JP7465147B2 - Vehicle control device, server, verification system - Google Patents

Description

The present invention relates to an on-board control device, a server, and a verification system.

Control applications that realize autonomous driving need to be verified to ensure that they operate correctly with respect to vehicle surroundings data, which is a variety of information about the vehicle's surroundings. Vehicle surroundings data includes information about obstacles around the vehicle and information about features that indicate the characteristics of the roads around the vehicle. Since autonomous vehicles are expected to become more widespread in the future, it is conceivable that verification will be performed using vehicle surroundings data obtained during autonomous driving. However, during autonomous driving, CPU resources are used to process autonomous driving applications, so the CPU resources available for verification are limited. Even with limited CPU resources, it is necessary to efficiently verify applications. Patent Document 1 discloses a program providing device that includes an emulation means for emulating the hardware and software environments of an in-vehicle information system, a program receiving means for receiving a program developed for the in-vehicle information system, a constraint condition storage means for storing the resource and environmental conditions of the in-vehicle information system as constraint conditions, a program execution restriction means for restricting the operation of the program based on the constraint conditions stored in the constraint condition storage means, and a program execution means for executing the program received from the program receiving means using the resources provided by the emulation means in accordance with the restrictions imposed by the program execution restriction means.

JP 2011-146068 A

The invention described in Patent Document 1 leaves room for improvement in the verification of multiple verification application programs.

The in-vehicle control device in a first aspect of the present invention is an in-vehicle control device mounted on a vehicle, and comprises an in-vehicle memory unit that stores a plurality of verification application programs different from a basic application program related to driving control of the vehicle, verification plan information including driving environment conditions that are conditions related to the vehicle for verifying the verification application programs , and verification priorities for pairs of the verification application programs and the driving environment conditions, and the basic application programs, a CPU capable of executing the basic application programs and the verification application programs, and a verification execution control unit that controls the execution of verification of the verification application programs based on the driving environment conditions and the verification priorities, wherein the verification plan information stores the verification priority for each combination of the verification application program and the driving environment conditions, and the verification execution control unit prioritizes verification of verification application programs with higher verification priorities among the verification application programs for which the driving environment conditions are satisfied .
A server in a second aspect of the present invention is a server capable of communicating with a vehicle, and includes a server memory unit that stores a verification application program, which is an application program to be verified in the vehicle, and driving environment conditions, which are conditions related to the vehicle for verifying the verification application program , a verification plan information generation unit that determines a verification priority for a set of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority, and a verification plan information output unit that outputs the verification plan information to the vehicle, wherein the vehicle information includes verification results of the verification application program executed in the vehicle, and the verification plan information generation unit updates verification progress information indicating the progress of verification related to the verification application program based on the verification results of the verification application program, and determines the verification priority for the set of the verification application program and the driving environment conditions based on the verification progress information.
A server in a third aspect of the present invention is a server capable of communicating with a vehicle, and further includes a server memory unit that stores a verification application program, which is an application program to be verified in the vehicle, and driving environment conditions, which are conditions related to the vehicle for verifying the verification application program, a verification plan information generation unit that determines a verification priority for a pair of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority, a verification plan information output unit that outputs the verification plan information to the vehicle, and a driving environment condition establishment prediction unit that predicts, based on the vehicle information , the timing when the driving environment of the vehicle will match the driving environment conditions included in the verification plan information, and the verification plan information generation unit determines the verification priority for the pair of the verification application program and the driving environment conditions based on the predicted timing.
A verification system according to a fourth aspect of the present invention includes an on-board control device mounted on a vehicle and a server capable of communicating with the on-board control device, the server including: a server storage unit that stores a verification application program, which is an application program to be verified in the vehicle, and driving environment conditions, which are conditions related to the vehicle for verifying the verification application program; a verification plan information generation unit that determines a verification priority for a pair of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority; and a verification plan information output unit that outputs the verification plan information to the vehicle, the on-board control device including: a verification plan information acquisition unit that acquires the verification plan information output by the server;
a verification execution control unit that controls the execution of verification of the verification application program based on the driving environment conditions and the verification priority in parallel with a basic application program related to driving control of the vehicle, wherein the vehicle information includes verification results of the verification application program executed in the vehicle, and the verification plan information generation unit updates verification progress information indicating the progress of verification of the verification application program based on the verification results of the verification application program, and determines the verification priority for a pair of the verification application program and the driving environment conditions based on the verification progress information .
A verification system according to a fifth aspect of the present invention includes an on-board control device mounted on a vehicle and a server capable of communicating with the on-board control device, the server including a server storage unit that stores a verification application program, which is an application program to be verified in the vehicle, and driving environment conditions, which are conditions related to the vehicle for verifying the verification application program; a verification plan information generation unit that determines a verification priority for a pair of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority; the vehicle control device comprises a verification plan information output unit that outputs verification plan information to the vehicle, and a driving environment condition establishment prediction unit that predicts, based on the vehicle information, the timing when the vehicle's driving environment will match the driving environment conditions included in the verification plan information; the on-board control device comprises a verification plan information acquisition unit that acquires the verification plan information output by the server, and a verification execution control unit that controls the execution of verification of the verification application program based on the driving environment conditions and the verification priority in parallel with a basic application program related to driving control of the vehicle; and the verification plan information generation unit determines the verification priority for a pair of the verification application program and the driving environment conditions based on the predicted timing .

The present invention allows multiple verification application programs to be verified efficiently.

Verification system block diagram Vehicle Block Diagram Data flow diagram FIG. 1 shows an example of driving environment conditions. A diagram showing an example of verification plan information FIG. 13 is a diagram showing an example of prediction information. Flowchart showing the process of defining a verification execution schedule A diagram showing an example of progress information Flowchart showing verification plan information generation processing

Control applications that realize autonomous driving need to operate correctly with respect to a variety of vehicle surroundings data. To ensure that applications operate normally, verification using vehicle surroundings data as input is required during application development. Methods for preparing vehicle surroundings data for verification include collecting vehicle surroundings data using an actual vehicle, or artificially generating the data using a simulator. Vehicle surroundings data needs to assume a variety of real-world conditions, including pedestrians, vehicles, road conditions, and weather, and it is generally considered difficult to comprehensively simulate such vehicle surroundings data using a simulator alone. For this reason, verification using vehicle surroundings data obtained while the actual vehicle is running is considered essential.

There are two types of verification timing that utilize data collected in an actual vehicle: online verification, which is performed in real time, and offline verification, in which log data is sent to a data center and the application is verified there. A drawback of offline verification is that when sending data used to verify the application to the data center, the amount of data is huge, resulting in a large communication load. Therefore, this invention deals with online verification.

Even in the case of online verification, the verification challenges differ depending on whether the actual vehicle is being driven manually or autonomously. When the vehicle is being driven manually by a human, there are ample surplus CPU resources that can be used for verification. On the other hand, in the case of autonomous driving, CPU resources are used for autonomous driving application processing, so the CPU resources used for verification are smaller than in manual driving. Since autonomous vehicles are expected to become more common in the future, it is necessary to efficiently verify applications even with limited CPU resources, using vehicle surrounding environment data obtained during autonomous driving. In this embodiment, a technology is described that controls the verification schedule for multiple applications under multiple driving environment conditions on an on-board control device.

Below, with reference to the drawings, an embodiment of a verification system consisting of a verification management server that manages verification across a fleet of vehicles and an on-board control device that is a computing device will be described. Note that in this embodiment, as an example of an on-board control device to which the present invention is applied, a device that processes driving assistance or driving control of a vehicle in an advanced driver assistance system (ADAS) or an autonomous driving system is treated, but the present invention is not limited to this and may be other systems.

-First embodiment-
A first embodiment of a verification system will be described below with reference to FIGS.

(System configuration)
Fig. 1 is a block diagram showing an example of the configuration of a verification system 1 according to the present invention. However, for convenience of drawing, the configuration of a vehicle 2 is shown in a simplified manner in Fig. 1, and the details are shown in Fig. 2.

As shown in FIG. 1, the verification system 1 according to this embodiment includes one or more vehicles 2 and a verification management server 10 that manages the verification of in-vehicle applications for the one or more vehicles 2. Each vehicle 2 and the verification management server 10 are connected via a network 3. First, the configuration of the vehicle 2 will be described with reference to FIG. 2.

(Vehicle configuration)
The vehicle 2 has an on-board control device 21 , a wireless communication device 20 , a group of external sensors 22 , a group of vehicle sensors 23 , a group of actuators 24 , and an on-board network 25 .

(Configuration of the on-board control device)
The on-board control device 21 is, for example, an ECU (Electronic Control Unit) mounted on the vehicle 2, and includes a processing unit 220, an on-board storage unit 210, and a communication unit 230. The form of the on-board control device 21 is not particularly limited, and may be, for example, a vehicle position estimation device for estimating the position of the vehicle 2, or a driving control device for realizing an ADAS of the vehicle 2. Furthermore, the on-board control device 21 may be a surrounding object detection processing device that detects surrounding objects from surrounding environment data acquired from an external sensor, or may be an external device such as a smartphone connected to the internal network of the vehicle 2 by a user of the vehicle 2.

The processing unit 220 is configured to include, for example, a CPU (Central Processing Unit) and a RAM (Random Access Memory), and performs processing to realize the functions of the in-vehicle control device 21 by executing a predetermined operating program. The processing unit 220 also includes, as functional blocks, a sensor input unit 221, an actuator output unit 222, a basic application execution control unit 223, a verification application execution control unit 224, a verification plan information acquisition unit 225, a verification result output unit 226, and a driving environment condition establishment prediction unit 227. When a stop command is input from outside to the in-vehicle control device 21, the processing unit 220 outputs a stop command to the sensor input unit 221, the actuator output unit 222, the basic application execution control unit 223, the verification application execution control unit 224, the verification plan information acquisition unit 225, the verification result output unit 226, and the driving environment condition establishment prediction unit 227.

The sensor input unit 221 acquires surrounding environment information related to the surroundings of the vehicle and vehicle sensor information related to the movement of the vehicle from the external sensor group 22 and the vehicle sensor group 23, and stores them as application input/output data groups (not shown) in the in-vehicle storage unit 210. The surrounding environment information is, for example, information on obstacles present around the vehicle and information on features indicating the characteristics of the road around the vehicle. Note that obstacles present around the vehicle are, for example, other vehicles, bicycles, pedestrians, and other moving objects moving around the vehicle, parked vehicles stationary on the road around the vehicle, fallen objects, installed objects, etc. The vehicle sensor information is, for example, the vehicle position, driving speed, steering angle, accelerator operation amount, brake operation amount, etc. The surrounding environment information and vehicle sensor information acquired by the sensor input unit 221 are stored in the in-vehicle storage unit 210 as application input/output data groups.

The actuator output unit 222 acquires control information from a group of application input/output data (not shown) stored in the in-vehicle memory unit 210, and outputs the information to the actuator group 24 connected to the in-vehicle network 25.

The basic application execution control unit 223 executes and controls the basic application program 211 on one or more CPUs on the in-vehicle control device 21 based on the execution schedule of the basic application program 211 stored in the in-vehicle storage unit 210. The basic application program 211 is a program that has been verified and is executed as the main application on the in-vehicle control device. The basic application program 211 differs from the verified application program 212 in that verification has already been completed.

The basic application program 211 is, for example, a vehicle position estimation application for performing position estimation, a driving control application for implementing an advanced driving assistance system, an autonomous driving application for implementing fully autonomous driving, or a surrounding object detection application for detecting surrounding objects from surrounding environment data acquired from an external sensor.

The execution schedule of the basic application program 211 defines the timing of operation start and end, and the operation period when the application is operated sequentially or in parallel. For example, for an application with a period set to 10 ms, the basic application execution control unit 223 executes the application at 10 ms. For example, for an application set for data parallelization, the basic application execution control unit 223 controls the execution of the application on one or more CPUs at a determined timing. Note that the execution schedule of the basic application program 211 is not shown.

The verification application execution control unit 224 executes and controls the verification application program 212 stored in the verification plan information 213 of the in-vehicle storage unit 210 on one or more CPUs on the in-vehicle control device 21. The verification application program 212 is acquired by the verification plan information acquisition unit 225 from the verification management server 10 via the network 3. The verification application program 212 is executed based on the verification execution schedule 219A, which will be described in detail later.

The verification application program 212 may be executed on the same CPU as the basic application program 211, or may be isolated so as to be executed on a different CPU. Also, the verification application program 212 and the basic application program 211 may be executed on the same OS, or may be isolated so as to be executed on different OSs.

A verification priority 215 is set for each of these verification application programs 212, and the in-vehicle control device 21 performs verification according to the verification priority 215. The verification priority 215 is created by the verification management server 10 based on information unknown to the vehicle 2 and the progress of verification in multiple vehicles 2, so that the in-vehicle control device 21 can perform verification efficiently.

The verification plan information acquisition unit 225 acquires verification plan information 213 including a verification application program 212, a verification method definition 214, driving environment conditions 216, and a verification priority 215 from the verification management server 10, and stores the information in the on-board storage unit 210. The verification plan information 213 is represented, for example, in a table format, and has multiple entries. These entries are also referred to as "verification plan entries" below. A verification plan entry is created for each combination of a verification application program 212 and driving environment conditions 216, and each verification plan entry includes a verification method definition 214 and a verification priority 215.

The verification method definition 214 is a definition of the verification method of the verification application program 212. As an example of the verification method definition 214, the output value of the application may be directly defined, or may be defined by comparison with the output value of the basic application program 211. The driving environment conditions 216 are the environmental conditions inside and outside the vehicle under which the verification of the verification application program 212 should be performed.

The verification result output unit 226 obtains the result of the verification related to the verification application program 212 as the verification result 218 from the verification application execution control unit 224, and outputs it to the verification management server 10 together with vehicle information 219 related to the vehicle 2. The verification result 218 includes, for example, verification progress information for each of one or more verification application programs 212. The vehicle information 219 includes information related to the vehicle 2 obtained by the vehicle 2, including the position, speed, steering information, driving track information, and driving route information of the vehicle 2. This vehicle information 219 may be, for example, information output by the verification application program 212 or the basic application program, or information output by the vehicle sensor group 23, the external sensor group 22, or the actuator group 24.

The driving environment condition satisfaction prediction unit 227 predicts in advance the timing when the driving environment condition 216 will be satisfied and the timing when it will no longer be satisfied, and creates driving environment condition prediction information 217 and stores it in the in-vehicle storage unit 210. The driving environment condition satisfaction prediction unit 227 makes predictions, for example, by comparing the vehicle information 219 with the driving environment condition 216.

The on-board storage unit 210 is, for example, a hard disk drive (HDD) or a flash memory. However, it may also be configured to include a read-only memory (ROM). The on-board storage unit 210 stores programs executed by the processing unit 100 to realize its functions, application programs executed periodically, and data groups necessary for the on-board control device 21 to operate. Specifically, the on-board storage unit 210 stores a basic application program 211, a verification application program 212, verification plan information 213, a verification method definition 214, a verification priority 215, driving environment conditions 216, driving environment condition prediction information 217, verification results 218, vehicle information 219, and a verification execution schedule 219A.

The basic application program 211 is a control program for ADAS or autonomous driving. For example, the basic application program 211 is any one of a vehicle position estimation application for performing position estimation, a driving control application for implementing an advanced driving assistance system, an autonomous driving application for implementing fully autonomous driving, and a surrounding object detection application for detecting surrounding objects from surrounding environment data acquired from an external sensor.

The basic application program 211 inputs and outputs a group of application input/output data (not shown). This group of application input/output data is information input to the basic application program 211 and information output from the application. Specifically, the group of application input/output data is surrounding environment information related to the vehicle's surroundings, vehicle sensor information related to the movement of the vehicle, and information processed by the application. A collection of data included in this group of application input/output data that corresponds to a specific target element is called "object data", and data is managed and manipulated using this object data as a unit.

Here, a "target element" is a conceptual object commonly expressed by individual information elements grouped together as object data. Target elements are, for example, the detection target of a sensor, the control target of an actuator, and even the results of computational processing by an application. Preferably, in particular in the case of an external sensor, each recognized environmental element (obstacle, road shape, traffic rules, etc.) corresponds to the target element. That is, in this embodiment, instead of abstracting the hardware itself, which is the external sensor, a method is adopted in which data is abstracted in units of environmental elements that are detection targets. Note that, for internal sensors, object data may be configured based on the concept of the vehicle itself, or object data may be configured for each individual detection target, for example, for a vehicle speed sensor, for each vehicle speed information. Hereinafter, object data will be referred to as data.

The verification application program 212 is a program that requires verification, unlike the basic application program 211. The verification application program 212 is acquired by the verification plan information acquisition unit 225 from the verification management server 10 via the network 3. The execution of the verification application program 212 is scheduled based on the verification plan information 213 acquired by the verification plan information acquisition unit 225.

The verification application program 212 may be executed on the same CPU as the basic application program 211, or may be isolated so as to be executed on a different CPU. The verification application program 212 may be executed on the same OS as the basic application program 211, or may be isolated so as to be executed on a different OS from the basic application program 211.

The verification plan information 213 is data in the data format shown in FIG. 4, which will be described later, and each verification plan entry includes a verification application program 212, a verification method definition 214, a verification priority 215, and driving environment conditions 216.

The verification method definition 214 is a definition of the verification method for an application, defined for each verification plan entry. This definition may be a range of expected normal output values, or may be information that specifies the basic application program 211 that should have the same output. For example, if the verification application program 212 has the same function as a specific basic application program 211 (hereinafter referred to as the "basic application with the same function") and has an improved algorithm to increase execution speed, the verification method definition 214 of the verification application program 212 is defined as, for example, "output is the same as the basic application with the same function." The output value of this existing application may be run while running as the basic application program 211, and the results may be compared sequentially, or the output value of the existing application may be stored in advance as a verification method definition and compared with that.

The verification priority 215 is defined for each verification plan entry. This verification priority 215 is obtained from the verification management server 10 and stored in the in-vehicle memory unit 210 of the in-vehicle control device 21. The verification application execution control unit 224 schedules the execution of the verification application program 212 by creating a verification execution schedule 219A based on the verification plan information 213 including this verification priority 215.

The driving environment condition 216 is setting information that defines one or more driving environments in which verification should be performed, which are defined for the verification application program 212. Each verification plan entry exists for a pair of this driving environment condition 216 and the verification application program 212. For example, if the verification application program 212 is a recognition application program, the driving environment condition 216 is set to a driving environment such as "when in an intersection area."

The driving environment condition prediction information 217 contains information regarding the timing when the driving environment condition 216 will be satisfied and the timing when it will no longer be satisfied. The driving environment condition prediction information 217 is created by the driving environment condition satisfaction prediction unit 227. For example, the driving environment condition satisfaction prediction unit 227 compares the vehicle information 219 with the driving environment condition 216 to create the driving environment condition prediction information 217. This driving environment condition prediction information 217 includes information such as the future time when the driving environment condition 216 will be satisfied, the future time when it will not be satisfied, the frequency of satisfaction, the duration, and the probability of satisfaction.

The verification result 218 is information indicating the success or failure and progress of the verification for each verification plan entry in the verification plan information 213. The verification application execution control unit 224 records the success or failure of the verification in accordance with the verification method definition 214. Even before the verification is completed, the verification application execution control unit 224 records the progress information of the verification in accordance with the verification method definition 214. The verification result 218 is output from the verification result output unit 226 to the verification management server 10.

The vehicle information 219 includes the position, speed, steering information, driving trajectory information, driving route information, etc. of the vehicle 2, and includes vehicle information related to the vehicle 2 acquired by the vehicle 2. This vehicle information 219 may be, for example, information output by the verification application program 212 or the basic application program, or information output by the vehicle sensor group 23, the external sensor group 22, or the actuator group 24.

The verification execution schedule 219A is information about the schedule for executing the verification application program 212. The verification execution schedule 219A is created by the verification application execution control unit 224. This creation uses information including the verification application program 212, the driving environment conditions 216, the verification priority 215, the driving environment conditions 216, and the driving environment condition prediction information 217. Note that below, creating, updating, and changing the verification execution schedule 219A is also expressed as "performing verification scheduling" or "performing verification scheduling."

The communication unit 230 is configured to include, for example, a network card conforming to a communication standard such as Ethernet (registered trademark) or CAN (Controller Area Network). The communication unit 230 transmits and receives data to and from other devices mounted on the vehicle 2 based on various protocols. Note that the connection between the communication unit 230 and other devices mounted on the vehicle 2 is not limited to a wired connection such as Ethernet, and may be a short-range wireless connection such as Bluetooth (registered trademark) or wireless LAN (Local Area Network).

The wireless communication device 20 has a network card or the like that complies with a long-distance wireless communication standard such as LTE (Long Term Evolution) or a short-distance wireless communication standard such as wireless LAN or DSRC (Dedicated Short Range Communications). The wireless communication device 20 is configured to be capable of data communication with, for example, the verification management server 10, wireless communication devices 20 mounted on one or more other vehicles, and one or more communication terminals (not shown) held by people, etc.

The wireless communication device 20 communicates data with the verification management server 10 via the network 3. The wireless communication device 20 preferably connects to the network 3 using long-distance wireless communication, and transmits and receives data generated based on various IP (Internet Protocol)-based protocols, for example. Note that the wireless communication device 20 is not limited to long-distance wireless communication, and may be directly connected to the network 3 using short-distance wireless communication, or may be connected to the network 3 via another communication device such as a roadside unit.

The external sensor group 22 is a group of sensors that recognize obstacles within a certain range around the vehicle, such as other vehicles, pedestrians, objects, and features such as road signs and white lines. The external sensor group 22 is composed of, for example, a camera, a radar, a lidar, and the like. The external sensor group 22 outputs information on the detected obstacles and features around the vehicle, such as the relative distance and relative angle from the vehicle, to the in-vehicle network 25 to which the external sensor group 22 and the in-vehicle control device 21 are connected. The in-vehicle control device 21 can acquire the output results from the external sensor group 22 via the in-vehicle network 25. Note that in this embodiment, the external sensor group 22 is configured to perform processing to detect obstacles and features, but the in-vehicle control device 21 or another device may perform these detection processes using signals and data output from the external sensor group 22.

The vehicle sensor group 23 is a group of devices that detect information related to the movement of the vehicle, such as the driving speed, steering angle, accelerator operation amount, brake operation amount, etc. The vehicle sensor group 23 outputs these detected state quantities, for example, onto the in-vehicle network 25. The in-vehicle control device 21 and other devices connected to the in-vehicle network 25 acquire the state quantities of various parts output from the vehicle sensor group 23 via this in-vehicle network 25.

The actuator group 24 is a group of devices that control the control elements such as steering, braking, and accelerator that determine the movement of the vehicle. The actuator group 24 controls the movement of the vehicle based on steering information of the steering wheel, brake pedal, accelerator pedal, etc. by the driver and target control values output from the on-board control device 21.

Network 3 is a communication network consisting of any combination of circuit-switched networks or packet-switched networks using at least one of wireless and wired communication as a medium. Network 3 is configured to enable data transmission and reception between the verification management server 10 and the wireless communication device 20 mounted on the vehicle 2. The on-board control device 21 communicates with the verification management server 10 via the wireless communication device 20 and through network 3.

(Verification management server configuration)
Returning to Fig. 1, the configuration of the verification management server 10 will be described. The verification management server 10 plans the verification of an application program that runs on the on-board control device 21 of the vehicle 2 and manages the progress of the verification. Although the verification management server 10 is depicted as a single hardware device in Fig. 1, it may be composed of multiple hardware devices. The verification management server 10 has a processing unit 100, a server storage unit 110, and a communication unit 120.

The processing unit 100 is configured to include, for example, a CPU and RAM, and realizes the functions of the verification management server 10 by executing a predetermined operating program. The processing unit 100 also has, as functional blocks, a verification result acquisition unit 102 that receives verification result information from one or more vehicles 2, and a driving environment condition establishment prediction unit 104. The processing unit 100 also includes a verification plan information generation unit 103 that generates verification plan information for each verification application program, a verification plan information output unit 101 that transmits verification plan information to the vehicle 2, etc.

The verification plan information output unit 101 outputs to the vehicle 2 verification plan information 213 including a verification application program 111, a verification method definition 112, a verification priority 113, and driving environment conditions 114 stored in the server memory unit 110.

The verification result acquisition unit 102 acquires verification result information related to the verification application program 111 transmitted from the vehicle 2, and stores the information in the server storage unit 110 together with vehicle information related to the vehicle 2. The verification result information includes verification progress information for each of one or more verification application programs 212.

The verification plan information generation unit 103 generates verification plan information 117 based on the verification progress information 115 and the driving environment condition prediction information 116. Each entry of this verification plan information 117 includes a verification application program, a verification method definition, driving environment conditions, verification priority, etc.

The driving environment condition satisfaction prediction unit 104 receives vehicle information 219 from one or more vehicles 2. The driving environment condition satisfaction prediction unit 104 predicts which vehicle 2 will satisfy the driving environment condition 114 of the verification application program 111 in the near future, and passes driving environment condition prediction information 116 to the verification plan information generation unit 103. This driving environment condition satisfaction prediction unit 104 may predict the satisfaction of the driving environment condition 114 using information unknown to the vehicle 2 and the vehicle information 219 of the vehicle 2. For example, if the verification management server 10 holds congestion information for a specific area that is unknown to the vehicle 2, the congestion information and the vehicle information of the vehicle 2 may be used to predict the satisfaction of the driving environment condition.

The server storage unit 110 includes, for example, a storage device such as an HDD, a flash memory, or a ROM, and stores the programs executed by the processing unit 100 and a set of data necessary to realize the present system. In this embodiment, in particular, the verification application program 111, the verification method definition 112, the verification priority 113, the driving environment conditions 114, the verification progress information 115, the driving environment condition prediction information 116, and the verification plan information 117 are stored in the server storage unit 110.

The verification application program 111, like the verification application program 212 on the vehicle control device 21, requires verification on the vehicle control device 21. For each verification application program, driving environment conditions 114, verification method definition 112, verification priority 113, etc. are defined. The verification management server 10 transmits the verification application program 111 to the vehicle control device 21.

The verification method definition 112 may be the same as the verification method definition 214 stored in the on-board storage unit 210. The verification priority 113 may be the same as the verification priority 215 stored in the on-board storage unit 210. The driving environment conditions 114 may be the same as the driving environment conditions 216 stored in the on-board storage unit 210. The driving environment conditions 114 may include meaningful information that can only be known by the verification management server 10.

The verification progress information 115 is expressed, for example, as a progress value, and indicates the progress of the verification. The progress representation value of this value depends on the verification application program 212, and may indicate the coverage of the verification application program 212 or the ratio of the verification execution time at that time to the target time for verifying the verification application program 212.

The driving environment condition prediction information 116 is information that indicates the timing when the driving environment condition 114 is satisfied and the timing when it is no longer satisfied. The verification plan information 117 is information generated by the verification plan information generation unit 103, and includes the verification application program 111, the verification method definition 112, the verification priority 113, and the driving environment condition 114.

The communication unit 120 is configured to include, for example, a network card conforming to a communication standard such as Ethernet or CAN, and transmits and receives data based on various protocols with other devices mounted on the verification management server 10. Note that the connection between the communication unit 120 and other devices mounted on the verification management server 10 is not limited to a wired connection such as Ethernet, and may be a short-range wireless connection such as Bluetooth or wireless LAN.

Figure 3 is a diagram showing the flow of data between the processing unit 100 of the verification management server 10 in the verification system 1 and the processing unit 220 of the on-board control device 21 of the vehicle 2.

The verification management server 10 transmits the verification plan information 240 to the on-board control device 21. The timing of this communication may be from the vehicle 2 when the vehicle 2 issues a transmission request to the verification management server 10, or the verification management server 10 may transmit to the vehicle 2 at any timing. Also, the information may be transmitted simultaneously to multiple vehicles 2. However, it is not necessary to transmit to all vehicles 2, and the information may be transmitted to one or more vehicles. Also, the verification management server 10 may not transmit directly to the vehicle 2, but may reach the vehicle 2 via another vehicle or another server. The verification management server 10 may transmit the same verification plan information 240 to all destination vehicles 2, or may transmit different verification plan information 240 for each vehicle 2.

The on-board control device 21 on the vehicle 2 transmits the verification result 218 and the vehicle information 219 to the verification management server 10. The timing of this communication may be such that the vehicle 2 transmits the verification result 218 and the vehicle information 219 when the verification management server issues a transmission request to the vehicle 2, or the vehicle 2 may transmit the verification result 218 and the vehicle information 219 to the verification management server 10 at any timing. The verification result 218 and the vehicle information 219 may also reach the verification management server 10 via another vehicle or server from the vehicle 2.

The verification result acquisition unit 102 of the verification management server 10 receives the verification results 218 from one or more vehicles 2. The verification results 218 store the success or failure of the verification or progress information as the verification results related to one or more verification application programs 212. The verification result acquisition unit 102 passes this to the verification plan information generation unit 103 as verification progress information 115.

The driving environment condition satisfaction prediction unit 104 receives vehicle information 219 from one or more vehicles 2. The driving environment condition satisfaction prediction unit 104 predicts which vehicle 2 will satisfy the driving environment condition 114 in the near future, generates driving environment condition prediction information 116, and passes the driving environment condition prediction information 116 to the verification plan information generation unit 103. The driving environment condition satisfaction prediction unit 104 may predict the satisfaction of the driving environment condition using information unknown to the vehicle 2 and the vehicle information 219 of the vehicle 2. For example, if the verification management server 10 holds traffic congestion information for a specific area that is unknown to the vehicle 2, the traffic congestion information and the vehicle information of the vehicle 2 may be used to predict the satisfaction of the driving environment condition. The verification plan information generation unit 103 defines a verification priority based on this prediction, thereby making it possible to further improve the efficiency of the verification of the verification application program 212.

The verification plan information generation unit 103 generates verification plan information 117 based on the verification progress information 115 and the driving environment condition prediction information 116. Each entry of this verification plan information 117 includes a verification application program, a verification method definition, driving environment conditions, verification priority, etc. The verification plan information acquisition unit 225 of the vehicle control device 21 acquires the verification plan information 117.

The driving environment condition fulfillment prediction unit 227 predicts whether the driving environment conditions 216 included in the vehicle information 219 and the verification plan entry will be satisfied, and generates driving environment condition prediction information 217. At this time, the driving environment condition prediction information 116 predicted by the verification management server 10 may be received in advance by the on-board control device 21, and the driving environment condition prediction information 217 may be generated by combining this driving environment condition prediction information 116.

The verification application execution control unit 224 verifies the verification application program 212 based on the verification plan information 213. At that time, the verification application execution control unit 224 may receive input and output of data from the basic application execution control unit 223. Although not shown in FIG. 3, the verification application execution control unit 224 may receive data input from the external sensor group 22 and the vehicle sensor group 23 when verifying the verification application program 212. The verification application execution control unit 224 generates the result of the verification as the verification result 218. This verification result 218 includes verification progress information for one or more pieces of verification plan information 213. The verification result output unit 226 receives the verification result 218 from the verification application execution control unit 224 and transmits it to the verification management server 10 together with the vehicle information 219.

Figure 4 shows an example of the format of the data of the driving environment conditions 114 stored in the server memory unit 110 of the verification management server 10. This format is the same as the format of the data stored in the driving environment conditions 216 of the in-vehicle memory unit 210. The driving environment conditions 114 have one or more entries, and each entry has fields for the verification application program name 301 and the driving environment conditions 302.

The verification application program name 301 field stores one or more names that identify the verification application program 212 to be verified. This identifier only needs to be uniquely identifiable by the vehicle 2, and may be an identifier other than a natural language.

The driving environment conditions 302 field stores the conditions of the driving environment in which the verification of the verification application program 212 should be performed. Multiple driving environment conditions 302 can be set for the same verification application program name 301. The pair of the verification application program name 301 and the driving environment conditions 302 must be unique. The driving environment conditions 302 are set in a natural language and may be analyzed by the verification application execution control unit 224, or may be written in a specific language system that is processed by a computer.

The driving environment conditions 302 include, for example, location conditions such as "when the vehicle is in an intersection area," "when the vehicle is on a highway," and "when the vehicle is in XX country." The vehicle's position information, which is the condition for this judgment, is provided from the sensor group or the basic application program while driving. The surrounding environment conditions include "when there are X number of surrounding vehicles," "when there are Y number of pedestrians," and so on. The information on the surrounding environment, which is the condition for this judgment, is provided from the sensor group or the basic application program 211 while driving. The vehicle type may also be set as a condition, and for example, a condition such as "when operating on vehicle type XX" may be specified. Weather conditions such as "cloudy" and "rainy" may also be specified. The date and time may also be specified, and for example, a condition such as "Y o'clock to Z o'clock" may also be specified.

In addition, multiple conditions may be written in an integrated manner, for example, by specifying a condition such as "if on a highway and between Y o'clock and Z o'clock", or by specifying a condition such as "if on a highway or between Y o'clock and Z o'clock". In addition, the output or input of the basic application program or other verification application programs may be monitored, and the input/output data may be used as the driving environment condition. For example, the driving environment condition may be "if the recognition application C of the basic application program is outputting specific data D". In addition, the execution of the basic application program 211 or other verification application programs 212 may be monitored, and the execution status may be used as the driving environment condition, for example, by specifying "if the verification application program D is running".

The driving environment conditions 302 may be set manually by the application developer, or may be set automatically by the verification plan information generating unit 103 by analyzing the verification application program 111. For example, the driving environment conditions 302 may be set automatically to cover all branches in the program.

The size of the driving environment conditions 114 increases when the verification application program 212 and the driving environment conditions 302 are set in detail. Therefore, the verification management server 10 stores the original driving environment conditions 114, but the driving environment conditions 114 sent to the vehicle control device 21 may be only a subset that contains only the settings related to the application program for which verification is performed.

5 is a diagram showing an example of the verification plan information 213 generated by the verification plan information generating unit 103 of the verification management server 10. The verification plan information 213 includes multiple entries, and each entry includes a verification application program name 301, a driving environment condition 302, an available CPU resource condition 403, a priority 404, and a verification method definition 405. The verification plan information 213 does not necessarily need to be integrated as one piece of data, and may exist as multiple data groups that are linked together. For example, the driving environment condition 114 shown in FIG. 4, the priority for each driving environment condition, the available CPU resource condition, and the verification method definition may be defined separately. In addition, the CPU resource condition 403, the priority 404, and the verification method definition 405 do not need to be statically defined, and may be held as different setting information for each vehicle model of the vehicle 2, for example. Here, the description will be given along with the description in FIG. 5.

Each verification plan entry in the verification plan information 213 exists uniquely for each combination of the verification application program name 401 and the running environment conditions 402. A priority 404, free CPU resource conditions 403, and a verification method definition 405 are set in each verification plan entry. The priority 404, free CPU resource conditions 403, and verification method definition 405 may be set to the same contents. The verification application program name 301 and the running environment conditions 302 are as described in FIG. 4, so their description will be omitted.

The free CPU resource condition 403 is a data element included in the verification plan information 117 and the verification plan information 213, and indicates the CPU resources required when verifying the verification application program 212. The value described in the free CPU resource condition 403 is a value such as the average or maximum value of the CPU resources consumed during verification, measured in advance or updated during running. The larger the value of the free CPU resource condition 403, the more CPU resources will be consumed for verification.

The priority 404 is information that the verification app execution control unit 224 on the in-vehicle control device 21 refers to when creating the verification execution schedule 219A, and based on this, determines the order in which the verification application programs 212 are verified. The higher the value of the priority 404, the higher the priority of the verification. For example, when the driving environment condition 402 is satisfied and the free CPU resource condition 403 is also satisfied, the verification application programs 212 with the highest priority are verified first.

For example, when the verification plan information 213 is as shown in the example in FIG. 5, the weather is cloudy, and there are 10% or more free CPU resources, verification of "cognitive application B" with a priority of "30" is scheduled preferentially rather than "cognitive application A" with a priority of "20". However, the method of scheduling the verification may be controlled by a specific algorithm in the verification application execution control unit 224 in combination with not only the priority but also other information. This definition of the priority may be performed by the verification plan information generation unit 103 of the verification management server 10, or the definition may be modified based on the prediction of fulfillment by the driving environment condition fulfillment prediction unit on the in-vehicle control device 21.

The verification method definition 405 is a definition of the verification method of the verification application program 212. The verification application execution control unit 224 manages the verification success/failure and progress information of the executed verification application program 212 according to this verification method definition 405. The verification method definition 405 is an item that is set depending on the application. For example, the verification method definition 405 may directly define the range of appropriate output values of the verification application program 212. The verification method definition 405 may also specify a basic application program 211 whose output should be the same. A specific example will be described.

Here, we consider the case where the verification application program 212 is an improvement of the existing basic application program 211. In this case, if the improvement does not change the function itself, but simplifies or streamlines the algorithm, it is often sufficient to simply compare this output value with the output value of the basic application program 211. On the other hand, if the improvement is a change in function, it may not be possible to simply compare the output value with that of the basic application program. In such cases, the appropriate output value of the verification application program 212 is written in advance in the verification method definition 405.

Furthermore, the following case can be considered for the verification method definition 405. For example, the verification of three application programs, verification application programs A, B, and C, can be simplified as follows. When multiple verification application programs A, B, and C are operated in conjunction with each other, it is possible to essentially complete the verification of the preceding application programs A and B by strictly checking the output value of application program C.

Figures 6(a) to (c) are diagrams showing three examples of the data format of the driving environment condition prediction information 116 in the verification management server 10 and the driving environment condition prediction information 217 on the in-vehicle control device 21. Here, the format of the driving environment condition prediction information 116 will be explained as a representative example. The data formats of the driving environment condition prediction information 116 in the verification management server 10 and the driving environment condition prediction information 217 on the in-vehicle control device 21 may be the same or different.

The example shown in FIG. 6(a) shows a format in the case where the driving environment condition prediction information 217 is stored in the form of a table. The driving environment condition prediction information 217 includes columns for a verification application program name 511, a driving environment condition 512, a most recent fulfillment timing 513, and a most recent failure timing 514. For the driving environment condition 512, the most recent fulfillment timing 513 and the most recent failure timing 514 are defined.

In the example of the first line in FIG. 6(a), the driving environment condition 512 is defined as "when in an intersection area", and the timing of the most recent failure is defined as 5 seconds later. This indicates that the content of this driving environment condition is satisfied, and the timing of the first failure is 5 seconds later. The verification application execution control unit 224 on the in-vehicle control device 21 uses this information, for example, to increase the value of the verification priority 215 for the combination of the verification application program 212 "cognition application A" and the driving environment condition 216 "when in an intersection area", and adjusts so that verification is executed with priority in the near future. This makes it possible to control the execution of verification with priority for driving environment conditions of application programs that are known to be failed in the future.

In the example of the second line in FIG. 6(a), the driving environment condition 512 is defined as "when there are X surrounding vehicles", and the timing of the most recent fulfillment is defined as 5 seconds later. For example, when the verification application execution control unit 224 on the in-vehicle control device 21 wishes to verify the driving environment condition 216 of "cognition application A", it can set a timer to re-execute the verification schedule in 5 seconds. At that time, it can also raise the priority 404 of the verification plan information 213. This makes it possible to control the application program for which the driving environment condition 216 was not satisfied to be executed as quickly as possible after the driving environment condition 216 is satisfied.

In the example shown in FIG. 6(b), driving environment condition prediction information 217 for a combination of a specific verification application program 212 and driving environment condition 216 is stored as binary time series data of true or false. In this example, it is possible to express multiple instances of a driving environment condition being true or false, which was not possible in the example shown in FIG. 6(a). This makes it possible to express, for example, that in a case where a condition is currently true, false after 5 seconds, and then true again immediately after 6 seconds, there is no need to perform control to raise the priority as described in the explanation of FIG. 6(a). In this way, the example shown in FIG. 6(b) can store information on the frequency of true/false and the time of true for a certain period of time in the future, making it possible to control the verification schedule using this information.

In the example shown in FIG. 6(c), driving environment condition prediction information 217 for a combination of a specific verification application program 212 and driving environment conditions 216 is stored as time-series data of probability of occurrence. When predicting whether a driving environment condition will occur using, for example, the results of a recognition application of the basic application program 211, when the recognition application expresses the output as a probability, this can be used as the prediction information as is. If it is necessary to express it as a binary value as in the example of FIG. 6(b), for example when the probability of occurrence is originally 0.5, the information will be rounded up or down, resulting in loss of accurate information. If it can be stored as a probability as prediction information, it becomes possible to control the verification schedule based on more accurate prediction information.

Figure 7 is a flowchart showing the process of defining the verification execution schedule 219A of the verification application program 212 by the verification application execution control unit 224. Note that Figure 7 can also be called a flowchart showing the process of creating or modifying the verification execution schedule 219A. First, in step S500, the verification application execution control unit 224 receives an execution scheduling request and proceeds to step S501.

To explain step S500 in more detail, the verification application execution control unit 224 may receive this request from any of the middleware, OS, or application of the in-vehicle control device 21. The timing of receiving this request may be at startup, while stopped, or while driving. Furthermore, the verification application execution control unit 224 may dynamically receive a request from the verification management server 10. For example, when a high-priority verification application program 212 is defined by the verification management server 10, the verification management server 10 may request that the verification execution schedule 219A of each vehicle 2 be changed. Furthermore, when it is difficult to satisfy the driving environment conditions 216, the verification management server 10 may request scheduling when it predicts the conditions to be satisfied.

In step S501, the verification application execution control unit 224 reads the verification plan information 213. This verification plan information 213 is configured, for example, in the data format shown in FIG. 5, and each entry includes the verification application program name, driving environment conditions, verification method definition, verification priority, etc. If a certain amount of time has passed since the latest verification plan information was received from the verification management server 10, the verification application execution control unit 224 may request the verification plan information 213 from the verification management server 10. In step S502, the verification application execution control unit 224 reads the driving environment condition prediction information 217. This driving environment condition prediction information 217 is prediction information created by the driving environment condition establishment prediction unit 227 regarding the driving environment conditions.

In step S503, the verification application execution control unit 224 updates the priority of the verification plan entry based on the driving environment condition prediction information 217, and proceeds to step S504. An example of this update will be described. As shown in the example of FIG. 6(a), assume that the driving environment condition 512 is defined as "when in an intersection area" and the timing of the most recent failure is defined as 5 seconds later. In this case, the verification application execution control unit 224 uses, for example, the driving environment condition prediction information 217 to increase the value of the verification priority 215 for the pair of this application program and driving environment condition 512, and adjusts so that the verification is executed with priority in the near future. This makes it possible to control the execution of verification with priority for driving environment conditions of the verification application program 212 that are known to be failed in the future.

Another example of updating the priority will be described with reference to FIG. 6(b). In the example shown in FIG. 6(b), a certain driving environment condition is currently satisfied, becomes non-satisfied after 5 seconds, and is satisfied again immediately after 6 seconds. In this case, since there is no need to perform control to increase the priority, it is possible to lower the priority.

In step S504, the verification application execution control unit 224 scans the verification plan information 213, starting with the verification plan entry with the highest priority, and extracts a verification plan entry that satisfies the driving environment condition 402. A specific example of whether or not the driving environment condition 402 is satisfied will be described. First, an example will be described in which the driving environment condition 402 is "being in an intersection area", which is a location-related condition. In this case, for example, the determination is made based on the self-position data output by the self-position estimation application of the basic application program 211. If the vehicle 2 is in the intersection area, it is determined that the driving environment condition 402 is satisfied, and the process proceeds to step S505. If the vehicle 2 is not in the intersection area, the driving environment condition 402 is not satisfied, and the process moves to the driving environment condition with the next highest priority.

Another specific example of step S504 will be described. If a vehicle-related condition, such as "must be vehicle model XX," is set in driving environment condition 402, a judgment is made, for example, based on vehicle information 219. If the vehicle model information included in vehicle information 219 matches "vehicle model XX," it is deemed that driving environment condition 402 is satisfied, and the process proceeds to step S505. If the vehicle model information included in vehicle information 219 does not match "vehicle model XX," driving environment condition 402 is not satisfied, and the process moves to the driving environment condition with the next highest priority.

Another specific example of step S504 will be described. If a weather-related condition such as "the weather is cloudy" is set in the driving environment condition 402, a judgment is made based on weather information output by the image recognition application of the basic application program 211, for example. If the weather information is cloudy, it is assumed that the driving environment condition 402 is satisfied, and the process proceeds to step S505. If the weather information is other than cloudy, the driving environment condition 402 is not satisfied, and the process moves to the driving environment condition with the next highest priority. If there is no driving environment condition, the process proceeds to step S507.

If there are multiple verification plan entries with the same priority value in step S504, any verification plan entry may be selected, or the verification plan entries requiring the most CPU resources may be scanned first. In this way, by determining the running environment conditions 216 of the verification application program 212 based on the free CPU resource conditions starting with the highest priority, the verification of high priority applications can be completed preferentially even in an environment with few CPU resources.

In step S505, the verification application execution control unit 224 assigns the execution of the verification application program 212 to the task based on the CPU resource conditions and the prediction information. This assignment is to write to the verification execution schedule 219A. For example, when it is predicted that the driving environment conditions will be satisfied after XX ms, it is desirable to assign the execution after the XX ms have elapsed. Conversely, when it is predicted that the driving environment conditions will not be satisfied after YY ms, it is desirable to assign the execution before the YY ms have elapsed. Furthermore, when it is predicted that the conditions will not be satisfied for a long time, the application program may not be assigned to a task for verification, but may be handed over to another verification application program 212. The verification application execution control unit 224 receives information on the CPU resource status on the vehicle control device 21, and compares the magnitude relationship with the numerical value described in the CPU resource condition 403 to determine whether the CPU resource condition 403 is satisfied.

In the next step S506, the verification application execution control unit 224 determines whether or not there is free CPU resource for verification. If the verification application execution control unit 224 determines that there is no free resource, it proceeds to step S507, and if it determines that there is free resource, it returns to step S504 and attempts to allocate the next highest priority verification application program.

In step S507, the verification application execution control unit 224 finalizes the verification execution schedule 219A, stores it in the in-vehicle storage unit 210, and ends the process shown in FIG. 7. The verification application execution control unit 224 executes the verification application program 212 based on this verification execution schedule 219A.

Figure 8 is a diagram showing an example of verification progress information 115 in the verification management server 10. In Figure 8, the verification progress information 115 is represented in a table format and has multiple entries. These entries are also referred to as "progress information entries" below. These progress information entries exist in correspondence with the verification plan entries of the verification plan information 117.

The progress information entry includes a verification application program name 710, driving environment conditions 711, and a progress value 712. This entry may also include a verification elapsed time 713. The pair of the verification application program name 710 and the driving environment conditions 711 corresponds to those present in the verification plan entry. The progress value 712 of the progress information entry indicates the progress of the verification. This progress expression value depends on the verification application program, and may indicate the coverage of the verification application program or the ratio of the verification execution time at that time to the target time for verifying the verification application program. This verification progress information 115 is created in the verification application execution control unit 224 of the vehicle control device 21.

The verification elapsed time 713 of the progress information entry indicates the time that has elapsed since the application program and the driving environment conditions were first scheduled on the in-vehicle control device 21 as verification plan information. Note that the elapsed time on the verification management server 10 may also be included in the verification progress information 115.

Figure 9 is a flowchart showing the process of generating verification plan information 117 by the verification plan information generation unit 103. First, in step S800, the verification plan information generation unit 103 receives a request to generate verification plan information. In step S801, the verification plan information generation unit 103 receives verification progress information 115 and driving environment condition prediction information 116. The verification progress information 115 is received from the verification result acquisition unit 102, and the driving environment condition prediction information 116 is received from the driving environment condition establishment prediction unit 104.

In step S802, the verification plan information generating unit 103 generates the verification plan information 213. For each verification plan entry, the verification plan information generating unit 103 may increase the priority of the verification plan entry with a small progress value relative to the verification elapsed time based on the verification progress information 115. The verification plan information generating unit 103 may also decrease the priority of the verification plan entry with a large progress value relative to the verification elapsed time. Furthermore, based on the driving environment condition prediction information 116 in the verification management server 10, the verification plan information generating unit 103 may decrease the priority of a verification plan entry that has not been satisfied recently but is likely to be satisfied in the future, or conversely, may increase the priority of a verification plan entry that has been satisfied recently but is likely to be satisfied in the future.

According to the above-described first embodiment, the following advantageous effects can be obtained.
(1) The in-vehicle control device 21 is mounted on the vehicle 2 and includes an in-vehicle storage unit 210 that stores a basic application program 211 related to driving control of the vehicle 2, multiple verification application programs 212, driving environment conditions 216 that are conditions related to the vehicle 2 for verifying the verification application programs 212, and verification priorities 215 of the driving environment conditions 216, and a verification application execution control unit 224 that controls execution of verification of the verification application programs 212 based on the driving environment conditions 216 and the verification priorities 215. Therefore, the in-vehicle control device 21 can efficiently verify the multiple verification application programs 212 in consideration of the conditions and priorities to be verified.

(2) In the on-board control device 21, a verification method definition 214 that defines a verification method under driving environment conditions 216 is stored in the on-board storage unit 210. The verification application execution control unit 224 further controls the execution of the verification of the verification application program 212 based on the verification method definition 214. Therefore, the on-board control device 21 can easily determine whether the verification of the verification application program 212 has been successful. For example, if the verification application program 212 has the same functions as the existing basic application program 211 and the algorithm has been improved to increase the execution speed, it is verified whether the output value matches that of the existing basic application program 211.

(3) The verification application execution control unit 224 obtains data necessary for verifying the verification application program 212 from the basic application program 211. Therefore, the verification application execution control unit 224 can omit a part of the data processing and can perform the verification efficiently.

(4) The on-board control device 21 includes a driving environment condition satisfaction prediction unit 227 that predicts the timing when the driving environment of the vehicle 2 will match the driving environment conditions 216 included in the verification plan information 213. The verification application execution control unit 224 controls the execution of the verification of the verification application program 212 based on the driving environment condition prediction information 217 predicted by the driving environment condition satisfaction prediction unit 227. The verification application execution control unit 224 creates a verification execution schedule 219A based on the prediction of the driving environment condition satisfaction prediction unit 227 and performs verification according to the verification execution schedule 219A. Therefore, for example, multiple verification application programs 212 can be efficiently verified in accordance with the planned progress of the vehicle 2.

(5) The verification management server 10 is capable of communicating with the vehicle 2. The verification management server 10 includes a server storage unit 110 that stores a verification application program 111, which is an application to be verified in the vehicle 2, and a driving environment condition 114, which is a condition under which the verification application program 111 should be verified; a verification plan information generating unit 103 that determines a verification priority 113 of the verification application program 212 based on the vehicle information 219 and the driving environment condition 114 acquired from the vehicle 2, and generates verification plan information 117 including the driving environment condition 114, the verification application program 212, and the verification priority 113; and a verification plan information output unit 101 that outputs the verification plan information 117 to the vehicle 2. Therefore, the verification management server 10 determines the verification priority 113 of the verification application program 212 based on the vehicle information 219 and the driving environment condition 114 acquired from the vehicle 2, and therefore can efficiently execute the verification of multiple verification application programs 212.

(6) The vehicle information 219 includes the verification results of the verification application program 212 executed in the vehicle 2. The verification plan information generating unit 103 updates the verification progress information 115 of the verification application program 212 based on the verification results of the verification application program 212, and determines the verification priority 113 of the verification application program 111 based on the verification progress information 115. Therefore, the verification management server 10 can avoid a situation where only some of the verification application programs 212 are significantly delayed by manipulating the verification priority 113 according to the progress. Furthermore, when multiple vehicle control devices 21 are connected to the verification management server 10, the verification priority 113 is manipulated based on the progress of the verification in the multiple vehicle control devices 21, so that the verification system 1 can be optimized as a whole, which is not possible with only one vehicle control device 21.

(7) The verification management server 10 includes a driving environment condition satisfaction prediction unit 104 that predicts the timing when the driving environment of the vehicle 2 will match the driving environment conditions included in the verification plan information 117 based on the vehicle information 219. The verification plan information generation unit 103 determines the verification priority 113 of the verification application program 111 based on the predicted timing. Therefore, the verification management server 10 assigns each on-board control device 21 to verify the optimal verification application program 212, thereby optimizing the verification system 1 as a whole.

(8) The verification system 1 includes an on-board control device 21 mounted on the vehicle 2 and a verification management server 10 capable of communicating with the on-board control device 21. The verification management server 10 includes a server memory unit 110 that stores a verification application program 111, which is an application to be verified in the vehicle 2, and driving environment conditions 114, which are conditions under which the verification application program 212 should be verified, a verification plan information generation unit 103 that determines a verification priority 113 of the verification application program 212 based on vehicle information 219 and the driving environment conditions 114 acquired from the vehicle 2, and generates verification plan information 117 including the driving environment conditions 114, the verification application program 111, and the verification priority 113, and a verification plan information output unit 101 that outputs the verification plan information 117 to the vehicle 2. The in-vehicle control device 21 includes a verification plan information acquisition unit 225 that acquires the verification plan information 117 output by the verification management server 10, and a verification application execution control unit 224 that controls the execution of the verification of the verification application program 212 based on the driving environment conditions 216 and the verification priority 215 in parallel with the basic application program 211 related to the driving control of the vehicle 2. Therefore, the verification system 1 can efficiently execute the verification of multiple verification application programs 212.

(Variation 1)
The distribution of the amount of priority updates in the on-board control device 21 and the amount of priority updates in the verification management server 10 may be adjusted in advance for the entire system. For example, the priority updates may not be performed at all in the on-board control device 21, and the priority updates may be performed only in the verification management server 10. Alternatively, for example, the priority updates may be performed in the verification management server 10, and further fine adjustments may be made based on the results of predictions in the vehicle 2. Note that if the priority updates are not performed in the on-board control device 21, the process of step S503 in FIG. 7 is not performed.

(Variation 2)
The definition process of the verification execution schedule 219A shown in FIG. 7 may be modified as follows (A) to (C).

7, in step S504, the verification plan entries with the highest priority are scanned first, and an execution schedule is assigned. However, as an alternative method, the verification plan entries may be scanned in order of the CPU resources required for verification, rather than the priority.
7, in step S504, the verification plan entries with higher priority are scanned first. However, at this stage, the CPU resource condition 403 may be checked, and entries that do not satisfy the CPU resource requirement may be ignored.
7, the verification plan information 213 is only read. However, when the definition of the verification execution schedule 219A is repeated, a process may be added to increase the priority of the verification application program 212 that is not assigned. This makes it possible to guarantee the execution of the verification application program 212 that is never scheduled for execution.

(Variation 3)
The verification plan information 213 may not include the verification method definition 214. In this case, the in-vehicle control device 21 can substitute for the verification by transmitting the execution result of the verification application program 212, for example, information output by the program, to the verification management server 10.

(Variation 4)
The on-board control device 21 may not include the driving environment condition satisfaction prediction unit 227. In this case, the on-board control device 21 may determine the order of the verification application programs 212 to be verified in advance using a predetermined method or randomly. Alternatively, the on-board control device 21 may determine whether the driving environment conditions 216 are satisfied at predetermined time intervals, and execute the verification application program 212 having the driving environment conditions 216 that are satisfied at that time.

(Variation 5)
The verification plan information generating unit 103 of the verification management server 10 does not need to update the verification priority 113 based on the verification result 218 .

(Variation 6)
The verification management server 10 may not include the driving environment condition satisfaction prediction unit 104. In this case, the verification management server 10 randomly assigns the verification of the verification application program 212 to each on-board control device 21, for example.

In each of the above-described embodiments and variations, the functional block configurations are merely examples. Several functional configurations shown as separate functional blocks may be configured together, or a configuration shown in a single functional block diagram may be divided into two or more functions. In addition, some of the functions of each functional block may be provided by other functional blocks.

The vehicle control device 21 may have an input/output interface (not shown), and a program may be loaded from another device via the input/output interface and a medium available to the vehicle control device 21 when necessary. The medium here refers to, for example, a storage medium that is detachable from the input/output interface, or a communication medium, i.e., a wired, wireless, optical, or other network, or a carrier wave or digital signal that propagates through the network. In addition, some or all of the functions realized by the program may be realized by a hardware circuit or an FPGA. The above-mentioned multiple modified examples may be combined with each other. Although various embodiments and modified examples have been described above, the present invention is not limited to these. Other aspects that are conceivable within the technical concept of the present invention are also included in the scope of the present invention.

The above-mentioned embodiments and modifications may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these. Other aspects that are conceivable within the scope of the technical concept of the present invention are also included within the scope of the present invention.

10... Verification management server 21... On-board control device 101... Verification plan information output unit 102... Verification result acquisition unit 103... Verification plan information generation unit 104... Driving environment condition establishment prediction unit 110... Server storage unit 111, 212... Verification application program 112, 214... Verification method definition 113, 215... Verification priority 114, 216... Driving environment condition 115... Verification progress information 116... Driving environment condition prediction information 117, 213... Verification plan information 210... On-board storage unit 211... Basic application program 217... Driving environment condition prediction information 218... Verification result 219... Vehicle information 219A... Verification execution schedule 220... Processing unit 221... Sensor input unit 222... Actuator output unit 223... Basic application execution control unit 224... Verification application execution control unit 225... Verification plan information acquisition unit 226... Verification result output unit 227... Driving environment condition establishment prediction unit

Claims (8)

An on-board control device mounted on a vehicle,
an in-vehicle storage unit that stores a plurality of verification application programs different from a basic application program related to driving control of the vehicle, verification plan information including driving environment conditions that are conditions related to the vehicle for verifying the verification application programs, and verification priorities for pairs of the verification application programs and the driving environment conditions, and the basic application programs ;
a CPU capable of executing the basic application program and the verification application program;
a verification execution control unit that controls execution of the verification application program based on the driving environment conditions and the verification priority ;
the verification plan information stores the verification priority for each combination of the verification application program and the driving environment condition;
The verification execution control unit prioritizes verification of a verification application program having a higher verification priority among the verification application programs for which the driving environment condition is satisfied . The on-board control device according to claim 1 ,
The vehicle-mounted storage unit further stores a verification method definition that defines a verification method under the driving environment conditions,
The verification execution control unit further controls the execution of the verification of the verification application program based on the verification method definition. The on-board control device according to claim 1 ,
The verification execution control unit obtains data necessary for verifying the verification application program from the basic application program. The on-board control device according to claim 1 ,
A driving environment condition satisfaction prediction unit predicts a timing when the driving environment of the vehicle matches the driving environment condition,
The verification execution control unit is an in-vehicle control device that further controls the execution of verification of the verification application program based on prediction information predicted by the driving environment condition satisfaction prediction unit. A server capable of communicating with a vehicle,
a server storage unit that stores a verification application program that is an application program to be verified in the vehicle, and a driving environment condition that is a condition related to the vehicle for verifying the verification application program;
a verification plan information generating unit that determines a verification priority for a set of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority;
a verification plan information output unit that outputs the verification plan information to the vehicle ,
the vehicle information includes a verification result of the verification application program executed in the vehicle;
The verification plan information generation unit updates verification progress information indicating the progress of verification regarding the verification application program based on the verification results of the verification application program, and determines the verification priority for the pair of the verification application program and the driving environment conditions based on the verification progress information. A server capable of communicating with a vehicle,
a server storage unit that stores a verification application program that is an application program to be verified in the vehicle, and a driving environment condition that is a condition related to the vehicle for verifying the verification application program;
a verification plan information generating unit that determines a verification priority for a set of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority;
a verification plan information output unit that outputs the verification plan information to the vehicle;
A driving environment condition satisfaction prediction unit that predicts a timing when the driving environment of the vehicle matches a driving environment condition included in the verification plan information based on the vehicle information ,
The verification plan information generating unit is a server that determines the verification priority for a pair of the verification application program and the driving environmental conditions based on the predicted timing. A verification system including an on-board control device mounted in a vehicle and a server capable of communicating with the on-board control device,
The server,
a server storage unit that stores a verification application program, which is an application program to be verified in the vehicle, and a driving environment condition, which is a condition related to the vehicle for verifying the verification application program;
a verification plan information generating unit that determines a verification priority for a set of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority;
a verification plan information output unit that outputs the verification plan information to the vehicle ,
The in-vehicle control device includes:
a verification plan information acquisition unit that acquires the verification plan information output by the server;
a verification execution control unit that controls execution of the verification application program based on the driving environment conditions and the verification priority in parallel with a basic application program related to driving control of the vehicle,
the vehicle information includes a verification result of the verification application program executed in the vehicle;
The verification plan information generation unit updates verification progress information indicating the progress of verification regarding the verification application program based on the verification results of the verification application program, and determines the verification priority for the pair of the verification application program and the driving environment conditions based on the verification progress information . A verification system including an on-board control device mounted in a vehicle and a server capable of communicating with the on-board control device,
The server,
a server storage unit that stores a verification application program, which is an application program to be verified in the vehicle, and a driving environment condition, which is a condition related to the vehicle for verifying the verification application program;
a verification plan information generating unit that determines a verification priority for a set of the verification application program and the driving environment conditions based on vehicle information acquired from the vehicle, and generates verification plan information including the driving environment conditions, the verification application program, and the verification priority;
a verification plan information output unit that outputs the verification plan information to the vehicle;
a driving environment condition satisfaction prediction unit that predicts a timing when the driving environment of the vehicle satisfies a driving environment condition included in the verification plan information based on the vehicle information,
The in-vehicle control device includes:
a verification plan information acquisition unit that acquires the verification plan information output by the server;
a verification execution control unit that controls execution of the verification application program based on the driving environment conditions and the verification priority in parallel with a basic application program related to driving control of the vehicle,
The verification system , wherein the verification plan information generating unit determines the verification priority for a pair of the verification application program and the driving environmental conditions based on the predicted timing .

Images