State abnormality detection system, state abnormality detection method, and program

Abstract

When an electronic system is updated, the present invention can ensure high reliability of the electronic system in operation by enabling a normal state list, which is used to determine the state of the system, to be updated more efficiently and in a short time.　In the present invention, a processor executes a normal state list generation program to identify the range of sub-modules affected by an update of an electronic system, on the basis of a comparison between configuration information before and after the update, and register each combination of the operating states of sub-modules within the range of sub-modules that are not affected by the update, and a combination of the operating states of sub-modules within the affected range of sub-modules and corresponding to the relevant combination, thereby updating a normal state list. The processor also executes a state abnormality detection program and thereby detects an abnormality in the state of the electronic system on the basis of the updated normal state list and combinations of operating states acquired from each sub-module.

Description

Status abnormality detection system, status abnormality detection method, and program

[0001] The present invention relates to a status abnormality detection system, a status abnormality detection method, and a program. This invention claims priority to Japanese Patent Application No. 2023-111134, filed on July 6, 2023, and the contents of that application are incorporated by reference into this application in designated states where incorporation by reference of documents is permitted.

[0002] In recent years, various electronic systems, including automotive systems, have become larger and more complex due to the incorporation of numerous modules. In such complex electronic systems, even if individual modules are operating normally, the system as a whole may fall into an abnormal state. For example, even if each module is processing data normally, a data synchronization error between modules may occur, causing the entire electronic system to become abnormal.

[0003] To detect abnormalities in such an electronic system as a whole, for example, one method is to perform a prior simulation to create a list of the combinations of states of each module when the system is normal, and then compare this list with the combinations of states of each module obtained from the system when it is in operation to determine whether the electronic system is in a normal or abnormal state.

[0004] Incidentally, Patent Document 1 discloses a method for detecting an abnormality in an electronic system. Specifically, Patent Document 1 describes the method as including "a feature extraction unit that receives time series data of a target device and extracts feature quantities of the time series data, a state transition estimation unit that identifies an operating state of the target device from the extracted feature quantities and estimates a state transition of the target device from the extracted feature quantities by referring to state transition pattern information that defines a state transition pattern between a plurality of operating states, and an anomaly detection unit that refers to the state transition pattern information and normal range information that defines a normal range for each operating state and determines whether the time series data is abnormal based on the identified operating state, the estimated state transition, and the feature quantities of the extracted time series data."

[0005] International Publication No. 2022 / 054256

[0006] In recent years, in fields such as in-vehicle systems, software over-the-air (OTA) and hardware updates have begun to be implemented. In the future, even in electronic systems that require high safety and reliability, such as in-vehicle systems, it is expected that there will be a growing trend to update them as they are used, rather than continuing to use them without changing their configuration.

[0007] The anomaly detection device described in Patent Document 1 determines whether an electronic system is in a normal state or an abnormal state based on whether the feature values ​​of time-series data are within a normal range of possible transitions in the operating state. However, the technology described in this document does not anticipate changes to the system configuration due to updates such as over-the-air (OTA), and does not consider updating the normal range of the operating state to reflect the changed configuration of the electronic system. Therefore, with the technology described in this document, when an update such as over-the-air (OTA) is performed, the normal range definition must be redefined from scratch, leaving room for improvement in terms of efficiency in updating the normal range.

[0008] The present invention has been made in consideration of the above-mentioned problems, and aims to ensure high reliability of electronic systems in operation by making it possible to update the normal status list used to determine the system status more efficiently and in a shorter time when the electronic system is updated.

[0009] The present application includes a number of means for solving at least part of the above problems, examples of which are as follows. One aspect of the present invention that solves the above-mentioned problem is an abnormal status detection system having one or more processors and one or more memory resources, wherein the memory resources store configuration information that registers the configuration of each sub-module of an electronic system, a normal status list that registers combinations of operating states of each sub-module when the electronic system is in a normal state, a normal status list generation program that generates the normal status list, and a abnormal status detection program that detects abnormal status of the electronic system, wherein the processor executes the normal status list generation program to: identify the scope of impact of the update on the sub-modules based on a comparison of the configuration information before and after an update of the electronic system, and update the normal status list by registering each combination of operating states of the sub-modules within a non-affected range that is not affected by the update, and the combination of operating states of the sub-modules within the affected range that corresponds to said combination, and wherein the processor executes the abnormal status detection program to: detect abnormal status of the electronic system based on the normal status list after the update and the combinations of operating states obtained from each sub-module.

[0010] According to the present invention, when an electronic system is updated, the normal status list used to determine the system status can be updated more efficiently and in a shorter time, thereby ensuring high reliability of the electronic system during operation.

[0011] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0012] 1 is a diagram showing an example of a schematic configuration of an abnormal status detection system; FIG. 2 is a diagram showing an example of configuration information; FIG. 3 is a diagram showing an example of a normal status list; FIG. 4 is a diagram showing an example of a functional configuration of an abnormal status detection system; FIG. 5 is a flow diagram showing an example of an abnormal status detection process; FIG. 6 is a diagram showing an example of a configuration of a sub-module of an electronic system; FIG. 7 is a diagram showing an example of a change area; FIG. 8 is a diagram showing an example of an impact range; FIG. 9 is a diagram showing an example of a normal status list related to an update; and FIG. 10 is a diagram showing an example of a functional configuration of an abnormal status detection system according to a second embodiment.

[0013] Hereinafter, each embodiment of the present invention will be described with reference to the drawings.

[0014] First Embodiment A condition abnormality detection system 100 according to this embodiment (hereinafter, sometimes referred to as "the system 100") is a processor system that detects a condition abnormality in an electronic system. Note that the type of electronic system to be detected is not limited, but a possible target is, for example, an electronic system such as an in-vehicle system having multiple ECUs (Electronic Control Units) as sub-modules.

[0015] Specifically, the abnormal status detection system 100 generates a normal status list that registers combinations of the statuses of the sub-modules when the electronic system is in a normal status. The abnormal status detection system 100 also detects an abnormal status of the electronic system based on a comparison between the normal status list and the combinations of the statuses acquired from the sub-modules.

[0016] Furthermore, the status abnormality detection system 100 generates new configuration information after an OTA (Over The Air) update or a hardware update (hereinafter, these may be collectively referred to as an "update") based on the configuration information acquired from each sub-module. Furthermore, the status abnormality detection system 100 identifies the extent to which the update has affected the sub-module based on the difference between the old configuration information before the update and the new configuration information.

[0017] Furthermore, the abnormal condition detection system 100 uses simulation to identify the state of the sub-modules included in the identified range of influence when the electronic system is in a normal state after the update. Furthermore, the abnormal condition detection system 100 updates the normal condition list after the update by registering combinations of the identified states of the sub-modules included in the range of influence and the corresponding states of the sub-modules not included in the range of influence in the normal condition list.

[0018] Furthermore, the abnormal status detection system 100 detects an abnormal status of the electronic system based on a comparison between the updated normal status list and the combination of statuses acquired from each sub-module.

[0019] According to this abnormal status detection system, when an electronic system is updated, it is possible to update the normal status list related to the combinations of operating states, focusing on the range affected by the update. As a result, the abnormal status detection system can update the normal status list used to determine the system status more efficiently and in a shorter time, thereby ensuring high reliability of the electronic system during operation.

[0020] 1 is a diagram showing an example of a schematic configuration of a status abnormality detection system 100 (processor system). The status abnormality detection system 100 is connected to an external device 10 so as to be able to communicate with each other via, for example, a CAN (Controller Area Network) or another communication network N (e.g., the Internet, a LAN (Local Area Network), and a WAN (Wide Area Network)).

[0021] <<External Device 10>> The external device 10 is a device that provides information to the abnormal condition detection system 100, and is, for example, a sub-module mounted on an electronic system. For example, if the electronic system is an in-vehicle system, the sub-module that is the external device 10 corresponds to various ECUs. Such an external device 10 outputs the operating state (actual system state) and configuration information of the electronic system to the abnormal condition detection system 100.

[0022] Specifically, the external device 10 outputs information indicating the operating state of each sub-module (e.g., a predetermined control or operating state) to the abnormal condition detection system 100. The external device 10 also outputs sub-module information including at least a list of possible states (types of operating states) of each sub-module and connection information between the sub-modules to the abnormal condition detection system 100.

[0023] The external device 10 outputs information indicating the operating state and sub-module information at predetermined timing to the abnormal condition detection system 100. For example, the external device 10 periodically (for example, every one to several seconds) outputs the information indicating the operating state and the sub-module information to the abnormal condition detection system 100.

[0024] Note that the timing of outputting the information indicating the operating state and the sub-module information is not limited to this. For example, the external device 10 may output information indicating the operating state to the abnormal status detection system 100 when the external device 10 changes from a certain operating state to a different operating state. Furthermore, the external device 10 may output its own sub-module information to the abnormal status detection system 100 when the configuration is changed by an update such as over-the-air (OTA).

[0025] The external device 10 is not limited to devices such as sub-modules installed in the target electronic system, but also includes, for example, devices that provide various information used in the processing performed by the abnormal condition detection system 100 (e.g., an information providing server, etc.).

[0026] <<Details of the abnormal condition detection system 100 >> The abnormal condition detection system 100 is at least one processor system in which a processor 20 reads various programs and information stored in a memory resource 30 and executes various processes.

[0027] The abnormal condition detection system 100 is implemented in, for example, a gateway device that collects information output from each sub-module (e.g., sub-module information, information indicating an operating state, etc.). That is, the abnormal condition detection system 100 is incorporated into electronic devices and electronic components within an electronic system, and uses resources such as the processor 20 and memory of these electronic devices as its own processor 20 and memory resource 30.

[0028] However, the installation location of the abnormal condition detection system 100 is not particularly limited, and the abnormal condition detection system 100 may be installed in any electronic device or the like that is capable of acquiring the information output from each sub-module.

[0029] Furthermore, the abnormal condition detection system 100 may be realized as a processor system having an independent processor, memory resources, a network interface (NI), etc. within an electronic system, rather than being implemented in an electronic device or the like.

[0030] In the abnormal status detection system 100, a processor that has loaded a predetermined program executes the abnormal status detection process using various information. Specifically, when the configuration of a submodule is changed based on an update such as an OTA, the abnormal status detection system 100 updates the new configuration information and generates a normal status list corresponding to the updated new configuration information.

[0031] Furthermore, the abnormal status detection system 100 detects abnormal status that may occur in the electronic system based on the normal status list corresponding to the updated new configuration information.

[0032] 1, the abnormal condition detection system 100, which is configured with at least one processor system, has a processor 20, a memory resource 30, and an NI (Network Interface Device) 40. The abnormal condition detection system 100 may also have a UI (User Interface Device) that accepts instruction input from a user (operator).

[0033] The processor 20 is an arithmetic device that reads a program stored in the memory resource 30 and executes processing corresponding to the program. Examples of the processor 20 include a microprocessor, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an FPGA (Field Programmable Gate Array), or other semiconductor devices capable of performing calculations.

[0034] The memory resource 30 is a storage device that stores various types of information. Specifically, the memory resource 30 is a non-volatile or volatile storage medium such as a random access memory (RAM) or a read-only memory (ROM). Note that the memory resource 30 may also be a rewritable storage medium such as a flash memory, a hard disk, or a solid state drive (SSD), a universal serial bus (USB) memory, a memory card, or a hard disk.

[0035] The NI 40 is a communication device that communicates information with the external device 10. The NI 40 communicates information with the external device 10 via a communication network N such as a CAN, a LAN, or the Internet. Unless otherwise specified below, it is assumed that information communication between the abnormal condition detection system 100 and the external device 10 is performed via the NI 40.

[0036] Furthermore, some or all of the configurations, functions, processing means, etc. of the abnormal condition detection system 100 may be realized in hardware, for example, by designing them as integrated circuits. Furthermore, some or all of the functions of the abnormal condition detection system 100 may be realized in software, or may be realized through a combination of software and hardware. Furthermore, the abnormal condition detection system 100 may use hardware with fixed circuits, or may use hardware with at least some of the circuits that are changeable.

[0037] Furthermore, if the abnormal condition detection system 100 has a UI, the system can be realized by a user (operator) performing some or all of the functions and processes realized by each program.

[0038] Furthermore, the abnormal condition detection system 100 may entrust some of the output processing to the user and some of the input processing from the user to an external processor system such as a smartphone or tablet (referred to as an external processor system) instead of the system 100. In such cases, the abnormal condition detection system 100 (or its processor or program) may do the following to execute each process or other parts of the program.

[0039] Instead of outputting to the user using a UI, the abnormal condition detection system 100 transmits data required for output to the user to the external processor system via the NI 40. Examples of the data include the data to be output itself, or data for generating output data in another processor system, but it may also be a program or web data describing a process for performing user output in the external processor system.

[0040] Furthermore, instead of receiving input or operation from the user using the UI, the abnormal condition detection system 100 receives data indicating a user input or operation from an external processor system via the NI 40. From another perspective, the meaning of outputting data to the user may include not only the abnormal condition detection system 100 itself outputting the data, but also having another entity other than the system 100 output the data (using it). Furthermore, the meaning of receiving input or operation from the user may include not only direct output or reception from the abnormal condition detection system 100 to the user, but also indirect reception by the system 100.

[0041] Furthermore, the databases and various information within the memory resource 30 described below may be data structures other than files or databases, as long as they are areas capable of storing data. One program may also fulfill the roles of multiple programs, or vice versa. In other words, one or more programs may perform the processing of each program shown in the figure.

[0042] The programs executed by the abnormal condition detection system 100 may be stored in a non-volatile storage medium that can be read by the abnormal condition detection system 100. The programs stored in the non-volatile storage medium may be directly read by the abnormal condition detection system 100, or a processor system for program distribution may read the programs from the medium and then transmit (distribute) the programs to the abnormal condition detection system 100. An example of the non-volatile storage medium is the non-volatile memory described as the memory resource 30, but other optical disk media may also be used.

[0043] <<Configuration Information DB 110>> The configuration information DB 110 is a database that stores configuration information. The configuration information DB 110 stores new configuration information generated based on the latest sub-module information and old configuration information, which is the configuration information before the new configuration information was generated.

[0044] The configuration information includes information about the configuration of each sub-module installed in the electronic system. Specifically, the configuration information includes records that associate sub-modules, I / Fs, status lists, connection information, and data flows.

[0045] FIG. 2 is a diagram showing an example of configuration information. Here, submodule 110a is information for uniquely identifying each submodule. I / F 110b is information for identifying the interface of the submodule to which other submodules are connected. Status list 110c is information indicating all possible operating states of each submodule. Connection information 110d is information indicating other submodules connected to the submodule. Data flow 110e is information indicating the flow of specified information until it reaches the submodule. For example, data flow 110e is indicated by the route order of the submodules through which information passes.

[0046] Such configuration information is generated by the processor 20 using sub-module information obtained from each sub-module.

[0047] <<Normal State List 120>> The normal state list 120 is information in which combinations of states of the sub-modules when the electronic system is in a normal state are registered.

[0048] 3 is a diagram showing an example of the normal state list 120. As shown in the figure, each of records #1 to #6 registers a combination of states that each sub-module (sub-modules a to f) can assume when the electronic system is in a normal state. For example, record #1 indicates that the electronic system is in a normal state when the states of sub-modules a to f are a combination of "state a1, state b1, state c1, state d3, state e3, and state f4."

[0049] Such a normal status list 120 is generated (updated) by the processor 20 when an update such as an OTA occurs and new configuration information is updated accordingly. Details of the process for generating the normal status list 120 will be described later.

[0050] <<Configuration Information Update Program 211>> The configuration information update program 211 is a program that updates the new configuration information stored in the configuration information DB 110. When the processor 20 reads the configuration information update program 211, it compares, for example, the latest submodule information acquired from each submodule with the new configuration information at that time. If there is a difference between the latest submodule information and the new configuration information, the processor 20 updates (generates) the new configuration information by registering the latest submodule information in the record of the submodule corresponding to the new configuration information. When the new configuration information is updated, the previous new configuration information is stored in the configuration information DB 110 as old configuration information.

[0051] However, the method for updating the configuration information is not limited to this. For example, when an update such as OTA is performed, information regarding the configuration of the changed sub-module may be obtained from the changed sub-module or other configuration of the electronic system (for example, a gateway device or other subsystems related to the update), or from the server that performed the OTA update, and the new configuration information may be updated based on the obtained information.

[0052] <<Normal State List Generation Program 212>> The normal state list generation program 212 is a program that generates the normal state list 120. Specifically, the normal state list generation program 212 identifies the extent to which a sub-module is affected by an update such as an OTA. More specifically, the normal state list generation program 212 identifies the extent to which a sub-module is affected based on the difference between the configuration information after the change due to the update (new configuration information) and the configuration information before the change (old configuration information).

[0053] The normal state list generation program 212 also identifies combinations of the operating states of submodules included in the identified affected range and the operating states of submodules included in the non-affected range. Specifically, the normal state list generation program 212 identifies combinations of the operating states of submodules included in the non-affected range. The normal state list generation program 212 also identifies combinations of the operating states of submodules included in the affected range through simulation, using the identified combinations as conditions.

[0054] Furthermore, the normal state list generation program 212 updates (generates) the normal state list 120 by registering these identified combinations of operating states in the normal state list 120 .

[0055] <<Status Abnormality Detection Program 213>> The status abnormality detection program 213 is a program that detects status abnormalities in the electronic system. Specifically, the status abnormality detection program 213 detects status abnormalities in the electronic system based on the normal status list 120 and the operating statuses acquired from each submodule. More specifically, the status abnormality detection program 213 determines whether a combination of operating statuses acquired from each submodule is included in the normal status list 120, and if it determines that the combination is not included, detects a status abnormality in the electronic system.

[0056] <Functional Configuration of Condition Abnormality Detection System 100> Fig. 4 is a diagram showing an example of the functional configuration of the condition abnormality detection system 100. The functional units shown in the figure are categorized according to the main processing content in order to facilitate understanding of the functions realized by the processor 20 reading each program stored in the memory resource 30. Therefore, the present invention is not limited by the way the functions are categorized or the names of the functional units.

[0057] The configuration information update unit 310 is implemented by the processor 20 reading the configuration information update program 211. Specifically, the configuration information update unit 310 updates the new configuration information based on a comparison between the submodule information and the new configuration information at that time.

[0058] The normal state list generation unit 320 is realized by the processor 20 reading the normal state list generation program 212. Specifically, the normal state list generation unit 320 generates (updates) the normal state list 120. The normal state list generation unit 320 is classified into a change location identification unit 321, a simulation unit 322, and a list update unit 323 depending on the processing content.

[0059] The changed part identifying unit 321 uses the old and new configuration information to identify the changed part of the sub-module whose configuration has been changed by the update.

[0060] The simulation unit 322 performs general logic simulations and system model simulations using each combination of the operating states of submodules in the non-affected range that are not affected by the configuration change as conditions, and identifies combinations of operating states of submodules included in the affected range that correspond to each combination of the operating states of submodules in the non-affected range.

[0061] The list update unit 323 updates the normal state list 120. Specifically, the list update unit 323 registers in the normal state list 120 the combination of the operating states of the sub-modules identified by the simulation unit 322.

[0062] The abnormal status detection unit 330 is realized by the processor 20 reading the abnormal status detection program 213. Specifically, the abnormal status detection unit 330 detects an abnormal status that occurs in the electronic system. The abnormal status detection unit 330 is further classified into an operation status acquisition unit 331 and an abnormal status determination unit 332 depending on the processing content.

[0063] The operation status acquisition unit 331 acquires information indicating the operation status from each sub-module.

[0064] The abnormal status determination unit 332 compares the combination of operating states acquired from each sub-module with the latest normal status list 120 to determine whether an abnormal status has occurred in the electronic system.

[0065] Note that some of the functional units may be constructed using hardware (such as an integrated circuit such as an ASIC) implemented in the abnormal condition detection system 100. Furthermore, the processing of each functional unit may be executed by a single piece of hardware or by multiple pieces of hardware.

[0066] <Explanation of Abnormal Status Detection Processing> Figure 5 is a flow diagram showing an example of abnormal status detection processing. This processing is executed by the processor 20 that has loaded the configuration information update program 211, the normal status list generation program 212, and the abnormal status detection program 213. The processor 20 may load all of the programs at the start of processing, or may load the corresponding program each time at each step during processing. The abnormal status detection processing is executed, for example, periodically (for example, every one to several seconds).

[0067] When the process starts, the processor 20 determines whether an update such as an OTA has occurred (step S10). Specifically, the processor 20 compares the sub-module information acquired from each sub-module with the new configuration information at that time, and if there is a difference between the two, determines that an update such as an OTA has occurred.

[0068] If it is determined that an update has occurred (Yes in step S10), the processor 20 proceeds to step S20. On the other hand, if it is determined that an update has not occurred (No in step S10), the processor 20 proceeds to step S50.

[0069] In the process of step S20, the processor 20 updates the new configuration information. Specifically, the processor 20 updates the new configuration information by registering the latest sub-module information in the record of the sub-module corresponding to the difference between the latest sub-module information and the new configuration information at that time.

[0070] Next, the processor 20 identifies the extent of influence of the configuration change on the submodule (step S30). How to identify the extent of influence will be described with reference to FIGS.

[0071] FIG. 6 is a diagram showing an example of the configuration of submodules included in an electronic system. The illustrated electronic system includes submodules a through f, with submodules b through f connected to submodule a at the center. The diagram also shows that, due to an update such as OTA, changes have occurred in the configuration of submodule c (difference 1), the configuration of submodule d (difference 2), and the connection relationship between submodules a and b (difference 3). Changes in the configuration of the submodules include various types of configuration changes, such as upgrading or adding functions to a submodule via OTA update, or changing (replacing) a submodule with a higher-performance one based on a hardware update.

[0072] The processor 20 identifies the change location based on the difference between the old configuration and the new configuration, and sets a change area including the corresponding sub-module.

[0073] 7 is a diagram showing an example of a change area. As shown in the figure, the change area is set to include sub-modules c, d, and b whose configurations have been changed.

[0074] The processor 20 also identifies a sub-module that has a connection relationship with a sub-module included in the change area, and sets an area including the identified sub-module and the sub-module included in the change area as the range of influence of the configuration change.

[0075] 8 is a diagram showing an example of the range of influence. As shown in the figure, the range of influence is set to an area including sub-modules c, d, and b included in the change area, and sub-module a that is connected to sub-module b included in the change area.

[0076] Returning to Fig. 5, the processor 20 then updates the normal state list 120 (step S40). The updating of the normal state list 120 will now be described with reference to Fig. 9.

[0077] FIG. 9 is a diagram showing an example of the normal state list 120 related to the update. In the process of step S40, the processor 20 identifies submodules that are not included in the impact range (submodules e and f in the example shown in FIG. 8) as submodules in the non-impact range. Furthermore, the processor 20 identifies combinations of operating states of the non-impact range submodules when the electronic system is in the normal state. In this example, the combinations identified as the operating states of submodules e and f in the normal state are state e1 / state f1, state e1 / state f2, state e1 / state f3, state e1 / state f4, state e2 / state f1, and state e2 / state f2.

[0078] The processor 20 also identifies combinations of the operating states of each sub-module included in the affected range that correspond to each of these combinations. Specifically, the processor 20 performs a general logic simulation or a system model simulation using each combination of the operating states of the identified sub-modules in the unaffected range as a condition. In this way, the processor 20 identifies combinations of the operating states of the sub-modules included in the affected range that correspond to each combination of the operating states of the sub-modules in the unaffected range.

[0079] For example, if a logical simulation is performed using state e1 / state f1, which is one of the combinations of the operating states of submodules e and f, and the combinations of the operating states of submodules a to d are states a1 to a3, states b1 to b3, states c1 to c3, and states d1 to d3, the processor 20 registers all of these combinations (81 ways) in the normal state list 120 as combinations of operating states corresponding to state e1 / state f1.

[0080] Similarly, the processor 20 identifies combinations of the operating states of submodules a to f included in the affected range that correspond to each other combination of the operating states of submodules e and f in the non-affected range, and registers them in the normal state list 120.

[0081] In this way, the processor 20 identifies the operating state when the electronic system is in a normal state for the submodules in the affected range identified using the updated configuration information (new configuration information), and updates the list by registering it in the normal state list 120.

[0082] Next, the processor 20 determines whether or not information indicating the operating state has been acquired from each sub-module (step S50). If it is determined that the information has been acquired (Yes in step S50), the processor 20 proceeds to step S60. On the other hand, if it is determined that the information has not been acquired (No in step S50), the processor 20 performs the process of step S50 again.

[0083] In the process of step S60, the processor 20 determines whether or not a status abnormality has been detected. Specifically, the processor 20 determines that a status abnormality has been detected when the combination of the operating states of the sub-modules is not included in the normal state list 120.

[0084] If it is determined that an abnormal status has been detected (Yes in step S60), the processor 20 proceeds to step S70. On the other hand, if it is determined that an abnormal status has not been detected (No in step S60), the processor 20 returns the process to step S10.

[0085] In step S70, the processor 20 generates abnormal condition detection information notifying that an abnormal condition has been detected, and outputs the information to, for example, a predetermined control device (unit) that controls the electronic system. Based on the abnormal condition detection information, the control device performs predetermined control processing, such as stopping the electronic system or the drive system.

[0086] After performing the process of step S70, the processor 20 returns the process to step S10 again.

[0087] The abnormal state detection process has been described above.

[0088] According to this abnormal status detection system, when an electronic system is updated, it is possible to update the normal status list related to the combinations of operating states, focusing on the range affected by the update. As a result, the abnormal status detection system can update the normal status list used to determine the system status more efficiently and in a shorter time, thereby ensuring high reliability of the electronic system during operation.

[0089] In the above-described embodiment, the processor 20 includes submodules whose configurations have been changed, submodules whose connection relationships have been changed, and submodules connected to the change area in the impact range of the update, but the criteria for setting the impact range are not limited to this. For example, the processor 20 may set an impact range that includes only submodules whose configurations have been changed (submodules c and d in the examples of FIGS. 6 to 8 ).

[0090] Submodules whose configurations have been changed are likely to have changes in the types of operational states they can assume, and therefore should be included in the scope of impact. On the other hand, submodules whose connections have been changed or whose connected areas have been changed often do not have changes in the types of operational states even after an update. Therefore, the processor 20 may set the scope of impact of an update in accordance with predetermined criteria (rules). Note that such predetermined criteria may be set, for example, based on the functional specifications and design of each submodule.

[0091] In this way, by narrowing the influence range of the sub-modules to a narrower range, the abnormal status detection system can reduce the simulation load for combinations of the operating states of sub-modules included in the influence range that correspond to each combination of the operating states of sub-modules not included in the influence range. As a result, the abnormal status detection system can update the normal status list more efficiently and in a shorter time.

[0092] Second Embodiment In the abnormal status detection system 100 according to this embodiment, functions related to updating the configuration information and the normal status list 120 are implemented in an OTA server (computer) that performs OTA processing (including at least update processing) for the electronic system. Specifically, in the abnormal status detection system 100, a processor of the OTA server reads and executes a normal status list generation program 212 and a configuration information update program 211 stored in its own memory resources.

[0093] 10 is a diagram showing an example of the functional configuration of an abnormal status detection system 100 according to the second embodiment. As shown in the figure, both the configuration information update unit 310 and the normal status list generation unit 320 are implemented within the OTA server. Similarly to the first embodiment, the abnormal status detection program 213 is executed by an electronic system such as an in-vehicle system. Note that the same components and functions as those in the previous embodiment are designated by the same reference numerals, and detailed descriptions thereof will be omitted.

[0094] The processor of the OTA server reads the configuration information update program 211 and generates new configuration information after the configuration change according to a general OTA system configuration information generation means using the update information possessed by the OTA server. The normal status list 120 is updated by the processor of the OTA server that reads the normal status list generation program 212 in the same manner as in the first embodiment.

[0095] The OTA server also transmits the updated (generated) normal status list 120 to the abnormal status detection unit 330. The abnormal status detection unit 330 also detects an abnormal status of the electronic system using the information indicating the operating status of the submodule acquired by the operating status acquisition unit 331 and the latest normal status list 120.

[0096] Such an abnormal status detection system also makes it possible to update the normal status list used to determine the status of the system more efficiently and in a shorter time when the electronic system is updated, thereby ensuring high reliability of the electronic system during operation.

[0097] In particular, the abnormal status detection system of this embodiment eliminates the need for the electronic system to acquire sub-module information and update the new configuration information based on a comparison between the sub-module information and new configuration information. This simplifies the processing in the electronic system, thereby reducing the processing load on the electronic system.

[0098] As a modification of the second embodiment, the functions related to updating the configuration information and the normal-status list 120 may be implemented in a cloud server (computer). In this case, the processes executed by the configuration information update program 211, the normal-status list generation program 212, and the abnormal status detection program 213 are the same as those in the first embodiment.

[0099] Note that information required for processing by each program (for example, submodule information, configuration information, etc.) may be transmitted and received between the cloud server and the electronic system.

[0100] Such an abnormal status detection system also makes it possible to update the normal status list used to determine the status of the system more efficiently and in a shorter time when the electronic system is updated, thereby ensuring high reliability of the electronic system during operation.

[0101] Furthermore, the present invention is not limited to the above-described embodiments and modifications, and includes various modifications within the scope of the same technical concept. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0102] In addition, in the above explanation, the control lines and information lines are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be considered that almost all components are interconnected.

[0103] 100... abnormal status detection system, 20... processor, 30... memory resource, 40... NI (network interface device), 110... configuration information DB, 120... normal status list, 210... program, 211... configuration information update program, 212... normal status list generation program, 213... abnormal status detection program, 310... configuration information update unit, 320... normal status list generation unit, 321... change location identification unit, 322... simulation unit, 323... list update unit, 330... abnormal status detection unit, 331... operation status acquisition unit, 332... abnormal status determination unit, 10... external device, N... network

Claims

1. A status abnormality detection system having one or more processors and one or more memory resources, wherein the memory resource stores: configuration information registering the configuration of each sub-module of an electronic system, a normal state list registering combinations of operating states of each sub-module when the electronic system is in a normal state, a normal state list generation program for generating the normal state list, and a status abnormality detection program for detecting status abnormalities of the electronic system, wherein the processor executes the normal state list generation program to: determine the scope of impact of an update of the sub-module based on a comparison of the configuration information before and after an update of the electronic system, and update the normal state list by registering each combination of operating states of the sub-modules within a non-affected range that is not affected by the update and a combination of operating states of the sub-modules within the affected range that corresponds to said combination, and wherein the processor executes the status abnormality detection program to: detect a status abnormality of the electronic system based on the normal state list after the update and the combinations of operating states obtained from each sub-module.

2. A status abnormality detection system as described in claim 1, wherein the processor executes the normal status list generation program to: identify a combination of operating states of the sub-modules within the affected range that corresponds to a condition based on a simulation set as a condition for each combination of operating states of the sub-modules within the unaffected range that is not affected by the update.

3. A status abnormality detection system as described in claim 1, characterized in that the processor, by executing the normal status list generation program: sets the range including the sub-module whose configuration has been changed as the affected range based on the configuration information before and after the update of the electronic system.

4. A status abnormality detection system as described in claim 1, wherein the processor, by executing the normal status list generation program, identifies, as a changed portion, a submodule corresponding to a change in configuration or a change in connection relationship based on the configuration information before and after an update of the electronic system, and sets the affected range to a range including the submodule identified as the changed portion and other submodules connected to the submodule identified as the changed portion.

5. A status abnormality detection system as described in claim 1, wherein the processor executes the status abnormality detection program to: detect a status abnormality in the electronic system if a combination of operating states obtained from the submodule is not included in the updated normal state list.

6. A status abnormality detection system as described in claim 1, wherein the memory resource further stores a configuration information update program that updates the configuration information, and the configuration information includes at least information indicating the types of operating states that the submodules can take and information indicating the connection relationships between the submodules, and the processor executes the configuration information update program to: update the configuration information based on a difference between submodule information regarding the configuration of the submodule obtained from the submodule after updating the electronic system and the configuration information in the memory resource.

7. A status abnormality detection system as claimed in claim 1, wherein the normal status list generation program is executed by an OTA (Over The Air) updater that performs OTA updates on the electronic system, and the processor executes the status abnormality detection program to: detect a status abnormality in the electronic system based on a combination of the updated normal status list obtained from the OTA computer and the operating status obtained from the submodule.

8. A status abnormality detection method performed by a status abnormality detection system having one or more processors and one or more memory resources, wherein the memory resource stores: configuration information registering the configuration of each sub-module of an electronic system, a normal status list registering combinations of operating states of each sub-module when the electronic system is in a normal state, a normal status list generation program for generating the normal status list, and a status abnormality detection program for detecting an abnormal status of the electronic system, wherein the processor executes the normal status list generation program to: identify the range of influence of an update of the sub-module based on a comparison of the configuration information before and after an update of the electronic system, and update the normal status list by registering each combination of operating states of the sub-modules within a non-affected range that is not affected by the update and a combination of operating states of the sub-modules within the affected range that corresponds to said combination, and wherein the processor executes the status abnormality detection program to: detect an abnormal status of the electronic system based on the normal status list after the update and the combinations of operating states obtained from each sub-module.

9. A status abnormality detection method as described in claim 8, characterized in that the processor, by executing the normal status list generation program, performs a step of: identifying a combination of operating states of the sub-modules within the affected range that corresponds to a condition based on a simulation set to each combination of operating states of the sub-modules within the unaffected range that is not affected by the update.

10. A status abnormality detection system having one or more processors and one or more memory resources, comprising a program read from the memory resource and executed by the processor, wherein the memory resource stores: configuration information registering the configuration of each sub-module of an electronic system; a normal status list registering combinations of operating states of each sub-module when the electronic system is in a normal state; a normal status list generation program for generating the normal status list; and a status abnormality detection program for detecting status abnormalities of the electronic system, wherein the normal status list generation program executed by the processor: identifies the scope of influence of an update of the sub-module based on a comparison of the configuration information before and after an update of the electronic system, and updates the normal status list by registering each combination of operating states of the sub-modules within a non-affected range that is not affected by the update and a combination of operating states of the sub-modules within the affected range that corresponds to said combination, and wherein the status abnormality detection program executed by the processor: detects a status abnormality of the electronic system based on the normal status list after the update and the combinations of operating states obtained from each sub-module.

11. A program as described in claim 10, wherein the normal state list generation program executed by the processor: identifies a combination of operating states of the sub-modules within the affected range that corresponds to a condition based on a simulation set to each combination of operating states of the sub-modules within the unaffected range that is not affected by the update.

Images