Electronic control device, vehicle control system, and software verification method

Abstract

An electronic control device according to the present invention comprises: first software that executes a calculation process based on time-series sensor information, the process results thereof being used in vehicle control; second software that is executed in parallel with the first software, and outputs the results of the calculation process based on the sensor information, the process results thereof not being used in vehicle control; a comparison unit that compares the process results of the first software and the process results of the second software; and a transmission determination unit that determines to transmit, to a verification system, sensor information corresponding to the process results that have been determined to be mismatched by the comparison unit, and further determines to transmit, to the verification system and according to the number of pieces of information acquired from the sensor information, sensor information corresponding to the process results that have been determined to be matched by the comparison unit.

Description

Electronic control device, vehicle control system, and software verification method

[0001] The present invention relates to an electronic control device.

[0002] Modern vehicles are equipped with multiple electronic control units (ECUs). As autonomous driving becomes more advanced, control software becomes more complex, and multiple ECUs, each with their own control software, work together to realize a single in-vehicle application.

[0003] To achieve high-quality control software, comprehensive verification through testing on actual equipment is ideal, but it is not realistic to perform an evaluation that covers all conditions and satisfies all requirements.

[0004] The following prior art exists as background art in this technical field: Patent Document 1 (JP 2022-13187 A) describes a vehicle control device that includes a verification management unit that executes an old control software unit that indicates an old version of control software and a new control software unit that indicates a new version of control software in parallel or in parallel, and an output verification unit that outputs information indicating a mismatch when there is a mismatch between the output of the old control software unit and the output of the new control software unit.

[0005] Japanese Patent Application Laid-Open No. 2022-13187

[0006] In Patent Document 1, the old control software unit and the new control software unit perform recognition processing, route planning, and calculate control commands based on input sensor values. In addition, the outputs of the old control software unit and the new control software unit are compared, and if the outputs of the two control software units do not match, information indicating the mismatch is output.

[0007] When the technology described in Patent Document 1 is applied to comparing the outputs of the recognition processing of control software, there is a possibility of false detection or non-detection, so even if only cases where the outputs do not match are extracted, it is not sufficient to evaluate the software.

[0008] A representative example of the invention disclosed in this application to solve the above-mentioned problems is as follows: That is, an electronic control device for controlling a vehicle includes a processor that executes software and a storage device that stores the software, is connected to a verification system that verifies the software using information from the electronic control device, and includes: first software that executes arithmetic processing based on time-series sensor information and the processing results are used for vehicle control; second software that runs in parallel with the first software and outputs the results of arithmetic processing based on the sensor information and the processing results are not used for vehicle control; a comparison unit that compares the processing results of the first software with the processing results of the second software; and a transmission determination unit that transmits sensor information corresponding to processing results that the comparison unit determines to be in agreement to the verification system, and further determines, depending on the number of pieces of information acquired from the sensor information, to transmit sensor information corresponding to processing results that the comparison unit determines to be in agreement to the verification system.

[0009] According to one aspect of the present invention, the quality of software can be improved. Objects, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0010] FIG. 1 is a block diagram showing the configuration of an electronic control device of a first embodiment. FIG. 2 is a flowchart of processing executed by the electronic control device of the first embodiment. FIG. 3 is a diagram showing a comparison correspondence table in which an output comparison unit of the first embodiment compares detection results. FIG. 4 is a block diagram of an external re-processing unit of the first embodiment. FIG. 5 is a flowchart of processing executed by an electronic control device of the second embodiment. FIG. 6 is a block diagram showing the configuration of an electronic control device of the third embodiment. FIG. 7 is a block diagram showing the configuration of an electronic control device of the fourth embodiment. FIG. 8 is a flowchart of processing executed by an electronic control device of the fourth embodiment. FIG. 9 is a flowchart of processing executed by an electronic control device of the fifth embodiment. FIG. 10 is a configuration diagram of a vehicle control system of an embodiment of the present invention. FIG. 11 is a timing chart from sensor input to output of a sensor value of the first embodiment. FIG. 12 is a timing chart from sensor input to output of a sensor value of the second embodiment.

[0011] An embodiment of the present invention will be described below.

[0012] <Electronic Control Unit: Number of Objects Detected> FIG. 11 is a diagram showing the configuration of a vehicle control system according to an embodiment of the present invention.

[0013] The vehicle control system includes a sensor 1101 that observes the outside of the vehicle, an electronic control unit (ECU) 1102, and an external re-processing unit 1103 that is provided on a server or in the cloud. The sensor 1101 and the electronic control unit 1102 are disposed in a vehicle 1104 and connected by a communication line using a high-speed protocol such as Ethernet (registered trademark). The external re-processing unit 1103 is disposed in an external server 1105 and is connected to the electronic control unit 1102 by a wireless communication line. Although the external re-processing unit 1103 will be described as being located in the external server 1105, it may also be provided in an electronic control unit inside the vehicle.

[0014] FIG. 1 is a block diagram showing the configuration of the electronic control unit 1102.

[0015] The electronic control unit 1102 has a sensor receiving unit 101, a current detection software unit 102, an operation control unit 103, a new detection software unit 104, an output comparison unit 105, a transmission determination unit 106, a temporary storage unit 107, a transmission / reception unit 108, a threshold 1 adjustment unit 109, and a threshold 2 adjustment unit 110.

[0016] The current detection software unit 102 is equipped with the current (Version N) object detection software, and the new detection software unit 104 is equipped with new (Version N+1) object detection software that is different from the current software. The sensor receiving unit 101 receives sensor images from the sensor 1101, the current detection software unit 102 detects objects from the sensor images, and the driving control unit 103 executes processes such as recognition, route planning, and control commands to achieve autonomous driving. The sensor images input from the sensor 1101 are accompanied by attribute information that identifies the sensor 1101 that acquired the sensor image, and identifies the frame image, such as the time and location of the image.

[0017] The new detection software unit 104 also performs object detection processing, and the output comparison unit 105 compares the object detection results output from the current detection software unit 102 and the new detection software unit 104. The transmission determination unit 106 determines whether to output an input sensor value based on the output comparison result. For example, if the output comparison unit 105 detects a discrepancy between the two object detection results, it may output the input sensor value. The sensor value output may be output externally after the input sensor value temporarily stored in a temporary storage unit 107, such as a memory, is converted into an appropriate protocol by the transmission / reception unit 108. The current detection software unit 102 and the new detection software unit 104 count the number of objects detected in the object detection processing they execute and compare it with a detection threshold preset by the threshold 1 adjustment unit 109. The output comparison unit 105 detects a discrepancy between the object detection results of the current detection software unit 102 and the new detection software unit 104 according to a comparison threshold preset by the threshold 2 adjustment unit 110. For example, object detection is the case where "a certain object has been detected with a reasonable degree of confidence," and it is advisable to output coordinates showing the rectangular boundary line (bounding box) that indicates the object's position. Furthermore, detection is the case where "one or more objects are detected from a certain sensor image," excessive detection is the case where "a number of objects equal to or greater than a predetermined detection threshold are detected from a certain sensor image," and comparison match is the case where "the degree of overlap between the detection values ​​(bounding boxes) of both detection software is equal to or greater than a predetermined comparison threshold, and the types of objects detected are the same."

[0018] 2 is a flowchart of the process executed by the electronic control unit 1102. The flow of the process in the electronic control unit 1102 of FIG. 1 will be described with reference to FIG.

[0019] The current detection software unit 102 detects an object from the input sensor values ​​using software Version. N (201), and the new detection software unit 104 detects an object from the input sensor values ​​using software Version. N+1 (202). Next, the threshold 1 adjustment unit 109 counts the number of object detections by each object detection software, and counts the total count value n as 1 if the detections are presumed to be the same object in the same location (203), rather than adding up the total count value n. While not particularly limited here, the number of detected objects likely related to autonomous driving (e.g., other vehicles, pedestrians, etc.) may be used. If no object is detected (n = 0), the process terminates without doing anything; if something is detected, the following process is executed (204).

[0020] The transmission determination unit 106 determines whether the total count value n of the number of detected objects is equal to or greater than a predetermined threshold 1 (detection threshold) (205). If the total count value n is equal to or greater than threshold 1, the input sensor value is output without comparing the outputs of both software (210). This object detection number determination process may be performed at all times or at a predetermined time after an output discrepancy is detected. In the latter case, it is assumed that when an output discrepancy is detected, one of the software programs has erroneously detected or failed to detect an object, and that there is a high possibility that erroneous detection or failure will occur in both software programs in images immediately thereafter. Therefore, the target image may be the image output at a predetermined time after the discrepancy is detected, or an image in which a predetermined number of objects or more are detected. Furthermore, the threshold 1 (detection threshold) used to compare the number of detected objects may be a fixed value determined by initial setting, or may be determined taking into account the number of detected objects when a discrepancy is detected. Furthermore, the target image may be an image output at a predetermined time before and after the image in which the discrepancy is detected, rather than a predetermined time after the discrepancy is detected.

[0021] Next, the output comparison unit 105 repeatedly executes the subsequent detection output comparison process n times for all count values ​​(206). The detection output comparison process (207) evaluates the degree of overlap between the detection coordinates output by each software and determines a match if the overlap is equal to or greater than a predetermined threshold 2 (comparison threshold). If the transmission determination unit 106 determines that all detected objects (n count values) match, the process terminates (209). On the other hand, if a mismatch is detected, the input sensor value is output (210). This allows input sensor images to be output externally when the number of detected objects exceeds a certain threshold, in addition to when a mismatch is detected. When outputting the input sensor values ​​externally, it is recommended to attach attribute information, such as the sensor image (such as the observation time and observation location) as well as judgment information (such as whether a mismatch was detected, deterioration, or improvement), to facilitate data management and identification on an external server, etc. Although not shown in the electronic control device 1102 of FIG. 1, it would be advantageous to detect surrounding conditions such as weather and brightness, the vehicle's driving conditions on ordinary roads, expressways, intersections, etc., road conditions such as traffic jams, broken-down vehicles, and road damage, driving conditions such as lights, speed, and braking operations, and the driver's characteristics (level of proficiency, physical condition, etc.), and then add these to and transmit them as attribute information, thereby making management and identification easier.

[0022] FIG. 3 is a diagram showing a comparison correspondence table in which the output comparison unit 105 compares detection results. If both software programs correctly detect an object when it is present (pattern 301) or correctly fail to detect an object when it is absent (pattern 308), the output results can be determined to match. On the other hand, the software modification status when a mismatch is detected differs depending on whether an object is present. If a mismatch is detected when an object is present, and the current detection software fails to detect it but the new detection software detects it, it can be determined that the detection software has "improved" (pattern 303). If the current detection software detects it but the new detection software fails to detect it, it can be determined that the detection software has "degraded" (pattern 302). Furthermore, if a mismatch is detected when an object is absent, and the current detection software fails to detect it but the new detection software detects it, it can be determined that the software has "degraded" (pattern 307). If the current detection software detects it but the new detection software fails to detect it, it can be determined that the software has "improved" (pattern 306). Therefore, if the detection software is "degraded," the input sensor value may be output. Furthermore, there are cases where an object is present and a match is detected, but both software programs do not detect it (pattern 304), and cases where an object is not present and a match is detected, but both software programs detect it incorrectly (pattern 305). In these cases, the conditions for outputting the input sensor value are not met, and extraction of the problematic image may fail. Therefore, in this embodiment, as an example of a case where a problem remains, it is advisable to output an image in which object detection is above a certain threshold, there are many objects, and the objects appear to be complexly overlapping, as an edge case.

[0023] FIG. 12 is a timing chart showing the process from sensor input to sensor value output. For example, the diagram shows a case where images from scene 0 to scene 5 are input as input sensor images 1201, and processing is performed at each stage of current detection software 1202, new detection software 1203, comparison 1204, judgment 1205, detection count 1206, and detection threshold 1207 control. The timing of the start and end of processing is shown in a simplified manner, and the actual timing (e.g., software execution time) may vary depending on the hardware and software implementation method. The detection threshold is set to (detection count - 1) based on the number of detections when a mismatch is detected. If it is determined that only mismatch detections should be output (1208), as in the past, only "scene 2" is determined to be the transmitted image. If a certain period after the mismatch detection (in the case of two time periods) 1209 is set, "Scene 3" and "Scene 4" are also determined to be output images, and if a certain period before and after the mismatch detection (in the case of two time periods before and after) 1210 is set, "Scene 0" and "Scene 1" are also determined to be output images. Furthermore, if the condition is that the number of detections after the mismatch detection exceeds the detection threshold 1211, "Scene 3" and "Scene 5" are determined to be output images. In this way, suspicious cases before and after the mismatch detection can be output as edge cases.

[0024] The output input sensor values ​​are sent to, for example, a server or the like and managed appropriately. FIG. 4 is a block diagram of the external reprocessing unit 1103. The input sensor values ​​output from the electronic control unit 1102 are stored in a temporary storage unit 402 provided in a memory area via a data receiving unit 401. The memory area is a storage area within the server, and the hardware and media constituting the storage area are not limited. Re-verification on the server using software 403 equivalent to the new detection software can contribute to improving the quality of the software. In addition, the software is improved by a software correction unit 404 using images that cause detection problems, and the improved software is transmitted from a data transmission unit 405 to rewrite the software in the electronic control unit 1102.

[0025] 5 is a flowchart of the process executed by the external reprocessing unit 1103. First, it is determined whether the input sensor value is mismatched data based on the identification information of the input sensor value (501). If the input sensor value is mismatched data, it is determined whether the data is improved or deteriorated (502). If the data is deteriorated, the image is used for re-verification with new detection software (503), and an attempt is made to correct the detection software (504).

[0026] On the other hand, if the input sensor value is not discrepant data, re-verification is performed using the new detection software (505) to determine whether there are any problems, such as false detection or non-detection (506). If a problem is found, an attempt is made to correct the new detection software (504). This improves the quality of the software. Here, it has been described that discrepant data for improvement is processed so as not to be transmitted on the electronic control device 1102 side or is excluded on the server side, but an image of the discrepant data for improvement may also be used as a reference for correcting the new detection software.

[0027] Next, a second embodiment of the present invention will be described. In the second embodiment, the number of detected objects is not compared with the threshold value 1 (205) in the first embodiment (FIG. 2), but the transition of the number of detected objects is monitored (601). Note that the second embodiment will mainly describe the differences from the first embodiment, and the same components and processes as those in the first embodiment will be assigned the same reference numerals and their description will be omitted.

[0028] <Electronic Control Unit: Object Detection Progression> FIG. 6 is a flowchart of processing executed by the electronic control unit 1102 according to the second embodiment.

[0029] The threshold 1 adjustment unit 109 of the electronic control device 1102 not only counts the number of detected objects output by the current detection software unit 102 and the number of detected objects output by the new detection software unit 104, but also monitors changes in the number of detected objects output. For example, it checks changes such as changes in the total count value and changes in the count value for each type of detected object. While cases where objects suddenly disappear or suddenly appear are conceivable, taking into account cases where objects appear and disappear, resulting in undetected objects, or where objects are overlapping in a complex manner, resulting in frequent false detections, the presence or absence of abnormal changes such as sudden changes, sudden increases, or decreases is detected (601). If an abnormal change is detected, it is preferable to output the input sensor value without comparing the outputs of both software (210).

[0030] FIG. 13 is a timing chart from sensor input to sensor value output. As in FIG. 12, the process start and end timings are illustrated in a simplified manner. Images of scenes 10 to 15 are input as input sensor images 1201, and the transition in the number of detections 1301 is monitored. A sudden change in the number of detections 1302 is detected, and "scene 12" is extracted and determined as the image to be output and transmitted. Here, as a method for detecting a sudden change, some change may be tolerated, and the number of detections may be compared with the number of detections one or two time periods earlier, and a determination may be made as to whether there is an increase or decrease greater than a predetermined threshold. This allows input sensor images to be output externally in cases where there is a large change in the number of object detections, in addition to when a mismatch is detected.

[0031] Next, a third embodiment of the present invention will be described. In the third embodiment, a condition detection unit 701 is added to the configuration of the electronic control unit 1102 (FIG. 1) of the first embodiment. In the third embodiment, differences from the first embodiment will be mainly described, and the same components and processes as those of the first embodiment will be assigned the same reference numerals, and their description will be omitted.

[0032] <Electronic Control Unit: Under Specific Conditions> FIG. 7 is a block diagram showing the configuration of an electronic control unit 1102 according to a third embodiment.

[0033] The electronic control unit 1102 of Example 3 has a sensor receiving unit 101, a current detection software unit 102, an operation control unit 103, a new detection software unit 104, an output comparison unit 105, a transmission determination unit 106, a temporary storage unit 107, a transmission / reception unit 108, a threshold 1 adjustment unit 109, a threshold 2 adjustment unit 110, and a condition detection unit 701.

[0034] The condition detection unit 701 detects environmental information such as time, location, weather, and visibility. This environmental information may be managed as identification information added to input sensor values ​​or added to sensor values ​​output externally. For example, in cases of poor visibility, object detection accuracy may decrease, resulting in a lower number of object detections. This may also reduce the number of comparison items, resulting in a lower number of mismatch detections and potentially overlooking areas for software improvement. Therefore, the number of mismatch detections can be increased by adjusting the thresholds according to the surrounding environment. For example, the threshold 1 adjustment unit 109 and the threshold 2 adjustment unit 110 can be controlled to increase the number of mismatch detections by loosening threshold 1 (detection threshold) used to compare the number of object detections or tightening threshold 2 (comparison threshold) used to determine whether a match is true. This allows the necessary input sensor images to be output externally even in cases where detection accuracy is reduced.

[0035] Next, a fourth embodiment of the present invention will be described. In the fourth embodiment, a condition comparison unit 801 is added to the configuration of the electronic control device 1102 (FIG. 7) of the third embodiment. In the fourth embodiment, differences from the third embodiment will be mainly described, and the same components and processes as those of the first and third embodiments will be assigned the same reference numerals and will not be described again.

[0036] <Electronic Control Unit: Storage Condition Comparison 1> FIG. 8 is a block diagram showing the configuration of an electronic control unit 1102 according to a fourth embodiment.

[0037] The electronic control unit 1102 of Example 4 has a sensor receiving unit 101, a current detection software unit 102, an operation control unit 103, a new detection software unit 104, an output comparison unit 105, a transmission determination unit 106, a temporary storage unit 107, a transmission / reception unit 108, a threshold 1 adjustment unit 109, a threshold 2 adjustment unit 110, a condition detection unit 701, and a condition comparison unit 801.

[0038] The various conditions detected by the condition detection unit 701 are temporarily stored in the temporary storage unit 107 or the condition comparison unit 801, and are compared by the condition comparison unit 801 with the detection conditions of the input image.

[0039] FIG. 9 is a flowchart of the process executed by the electronic control unit 1102 according to the fourth embodiment.

[0040] The difference from FIG. 2 of the first embodiment is that, instead of comparing the number of detected objects with threshold 1 (205), the environment in which the object was detected is compared with stored condition 1 (901). For example, the condition comparison unit 801 stores the time and location in which a mismatch occurred in the past as condition 1. By comparing with condition 1, images of the time period and location in which a mismatch occurred can be extracted, facilitating re-verification under the conditions in which a mismatch occurred previously. Furthermore, when verifying a new version of software, using the conditions stored in the previous version makes it easy to determine whether improvements have been made under the same conditions. It is also possible to verify whether problems occur under different environments, such as different traffic volumes, even in the same time period and location, or whether there are other risks. While time and location are described as stored condition 1 here, other conditions may be used as long as they can be classified and are highly reproducible. This allows input sensor images to be output to the outside, not only when a mismatch is detected, but also when an environment identical to the conditions in which a mismatch occurred in the past is detected.

[0041] Next, a fifth embodiment of the present invention will be described. The fifth embodiment differs from the fourth embodiment in the determination by the condition comparison unit 801. In the fifth embodiment, differences from the fourth embodiment will be mainly described, and the same components and processes as those in the fourth embodiment will be assigned the same reference numerals, and their description will be omitted.

[0042] <Electronic Control Unit: Storage Condition Comparison 2> FIG. 10 is a flowchart of the process executed by the electronic control unit 1102 according to the fifth embodiment.

[0043] The difference from FIG. 9 of the fourth embodiment is that instead of comparing whether the condition matches condition 1 (901), it determines whether the condition matches condition 1 and whether the condition does not match condition 2 (1001). For example, the condition comparison unit 801 stores the time and location where a mismatch occurred in the past as condition 1, and the weather and visibility as condition 2. This allows for extraction of images under different weather conditions even in a time period or location where a mismatch previously occurred, making it possible to verify whether a problem occurs in a different environment, even in the same time period or location. While the description has been given using time and location as stored condition 1 and weather and visibility as stored condition 2, other conditions may be used as long as they can be classified and are highly reproducible. This allows for outputting to the outside, in addition to cases where a mismatch is detected, input sensor images for cases where a different environment is detected under conditions where a mismatch previously occurred.

[0044] 11 has been described as being configured with a single sensor 1101 and a single electronic control unit 1102, a plurality of sensors 1101 may be disposed within the vehicle 1104, and the observation results of the plurality of sensors 1101 may be input to a single electronic control unit 1102, or the observation results of the plurality of sensors 1101 may be input to a plurality of electronic control units 1102. Also, the vehicle control system may be configured in combination with an electronic control unit 1102 that does not compare the old and new software.

[0045] In the above embodiments, the output comparison unit 105 and the transmission determination unit 106 are provided in the electronic control device 1102, and the input sensor values ​​are output to an external server or the like and reprocessed in the external reprocessing unit 1103. However, the output comparison unit 105 and the transmission determination unit 106 may be provided in the external reprocessing unit 1103. In that case, the input sensor values ​​and all output values ​​of each detection software unit may be output to the external reprocessing unit 1103, and the external reprocessing unit 1103 may select data to be used for reprocessing by referring to the comparison results and determination results.

[0046] Although the comparison of output values ​​from object detection software has been described, the comparison of output values ​​from software used for recognition processing, path planning, and control commands can also be achieved with a similar configuration.

[0047] In addition, although the new detection software has been described as Version. N and the old detection software as Version. N+1, it is sufficient that the new detection software differs even partially from the old software, and even if the initial values ​​are different for the same version of software or the setting values ​​are different for the same version of software, the software functions can be verified in the same configuration. Any software can be used as the comparison subject as long as the purpose is to verify the functions of software that are different from the old version of software.

[0048] The vehicle control system of this embodiment outputs sensor information not only when the output of the new detection software and the output of the old detection software do not match, but also when the output results match based on the detection conditions and transition conditions for the number of detected objects. This makes it easy to output cases where there is a suspicion of erroneous detection or non-detection, and software quality can be improved by re-verifying the results in the external re-processing unit 1103.

[0049] The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the spirit and scope of the appended claims. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to configurations including all of the described configurations. Furthermore, part of the configuration of one embodiment may be replaced with the configuration of another embodiment. Furthermore, the configuration of another embodiment may be added to the configuration of one embodiment. Furthermore, part of the configuration of each embodiment may be added, deleted, or replaced with other configurations.

[0050] Furthermore, the aforementioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole in hardware, for example by designing them as integrated circuits, or may be realized in software by having a processor interpret and execute a program that realizes each function.

[0051] Information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, hard disk, or SSD (Solid State Drive), or in a recording medium such as an IC card, SD card, or DVD.

[0052] In addition, the control lines and information lines shown are those that are considered necessary for explanation, and do not necessarily represent all the control lines and information lines that are necessary for implementation. In reality, it can be assumed that almost all components are interconnected.

[0053] 101...sensor receiving unit, 102...current detection software unit, 103...driving control unit, 104...new detection software unit, 105...output comparison unit, 106...transmission determination unit, 107...temporary storage unit, 108...transmitting / receiving unit, 109...threshold 1 adjustment unit, 110...threshold 2 adjustment unit, 401...data receiving unit, 402...temporary storage unit, 403...new detection software unit, 404...software correction unit, 405...data transmitting unit, 701...condition detection unit, 801...condition comparison unit, 1101...sensor, 1102...electronic control unit, 1103...external re-processing unit, 1104...vehicle, 1105...server

Claims

1. An electronic control device for controlling a vehicle, A processor for executing software and a storage device for storing the software, a verification system that verifies software using information from the electronic control unit; First software that executes a calculation process based on time-series sensor information, the result of which is used for vehicle control; second software that is executed in parallel with the first software, outputs a result of a calculation process based on the sensor information, and the result of the calculation is not used for vehicle control; a comparison unit that compares a processing result of the first software with a processing result of the second software; An electronic control device characterized in that it has a transmission determination unit that transmits sensor information corresponding to a processing result that the comparison unit determines to be a mismatch to the verification system, and further determines, depending on the number of pieces of information obtained from the sensor information, to transmit sensor information corresponding to a processing result that the comparison unit determines to be a match to the verification system.

2. 2. The electronic control device according to claim 1, A first adjustment unit that adjusts the detection threshold, The electronic control device is characterized in that the transmission determination unit compares the amount of information obtained from the sensor information by the first software and the second software with the detection threshold, and when the amount of information obtained from the sensor information is greater than the detection threshold, determines to transmit the sensor information corresponding to the processing result that the comparison unit has determined to be a match.

3. 2. The electronic control device according to claim 1, The electronic control device, characterized in that the transmission determination unit determines to transmit sensor information corresponding to a processing result that the comparison unit determines to be a match during a certain period of time after the processing result that the comparison unit determines to be a match.

4. 2. The electronic control device according to claim 1, The electronic control device, characterized in that the transmission determination unit determines to transmit sensor information corresponding to a processing result that the comparison unit determines to be a match during a certain period before and after the processing result that the comparison unit determines to be a match.

5. 2. The electronic control device according to claim 1, A first adjustment unit that adjusts the detection threshold, The electronic control device is characterized in that the transmission determination unit compares the amount of information obtained from the sensor information by the first software and the second software with the detection threshold, and determines to transmit the sensor information corresponding to the processing result that the comparison unit has determined to be a match based on the change in the amount of information obtained from the sensor information.

6. 2. The electronic control device according to claim 1, a first adjustment unit that adjusts a detection threshold in accordance with a surrounding environment of the vehicle; The electronic control device is characterized in that the transmission determination unit compares the amount of information obtained from the sensor information by the first software and the second software with the adjusted detection threshold, and when the amount of information obtained from the sensor information is greater than the detection threshold, determines to transmit the sensor information corresponding to the processing result that the comparison unit has determined to be a match.

7. 2. The electronic control device according to claim 1, a second adjustment unit that adjusts a comparison threshold used by the comparison unit to compare the processing results in accordance with a surrounding environment of the vehicle; The comparison unit uses the adjusted comparison threshold value to compare the processing results of the first software with the processing results of the second software and determine whether the processing results match.

8. 2. The electronic control device according to claim 1, a condition detection unit for detecting a surrounding environment of the vehicle; The comparison unit stores the surrounding environment at the time when the mismatch is determined as an operating condition, The electronic control device is characterized in that the transmission determination unit determines to transmit sensor information corresponding to the processing result that the comparison unit has determined to be a match when the surrounding environment detected by the condition detection unit matches the operating conditions stored in the comparison unit.

9. 2. The electronic control device according to claim 1, a condition detection unit for detecting a surrounding environment of the vehicle; the comparison unit stores the first surrounding environment and the second surrounding environment when it is determined that there is a mismatch as a first operating condition and a second operating condition, respectively; The electronic control device is characterized in that the transmission determination unit determines to transmit sensor information corresponding to the processing result that the comparison unit determines to be a match when the surrounding environment detected by the condition detection unit matches the first operating condition stored in the comparison unit and does not match the second operating condition.

10. 2. The electronic control device according to claim 1, The electronic control device according to claim 1, wherein the sensor information transmitted to the verification system includes a processing result of the first software, a processing result of the second software, and a comparison result of the comparison unit.

11. 2. The electronic control device according to claim 1, a condition detection unit for detecting a surrounding environment of the vehicle; An electronic control device characterized in that the sensor information transmitted to the verification system includes the processing result of the first software, the processing result of the second software, the comparison result of the comparison unit, and the detection result of the condition detection unit.

12. A vehicle control system, comprising: An electronic control device for controlling a vehicle; a verification device that verifies software using information from the electronic control device, The electronic control device includes: First software that executes a calculation process based on time-series sensor information, the result of which is used for vehicle control; second software that is executed in parallel with the first software, outputs a result of a calculation process based on the sensor information, and the result of the calculation is not used for vehicle control; a comparison unit that compares a processing result of the first software with a processing result of the second software; a transmission determination unit that transmits to the verification device sensor information corresponding to the processing result determined to be a mismatch by the comparison unit, and further determines to transmit to the verification device sensor information corresponding to the processing result determined to be a match by the comparison unit according to a number of pieces of information acquired from the sensor information, A vehicle control system characterized in that the verification device executes arithmetic processing by the second software using sensor information transmitted from the electronic control device, and outputs information regarding the processing results of the second software.

13. A software verification method executed by a vehicle control system, comprising: The vehicle control system includes an electronic control unit that controls a vehicle, and a verification device that verifies software using information from the electronic control unit, The software verification method includes: the electronic control unit executes a calculation process for vehicle control based on the time-series sensor information by using first software whose processing result is used for vehicle control; the electronic control unit executes second software, the processing result of which is not used for vehicle control, in parallel with the first software, and outputs a result of arithmetic processing based on the sensor information; The electronic control device compares a processing result of the first software with a processing result of the second software, The electronic control device transmits to the verification device sensor information corresponding to the processing result determined to be a mismatch by the comparison, and further transmits to the verification device sensor information corresponding to the processing result determined to be a match by the comparison in accordance with the number of pieces of information acquired from the sensor information; the verification device executes a calculation process by the second software using the sensor information transmitted from the electronic control device; The software verification method, wherein the verification device outputs information regarding a processing result of the second software.