Granted Patent B2

US 12,436,772 · App. 18/297,075 · Granted Oct 7, 2025

Inventors: Kazuyoshi Shiohara (Nagoya, JP); Tomoki Shibutani (Nisshin, JP); Takayuki Fujimoto (Seto, JP); Masaki Miyake (Toyota, JP)

Assignee: TOYOTA JIDOSHA KABUSHIKI KAISHA

G06F9/4401G06F8/65

Abstract

Claims (50)

1. A control device constituting a system of a vehicle, the control device comprising a central processing unit (CPU) configured to:

store first software for executing a predetermined process, the predetermined process including a first process for implementing a first function of the vehicle in cooperation with another control device constituting the system, the control device and the other control device each being configured to update software at startup when software update is available;

execute the first software;

receive information about second software stored in the other control device from the other control device before execution of the first software at the startup of the control device, the information about the second software including a program for executing the first process;

execute a startup check process including a check process for checking consistency between the first software and the second software prior to executing the first process;

conditionally permit execution of the first process based on a result of the startup check process, wherein the execution of the first process is permitted only if the check process confirms software consistency between the first software and the second software;

during operation of the control device after startup, monitor for an event indicating that the other control device has restarted or undergone a software update, wherein the CPU is configured to detect a post-startup software inconsistency based on receiving updated software information from the other control device after execution of the first software has started; and

execute a real-time enforcement process that, in response to detecting the post-startup software inconsistency, immediately stops execution of the first process if already executing, and prevents execution of the first process if not yet started.

2. The control device according to claim 1 , wherein:

the information about the second software is version information of the second software; and

the CPU is configured to check the consistency based on a combination of a version of the first software and a version of the second software in the startup check process.

3. The control device according to claim 1 , wherein the CPU is configured to:

permit the execution of the first process when a result of the check process shows consistency.

4. The control device according to claim 3 , wherein the CPU is configured to, in the startup check process, forbid the execution of the first process when the CPU is not able to receive the information about the second software within a predetermined period after start of the startup check process.

5. The control device according to claim 4 , wherein the CPU is configured to, in the startup check process, transmit a signal including information indicating the result of the check process to the other control device.

6. The control device according to claim 1 , wherein:

the predetermined process further includes a second process for implementing a second function of the vehicle by the control device alone; and

the CPU is configured to

permit the execution of the first process and the second process when a result of the check process shows consistency,

forbid the execution of the first process and permit the execution of the second process when the result of the check process shows inconsistency, and

forbid the execution of the first process and the second process when the CPU is not able to receive the information about the second software within a predetermined period after start of the startup check process.

7. A control device constituting a system of a vehicle, the control device comprising a central processing unit (CPU) configured to:

store software for executing a predetermined process, the predetermined process including a first process for implementing a first function of the vehicle in cooperation with another control device constituting the system, the control device and the other control device each being configured to update software at startup when software update is available;

execute the software;

execute a startup check process prior to executing the first process at the startup of the control device, the startup check process including,

transmitting information about the software to the other control device,

receiving a first signal indicating a result of a check process executed by the other control device using the information about the software, the check process being a process for verifying software consistency between the control device and the other control device, and

conditionally permitting execution of the first process based on a result of the startup check process, wherein execution of the first process is permitted only if the first signal confirms software consistency between the control device and the other control device;

during operation of the control device after startup, monitor for an event indicating that the other control device has restarted or undergone a software update, wherein the CPU is configured to detect a post-startup software inconsistency based on receiving a second signal from the other control device indicating updated software information after execution of the software has started; and

execute a real-time enforcement process that, in response to detecting the post-startup software inconsistency, immediately stops execution of the first process if already executing, and prevents execution of the first process if not yet started.

8. The control device according to claim 7 , wherein the CPU is configured to, in the startup check process, transmit the information about the software to the other control device at predetermined time intervals.

9. The control device according to claim 8 , wherein the CPU is configured to, in the startup check process, stop transmitting the information about the software when the first signal is received.

10. The control device according to claim 7 , wherein the information about the software includes version information of the software.

11. The control device according to claim 7 , wherein the CPU is configured to:

permit the execution of the first process when the first signal indicates that the result of the check process shows consistency.

12. The control device according to claim 11 , wherein the CPU is configured to, in the startup check process, forbid the execution of the first process when the CPU is not able to receive the first signal within a predetermined period after transmission of the information about the software.

13. The control device according to claim 7 , wherein:

the predetermined process further includes a second process for implementing a second function of the vehicle by the control device alone; and

the CPU is configured to

permit the execution of the first process and the second process when the first signal indicates that the result of the check process shows consistency,

forbid the execution of the first process and permit the execution of the second process when the first signal indicates that the result of the check process shows inconsistency, and

forbid the execution of the first process and the second process when the CPU is not able to receive the first signal within a predetermined period after transmission of the information about the software.

14. A control method for a control device constituting a system of a vehicle and including first software for executing a predetermined process, the predetermined process including a first process for implementing a function of the vehicle in cooperation with another control device constituting the system, the control device and the other control device each being configured to update software at startup when software update is available, the control method comprising:

receiving information about second software stored in the other control device from the other control device before execution of the first software at the startup of the control device, the information about the second software including a program for executing the first process;

executing a startup check process prior to executing the first process at startup, the startup check process including:

performing a check process for verifying software consistency between the first software and the second software; and

conditionally permitting execution of the first process based on a result of the check process, wherein execution of the first process is permitted only if the check process confirms software consistency between the first software and the second software;

during operation of the control device after startup, monitoring for an event indicating that the other control device has restarted or undergone a software update, wherein the control device detects a post-startup software inconsistency based on receiving updated software information from the other control device after execution of the first software has started; and

executing a real-time enforcement process that, in response to detecting the post-startup software inconsistency, immediately stops execution of the first process if already executing, and prevents execution of the first process if not yet started.

15. A recording medium configured to record a program for executing the control method according to claim 14 .

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (9)