Vehicle control system

Abstract

Provided is a vehicle control system in which reliability is ensured and which can utilize inactive verification resources at non-verification times. A vehicle control system 100 comprises: a first processing unit 102 which stores first software for vehicle control and which outputs a vehicle control signal according to external information; a second processing unit 107 which stores second software 108 of the same or a different version as the first software 103 and which outputs a vehicle control signal according to external information; an output comparison unit 109 that compares the first processing unit 102 output with the second processing unit 107 output; a transmission unit 111 that outputs data to a server 115 according to a determination result from the output comparison unit 109; a data path construction unit 104 that constructs a data path according to the outputs from the first processing unit 102 and the second processing unit 107; a software version checking unit 106 that checks the versions of the first software 103 and the second software 108 and outputs a result to the data path construction unit 104; and a vehicle control unit 105 that controls a vehicle on the basis of control data from the data path construction unit 104.

Description

Vehicle Control System

[0001] The present invention relates to a vehicle control system.

[0002] An autonomous driving system is composed of multiple Electronic Control Units (ECUs). Each of these ECUs is equipped with control software that performs tasks such as external environment recognition, route planning, and vehicle control. As autonomous driving systems become more sophisticated, the control software is becoming increasingly complex.

[0003] To achieve a high-quality autonomous driving system, a comprehensive verification method is required that includes test cases that occur rarely.

[0004] Patent Document 1 describes a technology that compares the outputs of an old version of control software with those of a new version of control software, and outputs information indicating the mismatch if the outputs are found to be inconsistent. Patent Document 1 also describes a technology in which the old control software section and the new control software section perform recognition processing, route planning, and calculate control commands based on input sensor values.

[0005] Japanese Patent Application Laid-Open No. 2022-13187

[0006] However, while Patent Document 1 describes a software verification method that compares old and new software, there are resources dedicated to verification that are not in use when not being verified, and there is no mention of how to effectively utilize these resources.

[0007] Furthermore, to effectively utilize verification resources during non-verification periods, a path to vehicle control is required, but on the other hand, in shadow mode during verification, the results of verification and evaluation are not used for vehicle control.

[0008] An object of the present invention is to provide a vehicle control system that can effectively utilize verification resources that are idle when not being verified, while ensuring reliability.

[0009] In order to achieve the above object, the present invention is configured as follows.

[0010] The vehicle control system includes a first processing unit that stores first software used to control the vehicle, receives external information from an external sensor as input information, and outputs a control signal used to control the vehicle; a second processing unit that stores second software of the same version as the first software or a different version from the first software, receives the external information as input information, and outputs a control signal related to the control of the vehicle; an output comparison unit that compares the output of the first processing unit with the output of the second processing unit; a transmission unit that outputs data to a server based on the determination result of the output comparison unit; a data path construction unit that receives the output of the first processing unit and the output of the second processing unit and constructs a data path; a software version confirmation unit that confirms the versions of the first software stored in the first processing unit and the second software stored in the second processing unit and outputs the confirmation result to the data path construction unit; and a vehicle control unit that controls the vehicle based on the control data from the data path construction unit.

[0011] By checking the old and new control software versions and switching the path to use for vehicle control only when they are the same, it is possible to ensure reliability by preventing the output during verification from being used for vehicle control, while also making effective use of verification resources that are not in use when not being verified.

[0012] FIG. 1 is a block diagram of a vehicle control system according to a first embodiment of the present invention. FIG. 2 is an operation flowchart of the vehicle control system according to the first embodiment of the present invention. FIG. 3 is a diagram showing a modified example of the vehicle control system according to the first embodiment of the present invention. FIG. 4 is a block diagram of a vehicle control system according to a second embodiment of the present invention. FIG. 5 is an operation flowchart of the vehicle control system according to the second embodiment of the present invention. FIG. 6 is a block diagram of a vehicle control system according to a third embodiment of the present invention. FIG. 7 is an operation flowchart of the vehicle control system according to the third embodiment of the present invention. FIG. 8 is a timing chart according to the third embodiment of the present invention. FIG. 9 is a block diagram of a vehicle control system according to a fourth embodiment of the present invention. FIG. 10 is an operation flowchart of the vehicle control system according to the fourth embodiment of the present invention. FIG. 11 is a comparison table according to the fourth embodiment of the present invention.

[0013] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0014] 1 shows a block diagram of a vehicle control system 100 according to a first embodiment of the present invention. The vehicle control system 100 includes a sensor receiving unit 101, a first processing unit 102, a data reception path switching unit 104, a vehicle control unit 105 that controls the vehicle, a software version checking unit 106, a second processing unit 107, an output comparing unit 109, a determining unit 110, a transmitting / receiving unit 111, a software update control unit 112, and a diagnosing unit 113. The diagnosing unit 113 determines whether the first processing unit 113 is normal or faulty.

[0015] The first processing unit 102 includes a first software unit 103 that is equipped with the current (Version. N) vehicle control software (first software) and outputs a control signal used to control the vehicle. The second processing unit 107 includes a second software unit 108 that is equipped with the current (Version. N) vehicle control software (first software) or new (Version. N+1) vehicle control software that is different from the current (Version. N) software (first software), and outputs a control signal used to control the vehicle.

[0016] When the vehicle control software installed in the second software unit (second software) 108 is the same as the vehicle control software installed in the first software unit (first software) 103 (non-verification), the data reception path switching unit 104 outputs the output result of the second processing unit 107 to the vehicle control unit 105, and when they are different (verification), the data reception path switching unit 104 does not output the output result of the second processing unit 107 to the vehicle control unit 105. This makes it possible to newly construct an output path from the second processing unit 107 to the vehicle control unit 105 without compromising reliability during verification, thereby making it possible to effectively utilize verification resources during non-verification.

[0017] 2 is a flowchart illustrating the operation of the vehicle control system 100 according to the first embodiment of the present invention. Here, a process flow will be described in which the verification resource is used as a backup for the vehicle control system 100 when verification is not being performed.

[0018] The software update control unit 112 receives update software from an external device, such as over the air (OTA), and updates the control software installed in the first software unit 103 and the second software unit 108 (step 201). Next, the software version check unit 106 checks and compares the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 (step 202). If the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are different, the software version check unit 106 determines that the mode is a verification mode in which the vehicle control software installed (stored) in the first software unit 103 is compared with the vehicle control software installed in the second software unit 108, and instructs the data transmission bus switch unit 301 not to establish an output path from the second software unit 108 to the data reception path switch unit 104. Next, the sensor receiving unit 101 receives sensor data from the external sensor 114 and transmits it as an input sensor value to the first processing unit 102 and the second processing unit 107 (step 203).

[0019] The first software unit 103 executes the current version (Version. N) of vehicle control software based on the input sensor values ​​and transmits the output results to the output comparison unit 109 and the data reception path switching unit 104 (step 205). The second software unit 108 executes the new version (Version. N+1) of vehicle control software based on the input sensor values ​​and transmits the output results to the output comparison unit 109 (step 206). The data reception path switching unit 104 receives the output results from the first processing unit 102 and transmits them to the vehicle control 105 (step 212).

[0020] Here, the data reception path switching unit 104 constructs a path so as not to receive the output result from the second processing unit 107. Specifically, the output result of the second processing unit 107 is not sent to the data reception path switching unit 104, or the processing by the second software unit 108 is stopped. Note that the data reception path switching unit 104 may receive the output result from the second processing unit 107 and operate not to output it to the vehicle control unit 105 during verification.

[0021] The advantage of preventing the data reception path switching unit 104 from receiving the output result from the second processing unit 107 is that data congestion in the data reception path switching unit 104 can be avoided.

[0022] The vehicle control unit 105 performs recognition processing, route planning, control command processing, etc. based on the results output by the vehicle control software, thereby realizing autonomous driving.

[0023] Next, the output comparison unit 109 compares the output results of the first processing unit 102 and the second processing unit 107 and transmits the comparison result to the determination unit 110 (step 209). The determination unit 110 determines whether to output the input sensor value based on the output comparison result (step 213). If it determines to output the input sensor value, it instructs the transmission / reception unit 111 to output it externally. The transmission / reception unit 111 converts the sensor value to be output into an appropriate protocol and outputs it to the external server 115 (step 216).

[0024] Furthermore, the software version check unit 106 determines that the mode is non-verification mode if the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are the same (step 202). At this time, if the diagnosis unit 113 determines that the first processing unit 102 is normal (step 204), it instructs the data reception path switching unit 104 not to establish an output path from the second processing unit 107 (determining that the vehicle control software installed in the second software unit 108 will not be used as a backup).

[0025] Next, the sensor receiving unit 101 receives sensor data from the external sensor 114 and transmits it as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 207). The first software unit 103 executes the current version (Version.N) of vehicle control software based on the input sensor values ​​and transmits the output result to the data reception path switching unit 104 (step 210). The data reception path switching unit 104 receives the output result from the first processing unit 102 and transmits it to the vehicle control unit 105 (step 214). Note that when the first processing unit 102 is normal, the data reception path switching unit 104 establishes a path so as not to receive the output result from the second processing unit 107.

[0026] Furthermore, when the software version verification unit 106 determines that the mode is non-verification and the diagnostic unit 113 determines that the first processing unit 102 is faulty (step 204), the diagnostic unit 113 instructs the data reception path switching unit 104 not to receive data from the first processing unit 102 and to construct an output path from the second software unit 108.

[0027] Next, the sensor receiving unit 101 receives sensor data from the external sensor 114 and transmits it as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 208). The second software unit 108 executes the current version (Version. N) of vehicle control software based on the input sensor values ​​and transmits the output result to the data reception path switching unit 104 (step 211). The data reception path switching unit 104 receives the output result from the second processing unit 107 and transmits it to the vehicle control unit 105 (step 215). Note that if the diagnosis unit 113 determines that the first processing unit 102 is faulty, the data reception path switching unit 104 prevents data from being received from the first processing unit 102 and establishes a path to receive data from the second processing unit 107.

[0028] This makes it possible to effectively utilize verification resources that are not in use when verification is not being performed.

[0029] According to Example 1, it is possible to provide a vehicle control system 100 that can effectively utilize verification resources that are not in use during non-verification while ensuring reliability by preventing the output during verification from being used for vehicle control.

[0030] Although the second processing unit 107 is configured to have one second software unit 108, it can also be configured to have a backup second software unit 108A in addition to the second software unit 108, as shown in Fig. 3. If the second software unit 108 fails, normal operation can be maintained by using the backup second software unit 108A.

[0031] Furthermore, in the first embodiment, the configuration has been described as being made up of the first processing unit 102 and the second processing unit 107, but it may be similarly configured with three or more units.

[0032] Second Embodiment Next, a second embodiment of the present invention will be described.

[0033] FIG. 4 is a block diagram of a vehicle control system 100 according to a second embodiment of the present invention. However, the server 115 is omitted. This embodiment differs from FIG. 1 of the first embodiment in that a data transmission path switching unit 301 is added, and the vehicle control software installed in the first software unit 103 and the vehicle control software installed in the second software unit 108 are different versions. The data transmission path switching unit 301 outputs external sensor data (external information) to the first processing unit 102 and the second processing unit 107 in a verification mode in which output comparison is performed, and stops outputting the external sensor data to the second processing unit 107 in a non-verification mode in which the vehicle control software installed in the first software unit 103 and the software installed in the second software unit 108 are the same version and output comparison is not performed.

[0034] This makes it possible to reduce power consumption compared to when the second processing unit 107 is always running by canceling data transmission to the second processing unit 107 in scenes where the vehicle control software version is the same and verification is not performed.

[0035] 5 is an operational flowchart of the vehicle control system 100 according to the second embodiment of the present invention. This differs from FIG. 3 of the first embodiment in that the software version check unit 106 determines the vehicle control software to be in verification mode if the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are different, and instructs the data transmission path switching unit 301 to establish input paths to the first processing unit 102 and the second processing unit 107. The data transmission path switching unit 301 receives sensor data from the sensor receiving unit 101 and transmits it as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 401). Furthermore, the software version check unit 106 determines the vehicle control software to be in non-verification mode if the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are the same.

[0036] At this time, if the diagnosis unit 113 determines that the first processing unit 102 is normal, it instructs the data transmission path switching unit 301 to establish only an input path to the first processing unit 102. The data transmission path switching unit 301 receives sensor data from the sensor receiving unit 101 and transmits it to the first processing unit 102 as an input sensor value (step 402).

[0037] Furthermore, when the software version check unit 106 determines that the mode is non-verification, if the diagnosis unit 113 determines that the first processing unit 102 is faulty, the diagnosis unit 113 instructs the data transmission path switching unit 301 not to transmit data to the first processing unit 102 and to construct a path to transmit data only to the second software unit 108. The data transmission path switching unit 301 receives sensor data from the sensor receiving unit 101 and transmits it to the second processing unit 107 as an input sensor value (step 403).

[0038] This makes it possible to effectively utilize verification resources that are not in use when verification is not being performed.

[0039] In Example 2, as in Example 1, it is possible to provide a vehicle control system 100 that can effectively utilize verification resources that are not in use during non-verification while ensuring reliability by preventing the output during verification from being used for vehicle control.

[0040] As in the first embodiment, the second processing unit 107 can be configured to have a backup second software unit 108A in addition to the second software unit 108, as shown in FIG.

[0041] Third Embodiment Next, a third embodiment of the present invention will be described.

[0042] 6 is a block diagram of a vehicle control system 100 according to a third embodiment of the present invention. However, the server 115 is omitted. The difference from FIG. 4 of the second embodiment is that a processing data division unit 501 is added instead of the data transmission bus switching unit 301, and a processing data integration unit 502 is added instead of the data reception bus switching unit 104.

[0043] When the vehicle control software installed in the first software unit 103 and the vehicle control software installed in the second software unit 108 are the same version, the processing data division unit 501 divides the input external sensor data and transmits the divided data to the first processing unit 102 and the second processing unit 107. Similarly to the data reception path switching unit 104, the processing data integration unit 502 constructs a path to receive the output result of the second processing unit 107, integrates the output of the first processing unit 102 and the output of the second processing unit 107, and outputs the integrated data to the vehicle control unit 105.

[0044] As a result, when the vehicle control software installed in the first software unit 103 and the vehicle control software installed in the second software unit 108 are the same version and in a non-verification mode in which output comparison is not performed, the first processing unit 102 and the second processing unit 107 can perform vehicle control processing in parallel, thereby speeding up processing.

[0045] 7 is an operational flowchart of the vehicle control system 100 according to the third embodiment of the present invention. The difference from Fig. 5 of the second embodiment is that the software version check unit 106 determines that the verification mode is active when the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are different, and instructs the processing data division unit 501 to construct input paths to the first processing unit 102 and the second processing unit 107, and instructs the processing data integration unit 502 not to construct an output path from the second processing unit 107.

[0046] The processing data division unit 501 receives sensor data from the sensor receiving unit 101 and transmits it as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 601). The first software unit 103 executes the current version (Version.N) of vehicle control software based on the input sensor values ​​and transmits the output results to the output comparison unit 109 and the processing data integration unit 502 (step 205).

[0047] The second software unit 108 executes the new version (Version. N+1) of vehicle control software based on the input sensor values ​​and transmits the output results to the output comparison unit 109 (step 206). The processing data integration unit 502 receives the output results from the first processing unit 102 and transmits them to the vehicle control unit 105 (step 603). Here, the processing data integration unit 502 constructs a path so as not to receive the output results from the second processing unit 107.

[0048] Specifically, the output result of the second processing unit 107 is not sent to the processing data integration unit 502, or the processing by the second software unit 108 is stopped.

[0049] The processing data integration unit 502 may receive the output result from the second processing unit 107, and may operate so as not to output the result to the vehicle control unit 105 during verification. The advantage of not allowing the processing data integration unit 502 to receive the output result from the second processing unit 107 is that data congestion in the processing data integration unit 502 can be avoided.

[0050] In addition, if the versions of the vehicle control software installed in the first software unit 103 and the second software unit 108 are the same, the software version verification unit 106 determines that the mode is non-verification, and instructs the processing data division unit 501 to divide the input sensor values ​​by time or by input sensor and construct paths for input to the first processing unit 102 and the second processing unit 107, and instructs the processing data integration unit 502 to construct output paths from the first processing unit 102 and the second processing unit 107 and to integrate and reconstruct the processing data.

[0051] Next, the processing data division unit 501 receives sensor data from the sensor receiving unit 101, divides the sensor data by time or by input sensor, and transmits the divided sensor data as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 602). The first software unit 103 executes the current version (Version.N) of vehicle control software based on the input sensor values ​​and transmits the result to the processing data integration unit 502 (step 210). The second software unit 108 executes the current version (Version.N) of vehicle control software based on the input sensor values ​​and transmits the output result to the processing data integration unit 502 (step 211). The processing data integration unit 502 receives the output results from the first processing unit 102 and the second processing unit 107, integrates the output results of the first software unit 103 and the second software unit 108, and transmits the integrated result to the vehicle control unit 105 (step 604).

[0052] 8 is an example of a timing chart diagram during processing data division processing in Example 3 of the present invention. For example, the processing of the processing data division unit 501, the first processing unit 102, the second processing unit 107, and the processing data integration unit 502 when data of sensor values ​​0 to 3 are input as input sensor values ​​will be described.

[0053] 8 , the processing data division unit 501 divides the input sensor values ​​and transmits them to the first processing unit 102 and the second processing unit 107, such as transmitting sensor values ​​0 and 2 to the first processing unit 102 and transmitting sensor values ​​1 and 3 to the second processing unit 107. The first processing unit 102 and the second processing unit 107 execute the current version (Version.N) of vehicle control software based on the input sensor values ​​and transmit the output results to the processing data integration unit 502. The processing data integration unit 502 organizes the output result sensor values ​​received from the first processing unit 102 and the second processing unit 107 in the order of sensor value 0 to sensor value 3, and integrates and reconstructs them.

[0054] In this way, the input sensor value can be divided by time and processed, which can speed up the processing. Although the method of dividing by time has been described, the present invention is not limited to this.

[0055] Furthermore, when there are multiple external sensors, the processing speed can be increased by dividing the processing into sections for each input sensor. That is, in the third embodiment, the second processing unit 107 can be configured to have a second software section 108A in addition to the second software section 108, as in the first embodiment, as shown in FIG. 2. However, the second software section 108A in the third embodiment is not for backup, but is used to further divide and process the sensor values. By configuring it in this way, the processing speed of the sensor values ​​can be further increased.

[0056] According to the third embodiment, in addition to being able to obtain the same effects as those of the first embodiment, it is also possible to obtain the effect of further increasing the speed of processing the sensor values.

[0057] Fourth Embodiment Next, a fourth embodiment of the present invention will be described.

[0058] 9 is a block diagram of a vehicle control system 100 according to a fourth embodiment of the present invention. However, the server 115 is omitted. The difference from FIG. 6 of the third embodiment is that an operation determination unit 801 is added, and that a third software unit (third software) 802, which is equipped with the same version of vehicle control software as that installed in the first software unit 103, is added to the second processing unit 107.

[0059] It is assumed that the second software unit 108 is equipped with both the current (Version. N) software and new (Version. N+1) vehicle control software that is different from the current software.

[0060] The operation determination unit 801 determines whether to perform verification processing using verification resources or to use them as parallel processing for vehicle control based on specific conditions (e.g., vehicle state, driving environment, etc.), and transmits whether to switch and execute the determination to the software version check unit 106. When performing verification, the software version check unit 106 instructs the second processing unit 107 to execute the second software unit 108, and when performing parallel processing for vehicle control, instructs the second processing unit 108 to execute the third software unit 802.

[0061] This allows the vehicle control software executed by the second processing unit 107 to be switched, making it possible to dynamically switch between verification mode and non-verification mode depending on the vehicle state and driving environment.

[0062] FIG. 10 is an operational flowchart of an electronic control device according to a fourth embodiment of the present invention. This embodiment differs from FIG. 7 of the third embodiment in that the operation determination unit 801 determines whether to execute a switchover based on the vehicle's running state, environment, and the like, and transmits the determination result to the software version check unit 106 (step 901). The software version check unit 106 also checks and compares the versions of the vehicle control software installed in the first software unit 103 and the third software unit 802 (step 903). If the operation determination unit 801 determines that a switchover should not be executed, or if the versions of the vehicle control software installed in the first software unit 103 and the third software unit 802 are different, the software version check unit 106 determines that the verification mode is active, instructs the second processing unit 107 to execute the second software unit 108 (step 902), instructs the processing data division unit 501 to establish input paths to the first processing unit 102 and the second processing unit 107, and instructs the processing data integration unit 502 not to establish an output path from the second processing unit 107.

[0063] The software version check unit 106 determines the mode to be non-verification mode when switching is to be performed based on the determination result of the operation determination unit 801 and when the versions of the vehicle control software installed in the first software unit 103 and the third software unit 802 are the same. The software version check unit 106 then instructs the second processing unit 107 to execute the third software unit 802 (step 904) and instructs the processing data division unit 501 to divide the input sensor values ​​by time or by sensor and construct paths for inputting them to the first processing unit 102 and the second processing unit 107. The software version check unit 106 then instructs the processing data integration unit 502 to construct output paths from the first processing unit 102 and the second processing unit 107 and integrate the processing data.

[0064] Next, the processing data dividing unit 501 receives the sensor data from the sensor receiving unit 101, divides the sensor data by time or by sensor, and transmits the divided sensor data as input sensor values ​​to the first processing unit 102 and the second processing unit 107 (step 602). The first software unit 103 executes the current version (Version.N) of vehicle control software based on the input sensor values ​​and transmits the result to the processing data integrating unit 502 (step 210).

[0065] The third software unit 802 executes the current version (Version.N) of the vehicle control software based on the input sensor values ​​and transmits the output results to the processing data integration unit 502 (step 905). The processing data integration unit 502 receives the output results from the first processing unit 102 and the second processing unit 107, integrates the output results from the first software unit 103 and the third software unit 802, and transmits the integrated results to the vehicle control unit 105 (step 906).

[0066] FIG. 11 is a comparison table showing examples of specific conditions for the operation determination unit 801 in the fourth embodiment.

[0067] 11, an example of a condition for switching execution by the operation determination unit 801 will be described. For example, when the vehicle is moving forward, it is considered that the vehicle is traveling normally, so verification process A is performed, and when the vehicle is moving backward, it is considered that the vehicle is parking, so it is possible to dynamically switch to parallel process B to speed up control processing of a parking assistance system, etc. It is also possible to perform verification process A during the day, and switch to parallel process B at night when visibility is poor, in order to improve the accuracy and processing speed of the automated driving system.

[0068] Note that the conditions and switching methods shown in FIG. 11 are merely examples, and the conditions and switching methods will vary depending on the situation under which verification is desired or the speed of control processing is desired to be increased.

[0069] This makes it possible to effectively utilize verification resources that are not in use when verification is not being performed.

[0070] That is, according to the fourth embodiment, in addition to being able to obtain the same effect as the first embodiment, it is also possible to obtain an effect that verification resources that are not in use when verification is not being performed can be effectively utilized.

[0071] The data reception path switching unit 104 in the first and second embodiments and the processing data integration unit 502 in the third and fourth embodiments have in common the point of constructing a data path, and therefore can be collectively referred to as a data path construction unit.

[0072] 100: Vehicle control system, 101: Sensor receiving unit, 102: First processing unit, 103: First software unit (first software), 104: Data reception path switching unit, 105: Vehicle control unit, 106: Software version confirmation unit, 107: Second processing unit, 108: Second software unit (second software), 108A: Backup second software unit (backup second software), 109: Output comparison unit, 110: Determination unit, 111: Transmitting / receiving unit, 112: Software update control unit, 113: Diagnosis unit, 114: External sensor, 115: Server, 301: Data transmission path switching unit, 501: Processing data division unit, 502: Processing data integration unit, 801: Operation determination unit, 802: Third software unit (third software)

Claims

1. A vehicle control system comprising: a first processing unit storing first software used to control a vehicle, which takes external information from an external sensor as input information and outputs a control signal used to control the vehicle; a second processing unit storing second software of the same version as the first software or a different version from the first software, which takes the external information as input information and outputs a control signal related to the control of the vehicle; an output comparison unit comparing the output of the first processing unit with the output of the second processing unit; a transmission unit outputting data to a server based on the determination result of the output comparison unit; a data path construction unit receiving the output of the first processing unit and the output of the second processing unit and constructing a data path; a software version confirmation unit confirming the versions of the first software stored in the first processing unit and the second software stored in the second processing unit and outputting the confirmation result to the data path construction unit; and a vehicle control unit controlling the vehicle based on the control data from the data path construction unit.

2. A vehicle control system as described in claim 1, characterized in that the data path construction unit is a data reception path switching unit that outputs the output result of the second processing unit to the vehicle control unit when the second software stored in the second processing unit is identical to the first software stored in the first processing unit, and does not output the output result of the second processing unit to the vehicle control unit when the second software stored in the second processing unit is different from the first software stored in the first processing unit.

3. A vehicle control system as described in claim 2, further comprising a data transmission path switching unit which receives the external environment information from the external sensor and switches the data transmission path between the first processing unit and the second processing unit, wherein the data transmission path switching unit outputs the external environment information to the first processing unit and the second processing unit in a verification mode in which the first software stored in the first processing unit and the second software stored in the second processing unit are different versions and the first software stored in the first processing unit and the second software stored in the second processing unit are compared, and wherein the data transmission path switching unit stops outputting the external environment information to the second processing unit in a non-verification mode in which the first software stored in the first processing unit and the second software stored in the second processing unit are different versions and the first software stored in the first processing unit and the second software stored in the second processing unit are not compared.

4. A vehicle control system as described in claim 1, further comprising a processing data division unit which divides the input external world information and transmits the divided data to the first processing unit and the second processing unit when the first software stored in the first processing unit and the second software stored in the second processing unit are the same version, and the data path construction unit is a processing data integration unit which constructs a path to receive the output result of the second processing unit, and which integrates the output of the first processing unit and the output of the second processing unit and outputs the integrated data to a vehicle control unit.

5. A vehicle control system as described in claim 1, wherein the second processing unit stores second software different from the first software and third software of the same version as the first software, and comprises a processing data division unit which divides the input external world information and transmits the divided data to the first processing unit and the second processing unit when the first software is executed by the first processing unit and the third software is executed by the second processing unit, and transmits the input external world information to the first processing unit and the second processing unit when the first software is executed by the first processing unit and the second software is executed by the second processing unit, and an operation determination unit which determines the software to be executed by the second processing unit based on the external world information, The data path construction unit is a processing data integration unit that, when the first software is executed on the first processing unit and the third software is executed on the second processing unit, constructs a path to receive the output result of the second processing unit, integrates the output of the first processing unit and the output from the second processing unit, and outputs the integrated data to the vehicle control unit, and, when the first software is executed on the first processing unit and the second software is executed on the second processing unit, does not construct an output path from the second processing unit.

6. A vehicle control system as described in claim 2 or claim 3, further comprising a diagnostic unit which judges whether the first processing unit is normal or faulty, and which, if the first processing unit is normal, instructs the data path construction unit not to receive data from the second processing unit, and, if the first processing unit is faulty, instructs the data path construction unit not to receive data from the first processing unit and to construct an output path from the second processing unit.

7. A vehicle control system according to claim 2 or 3, wherein the second processing unit has second software for backing up the second software.

Images