阅读说明：本技术 车辆控制装置 (Vehicle control device ) 是由 大口良辅 天沼佳幸 山本健介 西本怜史 佐久间和辉 于 2021-03-19 设计创作，主要内容包括：本发明提供一种车辆控制装置(100),具备：转向操纵控制部(30),其与搭载于车辆(1)的车载通信网(10)连接,控制将与驾驶员的转向操作相应的辅助转矩附加于转向机构的转向操纵用马达(3b)；和非法信号检测部(50),其与车载通信网(10)连接,检测输入到车载通信网(10)的非法信号。当由非法信号检测部(50)检测到非法信号时,转向操纵控制部(30)实施限制转向操纵用马达(3b)的辅助转矩的转向操纵用马达(3b)的转矩限制。(The invention provides a vehicle control device (100), comprising: a steering control unit (30) that is connected to a vehicle-mounted communication network (10) mounted on a vehicle (1) and controls a steering motor (3b) that applies an assist torque corresponding to a steering operation by a driver to a steering mechanism; and an unauthorized signal detection unit (50) that is connected to the vehicle-mounted communication network (10) and detects an unauthorized signal input to the vehicle-mounted communication network (10). When the illegal signal is detected by the illegal signal detection unit (50), the steering control unit (30) limits the torque of the steering motor (3b) that limits the assist torque of the steering motor (3 b).)

1. A vehicle control device (100) is characterized by comprising:

a steering control unit (30) that is connected to a vehicle-mounted communication network (10) mounted on a vehicle (1) and controls a steering motor (3b) that applies an assist torque corresponding to a steering operation by a driver to a steering mechanism; and

an unauthorized signal detection unit (50) which is connected to the vehicle-mounted communication network (10) and detects an unauthorized signal input to the vehicle-mounted communication network (10),

when the illegal signal is detected by the illegal signal detection unit (50), the steering control unit (30) performs torque limitation of the steering motor (3b) that limits the assist torque of the steering motor (3 b).

2. The vehicle control apparatus (100) according to claim 1,

when the illegal signal is detected by the illegal signal detection unit (50), the steering control unit (30) performs torque limitation of the steering motor (3b) by reducing the power supplied to the steering motor (3b) as compared to when the illegal signal is not detected.

3. The vehicle control apparatus (100) according to claim 1,

when the unauthorized signal is detected by the unauthorized signal detection unit (50), the steering control unit (30) stops the supply of electric power to the steering motor (3b), thereby limiting the torque of the steering motor (3 b).

4. The vehicle control apparatus (100) according to claim 1,

the steering control unit (30) performs torque limitation of the steering motor (3b) after a notification operation for notifying a driver of the torque limitation of the steering motor (3b) is performed.

5. The vehicle control apparatus (100) according to claim 4,

an engine control device (20) for controlling the rotational speed of an engine (2) of the vehicle (1) is connected to the vehicle-mounted communication network (10),

the steering control unit (30) instructs the engine control device (20) to reduce the rotational speed of the engine (2) as the notification operation.

6. The vehicle control apparatus (100) according to claim 4 or 5,

a display control device (40) for controlling the display of a display unit (4) on the instrument panel of the vehicle (1) is connected to the vehicle-mounted communication network (10),

the steering control unit (30) instructs the display control device (40) to display a predetermined display on the display unit (4) as the notification operation.

7. The vehicle control apparatus (100) according to claim 1,

the unauthorized signal detection unit (50) is provided in a gateway device (50) configured to relay transmission and reception of data signals between a plurality of devices (20, 30, 40) connected to the vehicle-mounted communication network (10).

Technical Field

The present invention relates to a vehicle control device that controls a steering mechanism of a vehicle.

Background

Conventionally, there is known a device for detecting a DoS attack (Denial of Service attack) applied to a vehicle-mounted communication network from a device outside a vehicle (see, for example, patent document 1). In the device described in patent document 1, when it is determined that a DoS attack has occurred, the relay of the data signal to each electronic control device by the gateway is stopped.

However, in the device described in patent document 1, the gateway stops relaying the data signal only when it is determined that the DoS attack is occurring, and does not take into consideration the influence of an illegal signal input before the determination is made on the vehicle. Therefore, these signals may cause the steering mechanism of the vehicle to generate an unnecessary assist torque and an unintended steering force.

Documents of the prior art

Patent document

Patent document 1: japanese patent laid-open publication No. 2016-143963 (JP 2016-143963A).

Disclosure of Invention

A vehicle control device according to an aspect of the present invention includes: a steering control unit connected to a vehicle-mounted communication network mounted on a vehicle, and controlling a steering motor that applies an assist torque corresponding to a steering operation of a driver to a steering mechanism; and an unauthorized signal detection unit that is connected to the on-vehicle communication network and detects an unauthorized signal input to the on-vehicle communication network. When the illegal signal is detected by the illegal signal detection unit, the steering control unit performs torque limitation of the steering motor that limits the assist torque of the steering motor.

Drawings

The objects, features and advantages of the present invention are further clarified by the following description of the embodiments in relation to the accompanying drawings.

Fig. 1 is a diagram schematically showing an example of a vehicle-mounted communication network including a vehicle control device according to an embodiment of the present invention.

Fig. 2 is a diagram illustrating a data frame input to the gateway of fig. 1.

Fig. 3 is a block diagram schematically showing a configuration of a main part of each part of the vehicle-mounted communication network of fig. 1.

Fig. 4 is a flowchart showing an example of processing of an illegal data frame performed by the gateway of fig. 3.

Fig. 5 is a block diagram schematically showing a main part configuration of a modification of the vehicle control device according to the embodiment of the present invention.

Fig. 6 is a flowchart showing an example of processing for an illegal data frame performed by the steering control ECU of fig. 5.

Detailed Description

An embodiment of the present invention will be described below with reference to fig. 1 to 4. Fig. 1 is a diagram schematically showing an example of an in-vehicle communication network 10 including a vehicle control device 100 according to an embodiment of the present invention. As shown in fig. 1, the in-vehicle communication network 10 includes an engine control ECU (engine control device) 20 that controls an engine 2 of the vehicle 1, a steering control ECU30 that controls a steering device 3, a display control ECU (display control device) 40 that controls a display unit 4 on an instrument panel, and a gateway 50 that relays communication between the ECUs 20, 30, and 40 and communication with the outside of the vehicle (transmission and reception of data signals). The vehicle control device 100 according to the embodiment of the present invention may be configured by the gateway 50 and the steering control ECU 30. That is, the functions provided by the vehicle control device 100 can be distributed to the gateway 50 and the steering control ECU 30. An example in which the vehicle control device 100 is configured by the gateway 50 and the steering control ECU30 will be described below.

The engine control ECU20, the steering control ECU30, the display control ECU40, and the gateway 50 are communicably connected to each other via a serial communication line 11 such as a CAN (Controller Area Network) communication line. More specifically, the engine control ECU20 and the steering control ECU30 that constitute a control system communication network of the vehicle 1 are communicably connected to the gateway 50 via the serial communication line 11a, and the engine control ECU20 and the steering control ECU30 perform cooperative control by transmitting and receiving data signals to and from each other via the serial communication line 11 a. The display control ECU40 constituting the information system communication network of the vehicle 1 and the gateway 50 are communicably connected to each other via a serial communication line 11 b. The engine control ECU20, the steering control ECU30, and the display control ECU40 perform cooperative control by transmitting and receiving data signals to and from each other via the gateway 50.

Fig. 2 is a diagram illustrating a data frame input to the gateway 50. The data signals input from the ECUs 20, 30, and 40 and the data signals input from outside the vehicle are input to the gateway 50 as one data frame. As shown in fig. 2, the data Frame includes SOF (Start Of Frame) indicating the Start Of the data Frame, IDs indicating identification information Of a transmission source, a transmission destination, and the like, a data field as entity data, EOF (End Of Frame) indicating the End Of the data Frame, and the like.

The engine control ECU20 and the steering control ECU30 receive only data frames including the ID to be received, which is set in advance, from among the data frames input to the serial communication line 11a based on the ID of each data frame. Thus, for example, the steering ECU30 receives the engine speed transmitted from the engine control ECU20 and uses the engine speed for the processing of the next calculation cycle, thereby realizing cooperative control of the steering ECU30 and the engine control ECU 20. At this time, the data frame is also input to the gateway 50, and the gateway 50 also manages the relay of the data frame by the ECUs 20 and 30.

Similarly, the engine control ECU20, the steering control ECU30, and the display control ECU40 receive only data frames including the IDs to be received, which are set in advance, from among the data frames input to the serial communication lines 11a and 11b, based on the IDs of the data frames. Thus, for example, the steering ECU30 receives the display information transmitted from the display control ECU40 and uses the information in arithmetic processing, thereby realizing cooperative control of the steering ECU30 and the display control ECU 40. At this time, the gateway 50 manages the relay of the data frames by the ECUs 20, 30, and 40.

Such a vehicle-mounted communication network 10 may be attacked by so-called DoS attack (Denial of Service attack), in which transmission and reception of normal data frames are disturbed due to a large number of illegal data frames being transmitted (input) by a malicious third party. When such a DoS attack is received, the ECUs 20, 30, and 40 connected to the in-vehicle communication network 10 may not operate normally, and therefore the gateway 50 stops relaying data frames. On the other hand, before it is determined that the gateway is subjected to the DoS attack, the in-vehicle communication network 10 transmits an unauthorized data frame, and there is a possibility that an unintended steering force may be generated by the unauthorized data frame, for example, the steering control ECU 30. Therefore, in order to prevent the generation of an unintended steering force, the vehicle control device 100 according to the embodiment of the present invention is configured as follows.

Fig. 3 is a block diagram schematically showing a configuration of a main part of each part of the vehicle-mounted communication network 10 of fig. 1. As shown in fig. 3, the gateway 50 includes a computer having an arithmetic unit 51 such as a CPU, a storage unit 52 such as a ROM, a RAM, and a hard disk, and other peripheral circuits. The arithmetic unit 51 has a functional configuration of a signal reading unit 511, a relay unit 512, a determination unit 513, a communication restriction unit 514, and an output unit 515. The storage unit 52 has an ID storage unit 521 as a functional configuration.

The signal reading unit 511 reads all the data frames input to the in-vehicle communication network 10. The read data frames include not only data frames input from the ECUs 20, 30, and 40 in the vehicle but also data frames input from the outside of the vehicle via a TCU (remote control unit) not shown in the figure that performs wireless communication and a DLC (data link connector) not shown in the figure that can be connected to a diagnostic device or the like.

The relay unit 512 relays the data frame read by the signal reading unit 511 to the ECUs 20, 30, and 40. More specifically, the relay unit 512 specifies a transmission destination based on the ID of the data frame read by the signal reading unit 511, and transfers (relays) the data frame to the specified transmission destination.

The judgment unit 513 judges whether or not the data frame read by the signal reading unit 511 is an illegal data frame. The determination unit 513 determines whether or not the read data frame is an illegal data frame based on an ID list described later stored in the ID storage unit 521. For example, the judgment unit 513 judges that a data frame having an ID not in the ID list in which regular IDs are listed in advance is an illegal data frame. The determination unit 513 determines that the data frame is an illegal data frame when the transmission source is an unknown ID or an ID of a transmission source whose ID is actually present but should not be transmitted, or when the ID received by itself and its approximate transmission cycle are stored together and the data frame having the ID is received at a cycle shorter than the stored transmission cycle. The determination unit 513 may determine whether or not the data frame is an unauthorized data frame input from a tampered ECU or an unauthorized external device by a known method, and perform the determination based on the determination.

When the determination unit 513 determines that the data frame is an unauthorized data frame, the communication restriction unit 514 restricts communication to the in-vehicle communication network 10. More specifically, communication regulation unit 514 prohibits (stops) the relay of the data frame to each ECU20, 30, 40 of vehicle-mounted communication network 10, and disconnects the communication between vehicle-mounted communication network 10 and the outside of the vehicle.

When the determination unit 513 determines that the data frame is an unauthorized data frame, the output unit 515 transmits the data frame instructing the function restriction to the steering control ECU 30. The output unit 515 encrypts the data frame of the function restriction command by a MAC algorithm using a MAC key to generate a Message Authentication Code (MAC), and transmits the generated MAC and the data frame of the function restriction command to the steering control ECU 30. By transmitting the data frame to which the MAC is added, falsification of the data frame can be prevented.

When the determination unit 513 determines that the data frame is an illegal data frame, the output unit 515 transmits a data frame indicating a notification command for notifying the driver of the vehicle 1 of a predetermined notification operation in which the assist torque (assist of the steering force) by the steering device 3 is limited, to the engine control ECU20 and the display control ECU 40. For example, the output unit 515 outputs a data frame of the 1 st notification command to the engine control ECU20, and outputs a data frame of the 2 nd notification command to the display control ECU 40. Upon receiving the data frame of the 1 st notification command, the engine control ECU20 performs control to reduce the rotation speed of the engine 2 of the vehicle 1 so as to reduce the vehicle speed. By reducing the engine speed to reduce the vehicle speed, the driver of the vehicle 1 can be made aware of the occurrence of some abnormality. Upon receiving the data frame of the 2 nd notification command, the display control ECU40 controls the display unit 4 disposed on the instrument panel of the vehicle 1 to display a warning lamp for limiting the generated assist torque. The output unit 515 transmits the data frame of the 1 st notification command and the data frame of the 2 nd notification command to the engine control ECU20 and the display control ECU40 before transmitting the data frame of the function restriction command to the steering control ECU 30.

The ID storage unit 521 stores an ID list that lists IDs (regular IDs) of regular ECUs. The regular ID is an ID set in each ECU of the vehicle 1 together with the vehicle ID at the time of manufacturing the vehicle 1, and is an ID different for each ECU.

As shown in fig. 3, the steering ECU30 is configured to include a computer having an arithmetic unit 31 such as a CPU, a storage unit 32 such as a ROM, a RAM, and a hard disk, and other peripheral circuits. The arithmetic unit 31 has a functional configuration of a function restricting unit 311. Upon receiving the data frame of the function restriction instruction output from the output portion 515 of the gateway 50, the function restriction portion 311 restricts the assist function for the steering operation (the turning operation of the steering wheel 3a) by the steering apparatus 3 operated by the driver. For example, the amount of assist torque to be generated by the steering mechanism is reduced, and the assist function of the steering operation is reduced.

Here, the steering device 3 will be briefly described with reference to fig. 1. As shown in fig. 1, the steering device 3 includes a steering wheel 3a that is rotationally operated by a driver, a steering motor 3b, a steering shaft 3c that rotates integrally with the steering wheel 3a, and a steering gear box 3d that steers the wheels 1a and 1b in accordance with the rotation of the steering shaft 3 c. The steering wheel 3a, the steering shaft 3c, and the steering gear box 3d constitute a steering mechanism, and the steering motor 3b assists the driver in rotating the steering wheel 3a by applying an assist torque corresponding to the rotation of the steering wheel 3a to the steering shaft 3 c. For example, the steering motor 3b provides a turning force that makes the steering wheel 3a easier to turn, and provides the driver with a greater operation reaction force with a greater amount of operation of the steering wheel 3 a. An operation reaction force is generated in accordance with the operation amount of the steering wheel 3a, thereby preventing the driver from unnecessarily over-rotating the steering wheel 3 a.

The steering motor 3b is connected to the battery 1c via an inverter, not shown, and is driven by electric power supplied from the battery 1 c. The steering motor 3b controls the electric power supplied from the battery 1c by the function restricting unit 311. That is, the function restricting unit 311 controls the driving of the steering motor 3b and controls the assist torque applied to the steering shaft 3 c.

When the data frame of the function restriction instruction is received, the function restriction unit 311 controls the supply of electric power to the steering motor 3b so that the electric power supplied to the steering motor 3b is reduced from before the data frame of the function restriction instruction is received. That is, when the data frame of the function restriction instruction is received, the function restriction unit 311 decreases the power supply to the steering motor 3b to reduce the assist torque applied to the steering shaft 3 c. Thus, even when there is a possibility that the steering motor 3b is unnecessarily operated due to an unauthorized data frame input to the on-vehicle communication network 1, for example, the assist torque applied to the steering shaft 3c is reduced, and therefore, an abrupt change in the assist amount of the steering motor 3b is suppressed, and it is possible to prevent unintended steering from occurring.

The function restricting portion 311 may also stop the supply of electric power to the steering motor 3b when receiving the data frame of the function restriction instruction. By stopping the supply of electric power to the steering motor 3b, the assist function of the steering motor 3b is stopped, and the occurrence of unintended steering can be more reliably prevented.

As shown in fig. 3, the ECU20 for engine control is configured to include a computer having an arithmetic unit 21 such as a CPU, a storage unit 22 such as a ROM, a RAM, and a hard disk, and other peripheral circuits. The arithmetic unit 21 has a notification operation unit 211 as a functional configuration. Upon receiving the data frame of the 1 st notification command output from the output unit 515 of the gateway 50, the notification operation unit 211 performs control to decrease the rotation speed of the engine 2 so as to decrease the vehicle speed of the vehicle 1. The driver of the vehicle 1 can recognize that there is a possibility of some abnormality from a decrease in the vehicle speed, and can easily respond to the restriction of the assist function of the steering operation that occurs later.

The display control ECU40 includes a computer having an arithmetic unit 41 such as a CPU, a storage unit 42 such as a ROM, a RAM, and a hard disk, and other peripheral circuits. The arithmetic unit 41 has a notification operation unit 411 as a functional configuration. Upon receiving the data frame of the 2 nd notification command output from the output unit 515 of the gateway 50, the notification operating unit 411 controls the display unit 4 so as to display a warning lamp for assisting the steering force on the display unit 4 disposed on the instrument panel of the vehicle 1. The driver of the vehicle 1 can easily respond to the restriction of the assist function of the steering operation that occurs later by displaying the warning lamp for assisting the restriction of the steering operation force on the display unit 4.

Fig. 4 is a flowchart showing an example of processing for an illegal data frame performed by the gateway 50 of fig. 3. The processing shown in fig. 4 is repeated after the data frame is input to the serial communication lines 11a and 11 b.

First, in S1 (S: processing step), the signal reading unit 511 reads the ID (identification information) of the input data frame. Next, in S2, the processing of the determination unit 513 determines whether or not the input data frame is an illegal data frame. If S2 is negative (S2: no), the relay unit 512 transfers (relays) the data frame to the destination based on the ID of the data frame in S3.

On the other hand, if S2 is affirmative (S2: yes), then in S4, the data frame of the 1 st notification command is output to ECU20 for engine control by the processing of output unit 515. Next, at S5, the data frame of the 2 nd notification command is output to the display control ECU40 by the processing at the output unit 515. It should be noted that S4 and S5 may be executed simultaneously or in reverse order.

Next, at S6, the data frame of the function restriction command is output to the steering control ECU30 by the processing at the output unit 515. Next, at S7, the process performed by communication restricting unit 514 prohibits (stops) the relay of the data frame to each ECU20, 30, 40 of vehicle-mounted communication network 10, and disconnects the communication between vehicle-mounted communication network 10 and the outside of the vehicle.

The main operation of the vehicle control device 100 according to the present embodiment will be described. When the gateway 50 detects an unauthorized data frame from the data frame (data signal) input to the in-vehicle communication network 10 (S2), it transmits a data frame of a function restriction command to the steering control ECU30 (S6). When receiving the data frame of the function restriction command, the steering control ECU30 controls the supply of electric power to the steering motor 3b so that the electric power supplied to the steering motor 3b is reduced from before the data frame of the function restriction command is received.

At this time, the gateway 50 transmits a data frame of a notification command instructing a notification operation to the engine control ECU20 and the display control ECU40 before transmitting a data frame of a function restriction command to the steering control ECU 30.

The present embodiment can provide the following effects.

(1) The vehicle control device 100 includes: a steering control ECU30 connected to the vehicle-mounted communication network 10 mounted on the vehicle 1, and controlling a steering motor 3b that applies an assist torque corresponding to steering to a steering mechanism; and a gateway 50 that detects an illegal signal input to the in-vehicle communication network 10. When the gateway 50 determines that the data frame input to the in-vehicle communication network 10 is an unauthorized data frame (an unauthorized data frame is detected), the steering control ECU30 restricts the assist torque from the steering motor 3 b.

With this configuration, even when there is a possibility that the steering motor 3b is unnecessarily operated due to an unauthorized data frame input to the on-vehicle communication network 10, the assist torque applied to the steering shaft 3c is limited, and therefore, for example, the assist amount from the steering motor 3b is limited from changing abruptly, and it is possible to prevent unintended steering from occurring.

(2) When the gateway 50 determines that the data frame is invalid, the steering control ECU30 controls the supply of electric power to the steering motor 3b so that the electric power supplied to the steering motor 3b is reduced as compared to when the invalid data frame is not detected. This reduces the assist torque applied to the steering shaft 3c, and thus suppresses an abrupt change in the assist amount from the steering motor 3 b. As a result, it is possible to prevent the occurrence of unintended steering.

(3) When the unauthorized signal is detected by the gateway 50, the steering control ECU30 stops the supply of electric power to the steering motor 3 b. Thus, the electric power supply to the steering motor 3b is stopped, and the assist function of the steering motor 3b is stopped, whereby the occurrence of unintended steering can be more reliably prevented.

(4) The steering control ECU30 limits the assist torque from the steering motor 3b after performing a notification operation to notify the driver of the torque limit of the steering motor 3 b. Thus, the occurrence of the notification operation makes it possible for the driver of the vehicle 1 to recognize that there is a possibility of some abnormality, and to easily respond to the restriction of the assist function of the steering operation that occurs later.

(5) An engine control ECU20 that controls the rotation speed of the engine 2 of the vehicle 1 is connected to the vehicle-mounted communication network 10. The steering control ECU30 limits the assist torque of the steering motor 3b after the notification operation of the engine control ECU20 to decrease the rotation speed of the engine 2. As a result, the vehicle speed is reduced by the reduction in the rotation speed of the engine 2, so that the driver of the vehicle 1 can recognize that there is a possibility of some abnormality and can easily cope with the restriction of the assist function of the steering operation that occurs later. In particular, the occurrence of a certain abnormality can be easily recognized by a decrease in the vehicle speed.

(6) The vehicle-mounted communication network 10 is connected with a display control ECU40 that controls display on the display unit 4 on the instrument panel of the vehicle 1. The steering control ECU30 limits the assist torque of the steering motor 3b after the display control ECU40 displays a predetermined display notification operation on the display unit 4. Thus, the warning lamp for stopping the steering force assist is displayed on the display unit 4, so that the driver of the vehicle 1 can easily respond to the restriction of the steering assist function that occurs later. In particular, by displaying on the display unit 4, it is possible to easily recognize that some abnormality may occur.

Fig. 5 is a block diagram showing a main part configuration of a modification of the vehicle control device according to the embodiment of the present invention. In the above embodiment, the vehicle control device is configured by the steering control ECU30 and the gateway 50, but the functions of the vehicle control device may be mounted only on the steering control ECU. The following description deals with an example in which the functions of the vehicle control device are mounted only on the steering control ECU. Note that the following description will be focused on differences from the steering control ECU30, and the same reference numerals as those of the steering control ECU30 are given to the same configuration as that of the steering control ECU30, and the description thereof will be omitted.

As shown in fig. 5, the arithmetic unit 31A of the steering control ECU30A has a functional configuration including a signal reading unit 312, a determination unit 313, an output unit 314, and a function restriction unit 311. The storage unit 32A has an ID storage unit 321 as a functional configuration.

The signal reading unit 312 reads the data frame input to the serial communication line 11 a. The determination unit 313 determines whether or not the data frame read by the signal reading unit 312 is an illegal data frame. The determination unit 313 determines whether or not the read data frame is an illegal data frame based on the ID list stored in the ID storage unit 321. For example, the determination unit 313 determines that a data frame having an ID that is not in the ID list in which regular IDs are listed in advance is an illegal data frame. The determination unit 313 determines that the data frame is an illegal data frame when the transmission source is an unknown ID or an ID of a transmission source whose ID is not actually present but should not be transmitted, or when the ID received by itself and its approximate transmission cycle are stored together and the data frame having the ID is received at a cycle shorter than the stored transmission cycle. The determination unit 313 may determine whether or not the data frame is an unauthorized data frame input from a tampered ECU or an unauthorized external device by a known method, and perform the determination based on the determination.

When the determination unit 313 determines that the data frame is an illegal data frame, the output unit 314 transmits a data frame to the engine control ECU20 and the display control ECU40, the data frame instructing a notification command to notify the driver of the vehicle 1 of a predetermined notification operation in which the assist torque (assist of the steering force) from the steering apparatus 3 is restricted. For example, the output unit 515 outputs a data frame of the 1 st notification command to the engine control ECU20, and outputs a data frame of the 2 nd notification command to the display control ECU 40. The data frame of the 2 nd notification command is output to the display control ECU40 via the gateway 50.

When the determination unit 313 determines that the data frame is an illegal data frame, the function restriction unit 311 restricts the assist function for the steering operation using the steering operation device 3 operated by the driver.

Fig. 6 is a flowchart showing an example of processing for an illegal data frame performed by the steering control ECU of fig. 5. The processing shown in fig. 6 is repeated after a data frame is input to the serial communication line 11 a.

First, in S11, the signal reading unit 312 reads the ID (identification information) of the input data frame. Next, in S12, the processing of the determination unit 313 determines whether or not the input data frame is an illegal data frame. When S12 is negated (S12: NO), coordination control is executed in S13.

On the other hand, if S12 is affirmative (S12: yes), then in S14, the data frame of the 1 st notification command is output to ECU20 for engine control by the processing at output unit 314. Next, at S15, the data frame of the 2 nd notification command is output to display control ECU40 by the processing at output unit 314. It should be noted that S14 and S15 may be executed simultaneously or in reverse order. Next, in S16, the assist function for the steering operation by the steering operation device 3 is restricted by the processing in the function restricting unit 311.

In the above embodiment, the vehicle control device 100 is configured to include the gateway 50 and the steering control ECU30, but the vehicle control device may include a steering control unit that controls the steering motor and an unauthorized signal detection unit that detects an unauthorized signal input to the vehicle-mounted communication network.

The above-described embodiment assists the rotation operation of the steering wheel 3a by adding the assist torque corresponding to the rotation of the steering wheel 3a to the steering shaft 3c, but may be configured to assist the rotation operation of the steering wheel 3a by adding the assist torque corresponding to the rotation of the steering wheel 3a to the steering gear box 3 d. That is, the steering motor may be a steering motor.

One or more of the above embodiments and modifications may be arbitrarily combined, or modifications may be combined with each other.

The invention can prevent the occurrence of unintended steering operation when illegal signals are input into the vehicle-mounted communication network.

While the invention has been described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the scope of the disclosure of the following claims.