Control apparatus, control system, control method, and storage medium

1. A control apparatus comprising:

a receiver which, in operation, receives an instruction for controlling a brake of a movable-body apparatus;

a discriminator which, in operation,

(i) determines, in response to the instruction being received by the receiver, an indicator based on a speed of the movable-body apparatus and a distance between the movable-body apparatus and an obstacle, and

(ii) determines, in a case where the instruction is inconsistent with a situation of the movable-body apparatus determined in accordance with the indicator and a predetermined threshold value, that the instruction is a fraudulent instruction that should not be followed; and

a controller which, in operation, performs control so as not to execute control based on the instruction in response to the instruction being determined as a fraudulent instruction.

2. The control apparatus according to claim 1 ,

wherein the controller performs control so as not to execute control based on the instruction by invalidating or discarding the instruction.

3. The control apparatus according to claim 1 ,

wherein the speed is a relative speed of the movable-body apparatus with respect to the obstacle.

4. The control apparatus according to claim 1 ,

wherein the discriminator determines the indicator by a predetermined calculation based on the speed and the distance.

5. The control apparatus according to claim 4 ,

wherein the instruction includes an amount of deceleration by the brake,

in a case where the instruction includes a maximum amount of deceleration, and a result of the predetermined calculation is greater than a first threshold value, the discriminator determines that the instruction is a fraudulent instruction, and

in a case where the instruction includes zero deceleration, and the result of the predetermined calculation is less than a second threshold value less than or equal to the first threshold value, the discriminator determines that the instruction is a fraudulent instruction.

6. The control apparatus according to claim 5 ,

wherein the predetermined calculation is set to have a result less than or equal to the first threshold value and greater than or equal to the second threshold value in a case where the instruction transmitted from an emergency brake electronic control unit in a normal state includes an amount of deceleration greater than zero.

7. The control apparatus according to claim 4 ,

wherein the controller, in operation, modifies a detail of the predetermined calculation in accordance with a change in a structural element of the movable-body apparatus that affects a braking distance of the movable-body apparatus of the brake.

8. The control apparatus according to claim 4 ,

wherein the receiver, in operation, receives obstacle information that indicates a type of the obstacle and is detected by the movable-body apparatus, and

the controller, in operation, modifies a detail of the predetermined calculation in accordance with the obstacle information.

9. The control apparatus according to claim 1 ,

wherein, in a case where the instruction instructs the brake to be actuated, the discriminator determines a ratio of the distance to the speed, as the indicator.

10. The control apparatus according to claim 1 ,

wherein a predetermined condition is set in accordance with a type of the movable-body apparatus, the predetermined condition being a condition for determining that the instruction is a fraudulent instruction that should not be followed in the case where the instruction is inconsistent with the situation of the movable-body apparatus.

11. The control apparatus according to claim 1 ,

wherein the receiver, in operation, receives measurement information that indicates measurement results of the speed and the distance and is measured by the movable-body apparatus, and

the discriminator determines, based on the speed and the distance indicated by the measurement information, whether or not the instruction is a fraudulent instruction.

12. The control apparatus according to claim 1 ,

wherein the receiver, in operation, performs communication via a network according to a Controller Area Network protocol, and receives the instruction in a data frame, and

the controller, in operation, performs control to transmit an error frame for invalidating the data frame in response to the instruction being determined as a fraudulent instruction.

13. The control apparatus according to claim 1 ,

wherein the receiver, in operation, receives a data frame including the instruction using a sensor which is communicatively coupled to a dedicated communication line.

14. The control apparatus according to claim 1 ,

wherein the control apparatus is an electronic control unit among at least one or more electronic control units, the electronic control unit, in operation, controlling the brake of the movable-body apparatus,

in response to the instruction being determined as a fraudulent instruction, the controller performs control to inhibit control of the brake that follows the instruction by discarding the instruction.

15. The control apparatus according to claim 1 ,

wherein at least one or more electronic control units in the movable-body apparatus include a brake electronic control unit,

the brake electronic control unit includes storage medium and a brake controller which, in operation, controls the brake in accordance with information stored in the storage medium,

the control apparatus is included in the brake electronic control unit,

in response to the instruction being determined as a fraudulent instruction, the controller performs control to discard the instruction by avoiding storing, into the storage medium, information indicating the instruction.

16. The control apparatus according to claim 1 ,

wherein the instruction is inconsistent in a case where the instruction includes designating a maximum deceleration amount for actuating the brake when designating the maximum deceleration amount for actuating the brake is not needed.

17. The control apparatus according to claim 1 ,

wherein the instruction is inconsistent in a case where the instruction includes designating zero deceleration amount for actuating the brake when designating more than a predetermined deceleration amount for actuating the brake is needed.

18. The control apparatus according to claim 1 ,

wherein the discriminator determines that the instruction is a fraudulent instruction that should not be followed in a case where a relation between the indicator and the predetermined threshold value indicates a situation where actuating the brake is not needed, and the instruction includes designating a maximum deceleration amount for actuating the brake.

19. The control apparatus according to claim 1 ,

wherein the discriminator determines that the instruction is a fraudulent instruction that should not be followed in a case where a relation between the indicator and the predetermined threshold value indicates a situation where actuating the brake is needed, and the instruction includes designating zero deceleration amount for actuating the brake.

20. A control system comprising:

a brake provided to a movable-body apparatus;

a detection apparatus which, in operation, detects an obstacle; and

a control apparatus, including:

a receiver which, in operation, receives an instruction for controlling the brake;

a discriminator which, in operation,

(i) determines, in response to the instruction being received by the receiver, an indicator based on a speed of the movable-body apparatus and a distance between the movable-body apparatus and the obstacle, and

(ii) determines, in a case where the instruction is inconsistent with a situation of the movable-body apparatus determined in accordance with the indicator and a predetermined threshold value, that the instruction is a fraudulent instruction that should not be followed; and

a controller which, in operation, performs control so as not to execute control based on the instruction in response to the instruction being determined as a fraudulent instruction.

21. A control method comprising:

receiving an instruction for controlling a brake of a movable-body apparatus;

determining, in response to the receiving of the instruction, an indicator based on a speed of the movable-body apparatus and a distance between the movable-body apparatus and an obstacle;

determining, in a case where the instruction is inconsistent with a situation of the movable-body apparatus determined in accordance with the indicator and a predetermined threshold value, that the instruction is a fraudulent instruction that should not be followed; and

performing control so as not to execute control based on the instruction in response to the instruction being determined as a fraudulent instruction.

22. A non-transitory storage medium storing thereon a control program for causing an apparatus including a microprocessor to perform a fraud detection process,

wherein the fraud detection process includes:

receiving an instruction for controlling a brake of a movable-body apparatus;

determining, in response to the receiving of the instruction, an indicator based on a speed of the movable-body apparatus and a distance between the movable-body apparatus and an obstacle;

determining, in a case where the instruction is inconsistent with a situation of the movable-body apparatus determined in accordance with the indicator and a predetermined threshold value, that the instruction is a fraudulent instruction that should not be followed; and

performing control so as not to execute control based on the instruction in response to the instruction being determined as a fraudulent instruction.