Vehicle control system

Abstract

A vehicle control device according to the present invention includes a control software unit, a verification software unit, a shared buffer, and a verification platform. The verification platform receives input data, transmits the input data to the shared buffer, receives output data, transmits the output data to the shared buffer, identifies comparison data that can be compared with the output data, transmits the comparison data to the shared buffer, identifies the priority of the data stored in the shared buffer according to a predetermined priority policy. The shared buffer stores the input data, the output data, and the comparison data in association with each other. The verification platform transmits the output data to the verification software unit in descending order of priority. The verification software unit executes verification asynchronously with the control software unit.

Description

Technical Field

[0001] The present disclosure relates to a vehicle control device.

Background Art

[0002] In the future, with the expansion of the Operational Design Domain (ODD) for autonomous driving, it is expected that it will become inherently difficult to secure sufficient software test cases. However, even in situations where sufficient test cases cannot be prepared in advance, there is a need for a technology that can comprehensively verify control software, or a technology that collects data for improving the performance of control algorithms in unanticipated test cases.

[0003] As one of such technologies, there is a method called Shadow Mode, in which verification software is installed in an electronic control unit (ECU) mounted on a vehicle to verify the control software on the vehicle side. On the other hand, there is a problem that the operation of Shadow Mode increases the processing load of the ECU and may affect the vehicle control system. To address this problem, a method of resolving the impact on the vehicle control system by mounting a dedicated Shadow Mode ECU has been implemented, enabling software verification without affecting the production environment. However, this method has problems in terms of ECU cost, mounting space, and power consumption, and a new execution method for Shadow Mode has been proposed while suppressing impact on the control system.

[0004] As a background art in this field, there is Patent Document 1 (Japanese Unexamined Patent Publication No. 2022-13187). Patent Document 1 describes a vehicle control device including: a verification management unit that executes in parallel an old control software unit representing an old version of control software and a new control software unit representing a new version of control software; and an output verification unit that outputs information indicating a mismatch when the output of the old control software unit and the output of the new control software unit correspond to a mismatch.

Prior Art Literature

Patent Literature

[0005] [Patent Document 1] Japanese Patent Publication No. 2022-13187 [Overview of the project] [Problems that the invention aims to solve]

[0006] According to Patent Document 1, verification processing is achieved without using a dedicated verification ECU by running the old version of the control software and the new version of the control software in parallel or in parallel on the same ECU on which the production system (software used for actual vehicle control) is running, and by executing the verification process with a lower priority than the control application processing.

[0007] However, in the vehicle control device described in Patent Document 1, the old version of the control software and the new version of the control software are run separately from the production system (the old version of the vehicle control software). If the processing to be verified is heavy and the processing load on the production system increases, verification has to be skipped. Furthermore, if time-series data that has not been verified is deleted due to memory storage capacity limitations, the deleted data cannot be verified, and verification data cannot be collected. [Means for solving the problem]

[0008] A typical example of the invention disclosed in this application is as follows: A vehicle control device comprising: a control software unit that performs control calculations used for vehicle control based on input data including observation results of conditions inside and outside the vehicle, and outputs the results of the control calculations as output data; a verification software unit that performs verification processing for verifying the output data, which is calculation processing not used for vehicle control; a shared buffer that stores at least the input data and the output data; and a verification board that controls the input and output of data in the shared buffer, wherein the verification board transmits the received input data to the shared buffer, transmits the received output data to the shared buffer, identifies comparison data that can be compared with the output data, transmits it to the shared buffer, identifies the priority of the data stored in the shared buffer according to a predetermined priority policy, the shared buffer stores the input data, the output data and the comparison data in association, and the verification board transmits the output data to the verification software unit in order from the highest priority data, and the verification software unit performs the verification processing asynchronously with the control software unit. [Effects of the Invention]

[0009] According to one aspect of the present invention, by efficiently utilizing computing resources (memory, CPU), data necessary for verifying and improving the performance of control software can be collected even when the processing load of the production system increases. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments for carrying out the invention. [Brief explanation of the drawing]

[0010] [Figure 1A] This is a block diagram showing the configuration of a vehicle control system according to the first embodiment. [Figure 1B] This is a block diagram showing the configuration of a vehicle control system according to the first embodiment. [Figure 2] This is a flowchart of the buffer output processing performed by the buffer management unit according to the first embodiment. [Figure 3]This is a flowchart of the control process executed by the control software unit according to the first embodiment. [Figure 4] This is a flowchart of the control process executed by the verification software unit according to the first embodiment. [Figure 5] This is a flowchart of the verification timing determination process executed by the verification timing determination unit according to the first embodiment. [Figure 6] This is a flowchart of the verification validity determination process performed by the verification result validity determination unit according to the first embodiment. [Figure 7] This is a flowchart of the upload process executed by the upload instruction unit according to the first embodiment. [Figure 8] This is a flowchart of the upload process performed by the sensor unit according to the first embodiment. [Figure 9] This figure shows an example of the configuration of verification management data according to the first embodiment. [Figure 10] This is a diagram showing the data flow of the vehicle control system according to the first embodiment. [Modes for carrying out the invention]

[0011] The embodiments of this disclosure will be described below with reference to the drawings.

[0012] <First Embodiment> Figures 1A and 1B are block diagrams showing the configuration of a vehicle control system 1 according to the first embodiment of this disclosure.

[0013] The vehicle control system 1 shown in Figure 1A consists of an ECU-A 10, a sensor 11, a gateway 12, an actuator 13, and a cloud 14. The ECU-A 10 is connected to and can communicate with the sensor 11, gateway 12, and actuator 13. The ECU-A 10 can communicate with the cloud 14 via the gateway 12.

[0014] ECU-A 10 is a vehicle control device configured of a buffer management unit 104, a control software unit 105, a verification software unit 106, a verification timing determination unit 107, a verification result validity determination unit 108, and an upload instruction unit 109. In addition, ECU-A 10 includes a memory 100, a CPU-A 101, a CPU-B 102, and a CPU-C 103. As shown in FIG. 1B, the memory 100 includes a related data buffer 1001, a control software unit input data buffer 1002, a control software unit output data buffer 1003, a verification software unit input data buffer 1004, a verification software unit output data buffer 1005, a priority policy 1006, verification management data 1007, a vehicle control program 1008, and stores sensor data 1009, control software unit input data 1010, control software unit output data 1011, verification software unit input data 1012, and verification software unit output data 1013.

[0015] The buffer management unit 104, the control software unit 105, the verification software unit 106, the verification timing determination unit 107, the verification result validity determination unit 108, and the upload instruction unit 109 are computer programs stored in the memory 100 as the vehicle control program 1008, and are executed by the CPU-A 101 to CPU-C 103. The control software unit 105, the verification software unit 106, and other processing are preferably executed on separate CPU cores. For example, the CPU-A 101 executes the program of the control software unit 105, the CPU-B 102 executes the program of the verification software unit 106, and the CPU-C 103 executes programs for other processing.

[0016] The sensor 11 has a sensor unit 111 that transmits sensed sensor values to the ECU-A 10. The gateway 12 is a module that controls communication with the outside, and in the present embodiment, has a function of uploading data to the cloud 14 in response to a command from the upload instruction unit 109. The actuator 13 is a control target of the ECU-A 10, and is an engine, a motor, a steering, or the like. The cloud 14 is a computer system that stores and analyzes uploaded data.

[0017] Hereinafter, details of the operation flow of the ECU-A 10 according to the first embodiment will be described.

[0018] Figure 2 is a flowchart of buffer output processing executed by the buffer management unit 104.

[0019] The buffer management unit 104 executes processing for storing data generated in time series for a fixed period in the shared buffer 1000. The buffer management unit 104 also monitors access to areas outside the storage area secured for each data type to prevent data contention. For example, it suppresses access to areas outside the storage area secured for each data type, and prevents contention for data access caused by writing data to areas outside the predetermined storage area.

[0020] (Step 1041) The buffer management unit 104 reads one or more specified types of data from among sensor data 1009, control software unit input data 1010, control software unit output data 1011, verification software unit input data 1012, and verification software unit output data 1013, and calculates the priority of the read data according to a priority policy 1006. When prioritizing data with newer acquisition times in accordance with the priority policy 1006, the time information of the read data is referenced, and the highest priority is assigned to the latest data. Otherwise, a priority is assigned according to the result of comparison with the time information of data already in the buffer. The calculated priority may be dynamically updated in accordance with updates to the priority policy 1006. Further, priorities may be assigned according to the data verification status and upload status. For example, it is preferable to assign higher priorities in the following order: verification completed, verification not executed, verification in progress, upload completed. Furthermore, the time information is based on the time of the control software unit input data 1010, and the same time information as that of the control software unit input data 1010 is assigned to the control software unit output data 1011, verification software unit input data 1012, verification software unit output data 1013, and sensor data 1009 corresponding to the control software unit input data 1010.

[0021] (Step 1042) The buffer management unit 104 determines whether (Yes / No) there is free space in the associated data buffer 1001, control software unit input data buffer 1002, control software unit output data buffer 1003, verification software unit input data buffer 1004, or verification software unit output data buffer 1005 corresponding to the value read in step 1041. If the answer is Yes (there is free space in the buffer), the process proceeds to step 1045; if the answer is No (there is no free space in the buffer), the process proceeds to step 1043. The data and buffers are associated as shown below, and the data is selected for the associated buffer according to the type of data. Sensor data 1009: Related data buffer 1001 Control software input data 1010: Control software input data buffer 1002 Control software output data 1011: Control software output data buffer 1003 Verification software input data 1012: Verification software input data buffer 1004 Verification software output data 1013: Verification software output data buffer 1005

[0022] (Step 1043) The buffer management unit 104 calculates the priority of the new data based on the priority policy 1006, compares the priority of all already saved data, and determines whether or not to save it (Yes / No). If the priority of the new data is higher than that of any of the already saved data (Yes), the process proceeds to step 1044. If the priority of the new data is lower than that of any of the already saved data (No), the new data is not saved to the buffer, and the buffer output process ends.

[0023] (Step 1044) The buffer management unit 104 frees up buffer space by deleting data equal to the size of the new data from the buffer. For example, it may delete data that can be deleted (e.g., verified data) from the buffer. Alternatively, if there is no data that can be deleted from the buffer, it may delete data with a lower priority. If the priority policy 1006 assigns high priority to new data, it may delete older data from the buffer in order, equal to the size of the new data. In the verification management data 1007 shown in Figure 9, the data in row R01 is deleted. Alternatively, the buffer's storage area may be increased by the size of the new data to free up buffer space.

[0024] (Step 1045) The buffer management unit 104 updates the priority information of the verification management data 1007 after saving the new data to the buffer. For example, if new data with a high priority is saved, the data from row R04 is saved to the verification management data 1007 in Figure 9, and each row in column C01 is assigned a priority from the newest data upwards. The priority of deleted data (data from row R01) should be a special value such as -1, which means "none".

[0025] In addition to the processes described above, the buffer management unit 104 may monitor for requests to delete data being verified and prevent the deletion of data being verified. If the verification process by the verification software unit 106, which is verifying the data for which a deletion request has been received, is interrupted and the data is deleted, it is acceptable even if an incorrect verification result is not obtained.

[0026] Figure 3 is a flowchart of the control process executed by the control software unit 105.

[0027] (Step 1051) The control software unit 105 calculates processing results such as recognition processing, behavior prediction, path planning, and control commands based on the sensor data 1009.

[0028] (Step 1052) The control software unit 105 determines whether it is operating in control execution mode (Yes / No). If it is operating in control execution mode (Yes), it proceeds to step 1053. If it is operating in verification mode (No), it proceeds to step 1054.

[0029] (Step 1053) The control software unit 105 transmits the control command value, which is the processing result, to the actuator 13.

[0030] (Step 1054) The control software unit 105 writes the processing result to the control software unit output data 1011 and executes a buffer output process (Figure 2) that instructs the buffer management unit 104 to save the processing result to the control software unit output data buffer 1003.

[0031] (Step 1055) The control software unit 105 determines (Yes / No) the termination condition (for example, IGN OFF or completion of a specific control process), and if the termination condition is met (Yes), it terminates the control process. If the termination condition is not met (No), it returns to step 1041 and waits until new data is entered.

[0032] Figure 4 is a flowchart of the control process executed by the verification software unit 106.

[0033] (Step 1061) The verification software unit 106 reads the data instructed by the verification timing determination unit 107 from the verification software unit input data buffer 1004, verifies the validity of the control software unit 105 based on the read data, and calculates the verification result.

[0034] (Step 1062) The verification software unit 106 writes the verification results to the verification software unit output data 1013 and instructs the buffer management unit 104 to save the verification results to the verification software unit output data buffer 1005.

[0035] (Step 1063) The verification software unit 106 sets a verification completion flag in the area of ​​the verification management data 1007 corresponding to the relevant data. For example, it writes data indicating "in progress" (e.g., an integer value) to the C07 column of row R02 in the example verification management data 1007 shown in Figure 9.

[0036] Figure 5 is a flowchart of the verification timing determination process executed by the verification timing determination unit 107.

[0037] (Step 1071) The verification timing determination unit 107 acquires information on computing resources (CPU load, memory usage, etc.). This computing resource information can be obtained from the OS, semiconductor devices, etc.

[0038] (Step 1072) The verification timing determination unit 107 refers to the verification management data 1007 and identifies data from the unverified data in order of priority, including data stored in the control software unit output data buffer 1003 and data to determine the validity of the control software unit 105 by comparing it with the data stored in the buffer. The identified data is stored as a test case in the verification software unit input data 1012, transmitted to the buffer management unit 104, and instructed to execute by the verification software unit 106.

[0039] (Step 1073) The verification timing determination unit 107 sets a verification flag for the data being verified in the verification management data 1007. For example, it writes data indicating "in progress" (e.g., an integer value) to the C07 column of row R02 in the example verification management data 1007 shown in Figure 9.

[0040] (Step 1074) The verification timing determination unit 107 determines (Yes / No) the verification termination condition (e.g., IGN OFF, termination of shadow mode). If the verification termination condition is met (Yes), the verification timing determination process ends. If the verification condition is not met (No), the process returns to step 1071.

[0041] Figure 6 is a flowchart of the verification validity determination process performed by the verification result validity determination unit 108.

[0042] (Step 1081) The verification result validity determination unit 108 reads the data stored in the verification software unit output data buffer 1005.

[0043] (Step 1082) The verification result validity determination unit 108 determines the validity of the verification (Yes / No) based on the verification results and other information (for example, whether the vehicle is driving within a specific area) to determine whether the verification conditions are met. The verification conditions are, for example, whether the verification data is a valid value (not an invalid value) and whether the vehicle is in a state where verification is possible (not an impossible state). If the verification validity is met (Yes), the process proceeds to step S1083; if the verification validity is not met (No), the verification validity determination process ends.

[0044] (Step 1083) The verification result validity determination unit 108 instructs the upload instruction unit 109 to upload the data to the cloud 14.

[0045] Figure 7 is a flowchart of the upload process executed by the upload instruction unit 109.

[0046] (Step 1091) The upload instruction unit 109 identifies the input verification software output data 1013 and related data from the related data buffer 1001, sends the identified data to the gateway 12, and sets the information being uploaded to the verification management data 1007. For example, in Figure 9, data indicating "in progress" (e.g., an integer value) is written to column C08 of row R02 of the verification management data 1007. The identified data is sent from the gateway 12 to the cloud 14 outside the vehicle control system 1.

[0047] (Step 1092) When the upload instruction unit 109 receives notification of upload completion, it sets the upload completion information in the verification management data 1007 and sets the priority to the lowest or special value. For example, in the example of the verification management data 1007 shown in Figure 9, it writes data indicating "Completed" (e.g., an integer value) to column C08 of row R01 and sets the priority in column C01 of row R01 to the lowest value (e.g., 256 if the priority can be specified in the range of 1 to 256) or a special value (e.g., -1).

[0048] Figure 8 is a flowchart of the upload process performed by the sensor unit 111.

[0049] (Step 1111) The sensor unit 111 stores the data acquired by sensing in sensor data 1009 and control software unit input data 1010, and notifies the buffer management unit 104 and the control software unit 105.

[0050] Figure 9 shows an example of the configuration of verification management data 1007.

[0051] Verification management data 1007 manages information such as the time the data was acquired, the priority of the data, the identification information (ID) of the acquired control software input data, the identification information (ID) of the control software output data at that time, the identification information (ID) of the verification software input data at that time, the identification information (ID) of the verification software output data at that time, the identification information (ID) of related data at that time, the verification status of the data, and the update status of the data.

[0052] For example, information for time t-3 is stored in row R01, the acquisition time of the control software input data 1010 is stored in column C00, the priority is stored in column C01, and the control software input data ID that can identify the storage location of the control software input data 1010 at the time specified in column C00 (for example, a pointer to the control software data structure or index information of the control software input data buffer 1002) is stored in column C02. The control software output data ID, verification software input data ID, verification software output data ID, and related data ID for the time specified in C00 are stored in columns C03, C04, C05, and C06, respectively. The verification status of the data at that time is stored in column C07, and the upload status of the data at that time is stored in column C08.

[0053] Figure 10 is a diagram showing the data flow of the vehicle control system 1 according to the first embodiment of this disclosure.

[0054] As shown in Figure 10, the verification board 110 includes a buffer management unit 104, a verification timing determination unit 107, and verification management data 1007. The shared buffer 1000 includes an associated data buffer 1001, a control software unit input data buffer 1002, a control software unit output data buffer 1003, a verification software unit input data buffer 1004, and a verification software unit output data buffer 1005.

[0055] The sensor unit 111 transmits the acquired sensor values ​​to the control software unit 105 and the buffer management unit 104, and stores them in the sensor data 1009.

[0056] The control software unit 105 transmits the received sensor data 1009 to the buffer management unit 104 as control software unit input data 1010. The control software unit 105 transmits a drive signal to the actuator 13, which is the object to be controlled.

[0057] The buffer management unit 104 calculates the priority of the control software input data 1010 and sensor data 1009 according to the priority policy 1006, and stores them in the control software input data buffer 1002 and related data buffer 1001, respectively. If there is no free space, data with a lower priority is deleted. At this time, the priority of the control software input data 1010 and sensor data 1009 is set to be the same.

[0058] The buffer management unit 104 stores the calculated priority information and saved data in the verification management data 1007.

[0059] The control software unit 105 transmits the control software output data 1011 to the buffer management unit 104 based on the received control software input data 1010.

[0060] The buffer management unit 104 calculates the priority of the control software output data 1011 and stores it in the control software output data buffer 1003. If there is no free space, it deletes data with a lower priority. At this time, the priority of the received control software output data 1011 is set to be the same as the priority of the control software input data 1010 used in the calculation.

[0061] The buffer management unit 104 stores the calculated priority information and the data stored in the buffer in the verification management data 1007.

[0062] The verification timing determination unit 107 retrieves the highest priority unverified data from the data stored in the control software unit output data buffer 1003, identifies data that can be compared with the retrieved data, and transmits the identified data to the buffer management unit 104 as verification software unit input data 1012. The verification timing determination unit 107 also records a verification in progress flag in the verification management data 1007.

[0063] The buffer management unit 104 calculates the priority of the verification software input data 1012 and stores the calculated priority and data in the verification software input data buffer 1004. If there is no free space, it deletes data with a lower priority. At this time, the priority of the received verification software input data 1012 is made the same as the priority of the data in the corresponding control software output data buffer 1003. The buffer management unit 104 stores the calculated priority information and the data stored in the buffer in the verification management data 1007.

[0064] The verification software unit 106 reads the data instructed by the verification timing determination unit 107 from the verification software unit input data buffer 1004, verifies the validity of the control software unit 105 based on the read data, and transmits the verification result to the buffer management unit 104. The verification software unit 106 sets the verification completion flag in the verification management data 1007.

[0065] The buffer management unit 104 calculates the priority of the verification software output data 1013, stores the calculated priority in the verification management data 1007, and stores the verification software output data 1013 in the verification software output data buffer 1005. If there is no free space, it deletes data with a lower priority. At this time, the priority of the received verification software output data 1013 is made the same as the priority of the data in the corresponding verification software input data buffer 1004. The buffer management unit 104 stores the calculated priority information and the data stored in the buffer in the verification management data 1007.

[0066] The verification result validity determination unit 108 verifies the validity of the verification software output data 1013 received from the verification software unit 106. If it determines that the data is valid, it transmits the received verification software output data 1013 to the upload instruction unit 109.

[0067] The upload instruction unit 109 reads the data instructed by the verification result validity determination unit 108 from the verification software unit output data buffer 1005, identifies the data related to the read data from the related data buffer 1001, and instructs the upload unit 1201 to upload the data.

[0068] According to this embodiment, even for test cases that could not be executed due to high utilization of computing resources (e.g., CPU load), verification can be performed again using the test cases stored in the shared buffer 1000, thereby suppressing verification omissions and failures to upload verification results, and streamlining data collection.

[0069] Next, a modified example of the embodiment of the present disclosure will be described.

[0070] (Location of priority calculation) In the embodiment described above, the buffer management unit 104 calculates the priority, but another block (for example, the control software unit 105, the verification timing determination unit 107, the verification software unit 106, etc.) may calculate the priority and notify the buffer management unit 104. In this case, the priority can be calculated considering the utilization rate of computing resources (for example, CPU load) immediately before the verification process, so finer priority control can be performed depending on the situation.

[0071] (Number of software items) In the embodiment described above, one control software unit 105 and one verification software unit 106 are provided, but multiple control software units 105 and verification software units 106 may be provided. For example, two control software units 105 may be verified by two verification software units 106, or two control software units 105 may be verified by one verification software unit 106.

[0072] (Verification management data) In the embodiment described above, the verification management data 1007 is in table format, but it may be in other formats, such as an associative array (linked list) with verification management structures as elements. The associative array format has the advantage of faster processing because if the priority changes when new data is saved, the data can be modified simply by reconnecting the links.

[0073] (Core separation) In the embodiment described above, the control software unit 105, the verification software unit 106, and other processes may be executed on separate CPU cores, but other configurations are also possible. For example, everything may be executed on a single CPU core. In this case, by maximizing the task execution priority of the control software unit 105, control can be executed without being affected by the verification software unit, etc. This method of consolidating execution on a single CPU core is effective when the processing load of the verification software unit 106 is small, and has the advantage of being advantageous in terms of ECU cost and power consumption. Alternatively, the control software unit 105, the verification software unit 106, and other processes may be separated and executed on a different accelerator (such as a GPU), ECU, or cloud, or they may be separated as containers or virtual machines. Executing each process on appropriate computing resources has the advantage of increased efficiency and the ability to perform more verifications.

[0074] (Loading data) In the embodiment described above, the control software unit 105, the verification software unit 106, and other processing units send and receive data via the shared buffer (memory) 1000, but data may be sent and received by other means. For example, data may be sent and received using socket communication. When sending and receiving data, the verification timing determination unit 107 or the buffer management unit 104 may relay the data. In this case, it becomes possible to enable multi-ECU or cloud collaboration that does not share memory space, and there is the advantage that data contention in shared memory does not occur.

[0075] (Storage backup) In the embodiment described above, data that cannot be saved to the buffer is deleted, but other methods may be employed. For example, instead of deleting the data, the data may be backed up to storage or the cloud. Since the data is not deleted, the possibility of verification errors can be reduced.

[0076] (Processing by the control software unit 105) In the embodiment described above, the control software unit 105 calculates control command values ​​from sensor values, but other methods may be used. For example, instead of sensor values, the processing result of the processing unit preceding the control software unit 105 may be used as input, or the data may be output to a subsequent process instead of an actuator. The processing results may also be displayed on a display or the like.

[0077] (Verification result validity determination unit 108) In the embodiment described above, the processing of the verification result validity determination unit 108 is performed after the processing of the verification software unit 106, but other configurations may be adopted. For example, the verification result validity determination unit 108 may perform processing before the verification software unit 106. In this case, if the verification conditions are determined to be invalid, the execution of the processing of the verification software unit 106 can be skipped, which has the advantage of reducing the processing load.

[0078] (Batch processing, multi-processing) In the embodiment described above, one test case is verified by one verification software unit 106, but other configurations may be adopted. For example, multiple test cases may be grouped together and processed in batches, or multiple processes of the verification software unit 106 may be launched and processed in parallel or in parallel. Processing may also be performed in parallel using computing resources outside the vehicle control system 1. In this case, there are advantages such as being able to process test cases in batches, increasing the available buffer capacity, and reducing data loss when the processing load is high. In addition, data transfer efficiency can be improved in the case of batch processing.

[0079] (Buffer length) In the embodiment described above, it is assumed that the lengths (number of frames) of the associated data buffer 1001, the control software unit input data buffer 1002, the control software unit output data buffer 1003, the verification software unit input data buffer 1004, and the verification software unit output data buffer 1005 are the same, but other configurations may be adopted. For example, the associated data buffer 1001 may be shorter than the other buffers. For example, if the control software unit 105 has a function to take trajectory information (for example, object information arranged in a time series) as input and predict future trajectory information, the information stored in the control software unit input data buffer 1002, the control software unit output data buffer 1003, the verification software unit input data buffer 1004, and the verification software unit output data buffer 1005 is multiple trajectory information. In this case, if the input and output data of the camera recognition process used to generate the object information of the trajectory information is used as associated data, the data size of the associated data is large. In this case, it is preferable to reduce the size of the associated data buffer 1001. Furthermore, when the size of the associated data buffer 1001 is small, prioritizing the latest value for verification reduces the likelihood of missing associated data. In this case, there is the advantage of saving memory and efficiently collecting data by changing the size of the associated data buffer 1001 according to the data loss rate.

[0080] (Task priority control of verification software unit 106) In the embodiment described above, the task priority of the verification software unit 106 is set lower than that of the control software unit 105, but other configurations may be adopted. For example, if the control software unit 105 is autonomous driving software and is not busy, the verification software unit 106 may be given a priority equal to or higher than that of the control software unit 105. In this case, the verification software unit 106 can be executed without being interrupted by the control software unit 105, so it can process unprocessed test cases and free up the buffer, which has the advantage of reducing the number of missed cases when the control software unit 105 becomes busy. Also, if the control software unit 105 is unable to execute the processing in time, the control software unit 105 may use the computing resources allocated to the verification software unit 106 to execute the processing.

[0081] (Processing by verification software unit 106) In the embodiment described above, the verification software unit 106 can be any software capable of verifying the validity of the control software unit 105. For example, if the control software unit 105 is software that performs orbit prediction processing or orbit planning processing, the verification software unit 106 may compare predicted and observed orbit information at a future time. In this case, the verification software unit 106 can perform accurate verification with processing that has a light processing load, which has the advantage of lower ECU costs and lower power consumption.

[0082] Furthermore, if the control software unit 105 is software that performs recognition processing of camera images, it may be compared with recognition processing of other sensors (Lidar, radar, etc.). Since the results of recognition processing using each sensor are compared, there is the advantage that the processing load on the verification software unit 106 is light. Also, verification results for two processes can be obtained with a single verification software unit 106, which is efficient and useful for comparing each sensor.

[0083] Alternatively, the software executed by the control software unit 105 may be executed by the verification software unit 106, and the output of the control software unit 105 and the output of the verification software unit 106 may be compared. The software executed by the control software unit 105 and the software executed by the verification software unit 106 may be the same version, or the software executed by the verification software unit 106 may be a newer version of the software executed by the control software unit 105. When the verification software unit 106 executes a newer version of the software, there is the advantage of being able to verify bugs in the newer version of the control software.

[0084] <Second Embodiment> (FIFO) The second embodiment of the present invention differs from the first embodiment described above in that older data is given a higher priority and processed preferentially. In the second embodiment, the differences from the first embodiment will be mainly explained, and the same configuration and processing as in the first embodiment will be omitted.

[0085] In the second embodiment, step 1041 of the buffer management unit 104 differs from that of the first embodiment. In step 1041, the buffer management unit 104 assigns a high priority to older data so that it is processed preferentially. In other words, it assigns the lowest priority to newer data. According to this embodiment, the uploaded data is arranged in chronological order, making it easier for users to use, simplifying the buffer management process, and simplifying implementation.

[0086] <Third Embodiment> (Specific object, specific time) The third embodiment of the present invention differs from the first embodiment described above in that data having specific characteristics is given a higher priority and processed preferentially. In the third embodiment, the differences from the first embodiment will be mainly explained, and the same configuration and processing as in the first embodiment will be omitted.

[0087] In the third embodiment, step 1041 of the buffer management unit 104 differs from that of the first embodiment. In step 1041, the buffer management unit 104 analyzes the data, calculates feature quantities, and calculates the priority of the data according to the calculated features. If the control software unit 105 is software that performs object detection processing or trajectory prediction processing, a high priority may be assigned to data containing a specific object so that it is processed preferentially. Alternatively, a high priority may be assigned to data being processed preferentially in a specific location (urban area, highway, mountain road, etc.). Priorities may be assigned so that data with a specific value has a higher priority than other data. According to this embodiment, it is possible to reliably verify data under conditions that are truly to be verified, obtain data for efficiently evaluating and improving the control software unit 105, and have the advantage of suppressing communication costs and storage capacity.

[0088] It should be noted that the present invention is not limited to the embodiments described above, but includes various modifications and equivalent configurations within the spirit of the attached claims. For example, the embodiments described above are described in detail for the purpose of clearly illustrating the present invention, and the present invention is not necessarily limited to having all the described configurations. Furthermore, some of the configurations of one embodiment may be replaced with those of another embodiment. Furthermore, configurations of other embodiments may be added to the configuration of one embodiment. Furthermore, some of the configurations of each embodiment may be added, deleted, or replaced with those of other embodiments.

[0089] Furthermore, each of the aforementioned configurations, functions, processing units, and processing means may be implemented in hardware, for example, by designing them as integrated circuits, or they may be implemented in software by having a processor interpret and execute programs that realize each function.

[0090] Information such as programs, tables, and files that implement each function can be stored in memory, hard disks, SSDs (Solid State Drives), or other storage media such as IC cards, SD cards, and DVDs.

[0091] Furthermore, the control lines and information lines shown are those deemed necessary for explanation purposes and do not necessarily represent all control lines and information lines required for implementation. In reality, it can be assumed that almost all components are interconnected.

Claims

1. A vehicle control device, A control software unit that performs control calculations used for vehicle control based on input data including observation results of conditions inside and outside the vehicle, and outputs the results of the control calculations as output data, A verification software unit that performs a verification process to verify the output data, which is a calculation process not used for vehicle control. A shared buffer for storing at least the input data and the output data, The system includes a verification platform that controls the input and output of data to the shared buffer, The aforementioned verification platform is The received input data is sent to the shared buffer. The received output data is sent to the shared buffer. Identify comparison data that can be compared with the output data and send it to the shared buffer. Priorities are assigned to the data stored in the shared buffer according to a predetermined priority policy. The shared buffer stores the input data, the output data, and the comparison data in association with each other. The verification platform transmits the output data to the verification software unit in order of highest priority, A vehicle control device characterized in that the verification software unit executes the verification process asynchronously with the control software unit.

2. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that controls the system to save newly acquired data to the shared buffer if it is not possible to save the newly acquired data to the shared buffer, by newly allocating storage space in the shared buffer.

3. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that controls the system to delete data that can be deleted from the shared buffer and save the newly acquired data if the newly acquired data cannot be saved to the shared buffer.

4. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that controls the system to delete low-priority data and save the newly acquired data if the newly acquired data cannot be saved to the shared buffer and there is no data that can be deleted from the shared buffer.

5. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that, when newly acquired data cannot be saved to the shared buffer and there is no data that can be deleted from the shared buffer, compares the priority of low-priority data with the priority of newly acquired data and controls the deletion of low-priority data.

6. A vehicle control device according to claim 1, The verification platform is a vehicle control device characterized by having a buffer management unit that assigns priorities so that data stored earlier has a higher priority.

7. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that assigns priorities so that data saved later has a higher priority.

8. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that assigns priorities such that data having specific characteristics or data with specific values ​​has a higher priority than other data.

9. A vehicle control device according to claim 1, The verification platform is a vehicle control device characterized by having a buffer management unit that assigns priority to data acquired at a specific timing so that it has a higher priority than other data.

10. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that dynamically updates the priority in accordance with the update of the priority policy.

11. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that assigns priorities based on the state of the data stored in the shared buffer.

12. A vehicle control device according to claim 1, The verification platform has verification management data for managing the data stored in the shared buffer, The vehicle control device is characterized in that the verification management data includes identification information for the input data, identification information for the output data, identification information for the comparison data, identification information for the data output from the verification software unit, priority for verification of the output data, and the status of verification of the output data.

13. A vehicle control device according to claim 12, The vehicle control device is characterized in that the verification management data includes the upload status of the data stored in the shared buffer.

14. A vehicle control device according to claim 1, A vehicle control device characterized by having a verification result validity determination unit that determines the validity of the verification based on information other than the verification results, and controls the device not to transmit the verification results to an external source if it is determined that the verification is not valid.

15. A vehicle control device according to claim 1, A vehicle control device characterized in that the control software unit and the verification software unit perform processing in parallel.

16. A vehicle control device according to claim 1, The vehicle control device is characterized in that the control software unit and the verification software unit perform processing in parallel using different computing resources.

17. A vehicle control device according to claim 16, A vehicle control device characterized in that the control software unit and the verification software unit perform processing in parallel using computing resources outside the vehicle control device.

18. A vehicle control device according to claim 1, The control software unit is configured to execute processing with priority over the verification software unit. A vehicle control device characterized in that, if the control software unit is unable to execute the processing in time, the control software unit uses the computing resources allocated to the verification software unit to execute the processing.

19. A vehicle control device according to claim 1, The vehicle control device is characterized in that the verification platform has a buffer management unit that monitors access to storage areas outside of those reserved for each data type and controls it to prevent data contention.

20. A vehicle control device according to claim 19, The vehicle control device is characterized in that the buffer management unit monitors for requests to delete data being verified and prevents the deletion of such data being verified.

Images