In-vehicle computer system and autonomous driving assistance system
Provided is a technology capable of adding a new function by updating a program of an in-vehicle computer system. An in-vehicle computer system includes a plurality of ECUs. Each ECU is able to communicate with at least one other ECU via a communication bus. An in-vehicle computer system includes a measurement means that measures an ECU state for the ECUs, an estimation means that estimates a vehicle state based on the ECU state and a connection configuration of a communication bus, and a management means that acquires an update program and execution conditions of the update program. The management means selects a first ECU that is to execute the update program based on the vehicle state and the execution conditions. The first ECU executes the update program. The management means determines whether or not an output delay constraint of the update program is satisfied. The management means terminates execution of a redundancy program redundant to the update program.
1 . An in-vehicle computer system that is able to communicate with a computer outside a vehicle, and
has a plurality of electronic control units (ECUs), each of the ECUs being able to communicate with at least one other ECU via a communication bus,
the in-vehicle computer system comprising:
measurement means that measures an ECU state for the ECUs, the ECU state including information indicating a program being executed in the ECU, and including a processor load, a memory usage, and a communication bus usage in the ECU;
estimation means that estimates a vehicle state based on the ECU state and a connection configuration of the communication bus; and
management means that acquires an update program and execution conditions of the update program, the execution conditions including an input delay constraint and an output delay constraint of the update program,
wherein the management means dynamically selects, at runtime, a first ECU that is to execute the update program based on (i) the ECU state measured by the measurement means, (ii) the vehicle state estimated by the estimation means, and (iii) the execution conditions including the input delay constraint and the output delay constraint, and based on a communication-bus connection configuration including a communication-bus latency between ECUs,
wherein the management means determines whether or not a time required for starting execution of the update program and terminating execution of the redundancy program satisfies a predetermined safety criterion that changes depending on a vehicle speed,
the first ECU executes the update program,
wherein the redundancy program is a program redundant for the update program, and the management means terminates execution of the redundancy program by transmitting a termination request to an ECU executing the redundancy program,
the management means determines whether or not an output delay constraint of the update program is satisfied, and
the management means terminates execution of a redundancy program redundant to the update program.
2 . The in-vehicle computer system according to claim 1 , wherein, when the ECUs detect a failure in the management means, the ECUs execute the redundancy program whose execution has been terminated by the management means.
3 . The in-vehicle computer system according to claim 1 , wherein the management means stores the update program in a random access memory (RAM) and transmits a heartbeat signal to each of the ECUs,
each of the ECUs performs detection of a failure in the management means based on a lack of the heartbeat signal,
each of the ECUs ignores a signal received from the management means after the detection when the failure is detected,
each of the ECUs transmits failure information to the other ECUs when the failure is detected, and
each of the ECUs ignores a signal received from the management means after reception of the failure information when the failure information is received.
4 . The in-vehicle computer system according to claim 1 , wherein the in-vehicle computer system executes predetermined safety processing when the output delay constraint of the update program is not satisfied.
5 . An autonomous driving assistance system comprising: the in-vehicle computer system according to claim 1 ; and a computer outside the vehicle.