Software verification system and vehicle control device

Abstract

To provide a software verification system and the like, which can easily improve software that uses sensor data of a vehicle as input.SOLUTION: A software verification system detects degradation in a new version of control software (performance determination unit 118) by utilizing first information which is an output of a present version of control software used to control a vehicle, and to which sensor data from a sensor installed in a vehicle is input, second information which is an output of a new version of the control software that is not used to control the vehicle, and to which the sensor data is input, and third information regarding vehicle control other than the first information and the second information. The software verification system verifies the new version of the control software by utilizing the sensor data when the degradation was detected.SELECTED DRAWING: Figure 17

Description

Technical Field

[0001] The present invention relates to a software verification system and a vehicle control device.

Background Art

[0002] Non-Patent Document 1 introduces various methods as software safety evaluation methods. Among them, the evaluation method using Shadow Mode evaluates software by executing it in the background using external environment information in a real vehicle, so high-precision evaluation can be expected while ensuring safety.

[0003] Patent Document 2 proposes a technique for executing old version software and new version software in parallel or in series and outputting mismatch information when comparing output results. It not only uses data sensed by a real vehicle in a real environment as input information, but also enables simultaneous verification with multiple vehicles, which is effective from the viewpoints of verification systems and efficiency.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] The Shadow Mode technology described in Non-Patent Document 1 involves running and verifying the new software in a real vehicle in the background, separately from the old software. This allows obtaining the results of running the software in the background using data acquired from the actual vehicle. However, evaluating all execution results requires an enormous amount of time. Therefore, a method for evaluating the execution results of both the old and new software is desired.

[0007] Patent Document 2 describes running two versions of the software, old and new, in parallel (on one CPU) or in parallel (on multiple CPUs) using a verification scenario acquired while the vehicle is in motion. This allows for limited software verification. However, it is difficult for the system to determine the performance of the new software (improvement or deterioration) based on the difference in execution results between the old and new software while the vehicle is in operation, and it would require an enormous amount of work for a human to make such a determination. Furthermore, if both the old and new software produce the same output and the output is incorrect, it cannot be considered a difference in execution results, making evaluation difficult. Therefore, the challenge is to perform performance determination based on the difference in execution results between the old and new software using a system on the vehicle, and to also determine when both the old and new software produce inappropriate output.

[0008] The present invention aims to provide a software verification system and the like that can facilitate the improvement of software that takes vehicle sensor data as input. [Means for solving the problem]

[0009] To achieve the above objective, an example of the present invention's software verification system takes sensor data from a sensor mounted on a vehicle as input and uses the following to detect a degradation in the new version of the control software: first information which is the output of the current version of the control software used to control the vehicle; second information which is the output of a new version of the control software which is not used to control the vehicle and takes the sensor data as input; and third information relating to the control of the vehicle other than the first and second information. The system then verifies the new version of the control software using the sensor data at the time the degradation is detected. A software verification system, wherein the third information is information regarding whether or not the driver performed an accident avoidance operation, detected from driver input information entered by the vehicle's driver; the first and second information are information regarding the necessity of accident avoidance, indicating whether or not the vehicle needs to avoid an accident; and if the necessity of accident avoidance in the first and second information does not match, and the necessity of accident avoidance in the first information matches the presence or absence of the driver's accident avoidance operation in the third information, the system determines that the new version of the control software is a regression. . [Effects of the Invention]

[0010] According to the present invention, it is possible to easily improve software that takes vehicle sensor data as input. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments. [Brief explanation of the drawing]

[0011] [Figure 1] This figure shows the overall configuration of the vehicle control device in the first embodiment of the present invention. [Figure 2] This figure shows the connection relationship between a vehicle control device and a control device connected via a network in the first embodiment of the present invention. [Figure 3] This flowchart shows an example of the processing procedure of the radar sensor information acquisition unit in the first embodiment of the present invention. [Figure 4] This figure shows an example of radar sensor information in the first embodiment of the present invention. [Figure 5] This flowchart shows an example of the processing procedure of the camera sensor information acquisition unit in the first embodiment of the present invention. [Figure 6] This figure shows an example of camera sensor information in the first embodiment of the present invention. [Figure 7]It is a flowchart showing an example of a processing procedure of an object detection unit using a radar sensor in the first embodiment of the present invention. [Figure 8] It is a diagram showing an example of an object detection result by a radar sensor in the first embodiment of the present invention. [Figure 9] It is a diagram showing an example of an accident avoidance necessity flag based on an object detection result by a radar sensor in the first embodiment of the present invention. [Figure 10] It is a flowchart showing an example of a processing procedure of an object detection unit by software of Ver. N using a camera sensor in the first embodiment of the present invention. [Figure 11] It is a diagram showing an example of an object detection result by software of Ver. N using a camera sensor in the first embodiment of the present invention. [Figure 12] It is a diagram showing an example of an accident avoidance necessity flag based on an object detection result by software of Ver. N using a camera sensor in the first embodiment of the present invention. [Figure 13] It is a flowchart showing an example of a processing procedure of an object detection unit by software of Ver. N+1 using a camera sensor in the first embodiment of the present invention. [Figure 14] It is a diagram showing an example of an object detection result by software of Ver. N+1 using a camera sensor in the first embodiment of the present invention. [Figure 15] [ It is a diagram showing an example of an accident avoidance necessity flag based on an object detection result by software of Ver. N+1 using a camera sensor in the first embodiment of the present invention. [Figure 16] It is a flowchart showing an example of a processing procedure for transmitting the execution results of each software in the first embodiment of the present invention to a server. [Figure 17] It is a diagram showing the system configuration of a server in the first embodiment of the present invention. [Figure 18] It is a flowchart showing an example of a processing procedure of a server reception unit in the first embodiment of the present invention. [Figure 19]It is a diagram showing an example of the accident avoidance necessity determination result held in the server in the first embodiment of the present invention. [Figure 20] It is a diagram showing an example of the camera sensor information in the server in the first embodiment of the present invention. [Figure 21] It is a flowchart showing an example of the processing procedure of the performance determination unit that performs the performance determination of the software of Ver. N+1 in the server in the first embodiment of the present invention. [Figure 22] It is a diagram showing an example of the determination performance of the software of Ver. N+1 determined in the server in the first embodiment of the present invention. [Figure 23] It is a flowchart showing an example of the processing procedure of the log output unit that creates and outputs a log based on the determination performance of the software of Ver. N+1 in the server in the first embodiment of the present invention. [Figure 24] It is a diagram showing an example of the log information created based on the determination performance of the software of Ver. N+1 in the server in the first embodiment of the present invention. [Figure 25] It is a diagram showing the overall configuration of the vehicle control device in the second embodiment of the present invention. [Figure 26] It is a flowchart showing an example of the processing procedure of the performance determination unit of the software of Ver. N+1 in the second embodiment of the present invention. [Figure 27] It is a diagram showing an example of the determination performance of the software of Ver. N+1 in the second embodiment of the present invention. [Figure 28] It is a flowchart showing an example of the processing procedure of the log output unit 124 that creates and outputs a log based on the determination performance of the software of Ver. N+1 in the second embodiment of the present invention. [Figure 29] It is a diagram showing an example of the log information created based on the determination performance of the software of Ver. N+1 in the second embodiment of the present invention. [Figure 30A] It is a diagram showing the overall configuration of the vehicle control device in the third embodiment of the present invention. [Figure 30B] It is a diagram showing the overall configuration of the vehicle control device in a modified example of the third embodiment of the present invention. [Figure 31] This flowchart shows an example of the processing procedure of a real-time transmission unit that transmits log information in real time in a third embodiment of the present invention. [Figure 32] This figure shows an example of real-time transmission log information in a third embodiment of the present invention. [Figure 33] This flowchart shows an example of the processing procedure for a non-real-time transmission unit that transmits log information in a non-real-time manner in a third embodiment of the present invention. [Figure 34] This figure shows an example of non-real-time transmission log information in the third embodiment of the present invention. [Figure 35] This figure shows the overall configuration of the vehicle control device in the fourth embodiment of the present invention. [Figure 36] This flowchart shows an example of the processing procedure for the driver input acquisition unit in the fourth embodiment of the present invention. [Figure 37] This figure shows an example of driver input information in a fourth embodiment of the present invention. [Figure 38] This figure shows an example of the processing procedure of the accident avoidance operation detection unit in the fourth embodiment of the present invention. [Figure 39] This figure shows an example of the accident avoidance operation detection result in the fourth embodiment of the present invention. [Figure 40] This figure shows an example of an accident avoidance operation flag (driver) in a fourth embodiment of the present invention. [Modes for carrying out the invention]

[0012] The following embodiments relate to a software verification system and a vehicle control device (electronic control device) used therein. Each embodiment was created to solve the problem of determining the performance of new software (such as detecting degradation), and aims to provide a vehicle control device that enables the performance determination of new software using the execution results of the old and new software and other information in a software verification system.

[0013] (First example) A vehicle control system according to the first embodiment of the present invention will be described with reference to Figures 1 to 24.

[0014] Figure 1 is a diagram showing the overall configuration of a vehicle control system in the first embodiment of the present invention.

[0015] The vehicle control device 1 includes a radar sensor information acquisition unit 101, radar sensor information 102, camera sensor information acquisition unit 103, camera sensor information 104, object detection unit (radar) 105, object detection result (radar) 106, accident avoidance necessity flag (radar) 107, object detection unit (Ver. N) 108, object detection result (Ver. N) 109, accident avoidance necessity flag (Ver. N) 110, object detection unit (Ver. N+1) 111, object detection result (Ver. N+1) 112, accident avoidance necessity flag (Ver. N+1) 113, and a server transmission unit 114.

[0016] The vehicle control device 1 is composed of, for example, a processor such as a CPU (Central Processing Unit), a storage device such as memory, and communication devices according to various communication standards. The functions of the object detection unit (Ver. N) 108 and the object detection unit (Ver. N+1) 111 are realized, for example, by the processor executing software stored in the storage device. The same applies to other functions below.

[0017] Figure 2 shows an example of the connection relationship between a vehicle control device 1 and network-connected control devices in the first embodiment of the present invention. The vehicle control device 1 is connected to a gateway 2, a camera control device 3, a radar control device 4, and a sonar control device 5 via an in-vehicle network. From the gateway 2, vehicle data such as vehicle speed is transmitted to the vehicle control device 1. In addition, sensor data originating from the camera sensor, radar sensor, and sonar sensor are transmitted from the camera control device 3, radar control device 4, and sonar control device 5, respectively, to the vehicle control device 1. Based on this vehicle data and sensor data, the vehicle control device 1 makes decisions such as whether to move, turn, or stop the vehicle, and realizes vehicle control. As shown in the figure, in the vehicle, multiple control devices and gateways are connected by a network, and vehicle control is realized by the control devices communicating sensor data, vehicle data, etc. with each other. This network communication is performed periodically or aperiodicly.

[0018] Figure 3 is a flowchart showing an example of the processing procedure of the radar sensor information acquisition unit 101 in the first embodiment of the present invention. Sensor information during road driving is acquired using a radar sensor. For example, in step S10102 in the figure, the radar sensor information acquisition unit 101 (radar device) acquires the external environment in front of the vehicle as sensor information, and outputs the sensor information in step S10103. Note that the present invention is not limited to radar sensors and other sensors such as lidar sensors can be substituted (allowed as modified examples).

[0019] Figure 4 shows an example of radar sensor information 10201 in the first embodiment of the present invention. The radar sensor information includes sensor data (No. (1)) when there is an obstacle such as a pedestrian in front of the vehicle and accident avoidance maneuvers are required, and sensor data (No. (2)) when there is no obstacle such as a pedestrian in front of the vehicle and accident avoidance maneuvers are not required. Note that the sensor information includes timestamp information.

[0020] Figure 5 is a flowchart showing an example of the processing procedure of the camera sensor information acquisition unit 103 in the first embodiment of the present invention. Sensor information during road driving is acquired using the camera sensor. For example, the camera sensor information acquisition unit 103 (camera device) acquires the external environment in front of the vehicle as sensor information in step S10302 in the figure, and outputs the sensor information in step S10303.

[0021] Figure 6 shows an example of camera sensor information 10401 in the first embodiment of the present invention. The sensor information from the camera includes sensor data (No. (1)) when there is an obstacle such as a pedestrian in front of the vehicle and accident avoidance operation is required, and sensor data (No. (2)) when there is no obstacle such as a pedestrian in front of the vehicle and accident avoidance operation is not required. Note that the sensor information includes timestamp information.

[0022] Figure 7 is a flowchart showing an example of the processing procedure of the object detection unit (radar) 105 in the first embodiment of the present invention. Accident avoidance decisions are made based on the acquired radar sensor information. For example, in step S10502 in the figure, the object detection unit (radar) 105 (processor) acquires radar sensor information 102 output by the radar sensor information acquisition unit 101, performs object detection based on the radar sensor information in step S10503, makes a decision on whether accident avoidance is necessary based on the object detection result in step S10504, and outputs an accident avoidance necessity flag in step S10505.

[0023] Figure 8 shows an example of the object detection result (radar) 10601 in the first embodiment of the present invention. For example, there are cases where a vehicle in front of the vehicle is recognized (No. (1)) and cases where a pedestrian in front of the vehicle is recognized (No. (2)). Note that the present invention does not limit the objects to be detected.

[0024] Figure 9 shows an example of an accident avoidance requirement flag (radar) 10701 in the first embodiment of the present invention. Based on the object detection result (radar) 10601, the system predicts the occurrence of a vehicle accident and determines the accident avoidance requirement flag. For example, there is flag 0 (No. (1)) when no obstacle (pedestrian, etc.) is recognized in front of the vehicle while it is driving and accident avoidance (collision avoidance) is not required, and flag 1 (No. (2)) when an obstacle is recognized in front of the vehicle while it is driving and accident avoidance (collision avoidance) is required. The present invention also includes cases where an obstacle is recognized in front of the vehicle but accident avoidance is not required. The accident avoidance requirement flag includes timestamp information.

[0025] Figure 10 is a flowchart showing an example of the processing procedure of the object detection unit (Ver. N) 108 in the first embodiment of the present invention. Accident avoidance decisions are made based on the acquired camera sensor information. For example, in step S10802 in the figure, the object detection unit (Ver. N) 108 (processor) acquires camera sensor information 104 output by the camera sensor information acquisition unit 103, performs object detection based on the camera sensor information in step S10803, makes a decision on whether accident avoidance is necessary based on the object detection result in step S10804, and outputs an accident avoidance necessity flag in step S10805.

[0026] Figure 11 shows an example of object detection results (Ver. N) 10901 in the first embodiment of the present invention. For example, there are cases where a vehicle in front of the vehicle is recognized (No. (1)) and cases where a pedestrian in front of the vehicle is recognized (No. (2)). Note that the present invention does not limit the objects to be detected.

[0027] Figure 12 shows an example of the accident avoidance requirement flag (Ver. N) 11001 in the first embodiment of the present invention. Based on the object detection result (Ver. N) 10901, the system predicts the occurrence of a vehicle accident and determines the accident avoidance requirement flag. For example, there is flag 0 (No. (1)) when no obstacle (pedestrian, etc.) is recognized ahead of the vehicle while it is driving and accident avoidance is not required, and flag 1 (No. (2)) when an obstacle is recognized ahead of the vehicle while it is driving and accident avoidance is required. The present invention also includes cases where an obstacle is recognized ahead of the vehicle but accident avoidance is not required. The accident avoidance requirement flag includes timestamp information.

[0028] Figure 13 is a flowchart showing an example of the processing procedure of the object detection unit (Ver. N+1) 111 in the first embodiment of the present invention. Accident avoidance decisions are made based on the acquired camera sensor information. For example, in step S11102 in the figure, the object detection unit (Ver. N+1) 111 (processor) acquires camera sensor information 104 output by the camera sensor information acquisition unit 103, performs object detection based on the camera sensor information in step S11103, makes a decision on whether accident avoidance is necessary based on the object detection result in step S11104, and outputs an accident avoidance necessity flag in step S11105.

[0029] Figure 14 shows an example of object detection results (Ver. N+1)11201 in the first embodiment of the present invention. For example, there are cases where a vehicle in front of the vehicle is recognized (No. (1)) and cases where a pedestrian in front of the vehicle is recognized (No. (2)). Note that the present invention does not limit the objects to be detected.

[0030] Figure 15 shows an example of the accident avoidance requirement flag (Ver. N+1) 11301 in the first embodiment of the present invention. Based on the object detection result (Ver. N+1) 11201, the system predicts the occurrence of a vehicle accident and determines the accident avoidance requirement flag. For example, there is flag 0 (No. (1)) when no obstacle (pedestrian, etc.) is recognized ahead of the vehicle while it is driving and accident avoidance is not required, and flag 1 (No. (2)) when an obstacle is recognized ahead of the vehicle while it is driving and accident avoidance is required. The present invention also includes cases where an obstacle is recognized ahead of the vehicle but accident avoidance is not required. The accident avoidance requirement flag includes timestamp information.

[0031] Figure 16 is a flowchart showing an example of the processing procedure of the server transmission unit 114 in the first embodiment of the present invention. The server transmission unit 114 (processor and communication device) acquires each accident avoidance requirement flag in step S11402 and acquires synchronized camera sensor information in step S11403. In step S11404, it transmits the acquired information to the server.

[0032] Figure 17 is a diagram showing the overall configuration of the server system in the first embodiment of the present invention.

[0033] Server 6 includes a server receiving unit 115, an accident avoidance necessity determination result 116, camera sensor information 117, a performance determination unit 118, a determination performance 119, a log output unit 120, and log information 121.

[0034] The server 6 is composed of, for example, a processor such as a CPU, memory, a storage device such as a hard disk, and communication devices corresponding to various communication standards. The functions of the performance determination unit 118, etc., are realized, for example, by the processor executing software stored in the storage device. The same applies to other functions below.

[0035] Figure 18 is a flowchart showing an example of the processing procedure in the server receiving unit 115 in the first embodiment of the present invention. For example, the server receiving unit 115 (processor and communication device) acquires the accident avoidance necessity result (accident avoidance necessity flag (radar) 107, accident avoidance necessity flag (Ver. N) 110, and accident avoidance necessity flag (Ver. N+1) 113) and camera sensor information 104 in step S11502, and outputs the accident avoidance necessity result (accident avoidance necessity flag (radar) 107, accident avoidance necessity flag (Ver. N) 110, and accident avoidance necessity flag (Ver. N+1) 113) and camera sensor information 104 in step S11503.

[0036] Figure 19 is a diagram showing an example of the accident avoidance necessity determination result 11601 of the first embodiment of the present invention. For example, when accident avoidance flag (radar) 107 requires avoidance, accident avoidance flag (Ver. N) 110 requires avoidance, and accident avoidance flag (Ver. N+1) 113 requires avoidance (No. (1)), when accident avoidance flag (radar) 107 requires avoidance, accident avoidance flag (Ver. N) 110 requires avoidance, and accident avoidance flag (Ver. N+1) 113 does not require avoidance (No. (2)), when accident avoidance flag (radar) 107 requires avoidance, accident avoidance flag (Ver. N) 110 does not require avoidance, and accident avoidance flag (Ver. N+1) 113 requires avoidance (No. (3)), when accident avoidance flag (radar) 107 requires avoidance, accident avoidance flag (Ver. N) 110 does not require avoidance, and accident avoidance flag (Ver. If N+1)113 does not require avoidance (No. (4)), if accident avoidance requirement flag (radar) 107 does not require avoidance and accident avoidance requirement flag (Ver. N) 110 requires avoidance and accident avoidance requirement flag (Ver. N+1)113 requires avoidance (No. (5)), if accident avoidance requirement flag (radar) 107 does not require avoidance and accident avoidance requirement flag (Ver. N) 110 requires avoidance and accident avoidance requirement flag (Ver. N+1)113 does not require avoidance (No. (6)), if accident avoidance requirement flag (radar) 107 does not require avoidance and accident avoidance requirement flag (Ver. N) 110 does not require avoidance and accident avoidance requirement flag (Ver. N+1)113 requires avoidance (No. (7)), if accident avoidance requirement flag (radar) 107 does not require avoidance and accident avoidance requirement flag (Ver. N) 110 does not require avoidance and accident avoidance requirement flag (Ver. There are cases where N+1)113 does not need to be avoided (No. (8)).

[0037] Figure 20 shows an example of camera sensor information 11701 in the first embodiment of the present invention. The sensor information from the camera includes sensor data (No. (1)) when there is an obstacle such as a pedestrian in front of the vehicle and accident avoidance operation is required, and sensor data (No. (2)) when there is no obstacle such as a pedestrian in front of the vehicle and accident avoidance operation is not required. Note that the sensor information includes timestamp information.

[0038] Figure 21 is a flowchart showing an example of the processing procedure of the performance determination unit 118 in the first embodiment of the present invention. The performance of software Ver. N+1 is determined based on the accident avoidance necessity result. For example, the performance determination unit 118 (processor) obtains the accident avoidance necessity determination result 116 in step S11802, performs a performance determination of software Ver. N+1 in step S11803, and outputs the determined performance of software Ver. N+1 in step S11804. The present invention makes it possible to use other information for performance determination.

[0039] Figure 22 shows an example of the determination performance 11901 in the first embodiment of the present invention. The performance of Ver. N+1 is represented by the combination of information for each accident avoidance necessity flag.

[0040] For example, if accident avoidance flag (radar) 107 is avoidance required, accident avoidance flag (Ver. N) 110 is avoidance required, and accident avoidance flag (Ver. N+1) 113 is avoidance required (No. (1)), the result of the judgment is no change in performance (success).

[0041] When accident avoidance flag (radar) 107 indicates avoidance is necessary, accident avoidance flag (Ver. N) 110 indicates avoidance is necessary, and accident avoidance flag (Ver. N+1) 113 indicates avoidance is not necessary (No. (2)), the result of the judgment is performance degradation.

[0042] When accident avoidance flag (radar) 107 indicates avoidance is necessary, accident avoidance flag (Ver. N) 110 indicates avoidance is not necessary, and accident avoidance flag (Ver. N+1) 113 indicates avoidance is necessary (No. (3)), the result of the judgment is performance improvement.

[0043] When accident avoidance flag (radar) 107 indicates avoidance is necessary, accident avoidance flag (Ver. N) 110 indicates avoidance is not necessary, and accident avoidance flag (Ver. N+1) 113 indicates avoidance is not necessary (No. (4)), the result of the judgment is no change in performance (edge ​​case).

[0044] When accident avoidance flag (radar) 107 does not require avoidance, accident avoidance flag (Ver. N) 110 requires avoidance, and accident avoidance flag (Ver. N+1) 113 requires avoidance (No. (5)), the result of the judgment is no change in performance (edge ​​case).

[0045] When accident avoidance flag (radar) 107 is not required, accident avoidance flag (Ver. N) 110 is required, and accident avoidance flag (Ver. N+1) 113 is not required (No. (6)), the result of the judgment is performance improvement.

[0046] When accident avoidance flag (radar) 107 is not required, accident avoidance flag (Ver. N) 110 is not required, and accident avoidance flag (Ver. N+1) 113 is required (No. (7)), the result of the judgment is performance degradation.

[0047] If accident avoidance flag (radar) 107 is not required, accident avoidance flag (Ver. N) 110 is not required, and accident avoidance flag (Ver. N+1) 113 is not required (No. (8)), the result of the judgment is no change in performance (success).

[0048] Figure 23 is a flowchart showing an example of the processing procedure of the log output unit 120 in the first embodiment of the present invention. For example, the log output unit 120 (processor) acquires the judgment performance 119 in step S12002, acquires camera sensor information 117 synchronized with the judgment performance in step S12003, creates log information in step S12004 using the combination of the judgment performance 119 and the camera sensor information 117 when the judgment performance 119 is either performance degradation or no performance change (edge ​​case), and outputs the log information in step S12005. It is also possible to create log information by combining the judgment performance 119 with the camera sensor information 117 even if the judgment performance 119 is other information.

[0049] Figure 24 shows an example of log information 12101 in the first embodiment of the present invention. The log information includes software judgment performance information and camera sensor information for Ver. N+1. For example, if the judgment performance 119 is unchanged (success) (No. (1)), the log information consists only of performance change (success) information; if the judgment performance 119 is improved (No. (2)), the log information consists only of performance improvement judgment information; if the judgment performance 119 is degraded (No. (3)), the log information consists of performance improvement judgment information and camera sensor information; and if the judgment performance 119 is unchanged (edge ​​case) (No. (4)), the log information consists of performance change (edge ​​case) judgment information and camera sensor information. Note that the present invention does not limit the information included in the log information to camera sensor information, but makes it possible to include other information such as radar sensor information.

[0050] The main features of the first embodiment can also be summarized as follows:

[0051] The vehicle control device 1 and server 6 constitute a software verification system for verifying the new version (Ver. N+1) of the control software (software that implements the object detection unit (Ver. N+1) 111).

[0052] The software verification system (server 6) uses the first piece of information (accident avoidance flag (Ver. N) 110), the second piece of information (accident avoidance flag (Ver. N+1) 113), and the third piece of information (accident avoidance flag (radar) 107) relating to vehicle control other than the first and second pieces of information to detect a degradation (performance reduction) in the new version (Ver. N+1) of the control software.

[0053] Here, the first piece of information (accident avoidance requirement flag (Ver. N) 110) is the output of the current version (Ver. N) of the control software (software that implements the object detection unit (Ver. N) 108) used for vehicle control, with sensor data (camera sensor information 104) from a sensor mounted on the vehicle (camera sensor information acquisition unit 103) as input. The second piece of information (accident avoidance requirement flag (Ver. N+1) 113) is the output of the new version (Ver. N+1) of the control software (software that implements the object detection unit (Ver. N+1) 111) that is not used for vehicle control, with sensor data (camera sensor information 104) as input.

[0054] The software verification system (server 6) verifies (re-verifies) the new version of the control software using the sensor data (camera sensor information 104) obtained when a regression is detected.

[0055] By using a third piece of information (accident avoidance necessity flag (radar) 107), the degradation detection performance can be improved. Furthermore, by using sensor data (camera sensor information 104) obtained when degradation is detected, the control software can be quickly verified. As a result, it becomes easier to improve software that uses vehicle sensor data as input.

[0056] The software verification system (server 6) determines that there is a degradation (performance decrease) if the first piece of information (accident avoidance requirement flag (Ver. N) 110) and the second piece of information (accident avoidance requirement flag (Ver. N+1) 113) do not match, but the first piece of information (accident avoidance requirement flag (Ver. N) 110) and the third piece of information (accident avoidance requirement flag (radar) 107) do match.

[0057] By comparing the first piece of information with the second piece of information, and then comparing the first piece of information with the third piece of information, it is possible to reliably detect degradation in the control software.

[0058] In this embodiment, the third piece of information (accident avoidance requirement flag (radar) 107) is information indicating whether accident avoidance is necessary based on the radar sensor. The sensor mounted on the vehicle (which outputs sensor data input to the control software) is a camera (camera sensor information acquisition unit 103).

[0059] By using a highly accurate radar sensor to determine whether accident avoidance is necessary, the degradation detection performance of control software that uses camera sensor data as input can be improved.

[0060] In detail, the software verification system uses the first, second, and third pieces of information to determine the performance change of the new version of the software compared to the current version, and verifies the new version of the software using sensor data corresponding to the time when the performance change was determined.

[0061] By using the first, second, and third pieces of information, it is possible to precisely determine the performance changes of the new version of the software. As a result, it becomes easier to improve software that uses vehicle sensor data as input.

[0062] Specifically, the software verification system determines that there is no change in performance if the first, second, and third pieces of information indicate that accident avoidance is necessary or has been achieved (Figure 22, No. (1)), determines that performance has deteriorated if the first and third pieces of information indicate that accident avoidance is necessary or has been achieved, and the second piece of information indicates that accident avoidance is unnecessary or has not been achieved (Figure 22, No. (2)), determines that performance has improved if the second and third pieces of information indicate that accident avoidance is necessary or has been achieved, and the first piece of information indicates that accident avoidance is unnecessary or has not been achieved (Figure 22, No. (3)), and determines that there is no change in performance if the third piece of information indicates that accident avoidance is necessary or has been achieved, and the first and second pieces of information indicate that accident avoidance is unnecessary or has not been achieved (Figure 22 If the first and second pieces of information indicate that accident avoidance is necessary or has been avoided, and the third piece of information indicates that accident avoidance is unnecessary or has not been avoided, then it is determined that there is no change in performance (Figure 22, No. (5)). If the first piece of information indicates that accident avoidance is necessary or has been avoided, and the second and third pieces of information indicate that accident avoidance is unnecessary or has not been avoided, then it is determined that the performance has improved (Figure 22, No. (6)). If the second piece of information indicates that accident avoidance is necessary or has been avoided, and the first and third pieces of information indicate that accident avoidance is unnecessary or has not been avoided, then it is determined that the performance has deteriorated (Figure 22, No. (7)). If the first, second, and third pieces of information indicate that accident avoidance is unnecessary or has not been avoided, then it is determined that there is no change in performance (Figure 22, No. (8)).

[0063] Here, the first and second pieces of information indicate whether or not accident avoidance is necessary based on sensor data, and the third piece of information indicates whether or not accident avoidance is necessary based on data different from the sensor data. In this embodiment, the change in performance is determined by the server 6 (performance determination unit 118 in Figure 17), but it may also be determined by the vehicle control device 1 (performance determination unit 122 in Figure 25, which will be described later).

[0064] Since there are two possible combinations of the first, second, and third pieces of information, it is possible to determine eight different performance changes in the new version of the software.

[0065] The software verification system uses sensor data corresponding to the judgment results of No. (2), (4), (5), and (7) in Figure 22 as training data for cases where improvements to the new version of the software are necessary, or it uses sensor data corresponding to the judgment results of No. (1), (3), (6), and (8) in Figure 22 as training data for cases where improvements to the new version of the software are not necessary.

[0066] Since training data for cases requiring improvement or cases that do not require improvement are obtained from the real environment, learning accuracy and learning speed are improved.

[0067] As explained above, the software verification system in this embodiment is configured to compare the output of the current version of the control software with the output of the new version of the control software and other vehicle control information, thereby enabling the detection of regressions in the new version of the software. As a result, it has the effect of enabling effective data collection and re-verification for improving the new version of the software.

[0068] (Second example) Consider the case where data is stored. A vehicle control device and method according to a second embodiment of the present invention will be described with reference to Figures 25 to 29.

[0069] The difference from the first embodiment is that, instead of transmitting the accident avoidance requirement flag (radar) 107, accident avoidance requirement flag (Ver. N) 110, accident avoidance requirement flag (Ver. N+1) 113, and camera sensor information 104 all to the server, the vehicle control device 1 performs a performance determination of the Ver. N+1 software based on this information. The second embodiment has the effect of reducing the amount of log information data shown in the first embodiment and reducing the amount of communication. Note that the same reference numerals are used for the same configurations and procedures as in the first embodiment and their descriptions are omitted.

[0070] Figure 25 shows the overall configuration of the vehicle control device 1 in a second embodiment of the present invention. In the second embodiment as well, the vehicle control device has a performance determination unit 122, a determination performance 123, a log output unit 124, and log information 125 instead of a server transmission unit 114.

[0071] Figure 26 is a flowchart showing an example of the processing procedure of the performance determination unit 122 in a second embodiment of the present invention. The performance of the Ver. N+1 software is determined based on the accident avoidance necessity flag. For example, the performance determination unit 122 (processor) acquires the accident avoidance necessity flag (radar) 107, the accident avoidance necessity flag (Ver. N) 110, and the accident avoidance necessity flag (Ver. N+1) 113 in step S12202, performs a performance determination of the Ver. N+1 software in step S12203, and outputs the determined performance of the Ver. N+1 software in step S12204. The present invention makes it possible to use other information for performance determination.

[0072] Figure 27 shows an example of the determination performance 12301 in the second embodiment of the present invention. The performance of Ver. N+1 is represented by the combination of information for each accident avoidance necessity flag.

[0073] For example, if accident avoidance flag (radar) 107 is avoidance required, accident avoidance flag (Ver. N) 110 is avoidance required, and accident avoidance flag (Ver. N+1) 113 is avoidance required (No. (1)), the result of the judgment is no change in performance (success).

[0074] When accident avoidance flag (radar) 107 indicates avoidance is necessary, accident avoidance flag (Ver. N) 110 indicates avoidance is necessary, and accident avoidance flag (Ver. N+1) 113 indicates avoidance is not necessary (No. (2)), the result of the judgment is performance degradation.

[0075] When accident avoidance flag (radar) 107 indicates avoidance is necessary, accident avoidance flag (Ver. N) 110 indicates avoidance is not necessary, and accident avoidance flag (Ver. N+1) 113 indicates avoidance is necessary (No. (3)), the result of the judgment is performance improvement.

[0076] When accident avoidance flag (radar) 107 indicates avoidance is necessary, accident avoidance flag (Ver. N) 110 indicates avoidance is not necessary, and accident avoidance flag (Ver. N+1) 113 indicates avoidance is not necessary (No. (4)), the result of the judgment is no change in performance (edge ​​case).

[0077] When accident avoidance flag (radar) 107 does not require avoidance, accident avoidance flag (Ver. N) 110 requires avoidance, and accident avoidance flag (Ver. N+1) 113 requires avoidance (No. (5)), the result of the judgment is no change in performance (edge ​​case).

[0078] When accident avoidance flag (radar) 107 is not required, accident avoidance flag (Ver. N) 110 is required, and accident avoidance flag (Ver. N+1) 113 is not required (No. (6)), the result of the judgment is performance improvement.

[0079] When accident avoidance flag (radar) 107 is not required, accident avoidance flag (Ver. N) 110 is not required, and accident avoidance flag (Ver. N+1) 113 is required (No. (7)), the result of the judgment is performance degradation.

[0080] If accident avoidance flag (radar) 107 is not required, accident avoidance flag (Ver. N) 110 is not required, and accident avoidance flag (Ver. N+1) 113 is not required (No. (8)), the result of the judgment is no change in performance (success).

[0081] Figure 28 is a flowchart showing an example of the processing procedure of the log output unit 124 in a second embodiment of the present invention. For example, the log output unit 124 (processor) acquires the judgment performance 123 in step S12402, acquires camera sensor information 104 synchronized with the judgment performance in step S12403, creates log information in step S12404 using the combination of the judgment performance 123 and the camera sensor information 104 when the judgment performance 123 is either performance degradation or no performance change (edge ​​case), and outputs the log information in step S12405. It is also possible to create log information by combining the judgment performance 123 with the camera sensor information 104 even if the judgment performance 123 is other information.

[0082] Figure 29 shows an example of log information 12501 in a second embodiment of the present invention. The log information includes software judgment performance information and camera sensor information for Ver. N+1. For example, if the judgment performance 123 is unchanged (success) (No. (1)), the log information consists only of performance change (success) information; if the judgment performance 123 is improved (No. (2)), the log information consists only of performance improvement judgment information; if the judgment performance 123 is degraded (No. (3)), the log information consists of performance improvement judgment information and camera sensor information; and if the judgment performance 123 is unchanged (edge ​​case) (No. (4)), the log information consists of performance change (edge ​​case) judgment information and camera sensor information. Note that the present invention does not limit the information included in the log information to camera sensor information, but makes it possible to include other information such as radar sensor information.

[0083] The main features of the second embodiment can also be summarized as follows:

[0084] The vehicle control device 1 includes a degradation detection unit (performance determination unit 122) that detects degradation (performance deterioration) of the control software of the new version (Ver. N+1) using first information (accident avoidance necessity flag (Ver. N) 110), second information (accident avoidance necessity flag (Ver. N+1) 113), and third information relating to vehicle control other than the first and second information (accident avoidance necessity flag (radar) 107), and a log information assignment unit (log output unit 124) that assigns log information related to the degradation to sensor data (camera sensor information 104) at the time the degradation detection unit detects the degradation.

[0085] Here, the first piece of information (accident avoidance flag (Ver. N) 110) is the output of the current version (Ver. N) of the control software used for vehicle control, with sensor data (camera sensor information 104) from a sensor (camera sensor information acquisition unit 103) mounted on the vehicle as input. The second piece of information (accident avoidance flag (Ver. N+1) 113) is the output of the new version (Ver. N+1) of the control software, which is not used for vehicle control, with sensor data (camera sensor information 104) as input.

[0086] By adding log information regarding degradation to the sensor data (camera sensor information 104), it becomes easier to verify degradation using the sensor data. As a result, it becomes easier to improve software that takes vehicle sensor data as input. Alternatively, the sensor data (camera sensor information 104) with log information added may be uploaded to the server when the charging cable of the charging station's charger is connected to the charging socket of the vehicle (electric vehicle, etc.).

[0087] As explained above, the vehicle control device in this embodiment is configured to perform Ver. N+1 performance judgment internally within the vehicle control device 1 and create log information in combination with camera sensor information, thereby enabling the selection of camera sensor information. As a result, for example, it has the effect of reducing the amount of communication data when uploading log information to the server.

[0088] (Third embodiment) Real-time transmission A vehicle control device and method according to a third embodiment of the present invention will be described with reference to Figures 30A to 34.

[0089] The difference from the first embodiment is that, instead of transmitting the accident avoidance requirement flag (radar) 107, accident avoidance requirement flag (Ver. N) 110, accident avoidance requirement flag (Ver. N+1) 113, and camera sensor information 104 all to the server, the vehicle control device 1 performs a performance determination of the Ver. N+1 software based on this information, classifies the log information according to the determination result, and transmits it in real time or non-real time. The third embodiment has the effect of enabling rapid verification on the server while suppressing the increase in processing load within the vehicle caused by data transmission to the server. Note that the same reference numerals are used for the same configurations and procedures as in the first embodiment, and their explanations are omitted.

[0090] Figure 30A shows the overall configuration of the vehicle control device 1 in the third embodiment of the present invention. Compared to the first embodiment, the vehicle control device 1 in the third embodiment has a performance determination unit 122, a determination performance 123, a log output unit 124, log information 125, a real-time transmission unit 126, real-time transmission log information 127, a non-real-time transmission unit 128, and non-real-time transmission log information 129 instead of a server transmission unit 114. Note that, as shown in Figure 30B, the real-time transmission unit 126, real-time transmission log information 127, non-real-time transmission unit 128, and non-real-time transmission log information 129 may be provided in another electronic control device such as a TCU (Telematics Control Unit).

[0091] Figure 31 is a flowchart showing an example of the processing procedure of the real-time transmission unit 126 in a third embodiment of the present invention. The real-time transmission unit 126 (processor and communication device) acquires log information 125 in step S12602, extracts log data in step S12603 when the Ver. N+1 software determines that there is a performance degradation or no performance change (edge ​​case), and transmits the extracted log data in real time in step S12604. In this invention, the log information to be transmitted in real time can be changed.

[0092] Figure 32 shows an example of real-time transmission log information 12701 in a third embodiment of the present invention. For example, the real-time transmission log information includes determination information and camera sensor information (No. (1)) when the Ver. N+1 software is experiencing performance degradation, and determination information and camera sensor information (No. (2)) when the Ver. N+1 software is experiencing no performance change (edge ​​case). The present invention does not limit the information included in the log information to camera sensor information, but makes it possible to include other information such as radar sensor information.

[0093] Figure 33 is a flowchart showing an example of the processing procedure of the non-real-time transmission unit 128 in a third embodiment of the present invention. The non-real-time transmission unit 128 (processor and communication device) acquires log information 125 in step S12802, extracts log data in step S12803 when the Ver. N+1 software determines that performance has improved or there is no performance change (success), and transmits the extracted log data in non-real-time in step S12804. For example, by temporarily storing the log data in the vehicle's storage, the data can be transmitted all at once while the vehicle is stopped, suppressing the increase in processing load within the vehicle caused by data transmission to the server. In this invention, the log information for non-real-time transmission can be changed. Non-real-time transmission may also be performed when the processing load of the vehicle control device 1 is less than a predetermined value.

[0094] Figure 34 shows an example of non-real-time transmission log information 12901 in a third embodiment of the present invention. For example, the non-real-time transmission log information includes determination information (No. (1)) for when the Ver. N+1 software shows no performance change (success) and determination information (No. (2)) for when the Ver. N+1 software shows performance improvement. In this embodiment, the non-real-time transmission log information does not include camera sensor information, but it may include camera sensor information corresponding to the determination result (determination performance).

[0095] The main features of the third embodiment can also be summarized as follows:

[0096] The software verification system (vehicle control device 1) includes a degradation detection unit (performance determination unit 122) mounted on the vehicle that detects degradation, a log information assignment unit (log output unit 124) mounted on the vehicle that assigns log information related to degradation to sensor data (camera sensor information 104) at the time the degradation detection unit (performance determination unit 122) detects degradation, and a data transmission unit (real-time transmission unit 126, non-real-time transmission unit 128) mounted on the vehicle that transmits the sensor data (camera sensor information 104) with the assigned log information to the server 6.

[0097] By sending sensor data with log information attached to it to the server, the server can perform verification using the sensor data for each piece of log information.

[0098] As shown in Figure 30B, the vehicle control device 1 used in the software verification system may output sensor data (camera sensor information 104) with log information attached to it to the data transmission unit (real-time transmission unit 126 and non-real-time transmission unit 128 provided in the TCU) that transmits data to the server 6.

[0099] By not providing a data transmission unit that sends data to the server 6 in the vehicle control device 1, manufacturing costs can be reduced.

[0100] The software verification system (vehicle control device 1) is mounted on the vehicle and includes a storage unit (memory device) that stores log information (real-time transmitted log information 127, non-real-time transmitted log information 129). In this embodiment, the data transmission unit (non-real-time transmission unit 128) transmits the data (non-real-time transmitted log information 129) stored in the storage unit to the server when the vehicle stops.

[0101] By sending data (non-real-time transmission log information 129) to the server when the vehicle is stopped, it is possible to secure hardware resources used for controlling the vehicle while driving, while suppressing the processing load.

[0102] As explained above, the vehicle control device in this embodiment is configured to divide the log information transmission process into real-time and non-real-time modes, enabling the transmission of log information while considering the processing load within the vehicle control device. As a result, it has the effect of reducing hardware costs.

[0103] (Fourth embodiment) A specific example of an accident avoidance flag using driver information A vehicle control device and method according to a fourth embodiment of the present invention will be described with reference to Figures 35 to 40.

[0104] The difference from the first embodiment is that, instead of the radar sensor information acquisition unit 101 and radar sensor information 102, the driver input acquisition unit 130 and driver input information 131 are used to prepare the accident avoidance operation flag. The fourth embodiment has the effect of enabling the collection of accident occurrence cases that are difficult to recognize and judge with on-board sensors through the recognition and judgment of the driver, and can be used for evaluation and improvement of Ver. N+1 software. Note that the same reference numerals are used for the same configurations and procedures as in the first embodiment and their descriptions are omitted.

[0105] Figure 35 shows the overall configuration of the vehicle control device 1 in the fourth embodiment of the present invention. Compared to the first embodiment, the vehicle control device 1 in the fourth embodiment has a driver input acquisition unit 130 and driver input information 131 instead of a radar sensor information acquisition unit 101 and radar sensor information 102, and an accident avoidance operation detection unit 132, an accident avoidance operation detection result 133 and an accident avoidance operation flag (driver) 134 instead of an object detection unit (radar) 105, object detection result (radar) 106 and accident avoidance necessity flag (radar) 107.

[0106] Figure 36 is a flowchart showing an example of the processing procedure of the driver input acquisition unit 130 in the fourth embodiment of the present invention. The driver input acquisition unit 130 (accelerator opening sensor, brake pedal pressure sensor, steering angle sensor, etc.) acquires driver input information in step S13002 and outputs driver input information in S13003.

[0107] Figure 37 shows an example of driver input information 13101 in a fourth embodiment of the present invention. For example, it may include accelerator input value (No. (1)), brake input value (No. (2)), and steering input value (No. (3)).

[0108] Figure 38 is a flowchart showing the processing procedure of the accident avoidance operation detection unit 132 in the fourth embodiment of the present invention. The accident avoidance operation detection unit 132 (processor) acquires driver input information in step S13202, determines in step S13203 whether the driver input is an accident avoidance operation, and outputs the determination result in step S13204. For example, the accident avoidance operation detection unit 132 determines the presence or absence of an accident avoidance operation from the amount of change in the accelerator input value (time derivative), the amount of change in the brake input value (time derivative), and the amount of change in the steering input value (time derivative).

[0109] Figure 39 shows an example of the accident avoidance operation determination result 13301 in the fourth embodiment of the present invention. For example, the determination result may be no accident avoidance operation (No. (1)) or accident avoidance operation performed (No. (2)).

[0110] Figure 40 shows an example of the accident avoidance operation flag 13401 in the fourth embodiment of the present invention. For example, there is flag 0 (No. (1)) when no accident avoidance operation is determined based on the driver input, and flag 1 (No. (2)) when an accident avoidance operation is determined based on the driver input.

[0111] The main features of the fourth embodiment can also be summarized as follows:

[0112] The software verification system (server 6) detects a degradation (performance reduction) in the new version (Ver. N+1) of the control software using a first piece of information (accident avoidance requirement flag (Ver. N) 110), a second piece of information (accident avoidance requirement flag (Ver. N+1) 113), and a third piece of information related to vehicle control other than the first and second pieces of information (accident avoidance operation flag (driver) 134). Here, the third piece of information (accident avoidance operation flag (driver) 134) indicates whether or not the driver performed an accident avoidance operation.

[0113] By using a third piece of information (accident avoidance operation flag (driver) 134), the degradation detection performance can be improved.

[0114] The configuration and operation of server 6 are the same as in the first embodiment, so a description will be omitted. The performance determination unit 122, the determined performance 123, the log output unit 124, and the log information 125 may be provided in the vehicle control device 1, as in the second embodiment.

[0115] As explained above, the software verification system in this embodiment is configured to acquire accident avoidance operation flags based on input information from the driver, making it possible to compare the driver's judgment results with the output results of the control software. As a result, it has the effect of being able to acquire sensor data in situations where the system does not operate correctly.

[0116] According to the first to fourth embodiments of the present invention, the performance of the new version of the software is determined by comparing the execution results of the old version of the software with the execution results of the new version of the software and the detected accident avoidance operation information, making it possible to collect data necessary for performance improvement. Furthermore, by selecting and discarding sensor data according to the determination performance of the new version of the software, it is possible to reduce the amount of log information transmitted to the server. In addition, by dividing the processing of log information transmission to the server into real-time transmission and non-real-time transmission, it is possible to reduce hardware costs by transmitting data considering the processing load within the vehicle control device. Furthermore, by using driver input information for accident avoidance operation information, it becomes possible to acquire sensor data in situations where the system does not operate normally.

[0117] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. Furthermore, it is possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0118] Furthermore, some or all of the above configurations and functions may be implemented in hardware, for example, by designing them as integrated circuits. Alternatively, the above configurations and functions may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD. [Explanation of Symbols]

[0119] 1. Vehicle control system 2 Gateways 3. Camera control device 4. Radar control device 5. Sonar control device 6 servers 101 Radar sensor information acquisition unit 102 Radar Sensor Information 103 Camera sensor information acquisition unit 104 Camera Sensor Information 105 Object detection unit (radar) 106 Object detection results (radar) 107 Accident avoidance flag (radar) 108 Object detection unit (Ver. N) 109 Object detection results (Ver. N) 110 Accident avoidance necessity flag (Ver. N) 111 Object detection unit (Ver. N+1) 112 Object detection results (Ver. N+1) 113 Accident avoidance necessity flag (Ver. N+1) 114 Server Transmission Unit 115 Server receiving unit 116 Accident avoidance necessity determination result 117 Camera Sensor Information 118 Performance judgment section 119 Judgment performance 120 Log output section 121 Log Information 122 Performance judgment section 123 Judgment performance 124 Log output section 125 Log Information 126 Real-time transmission unit 127 Real-time transmission log information 128 Non-real-time transmission section 129 Non-real-time transmission log information 130 Driver Input Acquisition Unit 131 Driver Input Information 132 Accident avoidance operation detection unit 133 Accident Avoidance Maneuver Detection Results 134 Accident avoidance operation flag (driver)

Claims

1. Sensor data from sensors mounted on the vehicle is used as input, and the first information is the output of the current version of the control software used to control the vehicle, The sensor data is used as input, and a second piece of information is obtained, which is the output of a new version of control software that is not used for controlling the vehicle. Using a third piece of information relating to the control of the vehicle, other than the first and second pieces of information, the regression of the new version of the control software is detected. A software verification system that verifies the new version of the control software using the sensor data when the aforementioned degradation is detected, The third piece of information is information regarding whether or not the driver performed an accident avoidance maneuver, detected from driver input information entered by the driver of the vehicle. The first and second pieces of information are information regarding the necessity of accident avoidance, indicating whether or not the vehicle needs to avoid an accident. A software verification system that determines the new version of the control software to be a regression when the necessity of accident avoidance in the first information and the second information do not match, and the necessity of accident avoidance in the first information and the presence or absence of accident avoidance operations by the driver in the third information match.

2. A degradation detection unit mounted on the aforementioned vehicle detects the degradation, A log information assignment unit is installed in the vehicle and assigns log information related to the degradation to the sensor data at the time the degradation detection unit detects the degradation, A data transmission unit mounted on the vehicle transmits the sensor data to a server, to which the log information is attached. The software verification system according to claim 1, comprising:

3. It is mounted on the vehicle and includes a storage unit that stores the log information, The software verification system according to claim 2, wherein the data transmission unit transmits data stored in the storage unit to a server when the vehicle is stopped.

4. A first piece of information which is the output of the current version of the control software used to control the vehicle, and which takes sensor data from a sensor mounted on the vehicle as input. The sensor data is used as input, and a second piece of information is obtained, which is the output of a new version of control software that is not used for controlling the vehicle. Using a third piece of information relating to the control of the vehicle, other than the first and second pieces of information, the regression of the new version of the control software is detected. A software verification system that verifies the new version of the control software using the sensor data when the aforementioned degradation is detected, The third piece of information is information indicating whether or not accident avoidance is necessary based on radar sensors. The sensor mounted on the aforementioned vehicle is a camera, A software verification system that determines a regression when the first information and the second information do not match, but the first information and the third information do match.

5. A first piece of information which is the output of the current version of the control software used to control the vehicle, and which takes sensor data from a sensor mounted on the vehicle as input. The sensor data is used as input, and a second piece of information is obtained, which is the output of a new version of control software that is not used for controlling the vehicle. Using a third piece of information relating to the control of the vehicle, other than the first and second pieces of information, the regression of the new version of the control software is detected. A software verification system that verifies the new version of the control software using the sensor data when the aforementioned degradation is detected, The third piece of information is information indicating whether accident avoidance is necessary based on the rida sensor. The sensor mounted on the aforementioned vehicle is a camera, A software verification system that determines a regression when the first information and the second information do not match, but the first information and the third information do match.

6. A vehicle control device used in the software verification system according to claim 1, 4, or 5, A regression detection unit that detects the aforementioned regression, A log information assignment unit adds log information related to the degradation to the sensor data at the time the degradation detection unit detects the degradation, A vehicle control device comprising a data transmission unit that transmits sensor data to a server to which the aforementioned log information is attached.

7. A vehicle control device used in the software verification system according to claim 1, 4, or 5, A regression detection unit that detects the aforementioned regression, The system includes a log information assignment unit that assigns log information related to the degradation to the sensor data at the time the degradation detection unit detects the degradation, A vehicle control device that outputs sensor data with the aforementioned log information attached to it to a data transmission unit that transmits data to a server.

8. A first piece of information which is the output of the current version of the software used to control the vehicle, and which takes sensor data from a sensor mounted on the vehicle as input. The sensor data is used as input, and a second piece of information is obtained, which is the output of a new version of software that is not used for controlling the vehicle. Using the third piece of information relating to the control of the vehicle, in addition to the first and second pieces of information, the change in performance of the new version of the software compared to the current version of the software is determined. A software verification system that verifies the new version of the software using sensor data corresponding to the time when the change in performance was determined, The first and second pieces of information are information indicating whether or not accident avoidance is necessary based on the sensor data. The third piece of information is information indicating whether or not accident avoidance is necessary, based on data different from the sensor data. (1) If the first information, the second information, and the third information indicate that accident avoidance is necessary or that accident avoidance has occurred, then it is determined that there is no change in performance. (2) If the first information and the third information indicate that accident avoidance is necessary or that accident avoidance has occurred, and the second information indicates that accident avoidance is unnecessary or that accident avoidance has not occurred, then it is determined that the performance has deteriorated. (3) If the second information and the third information indicate that accident avoidance is necessary or that accident avoidance has occurred, and the first information indicates that accident avoidance is unnecessary or that accident avoidance did not occur, then it is determined that the performance has improved. (4) If the third piece of information indicates that accident avoidance is necessary or that accident avoidance has occurred, and the first piece of information and the second piece of information indicate that accident avoidance is unnecessary or that accident avoidance did not occur, then it is determined that there is no change in performance. (5) If the first information and the second information indicate that accident avoidance is necessary or that accident avoidance has occurred, and the third information indicates that accident avoidance is unnecessary or that accident avoidance has not occurred, then it is determined that there is no change in performance. (6) If the first piece of information indicates that accident avoidance is necessary or that accident avoidance has occurred, and the second piece of information and the third piece of information indicate that accident avoidance is unnecessary or that accident avoidance did not occur, then it is determined that the performance has improved. (7) If the second information indicates that accident avoidance is necessary or that accident avoidance has occurred, and the first information and the third information indicate that accident avoidance is unnecessary or that accident avoidance did not occur, then it is determined that the performance has deteriorated. (8) A software verification system that determines that there is no change in performance when the first information, the second information, and the third information indicate that accident avoidance is unnecessary or that accident avoidance did not occur.

9. The sensor data corresponding to the results of the judgments in (2), (4), (5), and (7) above is used as training data for cases where improvements to the new version of the software are necessary, or The software verification system according to claim 8, wherein the sensor data corresponding to the results of the determinations in (1), (3), (6), and (8) above is used as training data for cases where no improvement to the new version of the software is required, and machine learning is performed on this data.

Images