Vehicle control systems and ECUs

Abstract

A vehicle control system (100) includes a local ECU (200) and an electric component (300). The electric component (300) operates under control of the local ECU (200). The local ECU (200) authenticates the electric component (300) on the basis of information stored in the electric component (300), and when the authentication has failed, the local ECU (200) restricts the functions of the electric component (300).

Description

Technical Field

[0001] The present invention relates to a vehicle control system.

Background Art

[0002] An automobile includes a controller called an ECU (Electronic Control Unit), and electrical components such as headlamps, rear lamps, wipers, and wipers operate under the control of the ECU. Electrical components such as headlamps, rear lamps, wipers, and wipers operate under the control of the ECU.

[0003] Conventional vehicles have adopted an architecture in which in-vehicle electrical components are classified into groups related to the same function and controlled by a common ECU for each function. For example, lighting fixtures such as headlamps and wipers were controlled by an ECU that manages the lighting fixtures.

[0004] In recent years, as the functionality and electronics of automobiles have advanced, the architecture of vehicle design has been changing. As one of them, instead of for each function, an ECU is provided for each zone, and the electrical components included in that zone are centrally managed by that ECU. That is, under the control of an ECU in a certain zone, electrical components having different functions such as headlamps, wipers, wipers, sensors, air conditioners, and airbags will be placed.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] As this architecture becomes more widespread, it is anticipated that minimum specifications and protocols will be established between the ECU and the electrical components under its control, and that electrical components will be designed according to these specifications and protocols in the future. As a result, it is conceivable that third-party replacement parts will be offered as alternatives to genuine parts and selected by the user. However, there is no guarantee that third-party electrical components will function correctly under the control of an ECU that was not designed with this in mind.

[0007] This disclosure is made in the circumstances described herein, and one exemplary purpose of a certain aspect thereof is to provide a more reliable vehicle control system. [Means for solving the problem]

[0008] A vehicle control system in one aspect of this disclosure includes an ECU (Electronic Control Unit) and E The system includes electrical components that operate under the control of the ECU. The ECU authenticates the electrical components based on information stored inside them, and if the authentication fails, the ECU restricts the functionality of the electrical components.

[0009] Another aspect of this disclosure is the ECU (Electronic Control Unit) that constitutes the vehicle control system together with the electrical components. ECU stands for Control Unit. The ECU is an interface that communicates with electrical components and software. The system comprises a processor that executes software programs and non-volatile memory that holds authentication information. The processor authenticates electrical components based on information stored inside the components and restricts the functionality of the electrical components if authentication fails.

[0010] Furthermore, any combination of the above components, or conversion of the expressions of this disclosure between methods, apparatus, etc., are also valid embodiments of the present invention. [Effects of the Invention]

[0011] According to certain aspects of this disclosure, reliability can be enhanced. [Brief explanation of the drawing]

[0012] [Figure 1] This is a block diagram of a vehicle control system according to an embodiment. [Figure 2] This diagram shows a rear lamp, which is an example of an electrical component. [Modes for carrying out the invention]

[0013] (Summary of the embodiment) This section outlines some exemplary embodiments of the present disclosure. This outline is intended to provide a basic understanding of the embodiments and to simplify some concepts of one or more embodiments, serving as a prelude to the more detailed descriptions that follow. It is not intended to limit the scope of the invention or disclosure. This outline is not a comprehensive overview of all possible embodiments, nor is it intended to identify essential elements of all embodiments or to delineate the scope of some or all aspects. For convenience, “one embodiment” may be used to refer to one or more embodiments (examples or variations) disclosed herein.

[0014] A vehicle control system according to one embodiment includes an ECU (Electronic Control Unit) and an EC The system includes electrical components that operate under the control of the ECU. The ECU authenticates the electrical components based on information stored inside them, and if the authentication fails, the ECU restricts the functionality of the electrical components.

[0015] This configuration prevents electrical components from malfunctioning in unintended ways by limiting the functions of electrical components that do not pass certification, i.e., those not anticipated by the ECU. Furthermore, for component manufacturers (suppliers) who design and manufacture electrical components, additional functions become useless unless certification is obtained. Therefore, it becomes possible to eliminate suppliers who attempt to manufacture and sell substandard products without obtaining certification.

[0016] In one embodiment, the ECU may disable additional functions without restricting the functions essential for driving.

[0017] In one embodiment, the electrical component is a rear lamp, and the ECU may disable the functions related to decorative lighting. Specifically, lighting corresponding to the basic driving functions of the vehicle, such as driving, turning, and stopping, may be performed without restriction, and decorative lighting when the vehicle starts or stops may be restricted.

[0018] The ECU according to one embodiment constitutes a vehicle control system together with electrical components. The ECU includes an interface for communicating with the electrical component, a processor for executing a software program, and a non-volatile memory for holding authentication information. The processor authenticates the electrical component based on the information stored inside the electrical component, and restricts the functions of the electrical component if the authentication fails.

[0019] (Embodiment) Hereinafter, preferred embodiments will be described with reference to the drawings. The same or equivalent components, members, and processes shown in each drawing are denoted by the same reference numerals, and repeated explanations will be omitted as appropriate. Also, the embodiments are illustrative rather than limiting the disclosure and the invention, and not all the features and combinations thereof described in the embodiments are necessarily essential to the disclosure and the invention.

[0020] FIG. 1 is a block diagram of a vehicle control system 100 according to an embodiment. The vehicle control system 100 is a part of an automobile, but its position and function are not limited.

[0021] The vehicle control system 100 includes a vehicle ECU 110, a local ECU 200, and one or more electrical components 300.

[0022] The vehicle ECU 110 is a controller that comprehensively controls the entire vehicle or a part thereof. The vehicle ECU 110 is also a controller called a BCM (Body Control Module). It may be present. The local ECU200 controls parts 300_1 to 300_N of the multiple electrical components that make up the vehicle. Each of the electrical components 300_1 to 300_N can communicate with the local ECU200 and operates in response to control from the local ECU200.

[0023] Multiple electrical components 300_1 to 300_M connected to the local ECU 200 may be related to the same function. For example, the local ECU 200 may be a lamp ECU that controls lamps, and the electrical components 300_1 to 300_M may be lamps. For example, electrical component 300_1 may be the left rear lamp, and 300_2 may be the right rear lamp. If the left and right rear lamps are further divided into multiple housings (for example, vehicle side and trunk lid side), electrical component 300_1 may be the left body-side rear lamp, 300_2 may be the left trunk lid-side rear lamp, electrical component 300_3 may be the right body-side rear lamp, and 300_4 may be the right trunk lid-side rear lamp.

[0024] Multiple electrical components 300_1 to 300_M connected to the local ECU 200 may be associated with different functions. For example, the local ECU 200 is an integrated ECU that performs integrated control related to lamps, sensors, wipers, etc., and the electrical components 300_1 to 300_M may be lamps, sensors, and wipers.

[0025] In Figure 1, signal lines related to control are shown as dashed lines. Solid lines represent lines related to power supply.

[0026] The local ECU 200 comprises a processor 210, a communication circuit 220, a communication circuit 230, a memory 240, a non-volatile memory 250, and a power supply circuit 260. The processor 210 executes a software program 252 stored in the non-volatile memory 250 and controls multiple electrical components 300_1 to 300_M under its control in response to control commands from the vehicle ECU 110.

[0027] This software program 252 provides the following functions: • Communication function with vehicle ECU110 • Selection of functions (operating modes) of multiple electrical components (300) • Control of the operating status of multiple electrical components 300

[0028] The communication circuit 220 is an interface for communication with the vehicle ECU 110. The type of interface is not particularly limited, but it can be CAN (Controller Area Network) or LIN. Vehicle buses such as (Local Interconnect Network) are also acceptable.

[0029] The communication circuit 230 is an interface for communicating with the electrical component 300. The type of this interface is not limited to I 2 It can be a serial interface such as C (Inter IC) or SPI (Serial Peripheral Interface), or a standard that is designed in-house. It could be an unconverted interface, or it could be a vehicle bus.

[0030] Memory 240 stores the program 252 executed by the processor 210, as well as data generated by the processor 210.

[0031] The non-volatile memory 250 stores the program 252 executed by the processor 210 and the initial settings necessary for the operation of the local ECU 200.

[0032] The power supply circuit 260 supplies power voltage to the electrical components 300_1 to 300_M. The power supply circuit 260 may be a regulated power supply, or it may simply be wiring or a switch that branches off the battery voltage.

[0033] Of the local ECU 200, the processor 210, communication circuit 220, communication circuit 230, memory 240, and non-volatile memory 250 may be implemented as a microcontroller, or as an SoC (System on Chip). Alternatively, these may be separate components.

[0034] Some of the electrical components 300_1 to 300_M may include a processor capable of executing software itself. For such electrical components (hereinafter referred to as active electrical components) 300A, the processor 210 of the local ECU 200 generates and supplies only start and stop triggers to the active electrical components 300A. Upon receiving a start trigger, the active electrical component 300A executes predetermined processing based on the software program run by its internal processor, and stops processing in response to a stop trigger. In other words, after receiving a start trigger, the active electrical component 300A operates proactively.

[0035] Some of the electrical components 300_1 to 300_M may consist only of hardware and may not include a software-executable processor. For such electrical components (hereinafter referred to as passive electrical components) 300P, the program 252 executed by the processor 210 of the local ECU 200 contains instructions that describe the operation sequence of the passive electrical components 300P, and the operation of the passive electrical components 300P is controlled by the processor 210. The passive electrical components 300P operate passively under the control of the local ECU 200.

[0036] The above describes the overall configuration of the vehicle control system 100. Next, we will explain the certification process.

[0037] The local ECU 200 performs authentication for each of the electrical components 300_1 to 300_M. For the i-th (1≦i≦M) electrical component 300_i, authentication is performed based on authentication information 302 stored in the non-volatile memory 304 inside the electrical component 300_i. The authentication method is not particularly limited. If authentication fails, the local ECU 200 restricts the functionality of the electrical component 300_i.

[0038] For example, the manufacturer (supplier) of the electrical component 300 requests approval of the electrical component 300 from the automobile manufacturer or Tier 1 supplier involved in the design of the vehicle control system 100 at an appropriate time, such as when the design of the electrical component 300 is completed. If the approver confirms that the electrical component 300 meets the specifications and standards, they provide the designer of the electrical component 300 with appropriate certification information 302. The certification information 302 is stored in the non-volatile memory 304 of the electrical component 300 and shipped in that state.

[0039] Authentication begins when the local ECU 200 and the electrical component 300 are connected. Authentication may be performed only during the initial connection. For example, the local ECU 200 requests the electrical component 300 to send authentication information 302. The local ECU 200 compares the authentication information 302 received from the electrical component 300 with the authentication information 254 it holds, and if they match, authentication is passed; otherwise, authentication is rejected.

[0040] For example, the authentication information 254 for the local ECU 200 may be an ID specific to the model number or series of the local ECU 200. Alternatively, the authentication information 254 may be a passcode issued by an organization (group or alliance) related to the design of the vehicle control system 100. This organization also issues the same passcode for the electrical components 300.

[0041] Let's illustrate another example of authentication. The local ECU 200 requests the electrical component 300 to send authentication information 302. The authentication information 254 held by the local ECU 200 may include data or protocols for determining the truth value of the authentication information 302. The local ECU 200 may process the authentication information 302 based on the authentication information 302 and decide whether or not to grant authentication.

[0042] If the local ECU200 passes certification, it will operate the electrical component 300 as designed, without restricting its functionality.

[0043] On the other hand, if the local ECU 200 fails to pass certification, it will restrict the functions of the electrical components 300. Restriction includes disabling some or all of the functions, but in automobiles, depending on the type of electrical component 300, especially if it relates to the vehicle's driving function or safety, it may not be desirable to completely disable its functions.

[0044] Therefore, the local ECU200 may disable only additional functions, without restricting functions essential for driving. Additional functions may include functions that are not necessary for driving or ensuring safety, and functions that are not implemented in other common electrical components 300.

[0045] The above describes the certification in the vehicle control system 100 and the functional limitations of the electrical components 300.

[0046] This vehicle control system 100 prevents electrical components 300 from malfunctioning in unintended ways by restricting the functions of electrical components 300 that do not pass certification, i.e., those not anticipated by the local ECU 200. Furthermore, for component manufacturers (suppliers) that design and manufacture electrical components 300, additional functions are wasted unless certification is obtained. For component manufacturers (suppliers) that manufacture these components, additional functions are wasted unless certification is obtained. Therefore, it becomes possible to eliminate suppliers who attempt to manufacture and sell substandard products without obtaining certification.

[0047] This disclosure extends to various devices and methods as understood in the block diagram and circuit diagram of Figure 1, or derived from the above description, and is not limited to any particular configuration. More specific configuration examples and embodiments are described below, not to narrow the scope of this disclosure, but to aid in understanding and clarifying the essence and operation of this disclosure and the present invention.

[0048] Figure 2 shows a rear lamp 400, which is an example of an electrical component 300.

[0049] The rear lamp 400 comprises multiple light-emitting elements 410_1 to 410_N and a driver IC (Integrated Circuit) 420. In other words, the rear lamp 400 is a passive electrical component that does not have a processor (microcontroller). The rear lamp 400 may be a brake lamp, stop lamp, tail lamp, or turn signal lamp, or it may be a rear combination lamp that integrates these functions.

[0050] The multiple light-emitting elements 410_1 to 410_N are semiconductor light-emitting elements such as LEDs (light-emitting diodes), organic EL elements, and laser diodes, each corresponding to the type of lamp. A single light-emitting element 410 may include multiple LEDs connected in series.

[0051] The driver IC 420 is a functional IC (Integrated Circuit) that can individually control the brightness and on / off state of multiple light-emitting elements 410_1 to 410_N.

[0052] The driver IC 420 includes a lighting circuit 422, a communication circuit 424, a controller 426, and a non-volatile memory 428. The lighting circuit 422 includes multiple current sources CS1 to CSN that supply drive current to multiple light-emitting elements 410_1 to 410_N.

[0053] The rear lamp 400 may further include a power supply circuit 450. The power supply circuit 450 is, for example, a DC / DC converter and a power supply voltage V supplied from the local ECU 200. DD The voltage is stepped down or stepped up to an appropriate level for the light-emitting element 410, which is the load. The power supply circuit 450 can be omitted.

[0054] The communication circuit 424 is an interface that can communicate with the communication circuit 230 of the local ECU 200, and receives control commands from the local ECU 200, including instructions to turn on or off multiple light-emitting elements 410_1 to 410_N, as well as brightness settings. The controller 426 controls multiple current sources CS1 to CSN based on the control commands received by the communication circuit 424.

[0055] The non-volatile memory 428 corresponds to the non-volatile memory 304 in Figure 1 and stores the authentication information 302. The non-volatile memory 428 may be integrated into the driver IC 420 or it may be externally connected to the driver IC 420.

[0056] In this embodiment, the multiple light-emitting elements 410_1 to 410_N are red LEDs arranged in a horizontal line, forming a stop lamp. During normal driving, the stop lamp illuminates when the brake pedal is pressed. Therefore, when the brake pedal is pressed, the vehicle ECU 110 instructs the local ECU 200 to illuminate the stop lamp. The local ECU 200 executes a program command corresponding to this illumination instruction. As a result, a control command is input to the communication circuit 424 such that multiple current sources CS1 to CSN illuminate substantially simultaneously. This causes the multiple light-emitting elements 410_1 to 410_N to illuminate all at once.

[0057] In recent years, the use of vehicle lighting for special effects has become a trend. For example, the rear lamp 400 illuminates multiple light-emitting elements 410_1 to 410_N according to a predetermined sequence in response to actions such as unlocking or locking the doors or turning the ignition on (animated lighting). However, since the rear lamp 400 itself does not have a microcontroller, the processing related to the animated lighting is described in a software program executed by the local ECU 200.

[0058] In this case, if the rear lamp (stop lamp) 400 has not passed certification, the local ECU 200 may perform the processing related to the normal illumination of the stop lamp, but may not perform the processing related to the animated illumination.

[0059] In other embodiments, the multiple light-emitting elements 410_1 to 410_N may be amber LEDs arranged in a horizontal line, forming a turn signal lamp. Regarding turn signal lamps, sequential turn signals have recently been implemented in some vehicles. If the rear lamp (turn signal lamp) 400 has passed authentication, the local ECU 200 may perform a process of lighting the multiple light-emitting elements 410_1 to 410_N sequentially from end to end (sequential lighting), and if it has not passed authentication, it may disable sequential lighting by lighting the multiple light-emitting elements 410_1 to 410_N simultaneously.

[0060] Specifically, lighting corresponding to the basic driving functions of a vehicle, such as accelerating, turning, and stopping, may be permitted without restriction, while special effects such as lighting during vehicle startup or stopping may be restricted.

[0061] (modified version) The embodiments described above are illustrative, and it will be understood by those skilled in the art that various modifications are possible in combinations of their components and processing steps. Such modifications will be described below.

[0062] (Variation 1) In the example in Figure 2, the rear lamp 400 was a passive electrical component without a microcontroller, i.e., a software-controllable processor. However, the rear lamp 400 may also be an active electrical component equipped with a microcontroller. In this case, the local ECU 200 should not provide the trigger for illumination related to additional functions to the rear lamp 400 if the rear lamp 400 has not passed certification.

[0063] (Modification 2) In Figure 2, a rear lamp 400 is shown as an example of electrical component 300, but this is not the only example. Electrical component 300 may also be an interior light, fog light, sensor, wiper, etc.

[0064] Those skilled in the art will understand that the embodiments are illustrative, and that various modifications exist for each component and combination of processing steps, and that such modifications are also included within the scope of this disclosure or the present invention. [Industrial applicability]

[0065] This invention relates to a vehicle control system. [Explanation of symbols]

[0066] 100...Vehicle control system, 110...Vehicle ECU, 200...Local ECU, 210...Processor, 220, 230...Communication circuit, 240...Memory, 250...Non-volatile memory, 260...Power supply circuit, 300...Electrical components, 302...Authentication information, 304...Non-volatile memory, 400...Rear lamp, 410...Light-emitting element, 420...Driver IC, 422...Lighting circuit, 424...Communication circuit, 426...Controller, 428...Non-volatile memory, 450...Power supply circuit.

Claims

1. ECU (Electronic Control Unit) and Electrical components operating under the control of the aforementioned ECU, Equipped with, A vehicle control system characterized in that the ECU authenticates an electrical component based on information stored inside the electrical component, and if authentication fails and the electrical component has both a function essential for driving and an additional function that is not essential for driving, the ECU does not allow the additional function of the electrical component to be performed.

2. The vehicle control system according to claim 1, characterized in that the electrical component is a rear lamp, and the ECU restricts the function related to the lighting of the lights.

3. An ECU (Electronic Control Unit) that, together with electrical components, constitutes a vehicle control system, An interface for communicating with the aforementioned electrical component, A processor that executes software programs, Non-volatile memory that holds authentication information, Equipped with, The ECU is characterized in that the processor authenticates the electrical component based on information stored inside the electrical component, and if authentication fails and the electrical component has both a function essential for driving and an additional function that is not essential for driving, the processor prevents the electrical component from performing the additional function.

Images