Abnormality detecting device, abnormality detecting system, abnormality detecting method, and abnormality detecting program

Abstract

This abnormality detecting device detects an abnormality in a vehicle-mounted device of a vehicle-mounted system that includes the vehicle-mounted device, which is installed in a vehicle, the abnormality detecting device comprising: a first acquiring unit for acquiring first control information, which is information that is acquired by the vehicle-mounted device and that is used for travel control of the vehicle; a second acquiring unit for acquiring second control information, which is information that relates to travel of the vehicle, acquired by an external device not installed in the vehicle, and that is information of the same type as the first control information; a determining unit for determining, on the basis of the first control information acquired by the first acquiring unit and the second control information acquired by the second acquiring unit, whether the vehicle-mounted device is abnormal; and an abnormality processing unit for executing abnormality processing related to the abnormality in the vehicle-mounted device if the determining unit has determined that the vehicle-mounted device is abnormal.

Description

Anomaly detection device, anomaly detection system, anomaly detection method, and anomaly detection program

[0001] This application claims priority to Japanese Patent Application No. 2023-144653 filed on September 6, 2023, and incorporates by reference the entire contents of that application.

[0002] Patent document 1 discloses an apparatus that acquires vehicle data indicating the correspondence between the position and operating state of a vehicle to be evaluated, searches a vehicle operation log containing correspondence between the past positions of multiple vehicles and their operating states at the past positions for records of related operations that relate to the correspondence between the position of the vehicle to be evaluated and the operating state of the vehicle to be evaluated, and performs a determination as to whether there is an abnormality in the operating state of the vehicle to be evaluated based on the amount of records of related operations found.

[0003] Japanese Patent Application Laid-Open No. 2020-166452

[0004] An abnormality detection device according to one aspect of the present disclosure is an abnormality detection device that detects an abnormality in an on-board device in an on-board system including the on-board device installed in a vehicle, and includes: a first acquisition unit that acquires first control information, which is information acquired by the on-board device and used for driving control of the vehicle; a second acquisition unit that acquires second control information, which is information about the driving of the vehicle acquired by an external device not installed in the vehicle and is the same type of information as the first control information; a determination unit that determines whether the on-board device is abnormal based on the first control information acquired by the first acquisition unit and the second control information acquired by the second acquisition unit; and an abnormality processing unit that, when the determination unit determines that the on-board device is abnormal, executes abnormality processing related to the abnormality in the on-board device.

[0005] FIG. 1 is a schematic diagram showing an example of the overall configuration of an anomaly detection system according to a first embodiment. FIG. 2A is a block diagram showing a first example of a detailed configuration of the anomaly detection system according to the first embodiment. FIG. 2B is a block diagram showing a first example of a detailed configuration of the anomaly detection system according to the first embodiment. FIG. 3 is a block diagram showing an example of a hardware configuration of an in-vehicle device according to the first embodiment. FIG. 4 is a block diagram showing an example of a hardware configuration of a mobile terminal according to the first embodiment. FIG. 5 is a functional block diagram showing an example of the function of the anomaly detection system according to the first embodiment. FIG. 6 is a diagram for explaining examples of first control information and second control information. FIG. 7 is a flowchart showing an example of information provision processing according to the first embodiment. FIG. 8 is a flowchart showing an example of an anomaly detection processing according to the first embodiment. FIG. 9 is a sequence diagram showing an example of operation of the anomaly detection system according to the first embodiment. FIG. 10 is a flowchart showing an example of an anomaly detection processing according to the third embodiment. FIG. 11 is a sequence diagram showing an example of operation of the anomaly detection system according to the third embodiment. FIG. 12 is a block diagram showing an example of the configuration of an anomaly detection system according to a fourth embodiment. FIG. 13 is a block diagram showing an example of the hardware configuration of a roadside device according to the fourth embodiment. FIG. 14 is a functional block diagram showing an example of the function of the anomaly detection system according to the fourth embodiment. Fig. 15 is a diagram for explaining detection of a vehicle position by a roadside device. Fig. 16 is a diagram for explaining an example of recognition of an obstacle by a vehicle and a roadside device. Fig. 17 is a flowchart showing an example of an abnormality detection process in the sixth embodiment. Fig. 18 is a diagram for explaining detection of a magnetic marker. Fig. 19 is a flowchart showing an example of an abnormality detection process in the seventh embodiment. Fig. 20 is a sequence diagram showing an example of the operation of the anomaly detection system according to the seventh embodiment.

[0006] <Problem to be Solved by the Present Disclosure> The vehicle data in Patent Document 1 includes, for example, a position acquired by a positioning system such as a GPS (Global Positioning System) installed in the vehicle to be evaluated, and the execution status of a parking assistance function, a constant speed / adaptive cruise control (ACC: Adaptive Cruise Control), a lane keeping assistance function, and the like. Because such vehicle data is acquired by an on-board device installed in the vehicle to be evaluated, there is a risk that the vehicle data may be tampered with if the on-board device is subjected to an unauthorized attack. For example, if the vehicle data is tampered with to make it appear normal, it will be impossible to detect an abnormality in the vehicle to be evaluated.

[0007] <Effects of the Present Disclosure> According to the present disclosure, it is possible to accurately detect an abnormality in an in-vehicle device.

[0008] <Outline of Embodiments of the Present Disclosure> Below, an outline of embodiments of the present disclosure will be listed and described.

[0009] (1) An anomaly detection device according to this embodiment is an anomaly detection device that detects an anomaly in an on-board device in an on-board system including an on-board device installed in a vehicle, the anomaly detection device including: a first acquisition unit that acquires first control information that is acquired by the on-board device and used for driving control of the vehicle; a second acquisition unit that acquires second control information that is information related to the driving of the vehicle acquired by an external device that is not installed in the vehicle and is the same type of information as the first control information; a determination unit that determines whether the on-board device is abnormal based on the first control information acquired by the first acquisition unit and the second control information acquired by the second acquisition unit; and an anomaly processing unit that executes an anomaly processing related to the anomaly in the on-board device when the determination unit determines that the on-board device is abnormal. Even if the first control information is tampered with to make it appear normal, the anomaly detection device can accurately detect an anomaly in the on-board device by using the second control information acquired by an external device that is not subject to an unauthorized attack.

[0010] (2) In the above (1), the first control information may be first sensor information indicating a state of the vehicle detected by a first sensor provided in the in-vehicle device, or information calculated using the first sensor information output from the first sensor, and the second control information may be second sensor information indicating a state of the vehicle detected by a second sensor provided in the external device, or information calculated using the second sensor information output from the second sensor. This makes it possible to accurately detect an abnormality in the in-vehicle device even if the first sensor information output from the first sensor is tampered with by an unauthorized attack.

[0011] (3) In the above (1), the in-vehicle device may be connected to a first sensor that detects a position of the vehicle, the first control information may include first position information output from the first sensor, and the external device may be connected to a second sensor that detects a position of the vehicle, and the second control information may include second position information output from the second sensor. This makes it possible to accurately detect an abnormality in the in-vehicle device when the first position information output from the first sensor is tampered with by an unauthorized attack.

[0012] (4) In the above (1), the in-vehicle device may be connected to a first sensor that detects acceleration of the vehicle, the first control information may include first acceleration information output from the first sensor, and the external device may be connected to a second sensor that detects acceleration of the vehicle, and the second control information may include second acceleration information output from the second sensor. This makes it possible to accurately detect an abnormality in the in-vehicle device when the first acceleration information output from the first sensor is tampered with by an unauthorized attack.

[0013] (5) In the above (1), the in-vehicle device may be connected to a first sensor that detects a wheel speed of the vehicle, the first control information may include first vehicle speed information indicating a vehicle speed calculated based on the wheel speed information output from the first sensor, and the external device may be connected to a second sensor that detects a position of the vehicle, and the second control information may include second vehicle speed information indicating a vehicle speed calculated based on the position information output from the second sensor. This makes it possible to accurately detect an abnormality in the in-vehicle device when the wheel speed information output from the first sensor or the first vehicle speed information calculated from the vehicle speed information is tampered with by an unauthorized attack.

[0014] (6) In the above (1), the in-vehicle device may be connected to a first sensor that detects the distance from the vehicle to a preceding vehicle traveling ahead of the vehicle, the first control information may include first inter-vehicle distance information output from the first sensor, and the external device may be connected to a second sensor that detects the positions of objects within a specific range on a road, and the second control information may include second inter-vehicle distance information that indicates the distance from the vehicle to the preceding vehicle, calculated based on the position information of each object output from the second sensor. This makes it possible to accurately detect an abnormality in the in-vehicle device if the first inter-vehicle distance information output from the first sensor is tampered with by an unauthorized attack.

[0015] (7) In the above (1), the in-vehicle device may be connected to a first sensor that detects a distance from the vehicle to an object around the vehicle, the first control information may include first obstacle information indicating the position of an obstacle around the vehicle, which is acquired based on distance information output from the first sensor, and the external device may be connected to a second sensor that detects the position of an object within a specific range on a road, and the second control information may include second obstacle information indicating the position of the obstacle around the vehicle, which is acquired based on position information of each object output from the second sensor. This makes it possible to accurately detect an abnormality in the in-vehicle device when the distance information output from the first sensor or the first obstacle information acquired based on the distance information is tampered with by an unauthorized attack.

[0016] (8) In the above (1), the in-vehicle device may be connected to a first sensor that detects a magnetic marker provided on a road on which the vehicle is traveling, the first control information may include first position information indicating the position of the vehicle when the magnetic marker is detected by the first sensor, and the second control information may include second position information indicating the installation position of the magnetic marker on the road. This makes it possible to accurately detect an abnormality in the in-vehicle device when the detection result of the magnetic marker by the first sensor or the first position information is tampered with by an unauthorized attack.

[0017] (9) In any one of (1) to (8) above, the determination unit may determine that the in-vehicle device is normal if the first control information and the second control information match, and may determine that the in-vehicle device is abnormal if the first control information and the second control information do not match. The second control information acquired by the external device accurately reflects the state of the vehicle. Therefore, tampered first control information does not match the second control information. With the above configuration, an abnormality in the in-vehicle device can be detected based on whether the first control information acquired in the in-vehicle device matches the second control information acquired in the external device. Note that "match" here does not necessarily mean a perfect match, but may be a match with an error. For example, the error is within a range of ±5%.

[0018] (10) In any one of (1) to (8) above, the determination unit may calculate an abnormality score based on a difference between the first control information and the second control information, and determine that the in-vehicle device is normal if the calculated abnormality score is equal to or less than a threshold, and determine that the in-vehicle device is abnormal if the calculated abnormality score is greater than the threshold. The falsified first control information deviates from the second control information. With the above configuration, an abnormality in the in-vehicle device can be detected based on a comparison (difference) between the first control information acquired in the in-vehicle device and the second control information acquired in the external device.

[0019] (11) In the above (10), the determination unit may calculate the anomaly score based on a history of differences between the first control information and the second control information. This allows the on-board device to continue outputting falsified information if an abnormality occurs. Therefore, the above configuration allows for accurate detection of an abnormality in the on-board device.

[0020] (12) In any one of (1) to (11) above, the abnormality processing may include processing for notifying the user of the occurrence of the abnormality in the in-vehicle device. This allows the user to be notified of the abnormality in the in-vehicle device.

[0021] (13) An anomaly detection system according to this embodiment includes an in-vehicle system including an in-vehicle device mounted on a vehicle, an anomaly detection device that detects an anomaly in the in-vehicle device, and an external device that is not mounted on the vehicle, wherein the anomaly detection device includes a first acquisition unit that acquires first control information that is information acquired by the in-vehicle device and used for driving control of the vehicle, a second acquisition unit that acquires second control information that is information related to the driving of the vehicle acquired by an external device that is not mounted on the vehicle and is the same type of information as the first control information, a determination unit that determines whether the in-vehicle device is abnormal based on the first control information acquired by the first acquisition unit and the second control information acquired by the second acquisition unit, and an anomaly processing unit that executes an anomaly processing related to the anomaly in the in-vehicle device when the determination unit determines that the in-vehicle device is abnormal. Even if the first control information is tampered with to make it appear normal, an anomaly in the in-vehicle device can be accurately detected by using the second control information acquired by an external device that is not subject to an unauthorized attack.

[0022] (14) An anomaly detection method according to this embodiment is an anomaly detection method for detecting an anomaly in an on-board device in an on-board system including an on-board device installed in a vehicle, the anomaly detection method including the steps of: acquiring first control information, which is information acquired by the on-board device and used for driving control of the vehicle; acquiring second control information, which is information related to the driving of the vehicle acquired by an external device not installed in the vehicle and is the same type of information as the first control information; determining whether the on-board device is abnormal based on the acquired first control information and the acquired second control information; and, if it is determined that the on-board device is abnormal, executing an anomaly process related to the anomaly in the on-board device. Even if the first control information has been tampered with to make it appear normal, the anomaly in the on-board device can be accurately detected by using the second control information acquired by an external device that has not been subjected to an unauthorized attack.

[0023] (15) An anomaly detection program according to this embodiment is an anomaly detection program for detecting an abnormality in an on-board device in an on-board system including an on-board device installed in a vehicle, the program causing a computer to execute the following steps: acquiring first control information, which is information acquired by the on-board device and used for driving control of the vehicle; acquiring second control information, which is information related to driving of the vehicle acquired by an external device not installed in the vehicle and is the same type of information as the first control information; determining whether the on-board device is abnormal based on the acquired first control information and the acquired second control information; and, if it is determined that the on-board device is abnormal, executing an abnormality process related to the abnormality in the on-board device. Even if the first control information has been tampered with to make it appear normal, the abnormality in the on-board device can be accurately detected by using the second control information acquired by an external device that has not been subjected to an unauthorized attack.

[0024] The present disclosure can be realized not only as an anomaly detection device having the above-described characteristic configuration, an anomaly detection system including the anomaly detection device, an anomaly detection method having characteristic processing steps, and an anomaly detection program that causes a computer to execute the characteristic processing, but also as a semiconductor integrated circuit in which part or all of the anomaly detection device is realized.

[0025] <Details of Embodiments of the Present Disclosure> Hereinafter, details of embodiments of the present disclosure will be described with reference to the drawings. Note that at least some of the embodiments described below may be combined in any manner.

[0026] 1 is a schematic diagram showing an example of the overall configuration of an anomaly detection system according to Embodiment 1. The anomaly detection system 20 includes an in-vehicle system 100 mounted on a vehicle 10 and a mobile terminal 500 used by the driver of the vehicle.

[0027] 2A is a block diagram showing a first example of a detailed configuration of the anomaly detection system according to the first embodiment. The in-vehicle system 100 includes a relay device 200, in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F, and an external communication device 350. The in-vehicle system 100 is an in-vehicle network system including the relay device 200, the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F, and a communication line (communication bus) connecting them. The relay device 200, the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F, and the external communication device 350 are each installed in the vehicle 10. Note that "installed" here refers to being fixedly installed in the vehicle 10.

[0028] The multiple on-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F are arranged in various parts of the vehicle 10. The on-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F individually control the hardware of the various parts of the vehicle 10 and monitor the status of the hardware of the various parts of the vehicle 10. Note that the on-vehicle devices included in the on-vehicle system 100 are not limited to the on-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F, and the on-vehicle system 100 may include an on-vehicle device not shown.

[0029] The in-vehicle devices 300A, 300B, 300C, and 300D are connected to sensors 310A, 310B, 310C, and 310D, respectively. The sensors 310A, 310B, 310C, and 310D detect physical quantities related to the vehicle 10. For example, the in-vehicle device 300A is connected to a sensor 310A that is a Global Navigation Satellite System (GNSS) receiver. The sensor 310A detects the position (latitude, longitude) of the vehicle 10. The in-vehicle device 300B is connected to a sensor 310B that is an IMU (Inertial Measurement Unit). The sensor 310B includes an acceleration sensor and a gyro sensor. The sensor 310B detects the acceleration of the vehicle 10. For example, the in-vehicle device 300C is a driving assistance ECU (Electronic Control Unit) that assists the driver in driving the vehicle 10. The position and acceleration of the vehicle 10 are used for the driving assistance by the in-vehicle device 300C.

[0030] The in-vehicle device 300E is connected to a display device 360. For example, the in-vehicle device 300E is a device for man-machine interface. The in-vehicle device 300E controls the display device 360. The in-vehicle device 300F is an ECU for transmission control.

[0031] The display device 360 ​​includes, for example, a liquid crystal panel or an OEL (organic electroluminescence) panel, and can display text or graphic information on the screen.

[0032] The relay device 200 is connected to the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F via buses 400A, 400B, and 400C, such as CAN (Controller Area Network) buses. Specifically, the in-vehicle devices 300A and 300B are connected to the bus 400A. The in-vehicle devices 300C and 300D are connected to the bus 400B. The in-vehicle devices 300E and 300F are connected to the bus 400C. The relay device 200 relays communications between the buses 400A, 400B, and 400C. FIG. 2A shows, as an example, the configuration of an in-vehicle system 100 including a CAN network system.

[0033] The relay device 200 and the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F use a specific communication protocol, such as CAN or CAN FD (CAN with Flexible Data Rate).

[0034] The relay device 200 relays communications between the buses 400A, 400B, and 400C. Each of the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F can transmit frames conforming to the above-mentioned communication protocols. The relay device 200 relays frames between the in-vehicle devices connected to different buses. For example, the relay device 200 can relay frames between the in-vehicle device 300A connected to the bus 400A and the in-vehicle device 300C connected to the bus 400B.

[0035] The relay device 200 is connected to the external communication device 350 via an Ethernet cable 400D. The relay device 200 has a communication function based on the Ethernet protocol and can communicate with the external communication device 350 using the Ethernet protocol. The external communication device 350 is, for example, a wireless communication terminal conforming to a fifth-generation mobile communication system (5G) or a fourth-generation mobile communication network (4G), such as a TCU (Telematics Control Unit). The external communication device 350 may be equipped with an interface for short-range wireless communication, such as a wireless LAN (Local Area Network) conforming to IEEE (Institute of Electrical and Electronics Engineers) 802.11 or Bluetooth (registered trademark). The external communication device 350 can communicate with a mobile terminal 500. The external communication device 350 relays communication between the relay device 200 and the mobile terminal 500 .

[0036] The in-vehicle system 100 is not limited to a CAN network system. FIG. 2B is a block diagram showing a second example of a detailed configuration of the anomaly detection system according to the first embodiment. The in-vehicle system 100 according to the second example is an Ethernet network system having a star-shaped network topology. In the in-vehicle system 100, the relay device 200 has seven communication ports. Ethernet cables are inserted into each communication port. The in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F and the external communication device 350 are connected to each Ethernet cable. The in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F and the external communication device 350 can communicate with each other using the Ethernet protocol. The relay device 200A relays communication between the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F and the external communication device 350.

[0037] [1-2. Hardware Configuration of In-Vehicle Device] Fig. 3 is a block diagram showing an example of the hardware configuration of an in-vehicle device according to the first embodiment. Here, the configuration of an in-vehicle device 300C that is a driving assistance ECU will be described. The in-vehicle device 300C includes a processor 301, a non-volatile memory 302, a volatile memory 303, and a communication interface (hereinafter also referred to as "communication I / F") 304. The processor 301, the non-volatile memory 302, the volatile memory 303, and the communication I / F 304 are connected to one another by a bus 305. The processor 301, the non-volatile memory 302, the volatile memory 303, and the communication I / F 304 can transmit data to one another via the bus 305.

[0038] The volatile memory 303 is a semiconductor memory such as a static random access memory (SRAM) or a dynamic random access memory (DRAM). The non-volatile memory 302 is a flash memory, a hard disk, a read only memory (ROM), or the like. The non-volatile memory 302 stores an information provision program 210, which is a computer program, and data used to execute the information provision program 210. The functions of the in-vehicle device 300C, which will be described later, are realized when the processor 301 executes the information provision program 210.

[0039] The processor 301 is, for example, a CPU (Central Processing Unit). However, the processor 301 is not limited to a CPU. The processor 301 may be a GPU (Graphics Processing Unit). In a specific example, the processor 301 is a multi-core processor. The processor 301 may be a single-core processor. The processor 301 is configured to be able to execute a computer program. However, the processor 301 may be, for example, an ASIC (Application Specific Integrated Circuit) or a programmable logic device such as an FPGA (Field Programmable Gate Array). In this case, the ASIC or programmable logic device is configured to be able to execute the same function as the information provision program 210.

[0040] The communication I / F 304 is a communication interface that complies with the communication protocol for the in-vehicle network system described above. Specifically, the communication I / F 304 is, for example, a CAN interface (first example). The communication I / F 304 may also be an Ethernet interface (second example).

[0041] The communication I / F 304 is connected to the bus 400 B. The in-vehicle device 300 C can communicate with the in-vehicle device 300 D and the relay device 200 via the communication I / F 304 .

[0042] [1-3. Hardware Configuration of the Mobile Terminal] FIG. 4 is a block diagram showing an example of the hardware configuration of the mobile terminal according to the first embodiment. The mobile terminal 500 is, for example, a smartphone or a tablet. The mobile terminal 500 includes a processor 501, a non-volatile memory 502, a volatile memory 503, communication I / Fs 504A and 504B, an input / output interface (hereinafter also referred to as "I / O") 505, and a display device 506. The processor 501, the non-volatile memory 502, the volatile memory 503, the communication I / Fs 504A and 504B, the I / O 505, and the display device 506 are connected to each other via a bus 507. The processor 501, the non-volatile memory 502, the volatile memory 503, the communication I / Fs 504A and 504B, the I / O 505, and the display device 506 can transmit data to each other via the bus 507.

[0043] The volatile memory 503 is, for example, a semiconductor memory such as an SRAM or a DRAM. The non-volatile memory 502 is, for example, a flash memory or a ROM. The non-volatile memory 502 stores an anomaly detection program 510, which is a computer program, and data used to execute the anomaly detection program 510. The functions of the mobile terminal 500, which will be described later, are realized when the processor 501 executes the anomaly detection program 510.

[0044] The processor 501 is, for example, a CPU. In a specific example, the processor 501 is a multi-core processor. The processor 501 may be a single-core processor. The processor 501 is configured to be able to execute a computer program. The processor 501 is similar to the processor 301 described above, and therefore a description thereof will be omitted.

[0045] The communication I / F 504A is a short-range wireless communication interface. The mobile terminal 500 can communicate with the external communication device 350 via the communication I / F 504A. The communication I / F 504B is a wireless communication interface that complies with 5G or 4G, for example.

[0046] The nonvolatile memory 502 is provided with a database (hereinafter also referred to as "DB") 511. The DB 511 stores first control information transmitted from the in-vehicle device 300C. The first control information will be described later.

[0047] The mobile terminal 500 includes sensors 520A and 520B. The sensor 520A is a GNSS receiver. The sensor 520A detects the position (latitude, longitude) of the mobile terminal 500. The sensor 520B is an IMU. The sensor 520B includes an acceleration sensor and a gyro sensor. The sensor 520B detects the acceleration of the mobile terminal 500.

[0048] The I / O 505 inputs and outputs data to and from connected devices. The I / O 505 is connected to the sensors 520A and 520B. The I / O 505 receives sensor information (second sensor information) output from the sensors 520A and 520B and outputs the received sensor information to the processor 501.

[0049] The display device 506 includes, for example, a liquid crystal panel or an OEL panel, and is capable of displaying text or graphic information on the screen.

[0050] 1-4. Functions of the Anomaly Detection System FIG. 5 is a functional block diagram showing an example of functions of the anomaly detection system according to the first embodiment.

[0051] The in-vehicle device 300C has the functions of a reception unit 321 and a provision unit 322. The functions of the reception unit 321 and the provision unit 322 are realized by the processor 301 executing the information provision program 310. The mobile terminal 500 has the functions of a first acquisition unit 531, a second acquisition unit 532, a determination unit 533, and an abnormality processing unit 534. The functions of the first acquisition unit 531, the second acquisition unit 532, the determination unit 533, and the abnormality processing unit 534 are realized by the processor 501 executing the abnormality detection program 510. In the first embodiment, the mobile terminal 500 is an "anomaly detection device."

[0052] The reception unit 321 receives first sensor information output from the sensors 310A and 310B. The sensor 310A outputs position information (latitude and longitude) of the vehicle 10. The in-vehicle device 300A transmits a frame including the position information output from the sensor 310A to the communication bus 400A. The sensor 310B outputs acceleration information of the vehicle 10. The in-vehicle device 300A transmits a frame including the acceleration information output from the sensor 310B to the communication bus 400A. The first sensor information is one or both of the position information and the acceleration information. The reception unit 321 receives each of the frames transmitted from the in-vehicle device 300A and the in-vehicle device 300B, and receives the first sensor information. For example, the reception unit 321 may acquire time information indicating the time when the sensors 310A and 310B output the first sensor information. For example, if the first sensor information includes position information, the time information is output by the sensor 310A (GNSS receiver). For example, if the first sensor information includes acceleration information, the time information is acquired by recording the time when the in-vehicle device 300B acquires the acceleration information from the sensor 310B.

[0053] In the in-vehicle device 300C, the first sensor information is stored in a predetermined area of ​​the volatile memory 303 and used for the driving assistance process. That is, the first sensor information accepted by the accepting unit 321 is written to the above-mentioned area of ​​the volatile memory 302. The processor 301, having executed the information provision program 310, accesses the above-mentioned area of ​​the volatile memory 303 and acquires the sensor information. The providing unit 322 provides the first sensor information accepted by the accepting unit 321 to the mobile terminal 500. That is, the providing unit 322 transmits a frame including the first sensor information read from the predetermined area of ​​the volatile memory 302 as described above to the communication bus 400B. The providing unit 322 may transmit a frame of first control information including the first sensor information and time information indicating the time when the first sensor information was output from the sensors 310A and 310B. The frame transmitted from the providing unit 322 is received by the relay device 200 and transmitted to the external communication device 350 connected to the bus 400D. The external communication device 350 receives the frame transmitted from the providing unit 322 and transmits the first sensor information to the mobile terminal 500 .

[0054] The first acquisition unit 531 acquires first control information, which is information acquired by the in-vehicle devices 300A, 300B and is used for driving control (driving assistance) of the vehicle 10. In the first embodiment, the first control information includes first sensor information indicating the state (position, acceleration) of the vehicle 10 detected by sensors 310A, 310B provided in the in-vehicle devices 300A, 300B. The first acquisition unit 531 acquires the first control information by receiving the first control information (first sensor information) transmitted from the external communication device 350.

[0055] The second acquisition unit 532 acquires second control information. The second control information is information acquired by an external device that is a device different from the devices included in the in-vehicle system 100, i.e., the in-vehicle devices 300A, 300B, 300C, 300D, 300E, and 300F, the relay device 200, and the external communication device 350. The portable terminal 500 is a device external to the in-vehicle system 100 and is not installed in the vehicle 10. The portable terminal 500 is an example of an external device.

[0056] 4, sensor 520A outputs position information (latitude, longitude) of portable terminal 500. Sensor 520B outputs acceleration information of portable terminal 500.

[0057] The second acquisition unit 532 acquires second sensor information output from the sensors 520A and 520B. In the first embodiment, the second control information includes the second sensor information. The second control information is information related to the traveling of the vehicle 10 and is the same type of information as the first control information. That is, in the first embodiment, the second control information is one or both of position information and acceleration information. For example, the second acquisition unit 532 may acquire time information indicating the time at which the sensors 520A and 520B output the second sensor information. For example, if the second sensor information includes position information, the time information is output by the sensor 520A (GNSS receiver). For example, if the second sensor information includes acceleration information, the time information is acquired by recording the time at which the processor 501 acquired the acceleration information from the sensor 520B. The sensor 520A outputs position information at regular intervals, and the sensor 520B outputs acceleration information at regular intervals (which may be different from the output period of the position information). For example, every time the second sensor information is acquired, the second sensor information and time information are saved in the nonvolatile memory 502. That is, the nonvolatile memory 502 stores multiple sets of second sensor information and time information that have been acquired in the past.

[0058] The determination unit 533 determines whether or not the in-vehicle devices 300A, 300B are abnormal, based on the first control information acquired by the first acquisition unit 531 and the second control information acquired by the second acquisition unit 532.

[0059] FIG. 6 is a diagram illustrating an example of the first control information and the second control information.

[0060] The sensors 310A and 310B are mounted on the vehicle 10. Therefore, the position detected by the sensor 310A is the position of the vehicle 10, and the acceleration detected by the sensor 310B is the acceleration of the vehicle 10.

[0061] Mobile terminal 500 is used, for example, by a passenger (driver) of vehicle 10. That is, mobile terminal 500 is brought into vehicle 10 by the passenger. Therefore, the position detected by sensor 520A is the position of vehicle 10, and the acceleration detected by sensor 520B is the acceleration of vehicle 10. That is, the second control information is second sensor information indicating the state (position, acceleration) of vehicle 10 detected by sensors 520A and 520B provided in mobile terminal 500, which is an external device.

[0062] The determination unit 533 compares the first sensor information and the second sensor information obtained during the same time period. For example, the determination unit 533 compares the time at which the first sensor information was acquired with the time at which the second sensor information was acquired. The determination unit 533 selects, from the second sensor information stored in the non-volatile memory 502, the second sensor information acquired at the time closest to the time at which the first sensor information was acquired, and compares the first sensor information with the selected second selection information. For example, when the in-vehicle device 300A (see FIGS. 2A and 2B) is operating normally, the position information output from the sensor 310A matches the position information output from the sensor 520A (see FIG. 4) within a margin of error. When the in-vehicle device 300B (see FIGS. 2A and 2B) is operating normally, the acceleration information output from the sensor 310B matches the acceleration information output from the sensor 520B (see FIG. 4) within a margin of error. For example, the mobile terminal 500 is fixed inside the vehicle 10 while the vehicle 10 is traveling. In a specific example, the portable terminal 500 is fixed inside the vehicle by being held in a holder installed inside the vehicle. For example, if the portable terminal 500 is not fixed inside the vehicle 10, when the driver moves the portable terminal 500 to operate it, the sensor 520B detects an acceleration different from the acceleration of the vehicle 10 (acceleration caused by the driver moving the portable terminal 500). Therefore, when the portable terminal 500 detects that the driver is holding the portable terminal 500, the acceleration information included in the second sensor information is deleted or invalidated. In this case, the determination unit 533 does not compare the acceleration information.

[0063] On the other hand, if the in-vehicle device 300A is subjected to an unauthorized attack and becomes abnormal, the position information output from the sensor 310A will be falsified. Therefore, the position information output from the sensor 310A will deviate from the position information output from the sensor 520A beyond the error range. If the in-vehicle device 300B is subjected to an unauthorized attack and becomes abnormal, the acceleration information output from the sensor 310B will be falsified. Therefore, the acceleration information output from the sensor 310B will deviate from the acceleration information output from the sensor 520B beyond the error range.

[0064] 5, the determination unit 533 calculates an abnormality score based on the difference between the first control information and the second control information. In the first embodiment, the abnormality score is the difference between the first control information and the second control information.

[0065] For example, the determination unit 533 calculates the difference between the position information output from the sensor 310A mounted on the vehicle 10 and the position information output from the sensor 520A mounted on the mobile terminal 500 as an abnormality score (hereinafter also referred to as the "first abnormality score"). If the position detected by the sensor 310A is the first position and the position detected by the sensor 520A is the second position, the first abnormality score is the distance (Euclidean distance) between the first position and the second position. The determination unit 533 compares the first abnormality score with a threshold (threshold for the position information; hereinafter also referred to as the "first threshold"). If the first abnormality score is equal to or less than the first threshold, the determination unit 533 determines that the in-vehicle device 300A is normal. If the first abnormality score is greater than the first threshold, the determination unit 533 determines that the in-vehicle device 300A is abnormal.

[0066] For example, the determination unit 533 calculates the difference between the acceleration information output from the sensor 310B mounted on the vehicle 10 and the acceleration information output from the sensor 520B mounted on the mobile terminal 500 as an abnormality score (hereinafter also referred to as the "second abnormality score"). The determination unit 533 compares the second abnormality score with a threshold value (threshold value for the acceleration information; hereinafter also referred to as the "second threshold value"). If the second abnormality score is equal to or less than the second threshold value, the determination unit 533 determines that the in-vehicle device 300B is normal. If the second abnormality score is greater than the second threshold value, the determination unit 533 determines that the in-vehicle device 300B is abnormal.

[0067] When the determination unit 533 determines that the in-vehicle devices 300A, 300B are abnormal, the abnormality processing unit 534 executes abnormality processing, which is processing related to the abnormality in the in-vehicle devices 300A, 300B. In the first embodiment, the abnormality processing is processing for notifying the occurrence of an abnormality in the in-vehicle devices 300A, 300B. In the first embodiment, when the determination unit 533 determines that at least one of the in-vehicle devices 300A and 300B is abnormal, the abnormality processing unit 534 notifies the occurrence of the abnormality.

[0068] For example, the abnormality processing unit 534 displays abnormality notification information on the display device 506. The abnormality notification information is, for example, information for notifying the user that an abnormality has occurred in the in-vehicle devices 300A and 300B, and includes text information. This allows the user to be notified of the abnormality in the in-vehicle devices 300A and 300B. In another example, the abnormality processing unit 534 may wirelessly transmit the abnormality notification information to a remote driving management center (an autonomous driving manager) via, for example, 5G when the vehicle 10 is operating autonomously (unmanned). This allows the occurrence of an abnormality to be notified to a remote driving management center different from the user. In yet another example, the occurrence of an abnormality may be notified to surrounding drivers by flashing the hazard lights of the vehicle 10 or sounding the horn. Furthermore, the abnormality processing is not limited to notifying the abnormality information. For example, the abnormality processing may also be a process of safely stopping or decelerating the vehicle 10 by autonomous driving. Here, an abnormality in the in-vehicle devices 300A, 300B means that the in-vehicle devices 300A, 300B are in a state where they cannot operate normally, and includes a malfunction of the in-vehicle devices 300A, 300B as well as an unauthorized attack on the in-vehicle devices 300A, 300B.

[0069] [1-5. Operation of Anomaly Detection System] Hereinafter, the operation of the anomaly detection system 20 according to the first embodiment will be described.

[0070] The processor 301 of the in-vehicle device 300C executes information provision processing according to the information provision program 310. Fig. 7 is a flowchart showing an example of the information provision processing in the first embodiment.

[0071] The sensor 310A detects the position of the vehicle 10 and outputs position information. The in-vehicle device 300A transmits a frame including the position information. For example, the in-vehicle device 300A transmits a frame including the position information to the in-vehicle device 300C. The in-vehicle device 300C receives the frame including the position information transmitted from the in-vehicle device 300A.

[0072] The sensor 310B detects the acceleration of the vehicle 10 and outputs acceleration information. The in-vehicle device 300B transmits a frame including the acceleration information. For example, the in-vehicle device 300B transmits a frame including the acceleration information to the in-vehicle device 300C. The in-vehicle device 300C receives the frame including the acceleration information transmitted from the in-vehicle device 300B.

[0073] In this manner, the processor 301 of the in-vehicle device 300C receives the first sensor information (first control information) (step S101). The in-vehicle device 300A may transmit, together with the position information, time information indicating the time when the sensor 310A output the position information, and the in-vehicle device 300B may transmit, together with the acceleration information, time information indicating the time when the sensor 310B output the acceleration information. In this case, the processor 301 acquires the first control information including the position information, acceleration information, and time information. The processor 301 stores the acquired first control information in a predetermined area of ​​the volatile memory 303 for use in the driving assistance process.

[0074] Processor 301 reads the acquired first control information from volatile memory 302 and provides the read first control information to mobile terminal 500 (step S102). Specifically, processor 301 transmits a frame including the first control information to communication bus 400B. The frame including the first control information is transmitted to external communication device 350 via relay device 200. External communication device 350 receives the frame including the first control information and transmits the first control information to mobile terminal 500. This completes the information provision process.

[0075] For example, sensors 310A and 310B each periodically output position information and acceleration information. In-vehicle devices 300A and 300B each periodically transmit frames including position information and frames including acceleration information. Relay device 200 repeatedly executes the information provision process each time it receives a frame including position information and a frame including acceleration information.

[0076] The processor 501 of the mobile terminal 500 executes an abnormality detection process by the abnormality detection program 510. Fig. 8 is a flowchart showing an example of the abnormality detection process in the first embodiment.

[0077] The mobile terminal 500 receives the first control information transmitted from the external communication device 350, and the processor 501 acquires the first control information (step S111).

[0078] The sensor 520A detects the position of the mobile terminal 500, i.e., the vehicle 10, and outputs the position information. The processor 501 receives the position information output from the sensor 520A.

[0079] The sensor 520B detects the acceleration of the mobile terminal 500, that is, the vehicle 10, and outputs the acceleration information. The processor 501 receives the acceleration information output from the sensor 520B.

[0080] In this way, processor 501 acquires second sensor information (second control information) (step S112). Specifically, each time processor 501 receives position information periodically output from sensor 520A, processor 501 stores the position information and time information indicating the time when sensor 520A output the position information in non-volatile memory 502. Each time processor 501 receives acceleration information periodically output from sensor 520B, processor 501 stores the acceleration information and time information indicating the time when sensor 520B output the acceleration information in non-volatile memory 502. Processor 501 selects, from the plurality of pieces of position information stored in non-volatile memory 502, position information corresponding to the time closest to the acquisition time of the position information in the first control information. Processor 501 selects, from the plurality of pieces of acceleration information stored in non-volatile memory 502, acceleration information corresponding to the time closest to the acquisition time of the acceleration information in the first control information.

[0081] The processor 501 calculates the difference between the first control information and the second control information as the abnormality score (step S113). Specifically, the processor 501 calculates the difference between the first position information and the second position information as the first abnormality score. The processor 501 calculates the difference between the first acceleration information and the second acceleration information as the second abnormality score.

[0082] The processor 501 compares the abnormality score with a threshold value (step S114). Specifically, the processor 501 compares the first abnormality score with a first threshold value, and the second abnormality score with a second threshold value.

[0083] If the abnormality score is equal to or less than the threshold value (NO in step S114), the processor 501 determines that there is no abnormality in the in-vehicle devices 300A, 300B (step S115), and ends the abnormality detection process. Specifically, if the first abnormality score is equal to or less than the first threshold value and the second abnormality score is equal to or less than the second threshold value, the processor 501 determines that there is no abnormality in the in-vehicle devices 300A, 300B, and ends the abnormality detection process.

[0084] If the abnormality score is greater than the threshold value (YES in step S114), the processor 501 determines that an abnormality has occurred in the in-vehicle devices 300A, 300B (step S116) and notifies the user of the occurrence of the abnormality in the in-vehicle devices 300A, 300B (step S117). Specifically, if the first abnormality score is greater than the first threshold value, the processor 501 determines that an abnormality has occurred in the in-vehicle device 300A and causes the display device 506 to display abnormality notification information for the in-vehicle device 300A. If the second abnormality score is greater than the second threshold value, the processor 501 determines that an abnormality has occurred in the in-vehicle device 300B and causes the display device 506 to display abnormality notification information for the in-vehicle device 300B. This completes the abnormality detection process.

[0085] As described above, the first control information is repeatedly transmitted from the external communication device 350. The processor 501 repeatedly executes the abnormality detection process every time the processor 501 receives the first control information.

[0086] Fig. 9 is a sequence diagram showing an example of the operation of the anomaly detection system according to the first embodiment. Fig. 9 shows an example of anomaly detection based on position information.

[0087] The sensor 310A detects the position of the vehicle 10 and outputs first sensor information (first control information) including position information (step S11). Here, the first control information includes the position information and time information.

[0088] The in-vehicle device 300A transmits a frame including the first control information. The processor 301 of the in-vehicle device 300C receives the frame including the first control information transmitted from the in-vehicle device 300A and stores it in a predetermined area of ​​the volatile memory 303. The processor 301 of the in-vehicle device 300C reads the first control information from the predetermined area of ​​the volatile memory 303 and transmits the read first control information to the external communication device 350 (step S12).

[0089] The external communication device 350 receives the frame including the first control information, and transmits the first control information to the mobile terminal 500 (step S13).

[0090] The communication I / F 504 of the mobile terminal 500 receives the first control information. The communication I / F 504 outputs the received first control information to the processor 501 (step S14). The processor 501 acquires the first control information by accepting it.

[0091] The sensor 520A detects the position of the mobile terminal 500 (vehicle 10) and periodically outputs second sensor information (second control information) including position information (step S15). Here, the second control information includes position information and time information. The processor 501 stores the second control information in the non-volatile memory 502 each time the processor 501 receives the second control information. The processor 501 acquires the second control information by selecting, from the second control information stored in the non-volatile memory 502, the second control information whose time information is closest to the time information included in the first control information.

[0092] The processor 501 calculates the difference between the first control information and the second control information as an abnormality score (first abnormality score) (step S16).

[0093] The processor 501 compares the abnormality score (first abnormality score) with a threshold value (first threshold value). In this example, the abnormality score is greater than the threshold value. Therefore, the processor 501 detects an abnormality in the in-vehicle device 300A.

[0094] The processor 501 generates abnormality notification information for notifying the user of the abnormality of the in-vehicle device 300A (step S17), and outputs a video signal for displaying the generated abnormality notification information to the display device 506 (step S18). The display device 506 displays the abnormality notification information (step S19). This notifies the user of the abnormality of the in-vehicle device 300A.

[0095] As described above, sensor 310B detects the acceleration of vehicle 10. Sensor 520B detects the acceleration of mobile terminal 500. Sensor 310B may be able to detect the angular velocity of vehicle 10 as well as the acceleration of vehicle 10. Sensor 520B may be able to detect the angular velocity of mobile terminal 500 as well as the acceleration of mobile terminal 500. Therefore, angular velocity information output from sensor 310B may be set as first control information, and angular velocity information output from sensor 520B may be set as second control information, and an anomaly score may be calculated based on the first control information and the second control information.

[0096] 2. Second Embodiment The configuration of an anomaly detection system according to the second embodiment is the same as the configuration of the anomaly detection system 20 according to the first embodiment, and therefore a description thereof will be omitted.

[0097] 5. The first acquisition unit 531 stores the acquired first control information in the DB 511 (see FIG. 4). The first control information is transmitted from the in-vehicle device 300C periodically or irregularly. The first acquisition unit 531 stores the acquired first control information in the DB 511 every time the first acquisition unit 531 acquires the first control information. In this way, past first control information is accumulated in the DB 511.

[0098] The first acquisition unit 531 may store the first control information in DB 511 together with time information indicating the time at which the first control information was acquired, or, as described in the first embodiment, if the first control information includes time information, the first control information including the time information may be stored in DB 511.

[0099] The second acquisition unit 532 stores the acquired second control information in the DB 511. The second control information is output from the sensors 520A and 520B periodically or irregularly. Every time the second acquisition unit 532 acquires second control information, it stores the acquired second control information in the DB 511. In this way, past second control information is accumulated in the DB 511.

[0100] The second acquisition unit 532 may store the second control information in DB511 together with time information indicating the time at which the second acquisition information was acquired, or, as described in the first embodiment, if the second control information includes time information, the second control information including the time information may be stored in DB511.

[0101] The determination unit 533 according to the second embodiment calculates the abnormality score based on a history of the differences between the first control information and the second control information. In a specific example, the determination unit 533 calculates the abnormality score using the first control information and the second control information stored in the DB 511 for a certain period of time (hereinafter also referred to as the "evaluation period") prior to the present. The determination unit 533 calculates the differences between the first control information and the second control information at corresponding times (the same time or times close within a certain range) and calculates the abnormality score based on the differences at each of the multiple times. For example, the determination unit 533 calculates the average (moving average) of the differences between the first control information and the second control information during the evaluation period as the abnormality score. In another example, the determination unit 533 may calculate the CUSUM (cumulative sum) of the differences between the first control information and the second control information during the evaluation period as the abnormality score.

[0102] For example, DB 511 stores first position information output from sensor 310A, first acceleration information output from sensor 310B, second position information output from sensor 520A, and second acceleration information output from sensor 520B. Determination unit 533 calculates, as the first abnormality score, a moving average value of the difference between the first position information and the second position information. Determination unit 533 calculates, as the second abnormality score, a moving average value of the difference between the first acceleration information and the second acceleration information.

[0103] The determination unit 533 compares the first abnormality score with a first threshold. If the first abnormality score is equal to or less than the first threshold, the determination unit 533 determines that the in-vehicle device 300A is normal. If the first abnormality score is greater than the first threshold, the determination unit 533 determines that the in-vehicle device 300A is abnormal.

[0104] The determination unit 533 compares the second abnormality score with a second threshold. If the second abnormality score is equal to or less than the second threshold, the determination unit 533 determines that the in-vehicle device 300B is normal. If the second abnormality score is greater than the second threshold, the determination unit 533 determines that the in-vehicle device 300B is abnormal.

[0105] Other functions of the anomaly detection system according to the second embodiment are the same as those of the anomaly detection system 20 according to the first embodiment, and therefore description thereof will be omitted.

[0106] 2A (FIG. 2B). In the third embodiment, the sensor 310A is a wheel speed sensor. The sensor 310A detects the rotational speed (wheel speed) of the wheels of the vehicle 10. The sensor 310B is an IMU. The sensor 310B detects the acceleration of the vehicle 10. The sensor 310C is an engine rotation speed sensor. The sensor 310C detects the engine rotation speed. If the vehicle 10 is an electric vehicle, the sensor 310C may be a motor rotation speed sensor instead of the engine rotation speed sensor. The sensor 310D is an accelerator position sensor. The sensor 310D detects the accelerator operation amount, i.e., the accelerator opening. The in-vehicle device 300F is an ECU for transmission control. The in-vehicle device 300F determines the gear position while the vehicle is traveling, or receives a gear position instruction from the driver, and controls gear changes in the transmission. Therefore, the in-vehicle device 300F stores information indicating the current gear position (hereinafter also referred to as "gear position information").

[0107] The in-vehicle device 300A receives wheel speed information output from the sensor 310A. The in-vehicle device 300A transmits a frame including the wheel speed information to the in-vehicle device 300C. The in-vehicle device 300B receives acceleration information output from the sensor 310B. The in-vehicle device 300B transmits a frame including the acceleration information to the in-vehicle device 300C. The in-vehicle device 300D receives accelerator opening information output from the sensor 310D. The in-vehicle device 300D transmits a frame including the accelerator opening information to the in-vehicle device 300C. The in-vehicle device 300F transmits a frame including gear position information to the in-vehicle device 300C.

[0108] The in-vehicle device 300C receives engine rotation speed information output from the sensor 310C. The in-vehicle device 300C receives a frame including wheel speed information transmitted from the in-vehicle device 300A. The in-vehicle device 300C receives a frame including acceleration information transmitted from the in-vehicle device 300B. The in-vehicle device 300C receives a frame including gear position information transmitted from the in-vehicle device 300F. The in-vehicle device 300C receives a frame including accelerator opening information transmitted from the in-vehicle device 300D.

[0109] The in-vehicle device 300C calculates the vehicle speed of the vehicle 10 based on, for example, the wheel speed of the vehicle 10. In another example, the vehicle speed of the vehicle 10 is calculated based on the engine rotation speed (or motor rotation speed) and the gear position. In yet another example, the vehicle speed of the vehicle 10 may be calculated using at least one of the acceleration and the accelerator opening in addition to the wheel speed or the engine rotation speed (or motor rotation speed) and the gear position. The calculated vehicle speed information is used for driving assistance processing of the vehicle 10. In the third embodiment, the vehicle speed information is first control information that is information used for driving control of the vehicle 10.

[0110] The other configurations of the anomaly detection system according to the third embodiment are the same as those of the anomaly detection system 20 according to the first embodiment, and therefore, description thereof will be omitted.

[0111] Referring to FIG. 5 , the receiving unit 321 of the in-vehicle device 300C receives a frame including the wheel speed information as described above, thereby receiving the wheel speed information output from the sensor 310A. The in-vehicle device 300C calculates the vehicle speed of the vehicle 10 based on the wheel speed information. Here, the wheel speed information is the first sensor information. Note that, when the vehicle speed of the vehicle 10 is calculated based on the engine speed and the gear position, the first sensor information is the engine speed and the gear position. When at least one of the acceleration and the accelerator opening is used to calculate the vehicle speed, at least one of the acceleration and the accelerator opening is the first sensor information. The providing unit 322 of the in-vehicle device 300C provides the first control information by transmitting vehicle speed information (first control information) calculated using the wheel speed information. The relay device 200 receives the first control information transmitted from the in-vehicle device 300C.

[0112] The relay device 200 transmits a frame including the first control information to the communication bus 400 C. The external communication device 350 receives the frame transmitted from the providing unit 322 and transmits the first control information to the mobile terminal 500 .

[0113] The first acquisition unit 531 receives the first control information transmitted from the external communication device 350, thereby accepting the first control information.

[0114] The sensor 520A outputs position information of the mobile terminal 500 (i.e., the vehicle 10). The sensor 520B outputs acceleration information of the mobile terminal 500. The second acquisition unit 532 according to the third embodiment receives the position information output from the sensor 520A and the acceleration information (second sensor information) output from the sensor 520B. The second acquisition unit 532 calculates second control information, which is speed information of the mobile terminal 500 (i.e., vehicle speed information of the vehicle 10), based on the received position information and acceleration information.

[0115] For example, the second acquisition unit 532 calculates the distance traveled by the vehicle 10 between the time the previous position information was acquired and the time the current position information was acquired based on the previous position information and the current position information, and calculates the vehicle speed by dividing the traveled distance by the travel time. The second acquisition unit 532 can also calculate the vehicle speed of the vehicle 10 based on the previously calculated vehicle speed and the received acceleration information. For example, the second acquisition unit 532 can calculate an accurate vehicle speed by correcting the vehicle speed calculated using the position information using the acceleration information.

[0116] The determination unit 533 according to the third embodiment determines whether the in-vehicle device 300C is abnormal. The determination unit 533 according to the third embodiment calculates, as an abnormality score, the difference between the vehicle speed (first control information) calculated by the in-vehicle device 300C and the vehicle speed (second control information) calculated by the second acquisition unit 532.

[0117] Other functions of the anomaly detection system according to the third embodiment are the same as those of the anomaly detection system 20 according to the first embodiment, and therefore description thereof will be omitted.

[0118] The information provision process performed by the in-vehicle device 300C in the third embodiment will be described with reference to FIG.

[0119] The processor 301 of the in-vehicle device 300C receives (accepts) a frame including the first sensor information (wheel speed information) (step S101). The processor 301 calculates vehicle speed information (first control information) based on the received wheel speed information.

[0120] Processor 301 provides the calculated first control information to mobile terminal 500 (step S102). Specifically, processor 301 transmits a frame including the first control information to communication bus 400B. The frame including the first control information is transmitted to external communication device 350 via relay device 200. External communication device 350 receives the frame including the first control information and transmits the first control information to mobile terminal 500. This completes the information provision process.

[0121] FIG. 10 is a flowchart illustrating an example of an abnormality detection process according to the third embodiment.

[0122] The mobile terminal 500 receives the first control information transmitted from the external communication device 350, and the processor 501 acquires the first control information (step S211).

[0123] The processor 501 receives second sensor information including the position information output from the sensor 520A and the acceleration information output from the sensor 520B (step S212).

[0124] The processor 501 calculates (obtains) second control information, which is vehicle speed information of the vehicle 10, based on the received second sensor information (step S213).

[0125] The processor 501 calculates the difference between the first control information and the second control information as the abnormality score (step S214).

[0126] The processor 501 compares the abnormality score with a threshold value (step S215). If the abnormality score is equal to or less than the threshold value (NO in step S215), the processor 501 determines that there is no abnormality in the in-vehicle device 300C (step S216), and ends the abnormality detection process.

[0127] If the abnormality score is greater than the threshold value (YES in step S215), the processor 501 determines that an abnormality has occurred in the in-vehicle device 300C (step S217) and notifies the user of the occurrence of the abnormality in the in-vehicle device 300C (step S218). The details of steps S215 to S218 are the same as steps S114 to S117 in the first embodiment, and therefore will not be described again. This completes the abnormality detection process.

[0128] FIG. 11 is a sequence diagram illustrating an example of the operation of the anomaly detection system according to the third embodiment.

[0129] The in-vehicle device 300C calculates first control information, which is vehicle speed information, based on the first sensor information (e.g., wheel speed information). The first control information is transmitted from the in-vehicle device 300C to the mobile terminal 500 via the relay device 200 and the external communication device 350 (steps S21 to S23). Details of steps S21 to S23 are the same as steps S12 to S14 in the first embodiment, except that the first control information is vehicle speed information, and therefore will not be described again.

[0130] The sensor 520A detects the position of the mobile terminal 500 (vehicle 10) and outputs the position information (step S24). The sensor 520B detects the acceleration of the mobile terminal 500 (vehicle 10) and outputs the acceleration information (step S25).

[0131] The processor 501 receives the second sensor information including the position information and the acceleration information, and calculates second control information, which is vehicle speed information of the vehicle 10, based on the second sensor information (step S26).

[0132] The processor 501 calculates the difference between the first control information and the second control information as the abnormality score (step S27).

[0133] The processor 501 compares the abnormality score with the threshold. In this example, the abnormality score is greater than the threshold. Therefore, the processor 501 detects an abnormality in the in-vehicle device 300C.

[0134] The processor 501 notifies the user of the abnormality of the in-vehicle device 300C (steps S28 to S30). Steps S28 to S30 are the same as steps S17 to S19 in the first embodiment, and therefore a description thereof will be omitted.

[0135] 12 is a block diagram showing an example of the configuration of an anomaly detection system according to Embodiment 4. The anomaly detection system 20A according to Embodiment 4 includes an in-vehicle device 300C and a roadside device 600.

[0136] In the fourth embodiment, the sensor 310A is a GNSS receiver.

[0137] The roadside device 600 is a device installed on the roadside for, for example, traffic monitoring, driving assistance, etc. In the fourth embodiment, the roadside device 600 is an "anomaly detection device."

[0138] The external communication device 350 includes a communication interface for, for example, DSRC (Dedicated Short Range Communications). The roadside device 600 is also capable of communication using DSRC. The external communication device 350 can communicate with the roadside device 600.

[0139] 13 is a block diagram showing an example of the hardware configuration of a roadside device according to the fourth embodiment. The roadside device 600 is, for example, a radar that detects vehicles and pedestrians on a road. The roadside device 600 includes a processor 601, a nonvolatile memory 602, a volatile memory 603, a communication I / F 604, and an input / output interface 605. The processor 601, the nonvolatile memory 602, the volatile memory 603, the communication I / F 604, and the I / O 605 are connected to each other by a bus 606, which is a communication line. The processor 601, the nonvolatile memory 602, the volatile memory 603, the communication I / F 604, and the I / O 605 can transmit data to each other via the bus 606.

[0140] The volatile memory 603 is, for example, a semiconductor memory such as an SRAM or a DRAM. The non-volatile memory 602 is, for example, a flash memory or a ROM. The non-volatile memory 602 stores an anomaly detection program 610, which is a computer program, and data used to execute the anomaly detection program 610. The functions of the roadside device 600, which will be described later, are realized when the processor 601 executes the anomaly detection program 610.

[0141] The processor 601 is, for example, a CPU. In a specific example, the processor 601 is a multi-core processor. The processor 601 may be a single-core processor. The processor 601 is configured to be able to execute computer programs. The processor 601 is similar to the processor 301 described above, and therefore a description thereof will be omitted.

[0142] The communication I / F 604 is a wireless communication interface for DSRC. The roadside device 600 can communicate with the external communication device 350 via the communication I / F 604.

[0143] The roadside device 600 includes sensors 620A, 620B, and 620C. The sensor 620A is a millimeter-wave radar. The sensor 620A detects the position and speed of objects on the road (vehicles, pedestrians, and bicycles (including riders)). The sensor 620B is a LiDAR (Light Detection and Ranging). The sensor 620B detects the position (distance) and shape of objects on the road. The sensor 620C is a multi-lens camera. The sensor 620B detects the position (distance) and shape of objects on the road.

[0144] The I / O 605 inputs and outputs data to and from connected devices. The I / O 605 is connected to sensors 620A, 620B, and 620C. The I / O 605 receives sensor information (second sensor information) output from the sensors 620A, 620B, and 620C, and outputs the received sensor information to the processor 601.

[0145] FIG. 14 is a functional block diagram illustrating an example of functions of the anomaly detection system according to the fourth embodiment.

[0146] The roadside device 600 has the functions of a first acquisition unit 631, a second acquisition unit 632, a determination unit 633, and an abnormality processing unit 634. When the processor 601 executes the abnormality detection program 610, the functions of the first acquisition unit 631, the second acquisition unit 632, the determination unit 633, and the abnormality processing unit 634 are realized.

[0147] The reception unit 321 receives first sensor information output from the sensor 310A. The first sensor information is location information. The sensor 310A outputs location information of the vehicle 10. The reception unit 321 receives a frame including the location information transmitted from the in-vehicle device 300A, and receives the first sensor information.

[0148] The providing unit 322 provides the first sensor information received by the receiving unit 321 to the roadside unit 600. Specifically, the providing unit 322 transmits the first sensor information to the roadside unit 600 via the external communication device 350.

[0149] In the fourth embodiment, the first control information is first sensor information. The first control information may include the first sensor information and time information. The first acquisition unit 631 receives the first control information (first sensor information) transmitted from the external communication device 350, thereby accepting the first control information.

[0150] The second acquisition unit 632 acquires the second control information acquired by an external device. The roadside device 600 is an external device of the in-vehicle system 100 and is not installed in the vehicle 10. The roadside device 600 is an example of an external device.

[0151] The second acquisition unit 632 receives second sensor information output from the sensor 620A. In the fourth embodiment, the second control information is second sensor information. The second control information is the same type of information as the first control information. That is, in the fourth embodiment, the second control information is position information.

[0152] 15 is a diagram illustrating detection of a vehicle's position by a roadside device. A sensor 620A (millimeter-wave radar) mounted on the roadside device 600 transmits radio waves (millimeter waves) and receives the waves reflected by an object (vehicle 10). Based on the transmission and reception of the radio waves, the sensor 620A measures the distance to the vehicle 10, the speed of the vehicle 10 (the speed in the straight line connecting the roadside device 600 and the vehicle 10), and the azimuth angle at which the vehicle 10 is located as seen from the roadside device 600.

[0153] The sensor 620A stores position information (latitude, longitude) indicating the position P0 of the roadside device 600. The sensor 620A detects the position P1 of the vehicle 10 by combining the position information of the roadside device 600 with the measured distance and azimuth of the vehicle 10. The sensor 620A outputs position information (second sensor information) indicating the position P1. For example, when multiple vehicles are detected simultaneously by the sensor 620A, the second acquisition unit 632 compares the positions of each of the multiple vehicles with the position information of the vehicle 10, which is the first sensor information, and selects the detected position P1 closest to the position of the vehicle 10 as the second sensor information. As another example, the roadside device 600 may perform anomaly detection only when one vehicle is detected by the sensor 620A, but may not perform anomaly detection when multiple vehicles are detected simultaneously.

[0154] Returning to FIG. 14 , the determination unit 633 determines whether the in-vehicle device 300A is abnormal based on the first control information acquired by the first acquisition unit 631 and the second control information acquired by the second acquisition unit 632. As described above, the position of the vehicle 10 detected by the sensor 310A and the position of the vehicle 10 detected by the sensor 620A should match within the error range. Therefore, similar to the determination unit 533 according to the first embodiment, the determination unit 633 calculates an abnormality score based on the difference between the first control information and the second control information. The determination unit 633 compares the abnormality score with a threshold value. If the abnormality score is equal to or less than the threshold value, the determination unit 633 determines that the in-vehicle device 300A is normal. If the abnormality score is greater than the threshold value, the determination unit 633 determines that the in-vehicle device 300A is abnormal.

[0155] When the determination unit 633 determines that the in-vehicle device 300A has an abnormality, the abnormality processing unit 634 notifies the vehicle 10 of the occurrence of an abnormality in the in-vehicle device 300A. In the fourth embodiment, the abnormality processing unit 634 transmits abnormality notification information to the vehicle 10 by DSRC. For example, the abnormality notification information is transmitted to the relay device 200 via the external communication device 350. When the relay device 200 receives the abnormality notification information, it transmits the received abnormality notification information to the in-vehicle device 300E. When the in-vehicle device 300E receives the abnormality notification information, it displays the abnormality notification information on the display device 360. This notifies the user of the abnormality in the in-vehicle device 300A.

[0156] The information providing process performed by the relay device 200 according to the fourth embodiment will be described with reference to FIG.

[0157] The sensor 310A detects the position of the vehicle 10 and outputs first sensor information. The processor 201 of the relay device 200 receives the first sensor information (first control information) (step S101).

[0158] The processor 201 provides the received first control information to the roadside device 600 (step S102). Specifically, the processor 201 transmits a frame including the first control information to the communication bus 400C. The external communication device 350 receives the frame transmitted through the communication bus 400C and transfers the first control information to the roadside device 600. This completes the information provision process.

[0159] Anomaly detection processing by the roadside device 600 according to the fourth embodiment will be described with reference to FIG.

[0160] The roadside device 600 receives the first control information transmitted from the external communication device 350, and the processor 601 acquires the first control information (step S111).

[0161] The sensor 620A detects the position of the vehicle 10 and outputs second sensor information. The processor 601 acquires the second sensor information (second control information) output from the sensor 620A (step S112).

[0162] The processor 601 calculates the difference between the first control information and the second control information as the abnormality score (step S113).

[0163] The processor 601 compares the abnormality score with a threshold value (step S114).

[0164] If the abnormality score is equal to or less than the threshold value (NO in step S114), the processor 601 determines that there is no abnormality in the in-vehicle device 300A (step S115), and ends the abnormality detection process.

[0165] If the abnormality score is greater than the threshold value (YES in step S114), the processor 501 determines that an abnormality has occurred in the in-vehicle device 300A (step S116) and notifies the user of the occurrence of the abnormality in the in-vehicle device 300A (step S117). Specifically, the processor 501 transmits abnormality notification information of the in-vehicle device 300A to the external communication device 350. Upon receiving the abnormality notification information, the external communication device 350 transmits the abnormality notification information to the in-vehicle device 300E. The in-vehicle device 300E displays the received abnormality notification information on the display device 360. This completes the abnormality detection process.

[0166] An example of the operation of the anomaly detection system according to the fourth embodiment will be described with reference to Fig. 9 . In this embodiment, the external device is a roadside device 600, and therefore the communication I / F 504, processor 501, and sensor 520A in Fig. 9 will be read as a communication I / F 604, processor 601, and sensor 620A, respectively. Furthermore, in this embodiment, the display device 360 ​​displays the anomaly notification information. Therefore, the display device 506 will be read as a display device 360.

[0167] Steps S11 to S13 are the same as those in the first embodiment, and therefore a description thereof will be omitted.

[0168] The communication I / F 604 of the roadside device 600 receives the first control information. The communication I / F 604 outputs the received first control information to the processor 601 (step S14). The processor 601 accepts (acquires) the first control information.

[0169] Steps S15 to S17 are the same as those in the first embodiment except that they are executed by the processor 601.

[0170] The processor 601 transmits the generated abnormality notification information to the external communication device 350 via the communication I / F 604. The external communication device 350 transmits the abnormality notification information (including a display command) to the in-vehicle device 300E (step S18). The in-vehicle device 300E displays the received abnormality notification information on the display device 360 ​​(step S19). This notifies the user of the abnormality in the in-vehicle device 300A.

[0171] [5. Fifth Embodiment] Refer to FIG. 12 . In the fifth embodiment, the sensor 310A is a GNSS receiver. The sensor 310A acquires position information of the vehicle 10. The sensor 310B is a millimeter-wave radar. The sensor 310B detects the distance to an object within a predetermined range ahead of the vehicle 10. The sensor 310D is a LiDAR. The sensor 310D detects the distance to an object around the vehicle 10 and the shape of the object. The sensor 310C is a multi-lens camera. The sensor 310C detects the distance to an object around the vehicle 10 and the shape of the object.

[0172] The in-vehicle device 300A receives position information output from the sensor 310A. The in-vehicle device 300A transmits a frame including the position information to the in-vehicle device 300C. The in-vehicle device 300B receives distance information output from the sensor 310B. The in-vehicle device 300B transmits a frame including the distance information to the in-vehicle device 300C. The in-vehicle device 300D receives the distance information and shape information output from the sensor 310D. The in-vehicle device 300D transmits a frame including the distance information and shape information to the in-vehicle device 300C.

[0173] 14 , the reception unit 321 of the in-vehicle device 300C receives the distance information and shape information output from the sensor 310C. The reception unit 321 of the in-vehicle device 300C receives a frame including position information transmitted from the in-vehicle device 300A. The reception unit 321 of the in-vehicle device 300C receives (accepts) a frame including distance information transmitted from the in-vehicle device 300B. The reception unit 321 of the in-vehicle device 300C receives (accepts) a frame including distance information and shape information transmitted from the in-vehicle device 300D.

[0174] The on-board device 300C, which is a driving assistance ECU, can execute, for example, adaptive cruise control (hereinafter also referred to as "ACC"). ACC is a function that controls the vehicle speed of the vehicle 10 so as to maintain a certain distance from a vehicle traveling ahead in accordance with the vehicle speed of the vehicle traveling ahead. In the on-board device 300C, the distance information output from the sensor 310B, the distance information output from the sensor 310D, and the distance information output from the sensor 310C are inter-vehicle distance information that indicates the distance to a vehicle ahead of the vehicle 10, i.e., the inter-vehicle distance. The inter-vehicle distance information is used for the ACC of the vehicle 10. In the fifth embodiment, the inter-vehicle distance information is first control information that is information used for driving control of the vehicle 10.

[0175] The other configurations of the anomaly detection system according to the fifth embodiment are the same as those of the anomaly detection system 20A according to the fourth embodiment, and therefore description thereof will be omitted.

[0176] The providing unit 322 provides the first control information accepted by the accepting unit 321 to the roadside device 600. More specifically, the providing unit 322 adds location information to the first control information and transmits the resulting information, thereby providing the first control information and location information to the roadside device 600. The providing unit 322 transmits a frame including the first control information and the location information to the communication bus 400B. The relay device 200 receives the frame including the first control information transmitted from the in-vehicle device 300C, and transmits the received frame including the first control information to the communication bus 400C. The external communication device 350 receives the frame transmitted from the relay device 200, and transmits the received frame to the roadside device 600.

[0177] The first acquisition unit 631 receives the first control information transmitted from the external communication device 350 to acquire the first control information.

[0178] Sensor 620A (millimeter wave radar) detects the position of an object on the road. For example, when multiple vehicles are present within the detection range, sensor 620A detects the position of each vehicle and outputs position information for each vehicle. Sensor 620B (LiDAR) detects the position (distance) and shape of an object on the road. Sensor 620B outputs position information and shape information for the object. Sensor 620C (multi-lens camera) detects the position (distance) and shape of an object on the road. Sensor 620C outputs position information and shape information for the object.

[0179] The second acquisition unit 632 according to the fifth embodiment receives position information output from the sensor 620A, position information and shape information output from the sensor 620B, and position information and shape information output from the sensor 620C (second sensor information). The second acquisition unit 632 calculates the distance between vehicles on the road (inter-vehicle distance) based on the received second sensor information, thereby acquiring inter-vehicle distance information. In the fifth embodiment, the inter-vehicle distance information calculated by the second acquisition unit 632 is second control information.

[0180] The second acquisition unit 632 according to the fifth embodiment determines the vehicle 10 that is the target of anomaly detection (hereinafter also referred to as the target vehicle) based on the position information transmitted from the vehicle 10 together with the first control information and the position information output from at least one of the sensors 620A, 620B, and 620C. That is, when at least one of the sensors 620A, 620B, and 620C detects multiple vehicles, the determination unit 633 determines, as the target vehicle, the vehicle detected at a position closest to the position indicated by the position information received from the vehicle 10 together with the first control information. The second acquisition unit 632 calculates the distance between the target vehicle and the vehicle traveling ahead of the target vehicle, i.e., the inter-vehicle distance, based on the position of the target vehicle and the position of the vehicle traveling ahead of the target vehicle.

[0181] The judgment unit 633 in the fifth embodiment calculates the difference between the inter-vehicle distance (first control information) calculated by the in-vehicle device 300C and the inter-vehicle distance (second control information) calculated by the second acquisition unit 632 as an abnormality score.

[0182] Other functions of the anomaly detection system according to the fifth embodiment are the same as those of the anomaly detection system 20A according to the fourth embodiment, and therefore description thereof will be omitted.

[0183] The information provision process performed by the in-vehicle device 300C according to the fifth embodiment will be described with reference to FIG.

[0184] Sensor 310A detects the position of vehicle 10. Sensor 310B detects the distance to an object ahead of vehicle 10. Sensor 310D detects the distance to an object around vehicle 10 and the shape of the object. Sensor 310C detects the distance to an object around vehicle 10 and the shape of the object. Processor 301 of on-board device 300C accepts at least one of the distance information output from sensor 310A, the distance information output from sensor 310B, and the distance information output from sensor 310C as first sensor information, which is inter-vehicle distance information (step S101). As described above, the inter-vehicle distance information, which is the first sensor information, is also first control information. Furthermore, processor 301 accepts position information output from sensor 310A.

[0185] The processor 301 transmits the received first control information together with the location information to the roadside device 600 (step S102). The first control information and the location information are received by the external communication device 350 via the relay device 200. The external communication device 350 transmits the received first control information and location information to the roadside device 600. This completes the information provision process.

[0186] Anomaly detection processing by the roadside device 600 according to the fifth embodiment will be described with reference to FIG.

[0187] The roadside device 600 receives the first control information transmitted from the external communication device 350, and the processor 601 acquires the first control information (step S211). The roadside device 600 also receives the position information together with the second control information.

[0188] The processor 601 receives second sensor information including distance information output from the sensor 620A, distance information and shape information output from the sensor 620B, and distance information and shape information output from the sensor 620C (step S212).

[0189] Processor 601 calculates (acquires) second control information, which is inter-vehicle distance information, based on the received second sensor information (step S213). Specifically, when multiple vehicles are detected by at least one of sensors 620A, 620B, and 620C, processor 601 compares the position of each detected vehicle with the position of vehicle 10 indicated by the position information received from vehicle 10, and determines the vehicle detected at a position closest to the position of vehicle 10 indicated by the position information received from vehicle 10 as the target vehicle. Processor 601 calculates inter-vehicle distance information based on the position of the target vehicle detected by sensors 620A, 620B, and 620C and the position of the vehicle traveling immediately preceding the target vehicle.

[0190] The processor 601 calculates the difference between the first control information and the second control information as the abnormality score (step S214).

[0191] The processor 601 compares the abnormality score with a threshold value (step S215). If the abnormality score is equal to or less than the threshold value (NO in step S215), the processor 601 determines that there is no abnormality in the in-vehicle device 300C (step S216), and ends the abnormality detection process.

[0192] If the abnormality score is greater than the threshold value (YES in step S215), the processor 601 determines that an abnormality has occurred in the in-vehicle device 300C (step S217) and notifies the user of the occurrence of the abnormality in the in-vehicle device 300C (step S218). The details of step S218 are the same as those of step S117 in the fourth embodiment, and therefore will not be described again. This completes the abnormality detection process.

[0193] An example of the operation of the anomaly detection system according to the fifth embodiment will be described with reference to Fig. 11 . In this embodiment, the external device is a roadside device 600, and therefore the communication I / F 504, processor 501, and sensors 520A and 520B in Fig. 11 will be read as a communication I / F 604, processor 601, and sensors 620A, 620B, and 620C, respectively. Furthermore, in this embodiment, the display device 360 ​​displays the anomaly notification information. Therefore, the display device 506 will be read as a display device 360.

[0194] The in-vehicle device 300C receives the first sensor information (distance information output from sensor 310A, distance information output from sensor 310B, distance information output from sensor 310C) as first control information, which is inter-vehicle distance information. The in-vehicle device 300C transmits (provides) a frame including the first control information and position information (step S21). Steps S22 to S23 are the same as those in the third embodiment, and therefore will not be described.

[0195] Sensor 620A detects the position of an object on the road and outputs position information. Sensor 620B detects the position and shape of an object on the road and outputs position information and shape information. Sensor 620C detects the position and shape of an object on the road and outputs position information and shape information (steps S24 and S25).

[0196] The processor 601 receives second sensor information (position information output from sensor 620A, position information and shape information output from sensor 620B, and position information and shape information output from sensor 620C). The processor 601 compares the position information received from the in-vehicle device 300C with the position information included in the second sensor information, and identifies position information indicating a position closest to the position indicated by the position information received from the in-vehicle device 300C. The processor 601 determines the vehicle at the position indicated by the identified position information as the target vehicle. The processor 601 calculates second control information, which is inter-vehicle distance information, based on the position information of the target vehicle in the second sensor information and the position information of the vehicle traveling immediately before the target vehicle (step S26).

[0197] Steps S27 and S28 are the same as those in the third embodiment, and therefore their explanation will be omitted. The subsequent processing is the same as those in the fourth embodiment, and therefore their explanation will be omitted.

[0198] 6. Sixth Embodiment The configuration of the anomaly detection system according to the sixth embodiment is the same as the configuration of the anomaly detection system according to the fifth embodiment, and therefore a description thereof will be omitted.

[0199] 12 , the in-vehicle device 300C recognizes obstacles around the vehicle 10 based on the distance information output from the sensor 310B, the distance information and shape information output from the sensor 310D, and the distance information and shape information output from the sensor 310C (first sensor information). For example, the obstacle information indicating the position and type of the obstacle recognized by the in-vehicle device 300C is used for driving assistance processing of the vehicle 10 in the in-vehicle device 300C (for example, steering assistance to avoid a collision with the obstacle).

[0200] The roadside device 600 recognizes obstacles around the vehicle 10 based on the position information output from the sensor 620A, the position information and shape information output from the sensor 620B, and the position information and shape information output from the sensor 620C. Obstacle information indicating the position and type of the obstacle recognized by the roadside device 600 is transmitted to the vehicle 10 by DSRC and is used for the driving assistance processing of the vehicle 10.

[0201] 16 is a diagram illustrating an example of obstacle recognition by a vehicle and a roadside device. In the example of Fig. 16, ahead of a vehicle 10 traveling on a road are a truck 10A parked on the shoulder of the road, pedestrians 11A and 11B walking on the sidewalk, a bicycle 12 traveling on the road, and a vehicle 10B traveling in the oncoming lane.

[0202] For example, an obstacle is also recognized in the vehicle 10B. The vehicle 10B transmits obstacle information by DSRC. The in-vehicle device 300C of the vehicle 10 receives the obstacle information from the vehicle 10B via the external communication device 350 and can use the received obstacle information for the driving assistance processing of the vehicle 10.

[0203] The sensors 310B, 310C, and 310D mounted on the vehicle 10 individually detect the positions of the truck 10A, the pedestrians 11A and 11B, the bicycle 12, and the vehicle 10B. The sensors 310C and 310D individually detect the shapes of these objects.

[0204] The on-vehicle device 300C recognizes the position of each object (obstacle) based on the position information (including distance information) output from each of the sensors 310B, 310C, and 310D. Furthermore, the on-vehicle device 300C recognizes the type of each obstacle (person, bicycle, vehicle, other object) based on the shape information output from each of the sensors 310C and 310D. In the example of FIG. 16 , the on-vehicle device 300C recognizes the position P11 of the pedestrian 11A, the position P12 of the bicycle 12, the position P13 of the truck 10A, the position P14 of the vehicle 10B, and the position P15 of the pedestrian 11B. The on-vehicle device 300C recognizes the pedestrian 11A as a "person," the bicycle 12 as a "bicycle," the truck 10A as a "vehicle," the vehicle 10B as a "vehicle," and the pedestrian 11B as a "person."

[0205] The sensors 620A, 620B, and 620C mounted on the roadside device 600 individually detect the positions of the truck 10A, the pedestrians 11A and 11B, the bicycle 12, and the vehicle 10B. The sensors 620B and 620C individually detect the shapes of these objects.

[0206] The roadside device 600 recognizes the position of each obstacle based on the position information output from each of the sensors 620A, 620B, and 620C. Furthermore, the roadside device 600 recognizes the type of each obstacle (person, bicycle, vehicle, or other object) based on the shape information output from each of the sensors 620B and 620C. In the example of FIG. 16 , the roadside device 600 recognizes the position P11 of the pedestrian 11A, the position P12 of the bicycle 12, the position P13 of the truck 10A, the position P14 of the vehicle 10B, and the position P15 of the pedestrian 11B. The roadside device 600 recognizes the pedestrian 11A as a "person," the bicycle 12 as a "bicycle," the truck 10A as a "vehicle," the vehicle 10B as a "vehicle," and the pedestrian 11B as a "person." Furthermore, each of the vehicles 10 and 10B transmits position information of its own vehicle acquired by the GNSS receiver (sensor 310A) to the roadside device 600. As in the fifth embodiment, the roadside device 600 compares the position indicated by the position information received from each of the vehicles 10 and 10B with the positions of the vehicles 10 and 10B detected by the sensors 620A, 620B, and 620C, recognizes which of the detected vehicles is the vehicle 10 that provided the first control information, and determines the target vehicle.

[0207] 14 . In the sixth embodiment, the first control information is obstacle information indicating the position and type of an obstacle recognized by the in-vehicle device 300C. The reception unit 321 of the in-vehicle device 300C receives first sensor information (distance information and shape information) output from the sensors 310B, 310C, and 310D. The in-vehicle device 300C calculates the first control information based on the first sensor information.

[0208] The providing unit 322 provides the calculated first control information and the position information of the vehicle 10 to the roadside device 600. Specifically, the first control information and the position information are transmitted to the roadside device 600 by DSRC.

[0209] The first acquisition unit 631 receives the first control information and the location information transmitted from the external communication device 350, thereby acquiring the first control information and the location information.

[0210] The second acquisition unit 632 according to the sixth embodiment receives position information output from the sensor 620A, position information and shape information output from the sensor 620B, and position information and shape information output from the sensor 620C (second sensor information). The second acquisition unit 632 recognizes the position and type of an obstacle based on the received second sensor information. In the fifth embodiment, the obstacle information calculated by the second acquisition unit 632 is second control information. The second acquisition unit 632 compares the position information received from the vehicle 10 with the position information output from the sensors 620A, 620B, and 620C to determine a target vehicle. The second acquisition unit 632 acquires obstacle information indicating obstacles to the determined target vehicle (i.e., obstacle information excluding the vehicle 10) as the second control information.

[0211] The determination unit 633 according to the sixth embodiment determines whether or not the obstacle information (first control information) calculated by the in-vehicle device 300C matches the obstacle information (second control information) calculated by the second acquisition unit 632. Specifically, the determination unit 633 determines whether or not the position of each obstacle recognized by the in-vehicle device 300C matches the position of each obstacle recognized by the roadside device 600 within an error range. Furthermore, the determination unit 633 determines whether or not the type of each obstacle recognized by the in-vehicle device 300C matches the type of each obstacle recognized by the roadside device 600. For example, the determination unit 633 determines that the first control information and the second control information match when the position of each obstacle recognized by the in-vehicle device 300C and the position of each obstacle recognized by the roadside device 600 match within an error range and when the type of each obstacle recognized by the in-vehicle device 300C matches the type of each obstacle recognized by the roadside device 600. The determination unit 633 determines that the first control information and the second control information do not match when the position of each obstacle recognized by the in-vehicle device 300C and the position of each obstacle recognized by the roadside device 600 differ by an amount exceeding the error range, or when the type of each obstacle recognized by the in-vehicle device 300C and the type of each obstacle recognized by the roadside device 600 differ.

[0212] If the first control information and the second control information match, the determination unit 633 determines that the in-vehicle device 300C is normal. If the first control information and the second control information do not match, the determination unit 633 determines that the in-vehicle device 300C is abnormal.

[0213] Other functions of the anomaly detection system according to the sixth embodiment are the same as those of the anomaly detection system 20A according to the fourth embodiment, and therefore description thereof will be omitted.

[0214] Next, the operation of the anomaly detection system according to the sixth embodiment will be described.

[0215] The information provision process by the in-vehicle device 300C according to the sixth embodiment is the same as the information provision process according to the fifth embodiment, except that the first control information is obstacle information, and therefore a description thereof will be omitted.

[0216] FIG. 17 is a flowchart illustrating an example of an abnormality detection process according to the sixth embodiment.

[0217] The roadside device 600 receives the first control information and the position information transmitted from the external communication device 350, and the processor 601 acquires the first control information and the position information (step S311).

[0218] The processor 601 receives second sensor information including the position information output from the sensor 620A, the position information and shape information output from the sensor 620B, and the position information and shape information output from the sensor 620C (step S312).

[0219] Based on the position information received from vehicle 10 and the position information acquired from sensors 620A, 620B, 620C, processor 601 recognizes which of the objects detected by sensors 620A, 620B, 620C is vehicle 10 and determines the target vehicle. Based on the received second sensor information, processor 601 calculates (acquires) second control information, which is obstacle information indicating an obstacle to the target vehicle (step S313).

[0220] The processor 601 determines whether the first control information matches the second control information (step S314).

[0221] If the first control information matches the second control information (YES in step S314), the processor 601 determines that there is no abnormality in the in-vehicle device 300C (step S315), and ends the abnormality detection process.

[0222] If the first control information does not match the second control information (NO in step S314), the processor 601 determines that an abnormality has occurred in the in-vehicle device 300C (step S316) and notifies the user of the occurrence of the abnormality in the in-vehicle device 300C (step S317). The details of step S317 are the same as those of step S117 in the fourth embodiment, and therefore will not be described again. This completes the abnormality detection process.

[0223] An example of the operation of the anomaly detection system according to the sixth embodiment will be described with reference to FIG.

[0224] Steps S21 to S26 are the same as those in the fifth embodiment except that the first control information and the second control information are obstacle information, and therefore a description thereof will be omitted.

[0225] The processor 601 compares the first control information with the second control information and determines whether the first control information matches the second control information. In this example, the first control information does not match the second control information. Therefore, the processor 601 detects an abnormality in the in-vehicle device 300C.

[0226] Steps S27 and S28 are the same as those in the third embodiment, and therefore their explanation will be omitted. The subsequent processing is the same as that in the fifth embodiment, and therefore their explanation will be omitted.

[0227] 7. Seventh Embodiment Referring to Figure 12, in the seventh embodiment, the sensor 310C is a magnetic sensor module.

[0228] FIG. 18 is a diagram for explaining the detection of a magnetic marker.

[0229] A plurality of magnetic markers 700 are embedded in the road along the longitudinal direction of the road. The magnetic markers 700 are used for the automatic driving of the vehicle 10.

[0230] The magnetic marker 700 includes a magnet 711 and an RFID (Radio Frequency Identification) tag 712. The magnet 711 is, for example, a ferrite magnet. A unique ID (identification information) is assigned to each magnetic marker 700. The RFID tag 712 stores the ID and transmits it wirelessly.

[0231] A sensor 310C is disposed on the bottom of the vehicle 10. The sensor 310C includes a magnetic sensor 311 and an RFID reader 312.

[0232] The magnet 711 is a permanent magnet and constantly generates magnetism. When the vehicle 10 travels on a road and the sensor 310C approaches the magnetic marker 700, the magnetic sensor 311 detects the magnetism generated by the magnet 711. The RFID reader 312 reads the ID from the RFID tag 714. Specifically, the RFID tag 714 is a non-powered tag. The RFID reader 312 transmits, for example, authentication information from an antenna via radio waves or a magnetic field. When the RFID reader 312 approaches the RFID tag 714, the antenna of the RFID tag receives the radio waves or magnetic field and generates power. This causes the RFID control circuit to perform authentication processing, read the ID from memory, and transmit the ID via radio waves or a magnetic field. The RFID reader 312 receives (reads out) the ID. The ID is, for example, pre-associated with a location on a map stored in the vehicle 10, and the vehicle 10 detects its exact location using the magnetic marker 700. The sensor 310C outputs first sensor information including the read ID.

[0233] The in-vehicle device 300C receives the ID of the magnetic marker 700 output from the sensor 310C. In the seventh embodiment, the ID of the magnetic marker 700 is the first control information. The in-vehicle device 300C recognizes the position of the vehicle 10 based on the magnetism and ID detected from the magnetic marker 700. The in-vehicle device 300C performs automatic driving of the vehicle 10 based on the recognized position.

[0234] 13, the nonvolatile memory 602 of the roadside device 600 stores magnetic marker information 611. The magnetic marker information 611 is information indicating the ID of a magnetic marker 700 placed near the roadside device 600.

[0235] The rest of the configuration of the anomaly detection system according to the seventh embodiment is the same as that of the anomaly detection system 20A according to the fourth embodiment, and therefore description thereof will be omitted. Note that instead of the magnetic marker 700, only an RFID tag 712 may be embedded in the road, and the RFID reader 312 may read the ID when the vehicle 10 passes directly above the RFID tag 712. In this case, if the sensor 310C includes the RFID reader 312, the magnetic sensor 311 can be omitted.

[0236] 14 , the receiving unit 321 of the in-vehicle device 300C receives the ID of the magnetic marker 700 output from the sensor 310 as the first control information. The providing unit 322 provides the first control information (ID) by transmitting a frame including the first control information to the roadside device 600.

[0237] The first control information transmitted from the in-vehicle device 300C is transmitted to the roadside device 600 via the relay device 200 and the external communication device 350. The first acquisition unit 631 receives the first control information transmitted from the external communication device 350, thereby acquiring the first control information.

[0238] The second acquisition unit 632 according to the seventh embodiment reads out the magnetic marker information 611 stored in the nonvolatile memory 602. In the seventh embodiment, the magnetic marker information 611 is second control information.

[0239] The determination unit 633 according to the seventh embodiment determines whether the ID (first control information) of the magnetic marker 700 read by the in-vehicle device 300C matches the magnetic marker information 611 (second control information) acquired by the second acquisition unit 632. Specifically, the magnetic marker information 611 includes IDs of multiple magnetic markers 700 near the roadside device 600. The determination unit 633 determines whether the ID acquired by the first acquisition unit 631 matches one of the multiple IDs included in the magnetic marker information 611. For example, if the ID acquired by the first acquisition unit 631 matches one of the multiple IDs included in the magnetic marker information 611, the determination unit 633 determines that the first control information and the second control information match. If the ID acquired by the first acquisition unit 631 differs from all of the IDs included in the magnetic marker information 611, the determination unit 633 determines that the first control information and the second control information do not match.

[0240] If the first control information and the second control information match, the determination unit 633 determines that the in-vehicle device 300C is normal. If the first control information and the second control information do not match, the determination unit 633 determines that the in-vehicle device 300C is abnormal.

[0241] Other functions of the anomaly detection system according to the seventh embodiment are the same as those of the anomaly detection system 20A according to the fourth embodiment, and therefore description thereof will be omitted.

[0242] Next, the operation of the anomaly detection system according to the seventh embodiment will be described.

[0243] The information provision process by the in-vehicle device 300C according to the seventh embodiment is the same as the information provision process in the fifth embodiment, except that the first control information is the ID of the magnetic marker 700. Therefore, a description thereof will be omitted. Note that in the seventh embodiment, the in-vehicle device 300C does not necessarily need to provide the position information of the vehicle 10 to the roadside device 600.

[0244] FIG. 19 is a flowchart illustrating an example of an abnormality detection process according to the seventh embodiment.

[0245] The roadside device 600 receives the first control information transmitted from the external communication device 350, and the processor 601 acquires the first control information (step S411).

[0246] The processor 601 reads (acquires) the magnetic marker information 611 from the nonvolatile memory 602 (step S412).

[0247] The processor 601 determines whether the first control information matches the second control information (step S413).

[0248] If the first control information matches the second control information (YES in step S413), the processor 601 determines that there is no abnormality in the in-vehicle device 300C (step S414), and ends the abnormality detection process.

[0249] If the first control information does not match the second control information (NO in step S413), the processor 601 determines that an abnormality has occurred in the in-vehicle device 300C (step S415), detects the abnormality in the in-vehicle device 300C, and notifies the user of the occurrence of the abnormality in the in-vehicle device 300C (step S416). The details of step S416 are the same as those of step S117 in the fourth embodiment, and therefore will not be described again. This completes the abnormality detection process.

[0250] FIG. 20 is a sequence diagram illustrating an example of the operation of the anomaly detection system according to the seventh embodiment.

[0251] Steps S181 to S183 are the same as steps S61 to S63 in the fifth embodiment except that the first control information is the ID of the magnetic marker 700, and therefore a description thereof will be omitted.

[0252] The processor 601 reads the second control information, which is the magnetic marker information 611, from the nonvolatile memory 602 (step S184).

[0253] The processor 601 compares the first control information with the second control information and determines whether the first control information matches the second control information (step S185). In this example, the first control information does not match the second control information. Therefore, the processor 601 detects an abnormality in the in-vehicle device 300C.

[0254] Steps S186 to S190 are the same as steps S69 to S73 in the fifth embodiment, and therefore a description thereof will be omitted.

[0255] [8. Modifications] In the above-described embodiment, the mobile terminal 500 or the roadside device 600 is used as the anomaly detection device, but this is not limiting. For example, a server connected to the Internet may be used as the anomaly detection device. In this case, the external communication device 350 transmits first control information to the server via the Internet, and the mobile terminal 500 or the roadside device 600 transmits second control information to the server via the Internet. The server can detect an anomaly in the in-vehicle device based on the first control information and the second control information received via the Internet.

[0256] In another example, an on-board device of the vehicle 10, for example, the on-board device 300C, may be used as the abnormality detection device. In this case, the mobile terminal 500 or the roadside device 600 transmits the second control information to the on-board device 300C via the external communication device 350. The on-board device 300C can detect an abnormality in the on-board device based on the first control information acquired in the vehicle 10 and the second control information received from the mobile terminal 500 or the roadside device 600.

[0257] In the above-described embodiment, the abnormality processing is processing for notifying the occurrence of an abnormality in the in-vehicle device, but is not limited to this. For example, the abnormality processing may be processing for bringing the vehicle 10 to an emergency stop. In this way, safety can be ensured by stopping the vehicle 10 when it is determined that an abnormality has occurred in the in-vehicle device.

[0258] [9. Supplementary Note] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present disclosure is defined by the claims, not the above-described embodiments, and includes meanings equivalent to the claims and all modifications within the scope thereof.

[0259] 10, 10B Vehicle 10A Truck 11A, 11B Pedestrian 12 Bicycle 20, 20A Anomaly detection system 100 In-vehicle system 200 Relay device 201 Processor 202 Non-volatile memory 203 Volatile memory 204A, 204B, 204C Communication interface (communication I / F) 205 Bus 210 Information provision program 321 Reception unit 322 Provision unit 300A, 300B, 300C, 300D, 300E In-vehicle device 310A, 310B, 310C, 310D Sensor 311 Magnetic sensor 312 RFID reader 350 External communication device 360 ​​Display device 400A, 400B, 400C Communication bus 500 Portable terminal (anomaly detection device, external device) 501 Processor 502 Non-volatile memory 503 Volatile memory 504 Communication interface (communication I / F) 505 Input / output interface (I / O) 506 Display device 507 Bus 510 Abnormality detection program 511 Database (DB) 520A, 520B Sensors 531 First acquisition unit 532 Second acquisition unit 533 Determination unit 534 Abnormality processing unit 600 Roadside device (abnormality detection device, external device) 601 Processor 602 Non-volatile memory 603 Volatile memory 604 Communication interface (communication I / F) 605 Input / output interface (I / O) 606 Bus 610 Abnormality detection program 611 Magnetic marker information 620A, 620B, 620C Sensors 631 First acquisition unit 632 Second acquisition unit 633 Determination unit 634 Abnormality processing unit 700 Magnetic marker 711 Magnet 712 RFID tag P0, P1, P11, P12, P13, P14, P15 Position

Claims

1. An abnormality detection device that detects an abnormality in an on-board device in an on-board system including the on-board device installed in a vehicle, comprising: a first acquisition unit that acquires first control information that is acquired by the on-board device and is information used for driving control of the vehicle; a second acquisition unit that acquires second control information that is information regarding the driving of the vehicle acquired by an external device not installed in the vehicle and is the same type of information as the first control information; a judgment unit that judges whether the on-board device is abnormal based on the first control information acquired by the first acquisition unit and the second control information acquired by the second acquisition unit; and an abnormality processing unit that executes abnormality processing related to the abnormality in the on-board device when the judgment unit judges that the on-board device is abnormal.

2. The abnormality detection device described in claim 1, wherein the first control information is first sensor information indicating the state of the vehicle detected by a first sensor provided in the in-vehicle device, or information calculated using the first sensor information output from the first sensor, and the second control information is second sensor information indicating the state of the vehicle detected by a second sensor provided in the external device, or information calculated using the second sensor information output from the second sensor.

3. The abnormality detection device described in claim 1, wherein the in-vehicle device is connected to a first sensor that detects the position of the vehicle, the first control information includes first position information output from the first sensor, and the external device is connected to a second sensor that detects the position of the vehicle, and the second control information includes second position information output from the second sensor.

4. The abnormality detection device of claim 1, wherein the in-vehicle device is connected to a first sensor that detects acceleration of the vehicle, the first control information includes first acceleration information output from the first sensor, and the external device is connected to a second sensor that detects acceleration of the vehicle, and the second control information includes second acceleration information output from the second sensor.

5. The abnormality detection device described in claim 1, wherein the in-vehicle device is connected to a first sensor that detects the wheel speed of the vehicle, the first control information includes first vehicle speed information indicating a vehicle speed calculated based on the wheel speed information output from the first sensor, and the external device is connected to a second sensor that detects the position of the vehicle, and the second control information includes second vehicle speed information indicating a vehicle speed calculated based on the position information output from the second sensor.

6. The abnormality detection device described in claim 1, wherein the in-vehicle device is connected to a first sensor that detects the distance from the vehicle to a preceding vehicle traveling in front of the vehicle, the first control information includes first inter-vehicle distance information output from the first sensor, and the external device is connected to a second sensor that detects the position of objects within a specific range on the road, and the second control information includes second inter-vehicle distance information indicating the distance from the vehicle to the preceding vehicle calculated based on the position information of each object output from the second sensor.

7. The anomaly detection device of claim 1, wherein the in-vehicle device is connected to a first sensor that detects the distance from the vehicle to objects around the vehicle, and the first control information includes first obstacle information indicating the positions of obstacles around the vehicle obtained based on distance information output from the first sensor, and the external device is connected to a second sensor that detects the positions of objects within a specific range on a road, and the second control information includes second obstacle information indicating the positions of obstacles around the vehicle obtained based on position information of each object output from the second sensor.

8. The anomaly detection device described in claim 1, wherein the in-vehicle device is connected to a first sensor that detects a magnetic marker installed on a road on which the vehicle is traveling, the first control information includes first position information that indicates the position of the vehicle when the magnetic marker is detected by the first sensor, and the second control information includes second position information that indicates the installation position of the magnetic marker on the road.

9. An abnormality detection device as described in any one of claims 1 to 8, wherein the judgment unit judges that the in-vehicle device is normal when the first control information and the second control information match, and judges that the in-vehicle device is abnormal when the first control information and the second control information do not match.

10. An anomaly detection device as described in any one of claims 1 to 8, wherein the judgment unit calculates an anomaly score based on the difference between the first control information and the second control information, and judges that the in-vehicle device is normal if the calculated anomaly score is equal to or less than a threshold, and judges that the in-vehicle device is abnormal if the calculated anomaly score is greater than the threshold.

11. The anomaly detection device according to claim 10, wherein the determination unit calculates the anomaly score based on a history of the difference between the first control information and the second control information.

12. The anomaly detection device according to any one of claims 1 to 11, wherein the anomaly processing includes a process for notifying an occurrence of the anomaly in the vehicle-mounted device.

13. An anomaly detection system comprising: an in-vehicle system including an in-vehicle device mounted on a vehicle; an anomaly detection device that detects an anomaly in the in-vehicle device; and an external device not mounted on the vehicle, wherein the anomaly detection device includes: a first acquisition unit that acquires first control information that is acquired by the in-vehicle device and is information used for driving control of the vehicle; a second acquisition unit that acquires second control information that is information regarding the driving of the vehicle acquired by an external device not mounted on the vehicle and is the same type of information as the first control information; a determination unit that determines whether or not the in-vehicle device is abnormal based on the first control information acquired by the first acquisition unit and the second control information acquired by the second acquisition unit; and an anomaly detection processing unit that executes an abnormality processing related to the abnormality in the in-vehicle device when the determination unit determines that the in-vehicle device is abnormal.

14. An abnormality detection method for detecting an abnormality in an on-board device in an on-board system including the on-board device installed in a vehicle, comprising: a step of acquiring first control information that is acquired by the on-board device and is information used for driving control of the vehicle; a step of acquiring second control information that is information related to the driving of the vehicle acquired by an external device not installed in the vehicle and is the same type of information as the first control information; a step of determining whether or not the on-board device is abnormal based on the acquired first control information and the acquired second control information; and a step of executing abnormality processing related to the abnormality in the on-board device when it is determined that the on-board device is abnormal.

15. An abnormality detection program for detecting an abnormality in an on-board device in an on-board system including the on-board device installed in a vehicle, the abnormality detection program causing a computer to execute the following steps: acquiring first control information, which is information acquired by the on-board device and used for driving control of the vehicle; acquiring second control information, which is information regarding the driving of the vehicle acquired by an external device not installed in the vehicle and is the same type of information as the first control information; determining whether or not the on-board device is abnormal based on the acquired first control information and the acquired second control information; and when it is determined that the on-board device is abnormal, executing abnormality processing related to the abnormality in the on-board device.

Images