JP6080904B2 - Vehicle control system, reception control device, and vehicle control device - Google Patents

Description

  The present invention relates to a vehicle control system, a reception control device, and a vehicle control device that change control parameters of a vehicle control device.

In the field of automobiles, it has been proposed that control parameters (hereinafter simply referred to as parameters) of control devices in a vehicle can be changed even after the vehicle is shipped in accordance with the user's hobbies and preferences and the surrounding environment of the vehicle. ing.
For example, in a steering control device, Patent Literature 1 discloses a technique for changing parameters according to a vehicle.
In this patent document 1, parameters suitable for individual vehicles are transmitted by transmitting, to a radio base station, a vehicle identification code for identifying a vehicle and a vehicle control device identification code for identifying a control device mounted on the vehicle. It is described that the parameter can be changed by receiving.

JP 2002-144983 A (pages 4-6, FIG. 1)

However, the prior art described in Patent Document 1 has the following three problems.
(1) If the parameter is changed, such as when the load is high or the control state is abnormal, the operation of the steering control device or the engine control device may become unstable. For this reason, before applying a parameter, it is necessary to confirm whether a parameter is really applicable.
Generally, high functional safety standards are applied to devices that control a steering, an engine, and the like. Although the parameters of these control devices are changed by the control of the reception control device, if the reception control device is configured to determine whether or not the above-described parameters can be applied, the reception control device also has a high functional safety standard. It is necessary and causes development difficulties.

(2) When updating the parameters of the control devices that depend on the running state, such as the engine control device and the brake control device, it is necessary to ensure that the parameters are applied simultaneously.
If this is configured to be controlled by the reception control device, it is necessary to have a high functional safety standard, which causes development difficulty.

(3) By transmitting the parameter, the parameter may be leaked to an attacker against the in-vehicle network. Since the parameters used for the control are the intellectual property of the automobile manufacturer, it is necessary to have a configuration that avoids leakage as much as possible.

  The present invention has been made in order to solve the above-described problems. Even if a high functional safety standard is not applied to the reception control device that controls the parameter change of the vehicle control device, the higher functional safety standard is achieved. An object of the present invention is to obtain a vehicle control system, a reception control device, and a vehicle control device that can change parameters of the vehicle control device.

In the vehicle control system according to the present invention, a vehicle control device that is mounted on the vehicle and controls the vehicle based on the control parameter, and parameter change information including the control parameter that is mounted on the vehicle and distributed from the parameter distribution server. A reception control device that receives and distributes the control parameter of the received parameter change information to the vehicle control device, and the reception control device temporarily stores the parameter change information distributed from the parameter distribution server; Means, a parameter change notifying means for notifying the vehicle control device of the change of the control parameter based on the parameter distribution rule included in the parameter change information stored by the parameter change information storing means, and the parameter change notifying means. Control parameter notified of change And a parameter distributing means for distributing over data to the vehicle control device, the vehicle control device based on the control state of the vehicle control device determines updatability determine updatability control parameter delivered from the reception control unit And a parameter application unit that applies the control parameter determined to be updatable by the updatable / unupdating unit to the control.

According to the present invention, the vehicle control device that is mounted on the vehicle and controls the vehicle based on the control parameter, and the parameter change information that is mounted on the vehicle and that includes the control parameter distributed from the parameter distribution server is received. A reception control device that distributes the control parameter of the received parameter change information to the vehicle control device; the reception control device includes parameter change information storage means for temporarily storing the parameter change information distributed from the parameter distribution server; and Based on the parameter distribution rule included in the parameter change information saved by the parameter change information saving means, the parameter change notifying means for notifying the vehicle control device of the change of the control parameter, and the change notice is notified by the parameter change notifying means. Distributed control parameters to vehicle control equipment That has a parameter distribution means, vehicle control apparatus, the basis of the control state of the vehicle control device, and determines the update determination means updatability control parameter delivered from the reception control unit, the update determination unit Since the vehicle control device determines whether or not the control parameter can be updated, the functional safety standard of the reception control device can be lowered.

BRIEF DESCRIPTION OF THE DRAWINGS It is a block diagram which shows the parameter change system by Embodiment 1 of this invention. It is a block diagram which shows the vehicle control apparatus by Embodiment 1 of this invention. It is a figure which shows the parameter change information of the parameter change system by Embodiment 1 of this invention. It is a figure which shows the parameter table of the parameter change system by Embodiment 1 of this invention. It is a flowchart which shows the operation | movement which receives the parameter change information of the parameter change system by Embodiment 1 of this invention. It is a flowchart which shows the operation | movement which performs transmission determination of the parameter change notification of the parameter change system by Embodiment 1 of this invention. It is a figure which shows the parameter message of the difference format of the parameter change system by Embodiment 1 of this invention. It is a block diagram which shows the vehicle control apparatus in the case of using the parameter message of the difference format of the parameter change system by Embodiment 1 of this invention. It is explanatory drawing which shows the operation | movement at the time of updating the parameter of the single vehicle control apparatus of the parameter change system by Embodiment 1 of this invention. It is a block diagram which shows the vehicle control apparatus by Embodiment 2 of this invention. It is explanatory drawing which shows the operation | movement at the time of updating the parameter of the several vehicle control apparatus of the parameter change system by Embodiment 2 of this invention.

Embodiment 1 FIG.
Hereinafter, the configuration of a typical vehicle control system targeted by the present invention will be described with reference to FIG.
FIG. 1 is a block diagram showing a parameter changing system according to Embodiment 1 of the present invention.
In FIG. 1, the vehicle control system includes a parameter distribution server 10 that distributes parameters, the Internet 20 that is a distribution route, and a vehicle 30 that receives the parameters.
The parameter distribution server 10 distributes predetermined parameters to the vehicle 30. Typically, it exists in a data center on a cloud network, but it does not prevent the automaker from configuring it independently, configuring it at each dealership, or configuring a third party unrelated to the automaker. Absent.
The Internet 20 used as a distribution route is shown as an example, and does not hinder the use of a dedicated wireless network, VPN (virtual private network), or the like.

The vehicle 30 has the following devices.
The modem device 40 is a device that receives parameter change information 80 (see FIG. 3) distributed by the parameter distribution server 10 via the Internet 20. Here, the physical distribution means is not limited, but, for example, an LTE network, a 3G network, a Wi-Fi spot network, or the like can be used.
The reception control device 50 is a device for extracting the parameter 804 (see FIG. 4) to be applied from the parameter change information 80 received by the modem device 40 and distributing it to each vehicle control device 60.
The vehicle control device 60 is a device for controlling vehicles arranged at various locations in the vehicle, such as the engine control device 60a, the steering control device 60b, and the brake control device 60c. Since the present invention can be used without affecting the functionality unique to each control device, these will be collectively treated as the vehicle control device 60 in the future.
The in-vehicle network 70 is a network that is in the vehicle and connects various control devices to each other. The physical means is not limited, but CAN (Controller Area Network), in-vehicle Ethernet (registered trademark), and the like can be used.

Next, the reception control device 50 is configured as follows.
The parameter change information receiving unit 501 temporarily records the parameter change information 80 received by the modem device 40 in the parameter change information storage unit 502.
The parameter change information storage unit 502 temporarily stores the parameter change information 80.
The parameter change notification unit 503 notifies the vehicle control device 60 that the parameter 804 should be changed in accordance with the rules described in the parameter change information 80.
The parameter distribution unit 504 extracts the parameter 804 to be applied from the parameter change information 80 and transmits the extracted parameter 804 to the vehicle control device 60.

FIG. 2 is a block diagram showing a vehicle control apparatus according to Embodiment 1 of the present invention.
In FIG. 2, the vehicle control device 60 has the following units.
The update availability determination unit 601 determines whether the parameter of the vehicle control device 60 can be changed at present.
The parameter application unit 602 is a unit that applies the received parameter 804 to various actuators. This application is made through a change in the operation timing of the actuator, but is not limited thereto.
The parameter storage unit 603 is a unit that temporarily stores the received parameter 804 in the vehicle control device 60.

Next, the configuration of the parameter change information 80 will be described with reference to FIG.
FIG. 3 is a diagram showing parameter change information of the parameter change system according to the first embodiment of the present invention.
In FIG. 3, the parameter change information 80 includes a parameter distribution rule 801, a parameter table 802, and a deletion rule 803.
The parameter distribution rule 801 is a rule for determining which parameter on the parameter table 802 is to be distributed to the vehicle control device 60 at which timing.
The parameter table 802 is a table that is temporarily stored in the parameter change information storage unit 502 and includes one or more parameters 804 that can be specified by the parameter distribution rule 801. The parameter 804 in the table is a parameter distribution rule 801. Is transmitted to the vehicle control device 60.
The deletion rule 803 is a rule for determining when to delete the parameter change information 80 from the parameter change information storage unit 502.

FIG. 4 is a diagram showing a parameter table of the parameter changing system according to the first embodiment of the present invention.
In FIG. 4, a parameter 804 is a parameter for controlling an actuator, a sensor, or the like controlled by the vehicle control device 60. Examples include parameters that determine spark plug ignition timing, headlight light quantity, steering "weight", and the like, but are not limited thereto.
For example, the parameter table 802 shown in FIG. 4 describes parameters 804a to 804c named “mountain road”, “highway”, and “general road”. The parameter 804 may be a single numerical value or a combination of a plurality of numerical values as long as it is a parameter that changes the control of the vehicle control device 60. In the parameter table 802 shown as an example in FIG. 4, parameters to be applied to each of the four types of engine speeds are described.

FIG. 7 is a diagram showing a difference format parameter message of the parameter changing system according to the first embodiment of the present invention.
FIG. 7A is a diagram showing parameters to be applied, FIG. 7B is a diagram showing parameters in the vehicle control device, and FIG. 7C is a diagram showing a parameter message in a differential format to be transmitted.
The difference between FIG. 7 (a) and FIG. 7 (b) is the parameter value of parameter number 2. In FIG. 7 (c), this difference is parameter difference + 1. The parameter digest in FIG. 7C describes a message digest of parameters that are assumed when a differential message is generated. This message digest is used for parameter verification. As a message digest calculation method, for example, a hash function such as SHA-256 (Secure Hash Algorithm) is used.

FIG. 8 is a configuration diagram showing a vehicle control device when using a parameter message in a differential format of the parameter changing system according to the first embodiment of the present invention.
In FIG. 8, reference numerals 60 and 601 to 603 are the same as those in FIG. In FIG. 8, a difference verification unit 604 is provided in the vehicle control device 60, and the difference verification unit 604 verifies whether the parameter message is a valid parameter message before applying the parameter 804 when the parameter message is in the difference format.

Next, an operation until the reception control device 50 distributes the parameter 804 to the vehicle control device 60 will be described.
Step 1: Reception of Parameter Change Information First, the operation in which the reception control device 50 receives parameter change information will be described with reference to FIG.
The reception control device 50 receives the parameter change information 80 from the parameter distribution server 10 (S101).
The parameter change information 80 may be dynamically generated or sent to the reception control device 50 at any timing.
In the case of dynamic generation, the current position, the current vehicle speed, the current control state, the current passenger number, and the vehicle control device acquired in advance from the reception control device 50 by VIN (vehicle identification number), GPS, or the like. The request information by 60 is transmitted to the parameter distribution server 10 periodically or at any time. The parameter distribution server 10 dynamically generates parameter change information 80 based on the transmitted information and transmits the parameter change information 80 to the reception control device 50.
The distribution timing may be any timing. For example, it may be delivered periodically, such as every 7 days, or it may be sent at an optimal timing based on the transmitted information.
The reception control device 50 temporarily stores the received parameter change information 80 in the parameter change information storage unit 502 (S102).

Step 2: Determination of Transmission of Parameter Change Notification Next, the operation of the reception control device 50 determining transmission of a parameter change notification will be described using FIG.
The parameter change notification unit 503 periodically determines whether or not the parameter change information 80 accumulated in the parameter change information storage unit 502 satisfies the parameter distribution rule 801 (S201).
For example, the parameter delivery rule 801 can be described as follows, but is not limited thereto. That is, for example, “unconditional” “when the vehicle state satisfies a specific condition” “when requested from the vehicle control device” is described.

When “unconditional” is specified (described) in the parameter distribution rule 801 of the parameter change information 80, the reception control device 50 receives the parameter change information 80 and immediately receives the parameter change information 504 by the parameter distribution unit 504. The parameter 804 is distributed to the control device 60.
When “when the vehicle state satisfies a specific condition” is designated, the reception control device 50 periodically determines the vehicle state (including information such as a traveling speed and a brake state that can be acquired in the in-vehicle network). If it is determined and the condition is satisfied, the parameter 804 is distributed.
When “when requested from the vehicle control device” is designated, the parameter 804 is distributed when a specific message is transmitted from the vehicle control device 60 to the reception control device 50. This rule is particularly useful when you want to invalidate previously made parameter changes.
When it is determined in S201 that the parameter 804 should be distributed, the parameter distribution unit 504 distributes the parameter 804 to the vehicle control device 60 (S202).

The parameter change notification unit 503 periodically determines whether or not the parameter change information 80 accumulated in the parameter change information storage unit 502 satisfies the deletion rule 803 (S203).
If it is determined in S203 that the parameter change information 80 should be deleted, the parameter change information 80 is deleted from the parameter change information storage unit 502 (S204).

Step 3: Transmission of Parameter Change Notification and Parameter Application Next, the operation when updating the parameters of a single vehicle control device 60 will be described using FIG.
When the parameter change notification unit 503 of the reception control device 50 determines that the parameter change should be notified, the notification message m101 is delivered to the vehicle control device 60 (S301).
The vehicle control device 60 determines whether or not the parameter can be changed at that time by using the update availability determination means 601, and if applicable, transmits a request message m102 to the reception control device 50 (S302).
When receiving the request message m102, the reception control device 50 delivers the parameter message m103 to the vehicle control device 60 (S303).
Upon receiving the parameter message m103, the vehicle control device 60 temporarily stores the parameter 804 in the parameter storage unit 603, and controls the various actuators using the parameter 804 by the parameter application unit 602 (S304).

In S301, the notification message m101 and the parameter message m103 may be transmitted simultaneously. In this case, if it is not determined in S302 that the parameter can be changed, the parameter message m103 may be simply discarded. In this case, the operations in S303 and S304 can be omitted.
In S304, the parameter message m103 may be in a differential format as shown in FIG. 7. In this case, whether or not the parameter message m103 is a valid parameter message m103 by the difference verification unit 604 before applying the parameter in S304. To verify.

The parameter digest included in the parameter message shown in FIG. 7 (c) describes the message digest of the parameters assumed when generating the message in the differential format. The message digest calculation method includes, for example, There is a method using a hash function such as SHA-256.
When a parameter (for example, a parameter at the time of previous transmission, which can be regarded as a parameter in the vehicle control device) assumed in the difference format message and a parameter actually included in the vehicle control device 60 are different, If the differential message is applied as it is, it may fall into a dangerous situation. By reducing the parameter digest described in the differential format message and the message digest calculated from the parameters actually included in the vehicle control device 60, the risk of accidentally applying the differential message is reduced. Can do.

According to the first embodiment, whether or not the parameter 804 is actually applied depends on the determination of the vehicle control device 60, and therefore the functional safety standard of the reception control device 50 can be lowered.
Further, by determining the parameter distribution rule 801 by the reception control device 50, it is not necessary for the vehicle control device 60 to determine various conditions that do not directly affect safety.
Also, by distributing the parameters in the differential format, all the parameters do not flow through the in-vehicle network, which can contribute to the protection of the intellectual property rights of the automobile manufacturer.

Embodiment 2. FIG.
FIG. 10 is a block diagram showing a vehicle control apparatus according to Embodiment 2 of the present invention.
10, 60 and 601 to 604 are the same as those in FIG. In FIG. 10, a synchronization message transmission / reception means 605 is provided in the vehicle control device 60. The synchronization message transmission / reception means 605 transmits / receives synchronization messages m206, m207, m208, and m209, which will be described later, when parameters of a plurality of vehicle control devices are changed synchronously.

  In the second embodiment, the reception control device 50 transmits a parameter message to different vehicle control devices 61 and 62. The configuration of the vehicle control devices 61 and 62 may be the same as that of the vehicle control device 60.

Regarding the operation of the second embodiment, since the operations of step 1 and step 2 are the same as those of the first embodiment, the operation of step 3 will be described.
Step 3 ′: Transmission of Parameter Change Notification and Parameter Application The operation when updating the parameters of the plurality of vehicle control devices 61 and 62 in synchronization with each other will be described with reference to FIG.
When the parameter change notification unit 503 determines that the parameter change should be notified, the notification message m201 is distributed to the vehicle control device 61 and the vehicle control device 62 (S401).
The vehicle control device 61 uses the update availability determination means 601 to determine whether the parameter can be changed at that time. If the parameter is applicable, the vehicle control device 61 transmits a request message m202 to the reception control device 50 ( S402).
The vehicle control device 62 determines whether or not the parameter can be changed at that time using the update availability determination means 601, and transmits the request message m203 to the reception control device 50 if it is applicable ( S403).
When receiving the request messages m202 and m203, the reception control device 50 distributes the parameter message m204 to the vehicle control device 61 and the vehicle control device 62 (S404).

Upon receiving the parameter message m204, the vehicle control device 61 temporarily stores the parameter in the parameter storage unit 603, and transmits the synchronization message m206 to the vehicle control device 62 using the synchronization message transmission / reception unit 605 (S405).
The synchronization message m206 describes a message digest calculated from the parameter message m204.
Similarly, when receiving the parameter message m204, the vehicle control device 62 temporarily stores the parameter in the parameter storage unit 603, and transmits the synchronization message m207 to the vehicle control device 61 using the synchronization message transmission / reception unit 605 ( S406).
Similarly, the message digest calculated from the parameter message m204 is also described in the synchronization message m207.

When the synchronization message transmission / reception means 605 of the vehicle control device 61 receives the synchronization message m207, the synchronization message transmission / reception means 605 determines whether or not the message digest described in the message is valid. It transmits to the vehicle control apparatus 62 (S407). This message also describes the message digest calculated from the parameter message m204.
When the synchronization message transmission / reception means 605 of the vehicle control device 62 receives the synchronization message m206, the synchronization message transmission / reception means 605 determines whether or not the message digest described in the message is valid. The data is transmitted to the device 61 (S408). This message also describes the message digest calculated from the parameter message m204.

Steps S405 to S408 are repeated a predetermined number of times (S409).
Here, the specified number of times depends on the height of the functional safety standard expected for each of the vehicle control devices 61 and 62. The more you repeat, the more you can guarantee that there are no contradictions.
After repeating the specified number of times in S409, the parameter application means 602 uses the parameter when the number of transmitted synchronization messages m206 and m208 matches the number of received synchronization messages m207 and m209. Then, various actuators are controlled (S410).
The same applies to the vehicle control device 62, but the relationship between the synchronization messages m206 and m208 and the synchronization messages m207 and m209 is reversed (S411).

According to the second embodiment, a plurality of vehicle control devices to which the parameter is applied can confirm that each other's vehicle control device has determined that the parameter may be applied and that the parameter has been correctly received. The parameter application can be executed without contradiction.
Further, whether or not the plurality of vehicle control devices actually apply the parameter 804 depends on the mutual determination of the vehicle control devices 60, so the reception control device 50 does not need to determine. Therefore, the functional safety standard of the reception control device 50 can be lowered.

In the above-described second embodiment, the case where the reception control device transmits the parameter message to the two vehicle control devices has been described. However, the parameter is simultaneously transmitted to three or more vehicle control devices. The present invention can also be used when applying.
In this case, a synchronization message is sent to all the other vehicle control devices, and when the synchronization message is returned from all the other vehicle control devices, the next synchronization message is transmitted.

  It should be noted that the present invention can be freely combined with each other within the scope of the invention, and each embodiment can be appropriately modified or omitted.

10 parameter distribution server, 20 internet, 30 vehicle, 40 modem device,
50 reception control device, 60 vehicle control device, 61 vehicle control device, 62 vehicle control device,
70 in-car network, 80 parameter change information,
501 parameter change information receiving means, 502 parameter change information storing means,
503 parameter change notification means, 504 parameter distribution means,
601 update availability determination means, 602 parameter application means,
603 parameter storage means, 604 difference verification means,
605 synchronous message transmission / reception means;
801 Parameter distribution rule, 802 parameter table, 803 deletion rule, 804 parameter

Claims (13)

A vehicle control device that is mounted on a vehicle and controls the vehicle based on control parameters;
And a reception control device that is mounted on the vehicle and receives parameter change information including a control parameter distributed from a parameter distribution server, and distributes the control parameter of the received parameter change information to the vehicle control device. ,
The reception control device
Parameter change information storage means for temporarily storing parameter change information distributed from the parameter distribution server;
Based on the parameter distribution rule included in the parameter change information stored by the parameter change information storage means, parameter change notification means for notifying the vehicle control device of the change of the control parameter;
Parameter distribution means for distributing the control parameter notified of the change by the parameter change notification means to the vehicle control device;
The vehicle control device is
Update availability determination means for determining whether the control parameter delivered from the reception control device can be updated based on the control state of the vehicle control device ;
A vehicle control system comprising: parameter applying means for applying the control parameter determined to be updatable by the updatable judgment means to the control.   The update availability determination unit determines whether or not the control parameter can be updated when a change in the control parameter is notified by the parameter change notification unit, and transmits the control parameter to the reception control device when the update is possible. 2. The vehicle control system according to claim 1, wherein the parameter distribution means requests and distributes the control parameter in response to the request.   The vehicle control system according to claim 1, wherein the parameter distribution unit distributes the control parameter to the vehicle control device in synchronization with the notification of the change of the control parameter by the parameter change notification unit. The parameter distribution means distributes the difference between the control parameter and the control parameter distributed last time to the vehicle control device as the control parameter to be distributed,
When the difference between the control parameter and the control parameter distributed last time is distributed as the control parameter distributed from the reception control device, the vehicle control device, based on the control parameter of the vehicle control device, The vehicle control system according to any one of claims 1 to 3, further comprising difference verification means for verifying a control parameter based on the difference. The vehicle is equipped with a plurality of the vehicle control devices ,
Each vehicle control device is
When a control parameter distributed from the reception control device is received, a synchronization message including a check message digest generated from the control parameter is generated and transmitted to another vehicle control device. The vehicle control system according to any one of claims 1 to 4, further comprising synchronization message transmission / reception means for verifying the message digest included in the synchronization message received from the vehicle control device.   Each time the vehicle control device verifies the message digest by the synchronous message transmission / reception means, the vehicle control device retransmits the synchronization message including the message digest newly generated from the control parameter distributed from the reception control device. In addition, when the number of transmitted / received synchronization messages reaches a predetermined number and the number of transmitted synchronization messages is the same as the number of received synchronization messages, the parameter applying unit applies the control parameter to the control. The vehicle control system according to claim 5. A reception control device that is mounted on a vehicle and controls updating of control parameters of the vehicle control device,
Parameter change information storage means for temporarily storing parameter change information including control parameters distributed from the parameter distribution server;
Parameter change notification means for notifying the vehicle control device of a change in the control parameter based on the parameter distribution rule included in the parameter change information stored by the parameter change information storage means;
And parameter distribution means for distributing the control parameter notified of the change by the parameter change notification means to the vehicle control device ,
The reception control device according to claim 1, wherein the parameter distribution rule defines a timing for distributing the control parameter .   The parameter distribution means is notified of the change of the control parameter by the parameter change notification means, waits for the distribution request of the control parameter from the vehicle control apparatus to the change, and distributes the control parameter to the vehicle control apparatus The reception control device according to claim 7.   8. The reception control device according to claim 7, wherein the parameter distribution unit distributes the control parameter to the vehicle control device in synchronization with the notification of the change of the control parameter by the parameter change notification unit. A vehicle control device that is mounted on a vehicle and controls the vehicle based on control parameters,
Update availability determination means for determining whether the control parameters distributed from the parameter distribution server via the reception control device can be updated based on the control state of the vehicle control device ,
A vehicle control device comprising: parameter application means for applying the control parameter determined to be updatable by the updatable judgment means to the control.   When the difference between the control parameter and the control parameter distributed last time is distributed as the control parameter distributed from the reception control device, the control parameter verification based on the difference is performed based on the control parameter of the vehicle control device. The vehicle control apparatus according to claim 10, further comprising difference verification means for performing The control parameter distributed from the reception control device includes a check message digest generated from the control parameter distributed last time,
12. The vehicle according to claim 11, wherein the difference verifying unit verifies the control parameter based on the difference by comparing the message digest with a message digest generated from a control parameter of the vehicle control device. Control device.   When a control parameter distributed from the reception control device is received, a synchronization message including a check message digest generated from the control parameter is generated and transmitted to another vehicle control device. The vehicle control device according to any one of claims 10 to 12, further comprising synchronization message transmission / reception means for verifying the message digest included in the synchronization message received from the vehicle control device.

Images