Abstract: The purpose of the present invention is to provide a vehicle control technique that enables the safety of function substitution to be increased. This vehicle control device determines whether a substitution was successful by monitoring the operations which follow initiation of the substitution.

Abstract: In the present invention, when an abnormality occurs in a task, regardless of whether a critical section is being executed, timeout detection is realized by determining whether the critical section (CS) is necessary for the design in a preset task execution time and a certain period of time to distinguish between necessary interrupt disable and abnormal interrupt disable. A vehicle control device includes task execution means for causing a system to execute a task, and interrupt processing means for performing an interrupt process at the time of execution of the task. A maskable interrupt and a non-maskable interrupt that is commanded to execute after the maskable interrupt are included, the maskable interrupt is commanded to execute during an interrupt disable time, and then the non-maskable interrupt is executed.

Abstract: Fail operational that can guarantee stability of control while suppressing cost increase is difficult. A control controller according to the present invention stores information necessary for recovery in a normal travel mode in time series in a backup, and thus control software can be recovered from the backup in real time if a failure occurs in the system.

Abstract: The present invention provides a vehicle control apparatus in which a function stop caused by an access conflict when a high load is applied can be suppressed. The vehicle control apparatus according to the present invention determines the occurrence tendency of access conflicts by using a function expressed by the number of times of performing exclusive control on a shared storage area and by the number of the resultant access conflicts.

Abstract: This invention detects deviations from design without hindering the real-time nature of interrupt processing, and assists in analyzing the impact of faults caused by unintentional interrupt processing, with the goal of curbing erroneous detection. In order to resolve this problem, this vehicle control device comprises; a deviation determination unit 129 which determines if execution timing of an execution body has deviated from design settings, and transitions to a monitoring state; and a run-time verification unit 130 which verifies the impact of deviation at timing which differs from that of the interrupt processing.

Abstract: The present invention provides a vehicle control device capable of realizing access authority definitions by the number equal to or greater than the number of access control registers provided in a memory protection device. In the vehicle control device according to the present invention, the whole or a part of a storage device that stores the access authority definitions used by the memory protection device to control the access authorities, is allocated fixedly to a memory area in advance and the rest is allocated dynamically.

Abstract: The present invention provides a vehicle control apparatus in which a function stop caused by an access conflict when a high load is applied can be suppressed. The vehicle control apparatus according to the present invention determines the occurrence tendency of access conflicts by using a function expressed by the number of times of performing exclusive control on a shared storage area and by the number of the resultant access conflicts.

Abstract: The present invention provides technology for achieving both high responsiveness to an interrupt process and non-interference between control software. This vehicle control device comprises a storage device that stores various programs for controlling a vehicle, and a plurality of computation devices that include a first computation device and a second computation device, and that read a program from the storage device and execute the same. In addition, the storage device includes a first type of computation processing program executed not by time division and a second type of computation processing program executed by time division. The first computation device is configured to execute the first type of computation processing program, and the second computation device is configured to execute the second type of computation processing program.

Abstract: The purpose of the present invention is to provide a system such that functions of a vehicle control system can be quickly reconfigured. The present invention is a processing device connected to at least one processing device, wherein during a period in which the one processing device executes a control operation on the basis of a control program installed in the one processing device, the processing device acquires a substitute program for the control program. In another aspect, the present invention is an on-board control system equipped with multiple processing devices, wherein during a period in which one processing device among the multiple processing devices executes a control operation on the basis of a control program installed in the one processing device, another processing device acquires a substitute program for the program in the one processing device.

Abstract: The purpose of the present invention is to provide a vehicle control technique that enables the safety of function substitution to be increased. This vehicle control device determines whether a substitution was successful by monitoring the operations which follow initiation of the substitution.

Abstract: In order to detect and prevent attacks in which the network is infested with unauthorized data to cause malfunction, the invention aims, on the basis of network cycle information, to detect errors and to prevent unauthorized data forwarding in a network system such as a vehicle-mounted network. This network device is provided with a communication unit which receives data, a time management unit which manages the reception time at which data is received, and a control unit which processes data.

Abstract: A method for testing control software of a controlled system is disclosed. The method may involve providing control software code data for each of the one or more electronic control units. The method may further involve providing simulation code data for the controlled system. The method may further involve providing verification requirement information data that indicates one or more verification requirement conditions corresponding to a respective control error situation. The method may further involve creating a system model based on the provided simulation code data and the provided control software code data provided for each of the one or more electronic control units. The method may further involve creating an executable program based on the created system model and performing a software verification process on the basis of the executable program.

Abstract: If exclusive control is used when carrying out update processing or reference processing to a data buffer in a shared memory among plural arithmetic units, waiting time increases and it is difficult to guarantee a real time property. Accordingly, in a control device for a vehicle, a data buffer is multiplexed, and each arithmetic unit carries out update processing and reference processing to a different multiplexed data buffer. An arithmetic unit that is different from the arithmetic unit executing the data update processing synchronizes one data buffer updated by data update processing, with the multiplexed data buffer, in a shorter time than an execution cycle of the data update processing.

Abstract: In the present invention, on the basis of the results of determining whether or not a constituent element of a vehicle control device is malfunctioning, the malfunction determination logic for determining whether or not the vehicle control device as a whole is malfunctioning is caused to be easily reusable. This vehicle control device determines the level of functional malfunction of the vehicle control device on the basis of what combination of hardware configuring the vehicle control device is malfunctioning, and executes a failsafe function that is in accordance with the level of functional malfunction (see FIG. 5).

Abstract: In order to detect and prevent attacks in which the network is infested with unauthorized data to cause malfunction, the invention aims, on the basis of network cycle information, to detect errors and to prevent unauthorized data forwarding in a network system such as a vehicle-mounted network. This network device is provided with a communication unit which receives data, a time management unit which manages the reception time at which data is received, and a control unit which processes data.

Abstract: The present invention relates to a method and a system for testing control software of a controlled system, the controlled system comprising one or more electronic control units, one or more actuators, and one or more sensors, each sensor being adapted to input a respective sensor signal to at least one of the one or more electronic control units and each actuator being adapted to act responsive to respective control signals input from at least one of the electronic control units, and each electronic control unit being configured to execute a respective executable control program based on control software code data to output one or more control signals to the one or more actuators on the basis of input sensor signals.

Abstract: If exclusive control is used when carrying out update processing or reference processing to a data buffer in a shared memory among plural arithmetic units, waiting time increases and it is difficult to guarantee a real time property. In a control device for vehicle according to the invention, a data buffer is multiplexed and each arithmetic unit carries out update processing and reference processing to a different multiplexed data buffer. Also, an arithmetic unit that is different from the arithmetic unit executing the data update processing synchronizes one data buffer updated by data update processing, with the multiplexed data buffer in a shorter time than an execution cycle of the data update processing.

Abstract: In the present invention, on the basis of the results of determining whether or not a constituent element of a vehicle control device is malfunctioning, the malfunction determination logic for determining whether or not the vehicle control device as a whole is malfunctioning is caused to be easily reusable. This vehicle control device determines the level of functional malfunction of the vehicle control device on the basis of what combination of hardware configuring the vehicle control device is malfunctioning, and executes a failsafe function that is in accordance with the level of functional malfunction (see FIG. 5).

Abstract: Provided is a technology for performing communications between ECUs with different required safety levels while satisfying the required safety levels of the ECUs. An automotive control unit according to the present invention modifies the error detection method used for data transmission in accordance with the required degree of accuracy of operation of the receiving-end unit (as per FIG. 2).

Abstract: Provided is a technology such that communication performance required for relaying communication data in an in-vehicle network including a time-triggered network can be appropriately maintained even when the traffic to be relayed by a gateway is increased or decreased. An in-vehicle gateway according to the present invention dynamically changes a slot amount or the slot ID used by the in-vehicle gateway for the time-triggered network in accordance with the traffic to be relayed, and determines the execution timing of a process corresponding to a slot in accordance with the changed slot amount or slot ID (see FIG. 9).