JP2021081939A - Vehicle control device, vehicle system, and vehicle control method - Google Patents

Abstract

To allow permitted functions to be changed for each product grade of a vehicle control device when performance that is insufficient for the control device installed in a vehicle to update software is compensated by connecting the control device later.SOLUTION: A vehicle control device comprises: a terminal ID acquisition unit 301 that acquires a terminal ID for identifying individual additional ECU from an additional ECU when the additional ECUs are newly connected and added, for updating software used for control, to an integrated ECU 30 mounted on a vehicle and capable of controlling a plurality of on-vehicle devices; and a function restriction unit 304 that changes functions allowed for the additional ECU according to an authentication level of the additional ECU determined based on registration correspondence in which the authentication level that is the level of the function allowed for the additional ECU and the terminal ID are associated in advance from the terminal ID acquired by the terminal ID acquisition unit 301.SELECTED DRAWING: Figure 4

Description

The present disclosure relates to a vehicle control device, a vehicle system, and a vehicle control method.

Conventionally, there is known a technique for updating or expanding a function by updating software of a vehicle control device. For example, Patent Document 1 discloses a technique for upgrading a control program of an in-vehicle ECU by using version upgrade data transmitted from a data communication device.

Japanese Unexamined Patent Publication No. 2004-28000

The product life of the vehicle is relatively long. Therefore, when the software of the vehicle control device is repeatedly updated, it is possible that the capacity of the vehicle control device is insufficient for the updated software and the software cannot be updated. In this case, a vehicle control device capable of updating software is required, but it is not easy to replace the vehicle control device in the vehicle. As a means for solving this problem, it is conceivable to connect the control device for the vehicle already installed in the vehicle to supplement the insufficient performance and enable the software to be updated.

As described above, when compensating for the performance lacking in the vehicle control device already mounted on the vehicle by connecting the control device later, the following requirements can be considered. By changing the permitted functions for each product grade of the control device, it is conceivable that a plurality of product grades suitable for the price range required by each customer can be set.

One purpose of this disclosure is to allow each product grade of the controller to compensate for the lack of performance of the vehicle controller already installed in the vehicle for software updates by connecting the controller later. It is an object of the present invention to provide a vehicle control device, a vehicle system, and a vehicle control method that enable a change in a function to be performed.

The above object is achieved by a combination of the features described in the independent claims, and the sub-claims provide for further advantageous embodiments of the disclosure. The reference numerals in parentheses described in the claims indicate, as one embodiment, the correspondence with the specific means described in the embodiments described later, and do not limit the technical scope of the present disclosure. ..

In order to achieve the above object, the vehicle control device of the present disclosure is a vehicle control device mounted on a vehicle and capable of controlling a plurality of in-vehicle devices (34, 35, 36, 37, 38). Therefore, when a control device is newly connected and added to the vehicle control device for updating the software used for control, the terminal identification information for identifying each control device is provided to the vehicle control device. It is the level of the function permitted to the control device from the terminal identification information acquisition unit (301) acquired from the connection control device (39) which is the control device connected to the terminal identification information acquisition unit and the terminal identification information acquired by the terminal identification information acquisition unit. It is provided with a function limiting unit (304) that changes the function permitted to the connection control device according to the authentication level of the connection control device determined based on the correspondence between the authentication level and the terminal identification information in advance. ..

Further, in order to achieve the above object, the vehicle control method of the present disclosure is used.
A new control device has been added to the vehicle control device (30) that can be mounted on a vehicle and can control a plurality of in-vehicle devices (34, 35, 36, 37, 38) in order to update the software used for control. Connection control which is a control device for a vehicle implemented by a computer and is a control device connected to a control device for a vehicle to provide terminal identification information for identifying an individual control device when the device is connected to and added to the control device. From the terminal identification information acquired from the device (39), the connection control device is determined based on the correspondence between the authentication level, which is the level of the function permitted to the control device, and the terminal identification information in advance. It includes the step of changing the functions permitted to the connection control unit according to the authentication level.

According to these, terminal identification information for identifying each individual connection control device, which is a control device connected to the vehicle control device, is acquired, and from the acquired terminal identification information, at the level of the function permitted to the control device. Since the functions permitted to the connection control device are changed according to the authentication level of the connection control device, which is determined based on the correspondence between a certain authentication level and the terminal identification information in advance, each product grade of the control device is changed. , It is possible to change the permitted functions. In addition, this terminal identification information is added to a vehicle control device that is mounted on a vehicle and capable of controlling a plurality of in-vehicle devices by newly connecting a control device for updating software used for control. Therefore, when the performance that is insufficient for the vehicle control device installed in the vehicle for software update is supplemented by connecting the control device later, it is permitted according to the product grade of the control device. It is possible to change the function to be used.

Further, in order to achieve the above object, the vehicle system of the present disclosure is mounted on the vehicle and can control a plurality of in-vehicle devices (34, 35, 36, 37, 38). The control device (30) and the connection control device (39), which is a control device newly connected and added to the vehicle control device for updating the software used for control, are included.

According to this, since the above-mentioned vehicle control device is included, when the performance lacking in the vehicle control device already installed in the vehicle for software update is supplemented by connecting the control device later, control is performed. It is possible to change the permitted functions according to the product grade of the device.

It is a figure which shows an example of the schematic structure of the vehicle system 1. It is a figure which shows an example of the schematic structure of the server 2. It is a figure which shows an example of the schematic structure of the vehicle side unit 3. It is a figure which shows an example of the schematic structure of the integrated ECU 30. It is a figure for demonstrating an example of the function permitted to the additional ECU 39 according to the authentication level. It is a sequence diagram which shows an example of the flow of the authentication-related processing at the time of connection in a vehicle system 1. It is a sequence diagram which shows an example of the flow of the connection disconnection-related processing in a vehicle system 1.

A plurality of embodiments for disclosure will be described with reference to the drawings. For convenience of explanation, the parts having the same functions as the parts shown in the drawings used in the explanations up to that point may be designated by the same reference numerals and the description thereof may be omitted. is there. For the parts with the same reference numerals, the description in other embodiments can be referred to.

(Embodiment 1)
<Outline configuration of vehicle system 1>
Hereinafter, this embodiment will be described with reference to the drawings. First, the vehicle system 1 will be described with reference to FIG. As shown in FIG. 1, the vehicle system 1 includes a server 2 and a vehicle-side unit 3 used in each of the plurality of vehicles.

The server 2 is a server device installed outside the vehicle. The server 2 is connected to a public communication network. The server 2 acquires the information transmitted from the vehicle side unit 3 via the public communication network. Further, the server 2 transmits information to the vehicle side unit 3 via the public communication network.

The server 2 is mainly composed of, for example, a microcomputer (hereinafter, a microcomputer) including a processor, a memory, an I / O, and a bus connecting these. By executing the control program stored in the memory, the server 2 executes various processes related to the determination of the level of the function (hereinafter referred to as the authentication level) permitted to the additional ECU 39 described later. The memory referred to here is a non-transitory tangible storage medium for storing programs and data that can be read by a computer non-transitoryly. Further, the non-transitional substantive storage medium is realized by a semiconductor memory, a magnetic disk, or the like.

The server 2 may be composed of one server device or may be composed of a plurality of server devices. The server 2 may be a server device arranged on the cloud. The details of the server 2 will be described later.

The vehicle side unit 3 is used in the vehicle as described above. The vehicle-side unit 3 can communicate with the server 2. The details of the vehicle side unit 3 will be described later.

<Outline configuration of server 2>
Subsequently, the schematic configuration of the server 2 will be described with reference to FIG. As shown in FIG. 2, the server 2 includes a registration unit 20, an information acquisition unit 21, an authentication level determination unit 22, a release processing unit 23, and a response unit 24 as functional blocks. In addition, a part or all of the functions executed by the server 2 may be configured in hardware by one or a plurality of ICs or the like. Further, a part or all of the functional blocks included in the server 2 may be realized by a combination of software execution by a processor and hardware members.

The registration unit 20 includes identification information (hereinafter, vehicle-side ID) for identifying each of the integrated ECUs 30 described later, identification information (hereinafter, terminal ID) for identifying each of the additional ECUs 39 described later, and an authentication level. Correspondence relationship with (hereinafter, registration correspondence relationship) is stored in advance. This registration correspondence relationship shall be stored in advance by following a regular procedure at a terminal such as a dealer. This registration correspondence relationship is stored in the registration unit 20 for each of the integrated ECUs 30 described later used in a plurality of vehicles. That is, the server 2 is shared by a plurality of integrated ECUs 30. As the registration unit 20, for example, a non-volatile memory may be used.

The information acquisition unit 21 acquires the information transmitted from the vehicle side unit 3. The information transmitted from the vehicle side unit 3 includes an authentication request, a cancellation request, and the like. The authentication request is a request for authentication of the terminal ID. As an example, the authentication request may include the vehicle side ID of the integrated ECU 30 of the vehicle side unit 3 that makes the authentication request and the terminal ID of the additional ECU 39 connected to the integrated ECU 30. The cancellation request is a request for canceling the registration correspondence stored in the registration unit 20. The release request may include at least the vehicle side ID of the integrated ECU 30 of the vehicle side unit 3 that makes the release request. The release request may include the terminal ID of the additional ECU 39 connected to the integrated ECU 30.

When the information acquisition unit 21 acquires an authentication request from the vehicle side unit 3, the authentication level determination unit 22 uses the terminal ID and the vehicle side ID included in the authentication request to authenticate the terminal ID and determine the authentication level. Do. As an example, when the combination of the terminal ID and the vehicle side ID included in the authentication request exists in the registration correspondence relationship stored in the registration unit 20, the terminal ID authentication is established. When the authentication of the terminal ID is established, the connection is permitted, and in the registration correspondence relationship stored in the registration unit 20, the authentication level associated with the terminal ID and the vehicle side ID included in the authentication request is set to the terminal ID. The authentication level for the additional ECU 39 is determined.

On the other hand, if the combination of the terminal ID and the vehicle side ID included in the authentication request does not exist in the registration correspondence relationship stored in the registration unit 20, the terminal ID authentication is not established. An example of such a case is a case where the terminal ID included in the authentication request is not included in the registration correspondence relationship stored in the registration unit 20. Such a situation occurs when the additional ECU 39 is not a genuine product and the terminal ID of the additional ECU 39 is not stored in the registration unit 20. Further, there is also a case where the terminal ID included in the authentication request is associated with a vehicle side ID different from the vehicle side ID included in the authentication request in a registration correspondence relationship stored in the registration unit 20. Such a situation occurs when the additional ECU 39 is a stolen item from another vehicle and the terminal ID of the additional ECU 39 is already associated with the vehicle side ID of the integrated ECU 30 of the other vehicle. If the authentication of the terminal ID is not established, the connection is disallowed and the authentication level corresponding to the connection disapproval is determined.

Hereinafter, the case where the authentication level is four levels A to D will be described as an example. It is assumed that the high levels of the authentication levels A to D have a relationship of A> B> C> D. That is, the authentication level A is the highest level, and the authentication level D is the lowest level. The lowest authentication level D is the authentication level that is not permitted to connect. The authentication levels A to C are authentication levels corresponding to connection permission.

When the information acquisition unit 21 acquires the release request from the vehicle side unit 3, the release processing unit 23 uses the vehicle side ID included in the release request to release the registration correspondence relationship stored in the registration unit 20. Do. As an example, among the registration correspondences stored in the registration unit 20, the registration correspondences including the vehicle side ID included in the cancellation request may be canceled. For example, this registration correspondence relationship may be canceled by deleting the registration correspondence relationship including the vehicle side ID included in the cancellation request from the registration unit 20.

In addition, instead of the vehicle side ID, the terminal ID included in the cancellation request may be used to cancel the registration correspondence relationship including this terminal ID among the registration correspondence relationships stored in the registration unit 20. .. However, from the viewpoint of reducing the possibility of canceling the illegal registration correspondence relationship using the additional ECU 39 stolen from another vehicle, the configuration using the vehicle side ID is preferable.

The response unit 24 responds to the vehicle-side unit 3 from which the authentication request is transmitted with the authentication level determined by the authentication level determination unit 22. Further, when the release processing unit 23 performs the release process, the response unit 24 responds to the vehicle side unit 3 to the transmission source of the release request that the release has been completed.

<Outline configuration of vehicle side unit 3>
Subsequently, a schematic configuration of the vehicle-side unit 3 will be described with reference to FIG. As shown in FIG. 3, the vehicle side unit 3 includes an integrated ECU 30, a communication module 31, an in-vehicle LAN 32, a connector 33, a meter MID (Multi Information Display) 34, a CID (Center Information Display) 35, and a HUD (Head-Up Display). It includes a device 36, a speaker 37, an air conditioner unit 38, and an additional ECU 39.

The communication module 31 is an in-vehicle communication module. The communication module 31 communicates with the server 2 by connecting to the public communication network. As the communication module 31, for example, DCM (Data Communication Module) may be used. The in-vehicle LAN 32 is an in-vehicle network that connects in-vehicle devices such as an in-vehicle ECU so as to be communicable with each other. In the example of this embodiment, the integrated ECU 30 and the air conditioner unit 38 are connected to the in-vehicle LAN 32.

The connector 33 is a connector that connects the integrated ECU 30 and another device so that information can be exchanged. In this embodiment, the connector 33 connects the integrated ECU 30 and the additional ECU 39. The connector 33 can change the communication standard that can be used when connecting devices to each other. The communication standard referred to here is a standard used for communication between devices, and can be paraphrased as an interface standard.

In the present embodiment, the case where, for example, a USB (Universal Serial Bus) Type-C connector is used as the connector 33 will be described as an example. In the present embodiment, the connector 33 can use, for example, USB2.0, USB3.0, and a communication standard for transferring a video signal (hereinafter referred to as a video line) as communication standards. Examples of video lines include HDMI (registered trademark), DisplayPort, and the like.

The meter MID 34 is a display provided in the vehicle interior, for example, in front of the driver's seat. As an example, the meter MID 34 may be configured to be provided on the meter panel. As the meter MID34, a liquid crystal display, an organic EL display, or the like can be used. As an example, the meter MID 34 mainly displays information on safety and security functions such as meter information. This meter MID34 corresponds to an in-vehicle device.

The CID 35 is a display provided in, for example, a center cluster in the vehicle interior. As the CID35, a liquid crystal display, an organic EL display, or the like can be used. As an example, CID35 mainly displays information on multimedia functions such as navigation information and audio information. The navigation information is information related to the navigation function, such as a route guidance image. The audio information is an image or the like related to the operation of the audio device. Air conditioning information and the like are also displayed on the CID 35. The air conditioning information is an image or the like related to the operation of the air conditioning unit 38. This CID35 also corresponds to an in-vehicle device.

The HUD device 36 is provided in, for example, an instrument panel in the vehicle interior. The HUD device 36 projects the display image formed by the projector onto a projection area defined on the front windshield as a projection member. The light of the image reflected by the front windshield toward the passenger compartment is perceived by the driver sitting in the driver's seat. As a result, the driver can visually recognize the virtual image of the display image formed in front of the front windshield by superimposing it on a part of the foreground. As an example of the display image, there is an image showing the state of the own vehicle such as the vehicle speed. The projection member on which the HUD device 36 projects the display image is not limited to the front windshield, and may be a translucent combiner. This HUD device 36 also corresponds to an in-vehicle device.

The speaker 37 is a group of a plurality of speakers provided in the vehicle interior. This speaker corresponds to an audio output device. In the example of the present embodiment, the number and arrangement of the speakers 37 are assumed to be compatible with both stereo (that is, 2.0ch) sound and 5.1ch surround sound. Hereinafter, the stereo sound is referred to as 2.0ch output, and the 5.1ch surround sound is referred to as 5.1ch output. Two speakers are used for 2.0ch output. Six speakers are used for 5.1ch output. For example, in 5.1ch output, a total of six speakers are used, two on the left and right on the front side of the vehicle, one on the center on the front side of the vehicle, one on the left and right on the rear side of the vehicle, and one subwoofer. And it is sufficient. In the 2.0ch output, out of the six speakers used in the 5.1ch output, the left and right two speakers on the front side of the vehicle may be used. This speaker 37 also corresponds to an in-vehicle device.

The air conditioner unit 38 is a unit for air-conditioning the interior of the vehicle. The air conditioner unit 38 performs air conditioning by supplying cold air or hot air to the vehicle interior from an air outlet provided on an instrument panel or the like. The air conditioner unit 38 also corresponds to an in-vehicle device.

The integrated ECU 30 is an electronic control device that integrates functions for controlling a plurality of in-vehicle devices. It is assumed that the integrated ECU 30 is mounted on the vehicle. In the example of this embodiment, the integrated ECU 30 is directly connected to an in-vehicle device such as a meter MID34, a CID35, a HUD device 36, and a speaker 37. Further, the integrated ECU 30 is indirectly connected to an in-vehicle device such as the air conditioner unit 38 via an in-vehicle LAN 32.

The integrated ECU 30 makes it possible to display various images on the meters MID34, CID35, and HUD device 36. The integrated ECU 30 can output sound from the speaker 37. The integrated ECU 30 can perform air conditioning from the air conditioner unit 38 via the in-vehicle LAN 32.

The integrated ECU 30 is connected to the in-vehicle LAN 32, and information from a sensor connected to the in-vehicle LAN 32, another ECU, or the like is input. Examples of the information input to the integrated ECU 30 via the in-vehicle LAN 32 include vehicle information such as vehicle speed and mileage, digital TV image information, smartphone cooperation information linked with a smartphone, and the like. The integrated ECU 30 has a configuration in which input information and output information are collectively managed, and the input source and output destination of various information can be freely rearranged.

The integrated ECU 30 is mainly composed of, for example, a microprocessor (hereinafter, a microcomputer) including a processor, a memory, I / O, and a bus connecting these. The integrated ECU 30 executes various processes related to the control of a plurality of in-vehicle devices by executing the control program stored in the memory. The integrated ECU 30 corresponds to a vehicle control device. The memory referred to here is a non-transitory tangible storage medium for storing programs and data that can be read by a computer non-transitoryly. Further, the non-transitional substantive storage medium is realized by a semiconductor memory, a magnetic disk, or the like.

The integrated ECU 30 can control a plurality of in-vehicle devices by executing an application related to the control of a plurality of in-vehicle devices on software. This software will be described below assuming that it is, for example, basic software (hereinafter, OS). This OS may be updated by an update program within the range where the specifications of the integrated ECU 30 satisfy the operating environment. The update program may be configured to be acquired from the outside of the vehicle via, for example, the communication module 31. The operating environment referred to here may be replaced with the recommended environment. In addition, specifications can be rephrased as performance. The specifications of the integrated ECU 30 are, for example, the number of clocks of the processor, the capacity of the memory, and the like. The integrated ECU 30 may be configured to operate a plurality of OSs.

The additional ECU 39 is a control device newly connected to and added to the integrated ECU 30 for OS upgrade. This additional ECU 39 corresponds to a connection control device. The connection between the integrated ECU 30 and the additional ECU 39 is made via the connector 33. The connection for upgrade refers to a connection in which the OS cannot be updated according to the specifications of the integrated ECU 30, but the OS can be updated by newly connecting the additional ECU 39. The additional ECU 39 may be, for example, not used alone. Not used by itself means that it does not function when it is not connected to other devices. In other words, it means that it does not function by itself.

As an example, the integrated ECU 30 may be built in at a position not exposed outside the vehicle interior of the vehicle, and the connecting portion of the connector 33 for connecting to the integrated ECU 30 may be exposed inside the vehicle interior. The additional ECU 39 may be retrofitted to the connector 33 in the vehicle interior. The connection portion of the connector 33 is not limited to the configuration exposed in the vehicle interior as long as it is in the storage space that can be easily opened and closed from the vehicle interior. For example, in consideration of appearance, the connection portion of the connector 33 may be provided in, for example, the storage space of the dashboard, and the additional ECU 39 connected to the connector 33 afterwards may be configured to store the storage space.

<Outline configuration of integrated ECU 30>
Subsequently, a schematic configuration of the integrated ECU 30 will be described with reference to FIG. In the present embodiment, for convenience, description of the configuration of the integrated ECU 30 other than the configuration related to the change of the function permitted to the additional ECU 39 when the additional ECU 39 is connected will be omitted. As shown in FIG. 4, the integrated ECU 30 includes a terminal ID acquisition unit 301, a transmission processing unit 302, a result acquisition unit 303, a function restriction unit 304, and a storage unit 305 as functional blocks. In addition, a part or all of the functions executed by the integrated ECU 30 may be configured in hardware by one or a plurality of ICs or the like. Further, a part or all of the functional blocks included in the integrated ECU 30 may be realized by executing software by a processor and a combination of hardware members.

The terminal ID acquisition unit 301 acquires the terminal ID of the additional ECU 39 from the additional ECU 39 when the additional ECU 39 is newly connected and added to the integrated ECU 30 for updating the OS. This terminal ID corresponds to the terminal identification information, and the terminal ID acquisition unit 301 corresponds to the terminal identification information acquisition unit. When the terminal ID acquisition unit 301 detects that the additional ECU 39 is connected to the connector 33, the terminal ID acquisition unit 301 may request the additional ECU 39 for the terminal ID and acquire the terminal ID from the additional ECU 39. The fact that the additional ECU 39 is connected to the connector 33 may be detected based on, for example, a pull-down resistor.

When the additional ECU 39 is newly connected, the transmission processing unit 302 sends an authentication request including the terminal ID acquired by the terminal ID acquisition unit 301 and the vehicle side ID of the integrated ECU 30 as its own device via the communication module 31. Send to server 2. The vehicle side ID may be any identification information that can identify each individual of the integrated ECU 30. The vehicle-side ID is not limited to the device ID of the integrated ECU 30, and may be the vehicle ID of the vehicle on which the integrated ECU 30 is mounted. This vehicle-side ID corresponds to the vehicle-side identification information.

The result acquisition unit 303 acquires the authentication level of the additional ECU 39 determined by the server 2 via the communication module 31 as a response to the authentication request transmitted by the transmission processing unit 302. In other words, the authentication level of the additional ECU 39 determined by the server 2 based on the registration correspondence relationship is acquired from the terminal ID transmitted by the transmission processing unit 302.

The result acquisition unit 303 acquires the authentication level of connection disapproval when the terminal ID transmitted by the transmission processing unit 302 and the vehicle side ID are not associated with each other in the registration correspondence relationship. The result acquisition unit 303 is not connected even when the terminal ID transmitted by the transmission processing unit 302 is associated with a vehicle side ID different from the vehicle side ID transmitted by the transmission processing unit 302 in a registration correspondence relationship. Get the authorization level of authorization. The authentication level for disallowing connection is the authentication level D in this embodiment.

On the other hand, when the terminal ID transmitted by the transmission processing unit 302 and the vehicle side ID are associated with each other in a registration correspondence relationship, the result acquisition unit 303 has a higher level than the authentication level D of connection disapproval. Get an authentication level that is not disallowed. The authentication levels that are not disallowed are authentication levels A to C in this embodiment. The result acquisition unit 303 decides to acquire the authentication level associated with the pair of the terminal ID and the vehicle side ID transmitted by the transmission processing unit 302 in the registration correspondence relationship among the authentication levels A to C. Become.

The function limiting unit 304 changes the function permitted to the additional ECU 39 according to the authentication level acquired by the result acquisition unit 303. The function limiting unit 304 does not allow the connection of the additional ECU 39 to the integrated ECU 30 when the authentication level acquired by the result acquisition unit 303 is the authentication level for which connection is not permitted. In this case, for example, the function limiting unit 304 may cut off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30. On the other hand, when the authentication level acquired by the result acquisition unit 303 is an authentication level that is not disallowed, the function limiting unit 304 permits the additional ECU 39 to be connected to the integrated ECU 30 and sets the additional ECU 39 to the authentication level. Allow the corresponding function.

Here, an example of the function permitted to the additional ECU 39 according to the authentication level will be described with reference to FIG. In the example of FIG. 5, the functions are roughly classified into "display", "voice output", "data transfer", and "in-vehicle LAN access" for explanation. "Display" is a function related to display on a display such as meters MID34, CID35, and HUD device 36. “Voice output” is a function related to voice output from the speaker 37. "Data transfer" is a function related to data transfer via the connector 33. "In-vehicle LAN access" is a function related to connection to the in-vehicle LAN 32.

First, in the case of the authentication level D having the lowest authentication level, the connection of the additional ECU 39 to the integrated ECU 30 is not permitted, and all the functions are disallowed. When the authentication level is the authentication level C, which is the second lowest after the authentication level D, the "display" function allows the display of only a part of the screen of the CID35 of the meters MID34, CID35, and HUD device 36. In addition, when the vehicle is running, it is subject to running compulsion that does not allow display. In the case of authentication level C, for the function of "audio output", only 2ch output out of 2ch output and 5.1ch output is permitted for the audio output of the speaker 37. In the case of authentication level C, for the "data transfer" function, the use of USB 2.0 is permitted as a communication standard used for data transfer via the connector 33. In the case of authentication level C, the "in-vehicle LAN access" function does not allow connection to the in-vehicle LAN 32.

When the authentication level is the authentication level B, which is the second lowest after the authentication level C, the "display" function allows the display of the entire screen of the CID35 among the meters MID34, CID35, and HUD device 36. In addition, when the vehicle is running, it is subject to running compulsion that does not allow display. In the case of authentication level B, for the function of "audio output", the audio output of the speaker 37 is permitted up to 5.1ch output. In the case of authentication level B, for the "data transfer" function, the use of USB3.0 is permitted as a communication standard used for data transfer via the connector 33. In the case of authentication level B, for the function of "in-vehicle LAN access", some connections to the in-vehicle LAN 32 are permitted. As an example, control of the air conditioner unit 38 via the in-vehicle LAN 32 is permitted. The control of the air conditioner unit 38 may be configured to allow control by voice recognition. When controlling the air conditioner unit 38, the air conditioner unit 38 may be controlled via a control microcomputer for controlling the air conditioner unit 38.

In the case of the highest authentication level A, the "display" function is permitted to be displayed on all of the meters MID34, CID35, and HUD device 36. In addition, when the vehicle is running, it is not subject to driving compulsion that does not allow display. In the case of authentication level A, for the function of "audio output", the audio output of the speaker 37 is permitted up to 5.1ch output. In the case of authentication level A, for the "data transfer" function, the use of USB 2.0 and a video line is permitted as a communication standard used for data transfer via the connector 33. In the case of authentication level A, for the function of "in-vehicle LAN access", the connection to the in-vehicle LAN 32 is fully permitted. As an example, not only the control of the air conditioner unit 38 via the in-vehicle LAN 32 but also the acquisition of information from the in-vehicle LAN 32, the opening / closing control of the sunroof, and the like are permitted.

As described above, the function limiting unit 304 changes the communication standard that can be used when connecting the integrated ECU 30 and the additional ECU 39 according to the authentication level acquired by the result acquisition unit 303. For example, as the authentication level increases, the communication standard is changed so as to increase the capacity of data transfer per unit time. According to this, it is possible to change the available communication standard according to the product grade of the additional ECU 39. Therefore, for example, as the product grade of the additional ECU 39 increases, the communication standard can be changed so as to increase the capacity for data transfer per unit time.

As described above, the function limiting unit 304 permits the connection to the in-vehicle LAN 32 as the authentication level acquired by the result acquisition unit 303 increases. According to this, it becomes possible to allow the connection to the in-vehicle LAN 32 as the product grade of the additional ECU 39 increases.

As described above, the function limiting unit 304 increases the number of displays (that is, display devices) capable of displaying information as the authentication level acquired by the result acquisition unit 303 increases. According to this, it becomes possible to increase the number of displays capable of displaying information as the product grade of the additional ECU 39 increases.

As described above, the function limiting unit 304 increases the number of speakers 37 that can be used to output the voice as the authentication level acquired by the result acquisition unit 303 increases. According to this, it becomes possible to increase the number of speakers 37 that can be used to output audio as the product grade of the additional ECU 39 increases.

As described above, by changing the permitted functions for each product grade of the additional ECU 39, it is possible to set a plurality of grades of the additional ECU 39 that meet the price range required by the customer.

Further, the terminal ID acquisition unit 301 acquires an authentication level that is not disallowed by the result acquisition unit 303, and even after the connection permission that the connection of the additional ECU 39 to the integrated ECU 30 is permitted, each time a predetermined trigger is detected, the terminal ID acquisition unit 301 acquires the authentication level. The terminal ID is acquired from the additional ECU 39 connected to the integrated ECU 30 corresponding to the own device. The predetermined trigger may be, for example, the activation of the vehicle. The start-up of the vehicle may be detected based on, for example, that the IG power is turned on.

When the result acquisition unit 303 acquires an authentication level that is not a connection disapproval in response to the authentication request transmitted from the transmission processing unit 302, the storage unit 305 transmits the authentication level when the transmission processing unit 302 acquires the authentication level. Save the terminal ID included in the authentication request. A non-volatile memory may be used as the storage unit 305. The storage unit 305 may be configured to store the terminal ID and the authentication level acquired by the result acquisition unit 303 in association with each other.

After the connection permission described above, the function limiting unit 304 integrates when the terminal ID acquired by the terminal ID acquisition unit 301 for each detection of a predetermined trigger matches the terminal ID stored in the storage unit 305. Maintain permission to connect the additional ECU 39 to the ECU 30. On the other hand, if the terminal ID acquired by the terminal ID acquisition unit 301 does not match the terminal ID stored in the storage unit 305, the connection of the additional ECU 39 to the integrated ECU 30 is not permitted. When the connection is not permitted, the function limiting unit 304 may cut off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30. That is, after the connection permission described above, the terminal ID is authenticated by the integrated ECU 30 instead of the server 2.

According to this, once the terminal ID authentication is established in the server 2, the terminal ID is authenticated by the integrated ECU 30. Therefore, it is possible to reduce the processing load on the server 2 and the communication load with the server 2 as compared with the configuration in which the terminal ID is authenticated by the server 2 every time a predetermined trigger is detected.

In the case of a configuration in which the terminal ID and the authentication level are linked and stored in the storage unit 305, in addition to the authentication of the terminal ID, the authentication level is also determined by the integrated ECU 30 for each detection of a predetermined trigger. May be good. In the case of a configuration in which the terminal ID and the authentication level are not stored in the storage unit 305 in association with each other, the integrated ECU 30 authenticates the terminal ID every time a predetermined trigger is detected, and the authentication level is also maintained when the authentication is established. It may be configured.

Further, when the transmission processing unit 302 releases the connection of the additional ECU 39 to the integrated ECU 30 (hereinafter, when the connection is released), the transmission processing unit 302 transmits the release request to the server 2 via the communication module 31. The transmission processing unit 302 may determine that the connection is being disconnected, for example, by detecting that an input for disconnecting the connection has been made by a dealer or the like in a regular procedure.

The result acquisition unit 303 acquires the released response returned from the server 2 in response to the release request transmitted from the transmission processing unit 302. When the result acquisition unit 303 acquires the canceled response and the terminal ID is stored in the storage unit 305, the terminal ID stored in the storage unit 305 is deleted. Just do it. When the terminal ID and the authentication level are linked and stored in the storage unit 305, this authentication level may be deleted from the storage unit 305 in addition to the terminal ID. Further, when the result acquisition unit 303 acquires the released response, the function limiting unit 304 may cut off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30.

<Authentication-related processing at the time of connection in vehicle system 1>
Subsequently, an example of the flow of the process related to the authentication at the time of connecting the additional ECU 39 to the integrated ECU 30 in the vehicle system 1 (hereinafter, the authentication-related process at the time of connection) will be described with reference to the sequence diagram of FIG. .. In the example of FIG. 6, the case where the terminal ID authentication is established will be described as an example. The process of FIG. 6 may be started when the terminal ID acquisition unit 301 detects that the additional ECU 39 is connected to the connector 33. At the stage of temporary connection until the connection is permitted by the integrated ECU 30, data transfer between the integrated ECU 30 and the additional ECU 39 may be performed according to a predetermined communication standard such as USB 2.0. Executing the steps included in the connection-time authentication-related process by the computer corresponds to executing the vehicle control method.

First, at t1, the terminal ID acquisition unit 301 of the integrated ECU 30 requests the terminal ID from the additional ECU 39 via the connector 33. At t2, the additional ECU 39 that has received the request for the terminal ID transmits the terminal ID of its own device to the integrated ECU 30 via the connector 33. As a result, the terminal ID acquisition unit 301 acquires the terminal ID from the additional ECU 39.

At t3, the transmission processing unit 302 of the integrated ECU 30 causes the server 2 to transmit the authentication request via the communication module 31. At t4, the authentication level determination unit 22 of the server 2 performs authentication and determination of the authentication level using the terminal ID included in the authentication request. At t5, the response unit 24 of the server 2 responds the authentication level to the integrated ECU 30 via the communication module 31. In the integrated ECU 30, the result acquisition unit 303 acquires the authentication level returned from the server 2.

At t6, the function limiting unit 304 of the integrated ECU 30 permits the additional ECU 39 to function according to the authentication level acquired by the result acquisition unit 303. At t7, the terminal ID acquisition unit 301 stores the terminal ID acquired at t2 in the storage unit 305. In the sequence diagram of FIG. 6, an example of the case where the terminal ID authentication is established is shown, but when the terminal ID authentication is not established at t4, the connection of the additional ECU 39 to the integrated ECU 30 is permitted at t6. End the process without doing. In this case, the function limiting unit 304 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30.

At t8, the terminal ID acquisition unit 301 detects a trigger such as turning on the IG power supply. At t9, the terminal ID acquisition unit 301 requests the terminal ID from the additional ECU 39 via the connector 33. At t10, the additional ECU 39 that has received the request for the terminal ID transmits the terminal ID of its own device to the integrated ECU 30 via the connector 33. As a result, the terminal ID acquisition unit 301 acquires the terminal ID from the additional ECU 39.

At t11, for example, the function limiting unit 304 of the integrated ECU 30 authenticates the terminal ID depending on whether or not the terminal ID acquired in t10 is stored in the storage unit 305. At t12, when the terminal ID authentication is established, the function limiting unit 304 maintains the connection between the integrated ECU 30 and the additional ECU 39. When the terminal ID authentication is established, the function limiting unit 304 may also maintain the authentication level. After that, every time a trigger is detected, the processes of t8 to t12 are repeated.

In the sequence diagram of FIG. 6, an example of the case where the terminal ID authentication is established is shown, but when the terminal ID authentication is not established at t11, the connection of the additional ECU 39 to the integrated ECU 30 is permitted at t12. The process may be terminated without doing so. A situation in which the terminal ID authentication is not established at t11 is a case where the additional ECU 39 is illegally replaced when the IG power of the vehicle is turned off.

<Processing related to disconnection in vehicle system 1>
Subsequently, an example of the flow of the process related to the disconnection between the integrated ECU 30 and the ECU 39 in the vehicle system 1 (hereinafter, the connection disconnection related process) will be described with reference to the sequence diagram of FIG. The process of FIG. 7 may be started when, for example, the integrated ECU 30 detects that an input for disconnecting the connection has been made by a dealer or the like in a regular procedure.

First, at t21, the transmission processing unit 302 of the integrated ECU 30 causes the server 2 to transmit the release request via the communication module 31. In t22, the release processing unit 23 of the server 2 uses the vehicle side ID included in the release request, and among the registration correspondence relationships stored in the registration unit 20, the registration correspondence relationship including this vehicle side ID. Release it.

At t23, the response unit 24 of the server 2 responds to the integrated ECU 30 via the communication module 31 that the release has been completed. In the integrated ECU 30, the result acquisition unit 303 acquires the canceled notification returned from the server 2. At t24, the function limiting unit 304 of the integrated ECU 30 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30. At this time, the integrated ECU 30 may display on the above-mentioned display a display indicating that the registration correspondence relationship between the integrated ECU 30 and the additional ECU 39 on the server 2 has been canceled.

<Summary of Embodiment 1>
According to the configuration of the first embodiment, the terminal ID for identifying each of the additional ECUs 39 connected to the integrated ECU 30 is acquired, and the additional ECU 39 is assigned according to the authentication level of the additional ECU 39 determined from the acquired terminal ID. Since the permitted function is changed, it is possible to change the permitted function for each product grade of the additional ECU 39. Further, this terminal ID is acquired when an additional ECU 39 is newly connected and added to the integrated ECU 30 in order to update the software used for control. Therefore, when compensating for the insufficient performance of the vehicle control device installed in the vehicle for software update by connecting the control device later, the permitted functions should be changed according to the product grade of the control device. Becomes possible.

Further, according to the configuration of the first embodiment, the server 2 for storing the registration correspondence used for the authentication of the terminal ID and the determination of the authentication level is shared by the plurality of integrated ECUs 30, so that the security can be further enhanced. Becomes possible. The details are as follows. When the additional ECU 39 associated with the integrated ECU 30 mounted on a certain vehicle (hereinafter, the first vehicle) is stolen and an attempt is made to connect to the integrated ECU 30 mounted on another vehicle (hereinafter, the second vehicle). However, since the registration correspondence relationship is already stored in the server 2, the additional ECU 39 cannot be connected to other than the integrated ECU 30 associated with the registration correspondence relationship.

The function permitted by the function limiting unit 304 is not limited to the function described in the first embodiment. For example, it may be a part of the function described in the first embodiment or may be another function. Further, the in-vehicle device that can be controlled by the function limiting unit 304 is not limited to the in-vehicle device described in the first embodiment. For example, it may be a part of the in-vehicle device described in the first embodiment, or may be another in-vehicle device.

(Embodiment 2)
In the first embodiment, the connection between the integrated ECU 30 and the additional ECU 39 is a wired connection via the connector 33, but the connection is not necessarily limited to this. For example, the connection between the integrated ECU 30 and the additional ECU 39 may be a connection by wireless communication. In this case, the connection between the integrated ECU 30 and the additional ECU 39 may be by short-range wireless communication. The additional ECU 39 may be configured to be used in a vehicle. Further, when the communication standard is changed according to the authentication level, the communication standard that can be used for this short-range wireless communication may be changed. In this case, for example, the communication standard may be changed so as to increase the data transferable capacity per unit time as the authentication level increases.

(Embodiment 3)
In the first embodiment, the configuration in which the server 2 is included in the vehicle system 1 is shown, but the present invention is not necessarily limited to this. For example, the vehicle system 1 may not include the server 2. In this case, the integrated ECU 30 may include a functional block having the same functions as the registration unit 20, the authentication level determination unit 22, and the release processing unit 23, while omitting the transmission processing unit 302 and the result acquisition unit 303. .. Then, the integrated ECU 30 may be configured to authenticate the terminal ID and determine the authentication level. Further, in this case, the registration unit 20 may be provided instead of the storage unit 305.

The present disclosure is not limited to the above-described embodiment, and various modifications can be made within the scope of the claims, and can be obtained by appropriately combining the technical means disclosed in the different embodiments. Embodiments are also included in the technical scope of the present disclosure. Further, the control unit and the method thereof described in the present disclosure may be realized by a dedicated computer constituting a processor programmed to execute one or a plurality of functions embodied by a computer program. Alternatively, the apparatus and method thereof described in the present disclosure may be realized by a dedicated hardware logic circuit. Alternatively, the apparatus and method thereof described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor that executes a computer program and one or more hardware logic circuits. Further, the computer program may be stored in a computer-readable non-transitional tangible recording medium as an instruction executed by the computer.

1 Vehicle display system, 2 server, 3 vehicle side unit, 20 registration unit, 21 information acquisition unit, 22 authentication level determination unit, 23 release processing unit, 24 response unit, 30 integrated ECU (vehicle control device), 31 communication Module, 32 in-vehicle LAN (in-vehicle network), 33 connector, 34 meter MID (in-vehicle device), 35 CID (in-vehicle device), 36 HUD device (in-vehicle device), 37 speaker (in-vehicle device), 38 air conditioner unit (in-vehicle device) , 39 additional ECU (connection control device), 301 terminal ID acquisition unit (terminal identification information acquisition unit), 302 transmission processing unit, 303 result acquisition unit, 304 function restriction unit, 305 storage unit

Claims (12)

It is a vehicle control device that can be mounted on a vehicle and can control a plurality of in-vehicle devices (34, 35, 36, 37, 38).
When a control device is newly connected and added to the vehicle control device for updating software used for the control, terminal identification information for identifying each of the control devices is provided for the vehicle control. The terminal identification information acquisition unit (301) acquired from the connection control device (39), which is the control device connected to the device, and
From the terminal identification information acquired by the terminal identification information acquisition unit, the connection is determined based on a correspondence relationship in which the authentication level, which is the level of the function permitted to the control device, and the terminal identification information are associated in advance. A vehicle control device including a function limiting unit (304) that changes a function permitted to the connection control device according to the authentication level of the control device. The vehicle control device according to claim 1, wherein the connection control device added by being connected to the vehicle control device is not used by the connection control device alone. A transmission processing unit (302) that causes the terminal identification information acquired by the terminal identification information acquisition unit to be transmitted to a server (2) outside the vehicle that stores the correspondence.
A result acquisition unit (303) for acquiring the authentication level of the connection control device determined by the server based on the correspondence relationship from the terminal identification information transmitted by the transmission processing unit is provided.
The vehicle control device according to claim 1 or 2, wherein the function limiting unit changes the function permitted to the connection control device according to the authentication level acquired by the result acquisition unit. In addition to the authentication level and the terminal identification information, the correspondence relationship also includes vehicle-side identification information for identifying each vehicle control device in advance.
The authentication level also includes a connection disapproval authentication level that does not allow connection to the vehicle control device.
In addition to the terminal identification information, the transmission processing unit causes the server to transmit the vehicle-side identification information of the vehicle control device, which is its own device.
The result acquisition unit acquires the authentication level of the connection disapproval when the terminal identification information transmitted by the transmission processing unit and the vehicle side identification information are not associated with each other in the correspondence relationship. On the other hand, when the terminal identification information transmitted by the transmission processing unit and the vehicle side identification information are associated with each other in the corresponding relationship, the level is higher than the authentication level of the connection disapproval. Obtain the authentication level that is not permission to connect,
When the authentication level acquired by the result acquisition unit is the authentication level at which connection is not permitted, the function restriction unit does not allow connection to the vehicle control device, while the result acquisition unit acquires it. 3. If the authentication level is not the connection disapproval, the connection to the vehicle control device is permitted, and the connection control device is permitted to perform a function according to the authentication level. The vehicle control device according to. The server is shared by a plurality of the vehicle control devices, and is shared by the plurality of vehicle control devices.
In the correspondence relationship, the authentication level, the terminal identification information, and the vehicle side identification information are associated in advance with respect to the plurality of vehicle control devices.
In the result acquisition unit, the terminal identification information transmitted by the transmission processing unit is associated with the vehicle side identification information different from the vehicle side identification information transmitted by the transmission processing unit in the corresponding relationship. In this case, the vehicle control device according to claim 4, wherein the authentication level of the connection disapproval is acquired. The terminal identification information acquisition unit acquires the authentication level that is not the connection disapproval by the result acquisition unit, and even after the connection permission that the connection to the vehicle control device is permitted, every detection of a predetermined trigger , The terminal identification information is acquired from the connection control device connected to the vehicle control device corresponding to the own device.
When the result acquisition unit acquires the authentication level that is not the connection disapproval, the storage unit (305) that stores the terminal identification information transmitted by the transmission processing unit when acquiring the authentication level is provided. Prepare,
After the connection permission, the function limiting unit controls the vehicle when the terminal identification information acquired by the terminal identification information acquisition unit matches the terminal identification information stored in the storage unit. While maintaining the permission to connect to the device, when the terminal identification information acquired by the terminal identification information acquisition unit does not match the terminal identification information stored in the storage unit, the vehicle control device is reached. The vehicle control device according to claim 4 or 5, wherein the connection is not permitted. The communication standard that can be used when connecting the vehicle control device and the connection control device can be changed.
Claim 1 changes the communication standard that can be used when connecting the vehicle control device and the connection control device according to the authentication level determined based on the correspondence relationship. 6. The vehicle control device according to any one of 6. The plurality of in-vehicle devices include at least one of the in-vehicle device connected to the vehicle control device via the in-vehicle network of the vehicle and the in-vehicle device using data obtained via the in-vehicle network. And
The vehicle according to any one of claims 1 to 7, wherein the function limiting unit permits connection to the in-vehicle network as the authentication level determined based on the correspondence becomes higher. Control device for. The plurality of in-vehicle devices include a plurality of types of display devices.
The function limiting unit is described in any one of claims 1 to 8, wherein the number of display devices capable of displaying information increases as the authentication level determined based on the correspondence becomes higher. Vehicle control device. The plurality of in-vehicle devices include a plurality of audio output devices that output audio.
Any of claims 1 to 9, wherein the function limiting unit increases the voice output device that can be used to output voice as the authentication level determined based on the correspondence becomes higher. The vehicle control device according to item 1. The vehicle control device (30) according to any one of claims 1 to 10, which is mounted on a vehicle and capable of controlling a plurality of in-vehicle devices (34, 35, 36, 37, 38). ,
A vehicle system including a connection control device (39), which is a control device newly connected and added for updating software used for the control, to the vehicle control device. A control device (30) for a vehicle, which is mounted on a vehicle and capable of controlling a plurality of in-vehicle devices (34, 35, 36, 37, 38), is provided with a control device for updating software used for the control. It is a vehicle control method implemented by a computer when a new connection is made and added.
The terminal identification information for identifying each of the control devices is acquired from the connection control device (39), which is the control device connected to the vehicle control device.
From the acquired terminal identification information, the authentication level of the connection control device is determined based on the correspondence between the authentication level, which is the level of the function permitted to the control device, and the terminal identification information in advance. A vehicle control method including a step of changing a function permitted to the connection control device accordingly.

Images