is transmitted from the representative ECU 200, and the system processing is stopped. If the cooperation ECU is restarted, the representative ECU 200 transmits an abnormality signal to the cooperation ECU due to the representative ECU 200 receiving version information during normal processing. If the representative ECU 200 is restarted, the representative ECU 200 transmits an abnormality signal to the cooperation ECU due to a timeout caused by not receiving the version information. In this way, if a software inconsistency may occur due to a restart or the like after the startup check process is performed before the software is executed, an abnormality signal is sent and system processing is not permitted in the representative ECU 200 and the linked ECUs, thereby preventing system processing from being executed when a software inconsistency has occurred.

[0121] Furthermore, by executing the startup check process once at startup, version information is not sent from the associated ECU to the representative ECU 200 after the startup process unless a reboot or the like occurs. Therefore, when the representative ECU 200 receives version information from the associated ECU during processing execution, it can determine that an abnormality has occurred without performing a version check. This makes it possible to reduce computing resources compared to when version information is periodically received and a version check is performed.

[0122] Furthermore, if a software inconsistency occurs, system processing is not permitted, but individual processing is permitted. By permitting the execution of individual processing that can be performed even when a software inconsistency occurs, excessive restrictions on processing execution can be prevented.

[0123] Furthermore, if the representative ECU 200 fails to receive the version information within a first time period after starting the startup check process, or if the linked ECU fails to receive the startup signal within a second time period after transmitting the version information, it is assumed that some kind of abnormality has occurred. In this case, by disallowing the execution of the system process and the individual process, it is possible to prevent the system process and the individual process from being executed in an abnormal state.

[0124] [Variations] In the embodiment, in the startup check process, the linkage ECU periodically transmits the version information to the representative ECU 200. However, in the startup check process, the linkage ECU may be configured to transmit a signal indicating that the linkage ECU has been started to the representative ECU 200, and to transmit the version information in response to a request from the representative ECU 200.

[0125] When the electric vehicle 100 enters the IG on state, power is supplied to the representative ECU 200 and the cooperation ECUs 210, 220, and the representative ECU 200 and the cooperation ECUs 210, 220 are started up. Then, the representative ECU 200 and the cooperation ECUs 210, 220 each start up a start-up check process.

[0126] When the startup check process is started, each of the associated ECUs 210, 220 transmits a signal indicating that it has started to the representative ECU 200. When the representative ECU 200 receives the signal indicating that it has started during the startup check process, it transmits a request to transmit version information to the associated ECU that has sent the signal.

[0127] When each of the linkage ECUs 210, 220 receives a request to transmit the version information, it transmits the version information to the representative ECU 200. The representative ECU 200 uses the version information to perform the version check described in the embodiment. After starting the startup check process, each of the linkage ECUs 210, 220 does not start the startup process until it receives a startup signal from the representative ECU 200. The subsequent process is the same as in the embodiment, and therefore will not be described again.

[0128] Furthermore, after starting normal processing, if the representative ECU 200 receives a signal indicating that it has started from at least one of the associated ECUs, it determines that some abnormality has occurred and transmits an abnormality signal to the associated ECUs 210 and 220. The subsequent processing is the same as in the embodiment, and therefore will not be described repeatedly.

[0129] As described above, the configuration of the modified example can also achieve the same effects as those of the embodiment.

[0130] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0131] 1 Communication system, 6 Communication network, 7 Management server, 100 Electric vehicle, 200 Representative ECU, 201 CPU, 202 Memory, 202A First storage area, 202B Second storage area, 210, 220 Linked ECU, 212 Memory, 212A Third storage area, 212B Fourth storage area, 250 Communication bus, 260 Drive device.

Claims

1. A control device constituting a vehicle system, a storage means for storing first software for implementing a first function of the vehicle in cooperation with other control devices constituting the system; A control device comprising: a control means for stopping or disallowing execution of the first software when, during execution of the first software, information regarding second software stored in the other control device to realize the first function is received from the other control device, the information being for confirming the consistency between the first software and the second software.

2. the information about the second software is version information about the second software, The control device according to claim 1 , wherein the control means checks the consistency based on a combination of the version of the first software and the version of the second software.

3. The control means If a result of the process of checking the consistency is a consistency, execution of a first process that realizes the first function in cooperation with the other control device is permitted; The control device according to claim 1 , wherein if a result of the confirmation process indicates a mismatch, execution of the first process is not permitted.

4. The control means When the control device is started, a start-up check process including the confirmation process is executed; 4. The control device according to claim 3, wherein, in the startup check process, if information about the second software is not received within a predetermined time from the start of the startup check process, execution of the first process is not permitted.

5. 5. The control device according to claim 4, wherein said control means transmits a signal including information indicating a result of said confirmation process to said other control device in said startup check process.

6. the first software is configured to execute a first process and a second process; the first processing is processing for realizing the first function in cooperation with the other control device, the second processing is processing in which the control device independently realizes a second function of the vehicle, The control means When the control device is started, a start-up check process is performed, which includes a confirmation process for confirming the consistency. In the startup check process, if a result of the confirmation process is a match, execution of the first process and the second process is permitted; If a result of the confirmation process is inconsistent in the startup check process, the execution of the first process is not permitted and the execution of the second process is permitted; 3. The control device according to claim 1, wherein if information about the second software is not received within a predetermined time from the start of the startup check process, execution of the first process and the second process is not permitted.

7. A control method for a control device constituting a system of a vehicle, the control device being implemented with first software for realizing a first function of the vehicle in cooperation with other control devices constituting the system; determining whether or not information relating to second software stored in the other control device for realizing the first function has been received from the other control device during execution of the first software, the information being for confirming consistency between the first software and the second software; and stopping or not permitting execution of the first software when information for verifying the consistency is received.

8. a program for executing a control method for a control device constituting a system of a vehicle, the control device being implemented with first software for realizing a first function of the vehicle in cooperation with other control devices constituting the system; The control method includes: determining whether or not information relating to second software stored in the other control device for realizing the first function has been received from the other control device during execution of the first software, the information being for confirming consistency between the first software and the second software; and when the information for verifying the consistency is received, stopping or not permitting execution of the first software.

Images