Abstract:
There are provided an inspection apparatus, an inspection system, and an inspection method capable of inspecting operation of a control device, accurately, during use. 
     An inspection apparatus configured to inspect operation of an ECU coupled to automotive networks, includes an inspection performance control unit configured to transmit two pieces of data including operation-inspection data and security-check data used for inspecting the operation of the ECU, to the ECU, and configured to receive data output from the ECU. The operation-inspection data is data previously generated based on design information of the ECU. The security-check data is data including part or entirety of the operation-inspection data replaced with random data.

Description:
TECHNICAL FIELD 
       [0001]    The present invention relates to an inspection apparatus, an inspection system, and an inspection method that inspect operation of a control device with which a motor vehicle has been equipped. In particular, the invention is suitable for applying to an inspection apparatus, an inspection system, and an inspection method that inspect operation of a control device coupled to automotive networks. 
       BACKGROUND ART 
       [0002]    Recently, a technique of coupling a plurality of control devices (electronic control units: ECUs) with which a motor vehicle has been equipped, to automotive networks (controller area network: CAN) and operating the plurality of control devices in cooperation with each other through the automotive networks, has been developed. 
         [0003]    Examples of the plurality of ECUs include an engine ECU that performs control of an engine, a transmission ECU that performs control of shift changing, and a brake ECU that adjusts brake oil pressure. PTL 1 discloses a technique of determining a defect of cooperating operation and specifying a failure area in a case where the plurality of ECUs operates in cooperation with each other. 
         [0004]    In particular, PTL 1 discloses a failure diagnosis system including a defect determining means configured to determine occurrence of the defect due to the cooperating operation, based on data transmitted and received between the ECUs through automotive networks, a program acquisition means configured to acquire an inspection diagnosis program previously prepared in correspondence to the defect when the occurrence of the defect is determined, and a failure area specifying means configured to perform the inspection diagnosis program so as to perform corresponding processing to the ECUs, and configured to specify the failure area based on information transmitted from the ECUs by the performance of the corresponding processing. 
       CITATION LIST 
     Patent Literature 
       [0005]    PTL 1: JP 4622177 B2 
       SUMMARY OF INVENTION 
     Technical Problem 
       [0006]    However, the failure diagnosis system described in PTL 1 specifies the failure area, using the previously prepared inspection diagnosis program. The inspection diagnosis program is a program previously generated before use, based on design information on the ECUs. Thus, it cannot be determined whether the ECUs properly operate in a case where data not assumed at a design stage, is transmitted to the ECUs during the use. 
         [0007]    That is, a failure can be specified about the failure (a malfunction). However, it cannot be accurately determined whether the operation being performed is normal or abnormal. 
         [0008]    The present invention has been made in consideration of the above point. An object of the present invention is to propose an inspection apparatus, an inspection system, and an inspection method capable of inspecting operation of an ECU accurately during use. 
       Solution to Problem 
       [0009]    In order to solve the above problem, the inspection apparatus according to the present invention includes: an inspection performance control unit configured to transmit two pieces of data including operation-inspection data and security-check data used for inspecting operation of an ECU, to the ECU, and configured to receive data output from the ECU. The operation-inspection data is data previously generated based on design information of the ECU. The security-check data is data including part or entirety of the operation-inspection data replaced with random data. 
         [0010]    In order to solve the above problem, an inspection system according to the present invention, includes: a service providing server including: an inspection plan unit configured to plan a schedule for inspecting operation of an ECU; an inspection data generation unit configured to generate two pieces of data including operation-inspection data and security-check data used for inspecting the operation of the ECU; and an inspection control unit configured to transmit the generated two pieces of data to an exterior in accordance with the planned schedule; and a gateway configured to transmit, in a case where the two pieces of data including the operation-inspection data and the security-check data transmitted from the service providing server, are received, the received two pieces of data to the ECU, the gateway configured to transmit, in a case where data output from the ECU is received, inspection performance result information including the received data to the service providing server. The operation-inspection data is data previously generated based on design information of the ECU. The security-check data is data including part or entirety of the operation-inspection data replaced with random data. 
         [0011]    In order to solve the problem, an inspection method according to the present invention, includes: a first step of planning a schedule for inspecting operation of an ECU, by an inspection plan unit; a second step of generating two pieces of data including operation-inspection data and security-check data used for inspecting the operation of the ECU, by an inspection data generation unit; a third step of transmitting the generated two pieces of data to an exterior, by an inspection control unit, in accordance with the planned schedule; and a fourth step of transmitting by a gateway, in a case where the two pieces of data including the operation-inspection data and the security-check data transmitted from a service providing server, are received, the received two pieces of data to the ECU, and in a case where data output from the ECU is received, inspection performance result information including the received data to the service providing server. The operation-inspection data is data previously generated based on design information of the ECU. The security-check data is data including part or entirety of the operation-inspection data replaced with random data. 
       Advantageous Effects of Invention 
       [0012]    According to the present invention, the operation of the ECU during the use can be accurately inspected. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0013]      FIG. 1  is a block diagram of an entire configuration of an inspection system according to the present embodiment. 
           [0014]      FIG. 2  is a table of a logical configuration of user information. 
           [0015]      FIG. 3  is a table of a logical configuration of object-to-be-inspected vehicle information. 
           [0016]      FIG. 4  is a table of a logical configuration of object-to-be-inspected ECU information. 
           [0017]      FIG. 5  is a table of a logical configuration of security-check data information. 
           [0018]      FIG. 6  is a table of a logical configuration of operation-inspection data information. 
           [0019]      FIG. 7  is a table of a logical configuration of schedule information. 
           [0020]      FIG. 8  is a table of a logical configuration of field structure information. 
           [0021]      FIG. 9  is a table of a logical configuration of field segment information. 
           [0022]      FIG. 10  is a table of a logical configuration of field dependence information. 
           [0023]      FIG. 11  is a table of a logical configuration of inspection result information. 
           [0024]      FIG. 12  is a table of a logical configuration of inspection collation result information. 
           [0025]      FIG. 13  is a table of a logical configuration of inspection performance data information. 
           [0026]      FIG. 14  is a table of a logical configuration of inspection performance result information. 
           [0027]      FIG. 15  is a table of a configuration of a data frame structure. 
           [0028]      FIG. 16  is a view of a screen configuration of a schedule approval screen. 
           [0029]      FIG. 17  is a flow chart of schedule registration processing. 
           [0030]      FIG. 18  is a flow chart of schedule registration processing on the side of a terminal having a communication function. 
           [0031]      FIG. 19  is a flow chart of schedule registration processing on the side of a service providing sever. 
           [0032]      FIG. 20  is a flow chart of ECU inspection processing. 
           [0033]      FIG. 21  is a flow chart of ECU inspection processing on the side of the terminal having a communication function. 
           [0034]      FIG. 22  is a flow chart of ECU inspection processing on the side of the service providing server. 
           [0035]      FIG. 23  is a flow chart of ECU inspection processing on the side of a gateway of a motor vehicle. 
           [0036]      FIG. 24  is a flow chart of security-check data generation processing. 
           [0037]      FIG. 25  is a flow chart of ECU inspection processing in a case where a gateway analyzes an inspection result. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0038]    One embodiment of the present invention will be described below for the drawings. 
       (1) Entire Configuration 
       [0039]      FIG. 1  illustrates an entire configuration of an inspection system  5  according to the present embodiment. The inspection system  5  is configured with a motor vehicle  1 , a service providing server  2 , and a terminal having a communication function  3 . The motor vehicle  1 , the service providing server  2 , and the terminal having a communication function  3  are coupled so as to be communicable to each other through a communication network  4 . The communication network  4  is, for example, a mobile phone network or a wireless local area network (LAN). 
         [0040]    The motor vehicle  1  is configured with a gateway  11  and a plurality of electronic control units (ECUs)  12 . The gateway  11  and each of the ECUs  12  are coupled through automotive networks referred to as a controller area network (CAN). 
         [0041]    The gateway  11  here is a terminal that functions as an inspection apparatus. The gateway  11  is configured with an inspection performance control unit  111 , an inspection information acquisition unit  112 , an inspection performance unit  113 , an inspection monitor unit  114 , a communication unit  115 , and an inspection information management unit  116 . 
         [0042]    The inspection performance control unit  111  stores an inspection performance data information  1161  received through the communication unit  115 , in the inspection information management unit  116 , and also acquires and transmits the inspection performance data information  1161  stored in the inspection information management unit  116 , to the ECUs  12 . The inspection performance data information  1161  includes operation-inspection data and security-check data. 
         [0043]    The operation-inspection data is test data of the ECUs  12  to be previously generated at a design stage based on design information. The details will be given later (refer to  FIG. 6 ). The security-check data is test data for inspecting and diagnosing whether operation of the ECUs  12  is normal or abnormal during actual use. The details will be given later (refer to  FIG. 5 ). Note that, these pieces of data are collectively referred to as inspection data in some cases. 
         [0044]    The inspection information acquisition unit  112  acquires inspection performance result information  1162  stored in the inspection information management unit  116 , and transmits the inspection performance result information  1162  to the service providing server  2  through the communication unit  115 . The inspection performance unit  113  transmits the operation-inspection data and the security-check data to the ECUs  12  based on an inspection performance request from the inspection performance control unit  111 . 
         [0045]    The inspection monitor unit  114  monitors and acquires data output from the ECUs  12  based on the operation-inspection data and the security-check data, and stores the acquired data as the inspection performance result information  1162  in the inspection information management unit  116 . 
         [0046]    The ECUs  12  are control devices that control various types of instruments included in the motor vehicle  1 . Examples of the ECUs  12  include an engine ECU that performs control of an engine, a transmission ECU that performs control of shift changing, and a brake ECU that adjusts brake oil pressure. 
         [0047]    The service providing server  2  is configured with an inspection plan unit  21 , an inspection control unit  22 , an inspection data generation unit  23 , a dependence analysis unit  231 , a field structure analysis unit  232 , an inspection data allocation unit  233 , an inspection data entry unit  24 , an inspection result collection unit  25 , an inspection result analysis unit  26 , and an inspection service information management unit  27 . 
         [0048]    The inspection plan unit  21  plans a schedule of an inspection to be performed to the ECUs  12 , transmits the planned schedule to the terminal having a communication function  3  owned by a user of the motor vehicle  1 , receives the schedule approved in the terminal having a communication function  3 , and stores the schedule in the inspection service information management unit  27 . 
         [0049]    The inspection control unit  22  collectively controls operation of the inspection data generation unit  23 , the inspection data entry unit  24 , the inspection result collection unit  25 , and the inspection result analysis unit  26 . 
         [0050]    The inspection data generation unit  23  generates the security-check data, using the dependence analysis unit  231 , the field structure analysis unit  232 , and the inspection data allocation unit  233 , and stores the generated security-check data in the inspection service information management unit  27 . 
         [0051]    The inspection data entry unit  24  transmits a notification for performing an inspection, to the terminal having a communication function  3  owned by the user of the motor vehicle  1 , acquires the security-check data and the operation-inspection data from the inspection service information management unit  27 , and transmits the pieces of data to the motor vehicle  1  being an object to be inspected. 
         [0052]    When receiving an inspection completion notification from the gateway  11 , the inspection result collection unit  25  transmits a collection request for the inspection performance result information  1162  to the gateway  11 , and stores the inspection performance result information  1162  collected from the gateway  11 , in the inspection service information management unit  27 . 
         [0053]    The inspection result analysis unit  26  acquires inspection result information  280  and inspection collation result information  281  from the inspection service information management unit  27 , and compares both of the pieces of information so as to analyze whether a signal output from the ECUs  12  is normal or abnormal. 
         [0054]    The inspection service information management unit  27  includes various types of information ( 271  to  281 ) necessary for operation of the service providing server  2 . The details of the various types of information will be described later (refer to  FIGS. 2 to 14 ). 
         [0055]    The terminal having a communication function  3  is configured with a screen display unit  31 , a service performance confirmation unit  32 , and a communication unit  33 . The screen display unit  31  displays the schedule of the inspection planned by the service providing server  2 , on a display screen, and also displays an inspection result analyzed by the service providing server  2 , on the display screen. The service performance confirmation unit  32  performs editing and approval processing for the schedule of the inspection displayed on the display screen. 
       (2) Table Configuration 
       [0056]    The various types of information stored in the inspection service information management unit  27  of the service providing server  2  will be described with reference to  FIGS. 2 to 12 . 
         [0057]      FIG. 2  illustrates a logical configuration of user information  271 . The user information  271  is configured with a user ID column  2711 , a user PASS column  2712 , and a user name column  2713 . The user ID column  2711  stores identification information of a user who uses the inspection system  5 . The user PASS column  2712  stores a password of the user. The user name column  2713  stores a user name. 
         [0058]      FIG. 3  illustrates a logical configuration of object-to-be-inspected vehicle information  272 . The object-to-be-inspected vehicle information  272  is configured with a user ID column  2721 , a vehicle identification number (VIN) column  2722 , a maker column  2723 , a model column  2724 , a color column  2725 , and a vehicle number column  2726 . 
         [0059]    The user ID column  2721  stores the identification information of the user. The VIN column  2722  stores identification information for identifying the motor vehicle  1  being the object to be inspected. The maker column  2723  stores a maker name of the motor vehicle  1 . The model column  2724  stores a model of the motor vehicle  1 . The color column  2725  stores a color of the motor vehicle  1 . The vehicle number column  2726  stores a vehicle number of the motor vehicle  1 . 
         [0060]      FIG. 4  illustrates a logical configuration of object-to-be-inspected ECU information  273 . The object-to-be-inspected ECU information  273  is configured with a model column  2731 , an ECU-ID column  2732 , an ECU name column  2733 , an-object-to-be-inspected flag column  2734 , an inspection period column  2735 , and a CAN-ID column  2736 . 
         [0061]    The model column  2731  stores the model of the motor vehicle  1  being the object to be inspected. The ECU-ID column  2732  stores identification information for identifying the ECUs  12  being objects to be inspected. The ECU name column  2733  stores an ECU name. The object-to-be-inspected flag column  2734  stores information of whether the ECUs  12  are objects to be inspected, and, for example, stores “target” or “non-target”. 
         [0062]    The inspection period column  2735  stores an inspection period. The CAN-ID column  2736  stores identification information of the CAN to which ECUs  12  being the objects to be inspected, have been coupled. 
         [0063]      FIG. 5  illustrates a logical configuration of security-check data information  274 . The security-check data information  274  is configured with an inspection ID column  2741 , an ECU-ID column  2742 , a CAN-ID column  2743 , and an inspection data column  2744 . 
         [0064]    The inspection ID column  2741  stores identification information for identifying an inspection with security-check data allocated to each of the ECUs  12  being the objects to be inspected. The ECU-ID column  2742  stores identification information for identifying the ECUs  12  to be objects to be inspected with the security-check data. 
         [0065]    The CAN-ID column  2743  stores identification information of the CAN to which the ECUs  12  being the objects to be inspected have been coupled. The inspection data column  2744  stores inspection data and stores, for example, data corresponding to a data field of a CAN protocol. 
         [0066]      FIG. 6  illustrates a logical configuration of operation-inspection data information  275 . The operation-inspection data information  275  is configured with an inspection ID column  2751 , an ECU-ID column  2752 , a CAN-ID column  2753 , and an inspection data column  2754 , similarly to the security-check data information  274 . 
         [0067]    The inspection ID column  2751  stores identification information for identifying an inspection with the operation-inspection data allocated to each of the ECUs  12  being the objects to be inspected. The ECU-ID column  2752  stores identification information for identifying the ECUs  12  to be objects to be inspected with the operation-inspection data. 
         [0068]    The CAN-ID column  2753  stores the identification information of the CAN to which the ECUs  12  being the objects to be inspected have been coupled. The inspection data column  2754  stores inspection data and stores, for example, data corresponding to a data field of a CAN protocol. 
         [0069]      FIG. 7  illustrates a logical configuration of schedule information  276 . The schedule information  276  is configured with a VIN column  2761 , a date-and-time column  2762 , and an inspection ID column  2763 . The VIN column  2761  stores the identification information for identifying the motor vehicle  1  being the object to be inspected. 
         [0070]    The date-and-time column  2762  stores an inspection date and time approved by the user of the motor vehicle  1  being the object to be inspected. The inspection ID column  2763  stores identification information for identifying the inspection to be performed to the motor vehicle  1 . 
         [0071]      FIG. 8  illustrates a logical configuration of field structure information  277 . The field structure information  277  is configured with a model column  2771 , a CAN-ID column  2772 , a detailed field ID column  2773 , a segment ID column  2774 , and a bit number column  2775 . 
         [0072]    The model column  2771  stores the model of the motor vehicle  1  being the object to be inspected. The CAN-ID column  2772  stores the identification information of the CAN to which the ECUs  12  being the objects to be inspected have been coupled. 
         [0073]    The detailed field ID column  2773  stores identification information for identifying a segment having a meaning in which the data field of the CAN protocol has been classified in more detail, based on design information of applications of the ECUs  12 . The segment ID column  2774  stores identification information for identifying a meaning included in data, based on the design information of the applications of the ECUs  12 . 
         [0074]    For example, the segment ID column  2774  stores an eigenvalue for identifying a segment of “significant digits, variable data, reservation data, dummy data, or checksums”. The bit number column  2775  stores the number of bits allocated to detailed field ID. 
         [0075]      FIG. 9  illustrates a logical configuration of field segment information  278 . The field segment information  278  is configured with a segment ID column  2781  and a segment name column  2782 . The segment ID column  2781  stores identification information for identifying a type of data to be used in the data field of the CAN protocol. 
         [0076]    The segment name column  2782  stores a name of the type of data to be used in the data field of the CAN protocol, the name of the type of data corresponding to segment ID. The name of the type of data may be segmented into, for example, “significant digits, variable data, reservation data, dummy data, or checksums”. 
         [0077]      FIG. 10  illustrates a logical configuration of field dependence information  279 . The field dependence information  279  is configured with a model column  2791 , a CAN-ID column  2792 , and a detailed field dependence column  2793 . The model column  2791  stores the identification information of the motor vehicle  1  being the object to be inspected. The CAN-ID column  2792  stores the identification information of the CAN to which the ECUs  12  being the objects to be inspected have been coupled. 
         [0078]    The detailed field dependence column  2793  stores information indicating processing dependence of the detailed field ID (refer to  FIG. 8 ) in the applications of the ECUs  12 , based on, for example, away to be used as a condition of branch processing or an argument of a function call in the design information of the applications of the ECUs  12 . For example, in a case where there is dependence between A1 and A2 in the detailed field ID (refer to  FIG. 8 ), “A1 &amp; A2” is stored with “&amp;”. 
         [0079]      FIG. 11  illustrates a logical configuration of the inspection result information  280 . The inspection result information  280  is configured with a VIN column  2801 , an inspection result column  2802 , and performance inspection ID column  2803 . The VIN column  2801  stores the identification information for identifying the motor vehicle  1  being the object to be inspected. The inspection result column  2802  stores a result of the inspection that has been performed, as a log file. The performance inspection ID column  2803  stores identification information for identifying the inspection performed to the motor vehicle  1 . 
         [0080]      FIG. 12  illustrates a logical configuration of the inspection collation result information  281 . The inspection collation result information  281  is configured with a model column  2811 , a CAN-ID column  2812 , a performance inspection data column  2813 , an estimate output data column  2814 , and a determination result column  2815 . 
         [0081]    The model column  2811  stores the model of the motor vehicle  1  being the object to be inspected. The CAN-ID column  2812  stores the identification information of the CAN to which the ECUs  12  being the objects to be inspected have been coupled. 
         [0082]    The performance inspection data column  2813  stores inspection data transmitted to the ECUs  12 . The estimate output data column  2814  stores data estimated to be output by the ECUs  12  based on a result of the transmission of the performed inspection data to the ECUs  12 . 
         [0083]    The determination result column  2815  stores a result determined by comparing the estimate output data and output data being stored in the log file of the inspection result (refer to  FIG. 11 ). For example, in a case where the output data is within a range of the estimate output data, “no abnormality” is stored. In a case where the output data is out of the range of the estimate output data, “abnormality” is stored. 
         [0084]    Next, the various types of information stored in the inspection information management unit  116  of the motor vehicle  1 , will be described with reference to  FIGS. 13 and 14 . 
         [0085]      FIG. 13  illustrates a logical configuration of the inspection performance data information  1161 . The inspection performance data information  1161  is configured with a performance order column  11611 , an inspection ID column  11612 , a CAN-ID column  11613 , an inspection data column  11614 , and a progress column  11615 . 
         [0086]    The performance order column  11611  stores order in which inspection data stored in the inspection data column  11614  is transmitted to the ECUs  12 . The inspection ID column  11612  stores identification information for identifying the operation-inspection data or the security-check data in association with each of the ECUs  12 . 
         [0087]    The CAN-ID column  11613  stores the identification information of the CAN to which the ECUs  12  being the objects to be inspected have been coupled. The inspection data column  11614  stores the inspection data (the operation-inspection data or the security-check data) to be transmitted to the ECUs  12 . 
         [0088]    The progress column  11615  stores information of whether the inspection using the inspection data stored in the inspection data column  11614  has been completed. For example, “completion” is stored with timing with which the inspection data is transmitted to the ECUs  12  and data output from the ECUs  12  is acquired. 
         [0089]      FIG. 14  illustrates a logical configuration of the inspection performance result information  1162 . The inspection performance result information  1162  is configured with an inspection ID column  11621  and an inspection result column  11622 . The inspection ID column  11621  stores identification information for identifying the operation-inspection data or the security-check data in association with each of the ECUs  12 . 
         [0090]    The inspection result column  11622  stores the data output from the ECUs  12  after the inspection performance unit  113  transmits the inspection data stored in the inspection data column  11614  to the ECUs  12 . For example, a log file including “a date, the inspection data transmitted to the ECUs  12 , and the data output from the ECUs  12 ”, recorded therein, is stored. 
       (3) Data Structure 
       [0091]      FIG. 15  illustrates a data frame structure. The data frame structure is stipulated with ISO15031 of the international organization for standardization. 
         [0092]    A start of frame (SOF) field is a field that indicates a start of a data frame. An arbitration field is configured with ID (an identifier) indicating a destination, and a remote transmission request (RTR). The arbitration field is a field that indicates priority of the frame. A controller field is a field that indicates a reservation bit and the number of bytes of data. 
         [0093]    Note that, the ID included in the arbitration field is CAN-ID according to the present embodiment. The CAN-ID determines a structure (segments) of the data field to be described later. 
         [0094]    The data field is a field that stores a data body. According to the present embodiment, random data is stored in a part of the data field or the entirety thereof so that the security-check data is generated. Note that, the security-check data is generated by the inspection data generation unit  23  of the service providing server  2 . 
         [0095]    Details of generation processing of the security-check data will be described later (refer to  FIG. 24 ). Here, with the simple descriptions, the inspection data generation unit  23  first analyzes the structure (the segments) of the data field, and acquires, for example, an analysis result indicating four segments. Next, dependence of each of the segments is analyzed. Finally, based on the dependence, the random data is stored in any of segments having proper inspection efficiency, and then the security-check data is generated. 
         [0096]    A CRC field is a field that checks an error of the data frame. An ACK field is a field that indicates a sign of confirmation of reception that has been correctly made. An end of frame (EOF) field is a field that indicates an end of the data frame. 
       (4) Screen Configuration 
       [0097]      FIG. 16  illustrates a screen configuration displayed by the screen display unit  31  of the terminal having a communication function  3 . The screen is a screen upon editing or approval in the terminal having a communication function  3  in a case where the service providing server  2  has transmitted the schedule of the inspection to the terminal having a communication function  3 . 
         [0098]    A user name region  311  displays a user name registered as the user of the motor vehicle  1  being the object to be inspected. The user name is acquired from the user name stored in the user name column  2713 . A maker region  312  displays the maker name of the motor vehicle  1  being the object to be inspected. The maker name is acquired from the maker name stored in the maker column  2723 . 
         [0099]    A model region  313  displays the model of the motor vehicle  1  being the object to be inspected. The model is acquired from the model stored in the model column  2724 . A color region  314  displays the color of the motor vehicle  1  being the object to be inspected. The color is acquired from the color stored in the color column  2725 . A vehicle number region  315  displays the vehicle number of the motor vehicle  1  being the object to be inspected. The vehicle number is acquired from the vehicle number stored in the vehicle number column  2726 . 
         [0100]    An inspection date and time region  316  displays the schedule prepared by the inspection plan unit  21 , to be editable. A performance period region  317  displays an inspection period. The inspection period is acquired from the inspection period stored in the inspection period column  2735 . A registration approval button  318  is a button to be pressed upon approving the inspection to be performed at the inspection date and time displayed on the inspection day and time region  316 . 
       (5) Flow Charts 
       [0101]      FIG. 17  illustrates processing steps of schedule registration processing. The schedule registration processing is performed by the service providing server  2  and the terminal having a communication function  3 . 
         [0102]    First, the inspection plan unit  21  of the service providing server  2  transmits a notification of an inspection approval request (SP 1 ). The notification of the inspection approval request is a notification for requesting transmission of ID and a password. When receiving the notification of the inspection approval request, the service performance confirmation unit  32  of the terminal having a communication function  3  transmits the ID and the password input by the user, to the service providing server  2  (SP 2 ). 
         [0103]    Next, when receiving the ID and the password, the inspection plan unit  21  refers to the user information  271  and then performs identification processing of the ID and the password (SP 3 ). When the identification processing identifies the ID and the password, the inspection plan unit  21  refers to the object-to-be-inspected vehicle information  272  and the object-to-be-inspected ECU information  273 , prepares one inspection schedule or a plurality of inspection schedules, and transmits a notification of an approval request for the prepared one schedule or the prepared plurality of schedules, to the terminal having a communication function  3  (SP 4 ). 
         [0104]    The notification of the approval request for the one schedule or the plurality of schedules, is a notification for instructing displaying of the one schedule or the plurality of schedules together with the various types of information included in the user information  271 , the object-to-be-inspected vehicle information  272 , and the object-to-be-inspected ECU information  273 . When receiving the notification of the approval request for the one schedule or the plurality of schedules, the screen display unit  31  displays the one schedule or the plurality of schedules together with the various types of information included in the notification, on the display screen (SP 5 ). Note that, the display screen to be displayed is the display screen described in  FIG. 16 . 
         [0105]    After editing the one schedule or the plurality of schedules as necessary (SP 6 ), the service performance confirmation unit  32  approves the one schedule or the plurality of schedules by the press of the registration approval button  318  (SP 7 ). The service performance confirmation unit  32  transmits the approved one schedule or the approved plurality of schedules, to the service providing server  2  (SP 8 ). When receiving the one schedule or the plurality of schedules from the terminal having a communication function  3 , the inspection plan unit  21  stores the one schedule or the plurality of schedules in the schedule information  276  (SP 9 ). 
         [0106]    The inspection plan unit  21  transmits a registration completion notification for notifying that the one schedule or the plurality of schedules has been stored and the registration has been completed (SP 10 ). When receiving the registration completion notification, the screen display unit  31  displays a registration completion screen indicating that the registration has been completed (SP 11 ), and completes the schedule registration processing. 
         [0107]      FIG. 18  illustrates detailed processing steps of the schedule registration processing on the side of the terminal having a communication function  3 . Here, the detailed processing steps of the processing performed by the terminal having a communication function  3  during the schedule registration processing in  FIG. 17 , will be described. 
         [0108]    In wait for the inspection approval request (SP 101 ), the service performance confirmation unit  32  of the terminal having a communication function  3  determines whether the notification of the inspection approval request transmitted from the service providing server  2  has been received (SP 102 ). When the service performance confirmation unit  32  acquires a negative result with the determination at step SP 102 , the processing proceeds to step SP 101  so as to be on standby. 
         [0109]    In contrast to this, when acquiring a positive result with the determination at step SP 102 , the service performance confirmation unit  32  transmits the ID and the password to the service providing server  2 . After that, when receiving the notification of the schedule approval request from the service providing server  2 , the service performance confirmation unit  32  displays the one schedule or the plurality of schedules together with the various types of information, on the display screen (SP 103 ). 
         [0110]    The service performance confirmation unit  32  determines whether editing operation of the user has instructed the editing of the one schedule or the plurality of schedules (SP 104 ). When the service performance confirmation unit  32  acquires a negative result with the determination at step SP 104 , the processing proceeds to step SP 106 . When acquiring a positive result, the service performance confirmation unit  32  edits the one schedule or the plurality of schedules (SP 105 ). 
         [0111]    Next, the service performance confirmation unit  32  edits the one schedule or the plurality of schedules in a range of the performance period displayed on the performance period region  317 , and approves the one schedule or the plurality of schedules by the press of the registration approval button  318 . The service performance confirmation unit  32  transmits the approved one schedule or the approved plurality of schedules to the service providing server  2  (SP 106 ). 
         [0112]    In wait for the schedule registration completion (SP 107 ), the service performance confirmation unit  32  determines whether the registration completion notification has been received (SP 108 ). When the service performance confirmation unit  32  acquires a negative result with the determination at step SP 108 , the processing proceeds to step SP 107 . In contrast to this, when acquiring a positive result with the determination at step SP 108 , the service performance confirmation unit  32  displays the registration completion screen on the display screen (SP 109 ), and then completes the schedule registration processing. 
         [0113]      FIG. 19  illustrates detailed processing steps of the schedule registration processing on the side of the service providing server  2 . Here, the detailed processing steps of the processing performed by the service providing server  2  during the schedule registration processing in  FIG. 17 , will be described. 
         [0114]    When completing the identification processing of the ID and the password transmitted from the terminal having a communication function  3 , the inspection plan unit  21  of the service providing server  2  refers to the object-to-be-inspected ECU information  273  and prepares the one schedule or the plurality of schedules during the “inspection period” (SP 111 ). 
         [0115]    Next, the inspection plan unit  21  acquires the user information  271  and the object-to-be-inspected vehicle information  272  (SP 112 ), and then transmits, for example, the user information  271  together with the prepared one schedule or the prepared plurality of schedules, to the terminal having a communication function  3  (SP 113 ). Next, in wait for reception of the one schedule or the plurality of schedules approved in the terminal having a communication function  3  (SP 114 ), the inspection plan unit  21  determines whether the approved one schedule or the approved plurality of schedules has been received (SP 115 ). 
         [0116]    When the inspection plan unit  21  acquires a negative result with the determination at step SP 115 , the processing proceeds to step SP 114 . In contrast to this, when acquiring a positive result with the determination at step SP 115 , the inspection plan unit  21  stores the received one schedule or the received plurality of schedules in the schedule information  276  (SP 116 ). The inspection plan unit  21  transmits the registration completion notification to the terminal having a communication function  3  (SP 117 ), and then completes the schedule registration processing. 
         [0117]      FIG. 20  illustrates a series of processing steps of ECU inspection processing. The ECU inspection processing is performed by the gateway  11  of the motor vehicle  1 , the service providing server  2 , and the terminal having a communication function  3 . 
         [0118]    First, the inspection control unit  22  of the service providing server  2  regularly or irregularly refers to the schedule information  276 , and acquires “date and time” of an inspection schedule so as to check the one schedule or the plurality of schedules (SP 21 ). Next, the inspection control unit  22  determines whether an inspection to be performed is present (SP 22 ). When the inspection control unit  22  acquires a negative result, the processing goes back to step SP 21 . When the inspection control unit  22  acquires a positive result, the processing proceeds to step SP 23 . 
         [0119]    Next, the inspection control unit  22  transmits an inspection performance notification to the terminal having a communication function  3  by the inspection data entry unit  24  (SP 23 ). When receiving the inspection performance notification, the screen display unit  31  displays a reminder screen (SP 24 ). Meanwhile, the inspection data entry unit  24  acquires inspection data from the security-check data information  274  and the operation-inspection data information  275 , and transmits the acquired inspection data to the gateway  11  of the motor vehicle  1  being the object to be inspected (SP 25 ). 
         [0120]    When receiving the inspection data, the inspection performance control unit  111  of the gateway  11  stores the received inspection data in the inspection performance data information  1161  (SP 26 ). Next, the inspection performance control unit  111  confirms a vehicle state of the motor vehicle  1  (SP 27 ). In a case where the motor vehicle  1  is not on standby (SP 28 : N), the inspection performance control unit  111  determines that the state is not inspectable, and then the processing proceeds to step SP 27 . 
         [0121]    Note that, on standby means that the motor vehicle  1  is in a stopped state and a certain period of time also has passed. In a state where the motor vehicle  1  is on standby (SP 28 : Y), the inspection performance control unit  111  acquires the inspection data stored in the inspection performance data information  1161 , and the inspection performance unit  113  transmits the acquired inspection data to the ECUs  12  (SP 29 ). 
         [0122]    Next, the inspection performance control unit  111  acquires data output from the ECUs  12  by the inspection monitor unit  114 , in particular, captures a packet (SP 30 ), and stores the captured packet in the inspection performance result information  1162 . 
         [0123]    Next, the inspection performance control unit  111  confirms whether inspection data to be transmitted to the ECUs  12  remains in the inspection performance data information  1161  (SP 31 ). In a case where the inspection data remains, the processing proceeds to step SP 28 . In a case where no inspection data remains, the processing proceeds to step SP 32 . Note that, in a case where the inspection has not been completed even when a certain period of time has passed, the service providing server  2  may be notified of a warning. 
         [0124]    In a case where no inspection data to be transmitted to the ECUs  12  remains, the inspection performance control unit  111  transmits an inspection result completion notification indicating that the inspection has been completed, to the service providing server  2  (SP 32 ). When receiving the inspection result completion notification, the inspection control unit  22  of the service providing server  2  transmits a notification of an inspection result collection request, to the gateway  11  by the inspection result collection unit  25  (SP 33 ). 
         [0125]    When receiving the notification of the inspection result collection request, the inspection information acquisition unit  112  of the gateway  11  acquires the inspection performance result information  1162  (SP 34 ), and then transmits the acquired inspection performance result information  1162  to the service providing server  2  (SP 35 ). When receiving the inspection performance result information  1162 , the inspection result collection unit  25  of the service providing server  2  stores the inspection performance result information  1162  in the inspection result information  280  (SP 36 ). 
         [0126]    Next, the inspection result analysis unit  26  refers to the inspection result information  280  and the inspection collation result information  281 , and compares an output result actually output from the ECUs  12  and an output result being estimated so as to analyze the inspection result information  280  (SP 37 ), determines the analysis result (SP 38 ), and stores the determined result in the inspection collation result information  281 . 
         [0127]    The inspection control unit  22  transmits the determined result to the terminal having a communication function  3  (SP 39 ). Note that, the determined result may be transmitted to, for example, a dealer and a motor vehicle maker other than the terminal having a communication function  3 . When receiving the determined result, the screen display unit  31  of the terminal having a communication function  3  displays the determined result, as an inspection result, on the display screen (SP 40 ). As described above, the series of processing of the ECU inspection processing is completed. 
         [0128]      FIG. 21  illustrates detailed processing steps of the ECU inspection processing on the side of the terminal having a communication function  3 . Here, the detailed processing steps of the processing performed by the terminal having a communication function  3  during the ECU inspection processing in  FIG. 20 , will be described. 
         [0129]    In wait for the inspection performance notification (SP 201 ), the service performance confirmation unit  32  of the terminal having a communication function  3  determines whether the inspection performance notification transmitted from the service providing server  2  has been received (SP 202 ). When the service performance confirmation unit  32  acquires a negative result with the determination at step SP 202 , the processing proceeds to step SP 201 . 
         [0130]    In contrast to this, when acquiring a positive result with the determination at step SP 202 , the service performance confirmation unit  32  displays the remainder screen on the display screen (SP 203 ). Next, the service performance confirmation unit  32  determines whether the determined result transmitted from the service providing server  2  has been received (SP 204 ). When acquiring a negative result with the determination at step SP 204 , the service performance confirmation unit  32  remains on standby until the determined result is received. 
         [0131]    In contrast to this, when acquiring a positive result with the determination at step SP 204 , the service performance confirmation unit  32  displays the inspection result on the display screen by the screen display unit  31  (SP 205 ), and then completes the ECU inspection processing. 
         [0132]      FIG. 22  illustrates detailed processing steps of the ECU inspection processing on the side of the service providing server  2 . Here, the detailed processing steps of the processing performed by the service providing server  2  during the ECU inspection processing in  FIG. 20 , will be described. 
         [0133]    Based on an instruction from the inspection control unit  22 , the inspection data entry unit  24  of the service providing server  2  regularly or irregularly refers to the schedule information  276 , and acquires the “date and time” of the inspection schedule so as to check the one schedule or the plurality of schedules (SP 211 ). The inspection data entry unit  24  determines whether the inspection to be performed is present (SP 212 ). 
         [0134]    When the inspection data entry unit  24  acquires a negative result with the determination at step SP 212 , the processing proceeds to step SP 211 . In contrast to this, when acquiring a positive result with the determination at step SP 212 , the inspection data entry unit  24  transmits the inspection performance notification to the terminal having a communication function  3  (SP 213 ). 
         [0135]    Next, the inspection data entry unit  24  acquires the inspection data from the security-check data information  274  and the operation-inspection data information  275 , and transmits the inspection data to the gateway  11  of the motor vehicle  1  being the object to be inspected (SP 214 ). 
         [0136]    Next, in wait for the inspection result completion notification (SP 215 ), the inspection control unit  22  determines whether the inspection result completion notification transmitted from the gateway  11  has been received (SP 216 ). When the inspection control unit  22  acquires a negative result with the determination at step SP 216 , the processing proceeds to step SP 215 . 
         [0137]    In contrast to this, when acquiring a positive result with the determination at step SP 216 , the inspection control unit  22  transmits the notification of the inspection result collection request, to the gateway  11  by the inspection result collection unit  25  (SP 217 ). Next, in wait for the inspection result collection (SP 218 ), the inspection result collection unit  25  determines whether the inspection performance result information  1162  transmitted from the gateway  11  has been received (SP 219 ). 
         [0138]    When the inspection result collection unit  25  acquires a negative result with the determination at step SP 219 , the processing proceeds to step SP 218 . In contrast to this, when acquiring a positive result with the determination at step SP 219 , the inspection result collection unit  25  stores the received inspection performance result information  1162  in the inspection result information  280 . 
         [0139]    The inspection result analysis unit  26  refers to the inspection result information  280  and the inspection collation result information  281 , and compares the output result actually output from the ECUs  12  and the output result being estimated so as to analyze the inspection result (SP 220 ). The inspection result analysis unit  26  determines no abnormality in a case where the output result is as estimated, and determines abnormality in a case where the output result is not as estimated (SP 221 ). 
         [0140]    The inspection control unit  22  transmits the determined result to the terminal having a communication function  3  (SP 222 ) and then completes the ECU inspection processing. 
         [0141]      FIG. 23  illustrates detailed processing steps of the ECU inspection processing on the side of the gateway  11  of the motor vehicle  1 . Here, the detailed processing steps of the processing performed by the gateway  11  during the ECU inspection processing in  FIG. 20 , will be described. 
         [0142]    In wait for a processing request from the service providing server  2  (SP 231 ), the inspection performance control unit  111  of the gateway  11  determines whether the processing request is present (SP 232 ). When the inspection performance control unit  111  acquires a negative result with the determination at step SP 232 , the processing proceeds to step SP 231 . When acquiring a positive result, the inspection performance control unit  111  determines a processing description (SP 233 ). 
         [0143]    In a case where the processing description includes an inspection performance request, namely, in a case where the inspection data has been received from the service providing server  2 , the inspection performance control unit  111  stores the received inspection data in the inspection performance data information  1161  (SP 234 ). Next, the inspection performance control unit  111  confirms the vehicle state of the motor vehicle  1  (SP 235 ), and determines whether the motor vehicle  1  is on standby (SP 236 ). 
         [0144]    In a case where the motor vehicle  1  is on standby (SP 236 : Y), the inspection performance control unit  111  generates a message corresponding to the CAN protocol, based on the “CAN-ID” and the “inspection data” of the inspection performance data information  1161 , and transmits the generated message to the ECUs  12  by the inspection performance unit  113  (SP 237 ). 
         [0145]    Next, the inspection performance control unit  111  acquires the data output from the ECUs  12  by the inspection monitor unit  114 , in particular, captures the packet, and stores the captured packet in the inspection performance result information  1162  (SP 238 ). Next, the inspection performance control unit  111  updates the “progress” of the inspection performance data information  1161  to “completion” (SP 239 ). 
         [0146]    Next, the inspection performance control unit  111  refers to the “progress” of the inspection performance data information  1161  and confirms whether an item in which “completion” has not been made is present, so as to confirm whether inspection data to be transmitted to the ECUs  12  remains in the inspection performance data information  1161  (SP 240 ). 
         [0147]    When the inspection performance control unit  111  acquires a negative result with the determination at step SP 240 , the processing proceeds to step SP 236 . When acquiring a positive result, the inspection performance control unit  111  transmits the inspection result completion notification to the service providing server  2  (SP 243 ), and then completes the ECU inspection processing. 
         [0148]    Referring back to step SP 236 , in a case where the motor vehicle  1  is not on standby (SP 236 : N), the processing may wait until a standby state is made. However, the inspection temporarily suspends here (SP 241 ), and a suspension notification indicating the suspension is transmitted to the service providing server  2  (SP 243 ). Then, the ECU inspection processing is completed. 
         [0149]    Referring back to step SP 233 , in a case where the processing description includes the inspection result collection request, namely, in a case where the notification of the inspection result collection request has been received from the service providing server  2 , the inspection performance control unit  111  acquires the inspection performance result information  1162  by the inspection information acquisition unit  112  (SP 242 ), transmits the inspection performance result information  1162  to the service providing server  2  (SP 243 ), and then completes the ECU inspection processing. 
         [0150]      FIG. 24  illustrates processing steps of security-check data generation processing. The security-check data generation processing is performed by the service providing server  2  during the ECU inspection processing (refer to  FIG. 20 ) or with arbitrary timing before the ECU inspection processing. 
         [0151]    First, the inspection data generation unit  23  of the service providing server  2  refers to the object-to-be-inspected ECU information  273 , and acquires “ECU-ID” including “target” in the “object-to-be-inspected flag” as ECU-ID being an object t to be inspected (SP 31 ). Next, the inspection data generation unit  23  acquires “CAN-ID” corresponding to the ECU-ID specified as the object to be inspected (SP 32 ). 
         [0152]    Next, the inspection data generation unit  23  refers to the field structure information  277 , and acquires “detailed field ID” and “the number of bits” corresponding to the CAN-ID acquired at step SP 32  so as to analyze the field structure of the data field (refer to  FIG. 15 ), by the field structure analysis unit  232  (SP 33 ). 
         [0153]    For example, the field structure analysis unit  232  refers to the field structure information  277 , and acquires pieces of detailed field ID of “A1”, “A2”, “A3”, and “A4” corresponding to the CAN-ID including “0x7E0” in a case where the CAN-ID acquired at step SP 32  is “0x7E0”. 
         [0154]    The field structure analysis unit  232  acquires each of the number of bits of “8 bits”, “8 bits”, “16 bits”, and “32 bits” corresponding to the pieces of detailed field ID of “A1” to “A4”, respectively. As a result, the field structure analysis unit  232  can acquire an analysis result including the data field structure segmented into four, such as “A1” to “A4”, and the respective segments being “8 bits”, “8 bits”, “16 bits”, and “32 bits”. 
         [0155]    Note that, the field structure analysis unit  232  refers to the field structure information  277  so as to acquire pieces of segment ID of “D1”, “D2”, “D2”, and “D4” corresponding to the pieces of detailed field ID of “A1” to “A4”, respectively. The field structure analysis unit  232  refers to the field segment information  278  so as to acquire segment names of “significant digits”, “variable data”, and “dummy” corresponding to “D1”, “D2”, and “D4”. As a result, a meaning indicated by the data stored in “A1” to “A4”, can be analyzed. 
         [0156]    Next, the inspection data generation unit  23  refers to the field dependence information  279  and acquires “detailed field dependence” corresponding to the CAN-ID acquired at step SP 32 , by the dependence analysis unit  231  (SP 34 ). 
         [0157]    For example, the dependence analysis unit  231  refers to the field dependence information  279 , and acquires dependence of {A1, (A2 &amp; A3), A4} corresponding to the CAN-ID of “0x7E0” in a case where the CAN-ID acquired at step SP 32  is “0x7E0”. In this case, there is dependence between the data stored in the segment of “A2” and the data stored in the segment of “A3”. 
         [0158]    Next, the inspection data generation unit  23  determines an allocation number of random data by the inspection data allocation unit  233 , based on “the number of bits” acquired at step SP 33  and the “detailed field dependence” acquired at step SP 34  (SP 35 ). 
         [0159]    For example, the inspection data generation unit  23  allocates the random data to a position at which a more effective inspection can be achieved in the data field, in terms of inspection efficiency, instead of allocating the random data to all the data field totally including 64 bits. Here, since there is the dependence between “A2” and “A3”, and “A2” and “A3” are “8 bits” and “16 bits”, respectively, the inspection data generation unit  23  determines the allocation number of the random data to be 24 bits. 
         [0160]    Note that, the inspection data generation unit  23  may determine the allocation number of the random data per dependence unit as described above, or may determine the allocation number of the random data in accordance with priority corresponding to characteristics of the “segment ID” of the field segment information  278 . For example, the random data may be allocated to “A1” and fixed data may be allocated to “A2” to “A4”. 
         [0161]    Next, based on the allocation number of the data determined at step SP 35 , the inspection data generation unit  23  determines a range in which the random data is used, and generates inspection data by the inspection data allocation unit  233  (SP 36 ). The inspection data generation unit  23  stores the generated data in the security-check data information  274  (SP 37 ). 
         [0162]    Next, the inspection data generation unit  23  determines whether dependence including no inspection data generated remains in the dependence acquired at step SP 34  (SP 38 ). When the inspection data generation unit  23  acquires a negative result with the determination at step SP 38 , the processing proceeds to step SP 36 . When receiving a positive result, the inspection data generation unit  23  completes the security-check data generation processing. 
       (6) Effect According to the Present Embodiment 
       [0163]    As described above, the inspection system  5  according to the present embodiment, transmits the security-check data considered not to be received by the ECUs  12  at the design stage of the ECUs  12 , to the ECUs  12 , together with the operation-inspection data previously prepared at the design stage of the ECUs  12 , and determines whether the data output from the ECUs  12  is in a proper range. Therefore, the operation of the ECUs  12  during the use can be accurately inspected. 
       (7) Another Embodiment 
       [0164]    According to the present embodiment described above, the inspection result analysis unit  26  of the service providing server  2  refers to the inspection result information  280  and the inspection collation result information  281 , analyzes the inspection result information  280 , and determines the analysis result (refer to SP 37  and SP 38  in  FIG. 20 ). However, the present embodiment is not limited to this. A gateway  11  of a motor vehicle  1  may include an inspection result analysis unit  26  and inspection collation result information  281 . The gateway  11  may refer to inspection performance data information  1161  and the inspection collation result information  281 , may analyze the inspection performance data information  1161 , and may determine the analysis result, by the inspection result analysis unit  26 . 
         [0165]      FIG. 25  illustrates processing steps of ECU inspection processing according to another embodiment. The ECU inspection processing according to the other embodiment is different from the ECU inspection processing according to the present embodiment described above ( FIG. 20 ) in that the gateway  11  analyzes an inspection result (SP 31 A) and determines the analysis result (SP 32 A) and in that the gateway  11  acquires the determined result (SP 36 A) and transmits the determined result to a service providing server  2  (or directly to a terminal having a communication function  3 ) (SP 37 A). 
       REFERENCE SIGNS LIST 
       [0000]    
       
           1  motor vehicle 
           2  service providing server 
           3  terminal having a communication function 
           4  communication network 
           5  inspection system