Vehicle control system, vehicle, vehicle control method, and computer-readable storage medium

Abstract

The present application relates to a control system, a mobile body, a control method, and a computer-readable storage medium. The control system includes: a mobile body control unit that controls a mobile body; an update control unit that receives an update program for the mobile body control unit from an external device and updates the mobile body control unit by the update program; an instruction acquisition control unit that performs control to acquire a user instruction not to perform update of the mobile body control unit based on the update program; and a determination unit that determines whether or not a determination condition that the mobile body is in an updatable state, that is, an updatable condition, is satisfied based on at least either one of a state of a drive system of the mobile body or an open / close state of a door provided to the mobile body, and the update control unit updates the mobile body control unit by the update program when the user instruction is not acquired, with the updatable condition being satisfied as a condition.

Description

TECHNICAL FIELD

[0001] The present application relates to a control system, a mobile body, a control method, and a computer-readable storage medium. BACKGROUND

[0002] In Patent Literature 1, as an ECU for a vehicle, an ECU capable of rewriting an application program is disclosed.

[0003] Patent Literature 1: Japanese Patent Application Publication No. 2020-27666 SUMMARY

[0004] In a first aspect, a control system is provided. The control system includes a mobile body control unit that controls a mobile body. The control system includes an update control unit that receives an update program for the mobile body control unit from an external device and updates the mobile body control unit by the update program. The control system includes an instruction acquisition control unit that performs control to acquire a user instruction not to perform update of the mobile body control unit based on the update program. The control system includes a determination unit that determines whether or not an updateable condition is satisfied based on at least either a state of a drive system of the mobile body or an open / close state of a door provided to the mobile body, the updateable condition being a determination condition that determines whether or not the mobile body is in an updateable state. When the user instruction is not acquired, the update control unit updates the mobile body control unit by the update program on condition that the updateable condition is satisfied.

[0005] After performing notification to the user related to the update of the mobile body control unit, the update control unit can update the mobile body control unit by the update program when the user instruction is not acquired during a period until a predetermined time elapses.

[0006] The predetermined time can be 30 seconds or more and 600 seconds or less.

[0007] The predetermined time can be 300 seconds or less.

[0008] The control system can further include a notification control unit that controls notification to the user related to the update of the mobile body control unit.

[0009] The notification control unit can perform the notification to the user on condition that the updateable condition is satisfied.

[0010] When the updateable condition is not satisfied during a period until a predetermined time elapses, the update control unit can not update the mobile body control unit by the update program.

[0011] The notification to the user can include a notification for causing the user to select whether to perform the update of the mobile body control section. The update control section can update the mobile body control section by the update program before a predetermined time elapses when the user instruction to instruct the performance of the update of the mobile body control section is acquired by the instruction acquisition control section.

[0012] The state of the drive system can include at least one of a moving speed of the mobile body, a state of a drive device of the mobile body, and a state of a transmission possessed by the mobile body.

[0013] The updatable condition can include that the moving speed is 0, the drive device is in a stopped state, a shift lever that operates the transmission is in a position that fixes a gear possessed by the transmission, and a door is in a closed state.

[0014] The door can include an opening and closing cover for maintenance possessed by the mobile body.

[0015] The mobile body can be a vehicle, the door can include at least one of a hood and a cover of a fuel supply port, and the drive device can be an engine or a power unit.

[0016] In the second aspect, a mobile body is provided. The mobile body possesses the control system.

[0017] The mobile body can be a vehicle.

[0018] In the second aspect, a control method is provided. The control method has a step of receiving, from an external device, an update program that controls a mobile body control section of a mobile body. The control method has a step of performing control to acquire a user instruction that means not to perform the update of the mobile body control section based on the update program. The control method has a step of judging whether a determination condition, that is, an updatable condition, that the mobile body is in an updatable state is satisfied based on at least one of a state of a drive system of the mobile body and an opening and closing state of a door provided to the mobile body. The control method has a step of updating the mobile body control section by the update program when the user instruction is not acquired, with the condition that the updatable condition is satisfied.

[0019] In a third aspect, a program is provided. The program causes a computer to function as a mobile body control section that controls a mobile body. The program causes the computer to function as an update control section that receives an update program of the mobile control section from an external device and updates the mobile control section by the update program. The program causes the computer to function as an instruction acquisition control section that acquires a user's instruction to perform control not to perform update of the mobile control section based on the update program. The program causes the computer to function as a determination section that determines whether or not a determination condition that the mobile body is in an updatable state, that is, an updatable condition, is satisfied based on at least either of a state of a drive system of the mobile body and an open / close state of a door provided to the mobile body. When the user's instruction is not acquired, the update control section updates the mobile control section by the update program with the updatable condition satisfied as a condition, by the program.

[0020] In addition, the above summary of the invention does not list all the essential features of the invention. In addition, sub-combinations of these features can also be inventions. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 An update system 10 related to one embodiment is schematically shown.

[0022] Figure 2 A system configuration of a control system 200 is schematically shown.

[0023] Figure 3 An example of update notification information 300 displayed on an IVI 299 is shown.

[0024] Figure 4 An example of update notification information 400 displayed on an MID 298 is shown.

[0025] Figure 5 A flowchart showing an example of a process procedure related to an update process of the ECU 204 is shown.

[0026] Figure 6 An example of a computer 2000 is shown. DETAILED DESCRIPTION

[0027] Hereinafter, the present invention will be described through embodiments of the invention, but the following embodiments do not limit the invention as claimed. In addition, the combinations of features described in the embodiments are not all necessary for the solution means of the invention.

[0028] Figure 1An embodiment relating to an update system 10 is schematically shown. The update system 10 has a vehicle 20 and an external device 70. The vehicle 20 has a control system 200. The control system 200 is responsible for control of the vehicle 20 and communication with the external device 70 through a communication network 90. The communication network 90 includes an IP network such as the Internet, a P2P network, a dedicated line including a VPN, a virtual network, a mobile communication network, and the like.

[0029] In the vehicle 20, the control system 200 has a plurality of ECUs (Electronic Control Units) that perform control of the vehicle 20. The control system 200 acquires an update program for the ECUs included in the control system 200 from the outside. For example, the control system 200 receives the update program transmitted from the external device 70 through the communication network 90 using wireless communication. The control system 200 reprograms the ECUs included in the control system 200 by the update program. Reprogramming is performed for the purpose of upgrading the functions of the ECUs included in the control system 200 and the like. Thus, the control system 200 updates the ECUs by reprogramming the ECUs using OTA (Over The Air).

[0030] For example, when the IG (ignition) power of the vehicle 20 is off, the control system 200 notifies a user of the vehicle 20 to perform system update by the update program. When an update postponement instruction is not acquired from the user before a predetermined time elapses, the control system 200 starts the update. At this time, the control system 200 automatically starts the update with the conditions that the vehicle speed of the vehicle 20 is 0, the IG power is in the off state, the shift position is in the park position, and the hood is in the closed state. When the update of the ECUs is completed, the control system 200 closes the power state of the vehicle 20.

[0031] By the control of the control system 200, it is possible to suppress the start of the update of the ECUs during the use of the vehicle 20 by the user. Further, since the update is automatically performed when there is no update postponement instruction from the user, it is possible to suppress the case where the ECUs are kept as they are without being updated, for example, when there is an important update program.

[0032] Further, since the user cannot use the vehicle 20 during the update of the ECU, a downtime occurs until the update of the ECU is completed when the update of the ECU is started. By the control of the control system 200, since the update postponement instruction is received from the user until a predetermined time elapses after the IG power is turned off, the update of the ECU can be made not to be started in a case where the user wants to use the vehicle 20 immediately after the IG power is turned off. Thereby, the occurrence of the downtime unexpected by the user can be suppressed. Further, since the update postponement instruction is received only for a predetermined time after the IG power is turned off, and the power-off state is closed when the update is completed, it is possible to make the power of the battery possessed by the vehicle 20 not to be wasted.

[0033] Figure 2 The system configuration of the control system 200 is schematically shown. The control system 200 is provided with a TCU 201, an ECU 202, an ECU 203, an ECU 204, an ECU 205, and an ECU 206.

[0034] The TCU 201, the ECU 203, the ECU 204, the ECU 205, and the ECU 206 are connected to the ECU 202 through the in-vehicle communication line 180. The TCU 201, the ECU 203, the ECU 204, the ECU 205, and the ECU 206 communicate with each other through the in-vehicle communication line 180 and the ECU 202. The ECU 202 integrally controls the TCU 201, the ECU 203, the ECU 204, the ECU 205, and the ECU 206. The in-vehicle communication line 180 can be configured, for example, by including a CAN (Controller Area Network), an Ethernet, or the like.

[0035] The TCU 201 is a telematics control unit. The TCU 201 is responsible for at least communication through the communication network 90. The TCU 201 is an example of a communication unit.

[0036] The ECU 203, the ECU 204, the ECU 205, and the ECU 206 are each a vehicle control section for controlling the vehicle 20. The ECU 203, the ECU 204, the ECU 205, and the ECU 206 control various devices possessed by the vehicle 20. For example, the ECU 203 controls a transmission 291, a drive device 292, and a drive system sensor 293. The transmission 291 is a transmission system device provided with a transmission. The drive device 292 is, for example, a power unit including an internal combustion engine and a motor, and the like. The drive system sensor 293 includes a vehicle speed sensor for detecting a moving speed of the vehicle 20. The transmission 291, the drive device 292, and the drive system sensor 293 are devices belonging to a drive system of the vehicle 20. The ECU 204 controls an FI 294 that is a fuel injection device. The ECU 205 controls a door system 296. The door system 296 includes opening and closing doors for maintenance of a hood, a fuel cap, and the like. The ECU 206 controls an MID 298 and an IVI 299. The MID 298 is a multi-information display (MID). The IVI 299 is, for example, an in-vehicle infotainment device (IVI).

[0037] In the present embodiment, the system configuration in which the control system 200 is provided with the TCU 201, the ECU 202, the ECU 203, the ECU 204, the ECU 205, and the ECU 206 is shown, but the system configuration of the control system 200 is not limited to the example of the present embodiment. In addition, in the present embodiment, it is assumed as an example that the ECU that is an update target of the update program is the ECU 204. However, the ECU that is an update target of the update program is not limited to the ECU 204.

[0038] The update control section 220 receives the update program of the ECU 204 from the external device 70 and updates the ECU 204 by the update program. The update control section 220 receives the update program from the external device 70 through the TCU 201.

[0039] The determination section 210 determines whether or not an updatable condition, which is a determination condition for determining whether or not the vehicle 20 is in an updatable state, is satisfied, on the basis of at least one of a state of a drive system of the vehicle 20 and an opening and closing state of a door provided to the vehicle 20. The drive system is, for example, the transmission 291, the drive device 292, and the like.

[0040] The notification control section 230 controls notification to a user related to the update of the ECU 204. The user can be, for example, an occupant of the vehicle 20. The notification control section 230 displays update notification information on the MID 298 and the IVI 299 through the ECU 206. The notification control section 230 can perform the notification to the user with the updatable condition satisfied as a condition.

[0041] The instruction acquisition control section 240 executes control for acquiring a user instruction indicating that updating of the ECU 204 based on the update program is not performed. For example, the instruction acquisition control section 240 executes control for acquiring a user instruction input to the IVI 299 through the ECU 206.

[0042] When the user instruction is not acquired, the update control section 220 updates the ECU 204 by the update program with the condition that the updatable condition is satisfied. For example, when the user instruction is not acquired before a predetermined time elapses after the notification to the user related to the update of the ECU 204 is performed, the update control section 220 updates the ECU 204 by the update program. The predetermined time can be, for example, 30 seconds or more and 600 seconds or less. The predetermined time is preferably within 300 seconds. The predetermined time is preferably within 180 seconds. Since the shorter the time is, the more the power consumption until the user instruction is acquired can be reduced, deterioration of the battery can be suppressed. On the other hand, if the time is too short, the user's intention can not be appropriately acquired when the user does not want to perform the update.

[0043] When the updatable condition is not satisfied before the predetermined time elapses, the update control section 220 does not update the ECU 204 by the update program. Thereby, the start of the update can be suppressed in accordance with an increase in the possibility of use of the vehicle 20.

[0044] The notification to the user can include a notification for causing the user to select whether to perform the update of the ECU 204. When the instruction acquisition control section 240 acquires a user instruction indicating that the update of the ECU 204 is performed, the update control section 220 can update the ECU 204 by the update program before the predetermined time elapses. Thereby, since the update can be started if the user instruction to perform the update is indicated from the user, the power consumption during the user notification can be reduced.

[0045] Under the updatable condition, the state of the drive system can be at least one of a moving speed of the vehicle 20, a state of a drive device of the vehicle 20, and a state of a transmission possessed by the vehicle 20. For example, the updatable condition can include that the moving speed is 0, the drive device 292 is in a stopped state, a shift lever for operating the transmission is in a position for fixing a gear possessed by the transmission, and a door is in a closed state. In addition, the "position for fixing a gear possessed by the transmission" is, for example, a parking position. The door can be an opening and closing cover possessed by the vehicle 20 for maintenance. The door can be, for example, a hood. The door can include at least one of the hood and a cover of a fuel supply port (fuel cover). In addition, the vehicle speed of the vehicle 20 and the state of the drive system are acquired from the ECU 203, and the opening and closing state of the door is acquired from the ECU 205.

[0046] Figure 3An example of update notification information 300 displayed on the IVI 299 is shown. When the IG power of the vehicle 20 is turned off after the update program of the ECU 204 is downloaded from the external device 70, the notification control section 230 displays the update notification information 300 on the IVI 299.

[0047] The update notification information 300 includes waiting time information 310 that is the time until the update of the ECU 204 is started, message information 320 to the user, a UI button 330 for acquiring an update execution instruction that means to perform the update from the user, and a UI button 340 for acquiring an update postponement instruction that means not to perform the update from the user.

[0048] The waiting time information 310 includes information indicating the remaining time until the update control section 220 automatically starts the update of the ECU 204. The notification control section 230 counts down the remaining time of the waiting time information 310 according to the passage of time. The message information 320 is information for notifying the user that the update system is started, and that the vehicle 20 is to be stopped at a safe location.

[0049] The instruction acquisition control section 240 acquires a case where the position of the UI button 330 is operated as the update execution instruction from the user. The instruction acquisition control section 240 acquires a case where the display position of the UI button 340 is operated as the postponement instruction from the user.

[0050] Figure 4 An example of update notification information 400 displayed on the MID 298 is shown. When the IG power of the vehicle 20 is turned off after the update program of the ECU 204 is downloaded from the external device 70, the notification control section 230 displays the update notification information 400 on the MID 298. The update notification information 400 includes message information 420 to the user. The message information 420 is information for notifying the user that the system update is started.

[0051] The notification control section 230 notifies the user through the MID 298 in addition to the IVI 299. Thereby, the user can be reliably recognized that the update is started. For example, even if the IVI 299 fails, the user can be notified through the MID 298.

[0052] Figure 5 is a flowchart showing an example of a process procedure related to the update processing of the ECU 204. When the IG power is turned off, the process of the flowchart is started. Figure 5 The process of the flowchart.

[0053] In S500, the update control portion 220 determines whether or not there is an update program for the ECU 204. For example, the update control portion 220 determines whether or not an update program has been downloaded from the external device 70. In addition, the update program can be stored in the ECU 202, and can be stored in a storage area for predetermined user data of the ECU 204 that is an update target. When there is no update program, in S518, the IG power state is turned off, and the processing in the present flowchart ends. When there is no update program, the processing proceeds to S502.

[0054] In S502, the update control portion 220 determines whether or not the updateable condition is satisfied. In the present embodiment, the updateable condition includes the following four conditions: (i) the vehicle speed detected by the drive system sensor 293 is 0, (ii) the shift position is at the park position, (iii) the IG power is in the off state, and (iv) the engine hood and the fuel cap are in the closed state. According to condition (i), it can be determined that the user intends to stop the vehicle 20. According to condition (ii), it can be determined that the user intends to park the vehicle 20. According to condition (iii), it can be determined that the user intends to use the vehicle 20. According to condition (iv), it can be determined that the user has no intention to maintain the vehicle 20. In addition, when the state of the fuel cap cannot be detected in the vehicle 20, the engine hood being in the closed state can be made a condition (iv).

[0055] When it is determined in S502 that the updateable condition is not satisfied, the processing proceeds to S518. When it is determined in S502 that the updateable condition is satisfied, in S504, the notification control portion 230 performs notification relating to the update of the ECU 204. As described with reference to Figure 3 and 4 The notification control portion 230 displays the update notification information 300 on the IVI 299, and displays the update notification information 400 on the MID 298. When the update notification information 300 and the update notification information 400 are displayed, the notification control portion 230 can output a sound effect from the MID 298. In addition, the notification control portion 230 can output the content of the message information 320 described with reference to Figure 3 by voice, for example. Thereby, the notification control portion 230 can notify the user of the update by display and voice. Since the notification control portion 230 performs voice output and display output from the MID 298 and the IVI 299, respectively, the user can be made to recognize the update even when a failure occurs in either of the MID 298 and the IVI 299.

[0056] Next, in S506, the update control section 220 starts a countdown timer. As an example, the countdown timer is a timer that expires in 120 seconds. In S508, the instruction acquisition control section 240 determines the user instruction. For example, in a case where the user operation information indicating that the position of the UI button 330 in FIG. 3 is operated is not acquired from the IVI 299, the instruction acquisition control section 240 determines that there is no user instruction. In a case where the user operation information indicating that the position of the UI button 330 in FIG. 3 is operated is acquired from the IVI 299, the instruction acquisition control section 240 determines that the user instruction is an update execution instruction. In a case where the user operation information indicating that the position of the UI button 340 in FIG. 3 is operated is acquired from the IVI 299, the instruction acquisition control section 240 determines that the user instruction is an update postponement instruction. Figure 3 Figure 3

[0057] When it is determined in S508 that the user instruction is the update postponement instruction, the process shifts to S518. When it is determined in S508 that the user instruction is the update execution instruction, the process shifts to S514. When it is determined in S508 that there is no user instruction, the process shifts to S510.

[0058] In S510, it is determined whether the countdown timer expires. When the countdown timer expires, the process shifts to S514. If the countdown timer does not expire, the process shifts to S512. In S512, the update control section 220 determines whether the updatable condition is satisfied. The determination in S512 is the same as the determination in S502. In a case where the updatable condition is satisfied, the process shifts to S508. In a case where the updatable condition is not satisfied, the process shifts to S518.

[0059] As described with reference to S510 and S508, when the countdown timer expires, or when the update execution instruction is acquired from the user, the process of S514 is executed. In S514, the update control section 220 determines whether the updatable condition is satisfied. The determination in S514 is the same as the determination in S502. In a case where the updatable condition is satisfied, the process shifts to S516. In a case where the updatable condition is not satisfied, the process shifts to S518.

[0060] In S516, the update control section 220 executes the update of the ECU 204 by the update program. When the update of the ECU 204 is completed, the process shifts to S518.

[0061] ​​The update processing of the ECU 204 in S516 will be described. First, the update processing when the internal memory of the ECU 204 is a single-bank memory (so-called single-sided ROM) will be described. In this case, since the ECU 204 has only one control storage area that saves the control program, the ECU 204 cannot write the update program into the control storage area when the ECU 204 operates according to the control program. Therefore, in S516, the update control section 220 writes the update program into the control storage area of the ECU 204. When the writing of the update program is completed, the update control section 220 activates the update program as necessary. The activation of the update program includes, for example, a process of setting the startup parameters of the ECU 204 in such a manner that when the ECU 204 is started, the ECU 204 loads the update program saved in the control storage area to start the control based on the update program.

[0062] Next, the update processing when the internal memory of the ECU 204 is a double-bank memory (so-called double-sided ROM) will be described. In this case, since the ECU 204 has two control storage areas that save the control program, the ECU 204 can write the update program into the second control storage area when the ECU 204 operates according to the control program saved in the first control storage area. Therefore, when the download of the update program is completed, the update control section 220 can transmit the update program to the ECU 204 and write the update program into the second control storage area even during, for example, the running of the vehicle 20. In S516, when the update program has been written into the second control storage area, the update control section 220 updates the ECU 204 by activating the update program saved in the second control storage area. The activation of the update program includes a process of setting the startup parameters of the ECU 204 in such a manner that when the ECU 204 is started, the ECU 204 loads the update program saved in the second control storage area to start the control based on the update program. In addition, when the update program is not written into the second control storage area in S516, the update control section 220 writes the update program into the second control storage area of the ECU 204, and when the writing of the update program is completed, updates the ECU 204 by activating the update program saved in the second control storage area. Thus, the "updating the ECU by the update program" is a concept including writing the update program into the control storage area of the ECU. In addition, the "updating the ECU by the update program" is a concept including activating the update program.

[0063] As described above with reference to Figure 5As described above, the determination section 210 performs the determination of whether the updatable condition is satisfied at three points in time, before the notification to the user, during the notification to the user, and before the execution of the update. Thus, it is possible to determine whether the user intentionally does not perform the update in a timely manner. Further, it is possible to suppress the occurrence of the downtime of the vehicle 20 due to the update of the ECU only because the vehicle 20 is stopped at a signal or a railroad crossing. Further, it is possible to suppress the case where the notification of the update to the user is performed only because the vehicle 20 is stopped at a signal or a railroad crossing.

[0064] According to the above-described embodiment, when the user intends to use the vehicle 20, it is possible to suppress the start of the update of the ECU. Thus, it is possible to suppress the occurrence of the downtime of the vehicle 20 that is unexpected by the user. Further, when there is an important update program, it is possible to suppress the ECU from being updated and left as it is. Since the update deferral instruction is received only within the expected time after the notification of the update to the user, it is possible to prevent the waste of the electric power of the battery possessed by the vehicle 20.

[0065] Figure 6 An example of a computer 2000 in which the plurality of embodiments of the present application can be embodied in whole or in part is shown. A program installed to the computer 2000 can cause the computer 2000 to function as a system, a device, or each unit of the device of the communication system and the like related to the embodiments, perform operations associated with the device or each unit of the device, and / or perform a procedure or steps of the procedure related to the embodiments. In order for the computer 2000 to perform the processing flow described in the present specification and specific operations associated with some or all of the functional blocks of the block diagrams, such a program can be executed by the CPU 2012.

[0066] The computer 2000 according to the present embodiment includes the CPU 2012 and the RAM 2014, which are connected to each other through the host controller 2010. The computer 2000 further includes the ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040. The ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040 are connected to the host controller 2010 via the input / output controller 2020.

[0067] The CPU 2012 acts in accordance with the programs stored in the ROM 2026 and the RAM 2014, thereby controlling each unit.

[0068] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 holds programs and data used by the CPU 2012 within the computer 2000. The ROM 2026 holds a boot program or the like executed by the computer 2000 when activated, and / or a program dependent on the hardware of the computer 2000. The input / output chip 2040 can also connect various input / output units such as a keyboard, a mouse, and a monitor to the input / output controller 2020 via an input / output port of a serial port, a parallel port, a keyboard port, a mouse port, a monitor port, a USB port, an HDMI (registered trademark) port, or the like.

[0069] A program is provided via a computer-readable medium such as a CD-ROM, a DVD-ROM, or a USB memory, or a network. The RAM 2014, the ROM 2026, or the flash memory 2024 is an example of the computer-readable medium. The program is installed to the flash memory 2024, the RAM 2014, or the ROM 2026, and executed by the CPU 2012. Information processing described within these programs is read by the computer 2000, and cooperation between the program and various types of hardware resources described above is achieved. An apparatus or a method can be configured by operating or processing information in compliance with the use of the computer 2000.

[0070] For example, in a case where communication is performed between the computer 2000 and an external device, the CPU 2012 can execute a communication program loaded to the RAM 2014, and instruct the communication interface 2022 to perform communication processing based on processing described in the communication program. The communication interface 2022 reads transmission data held in a transmission buffer processing area provided in a recording medium such as the RAM 2014 and the flash memory 2024 under the control of the CPU 2012, transmits the read transmission data to a network, and writes reception data received from the network to a reception buffer processing area provided in the recording medium, or the like.

[0071] In addition, the CPU 2012 can cause all or a required part of a file or a database held in a recording medium such as the flash memory 2024 to be read to the RAM 2014, and perform various processing on the data on the RAM 2014. The CPU 2012 then writes the processed data back to the recording medium.

[0072] Various types of programs, data, tables, and various information such as databases can be saved to the recording medium and applied to information processing. The CPU 2012 can perform various processes described in this specification on data read from the RAM 2014, including various operations specified by an instruction sequence of a program, information processing, conditional determination, conditional branching, unconditional branching, search / replacement of information, and the like, and write the results back to the RAM 2014. In addition, the CPU 2012 can search for information in files, databases, and the like within the recording medium. For example, in a case where a plurality of items each having an attribute value of a first attribute associated with an attribute value of a second attribute are saved within the recording medium, the CPU 2012 can search for an item in which the attribute value of the first attribute coincides with a condition from among the plurality of items, read the attribute value of the second attribute saved within the item, and thereby acquire the attribute value of the second attribute associated with the first attribute that satisfies a condition set in advance.

[0073] The programs or software modules described above can be saved to a computer-readable medium on or near the computer 2000. A recording medium such as a hard disk or a RAM provided within a server system connected to a dedicated communication network or the Internet can be used as the computer-readable medium. The programs saved in the computer-readable medium can be provided to the computer 2000 via a network.

[0074] The programs installed in the computer 2000 and causing the computer 2000 to function as the control system 200 can act in the CPU 2012 or the like, thereby causing the computer 2000 to function as each unit of the control system 200, respectively. The information processing described in these programs is read into the computer 2000, thereby functioning as a specific unit of software and the various hardware resources described above, that is, each unit of the control system 200. Furthermore, by utilizing these specific units to achieve an operation or processing of information corresponding to the purpose of use of the computer 2000 in the present embodiment, a unique control system 200 corresponding to the purpose of use is constructed.

[0075] The various embodiments are described with reference to block diagrams and / or flowchart illustrations of the various embodiments. Each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, can be implemented by (1) a machine readable medium containing a computer readable instruction, or (2) a special purpose computer, a special purpose computer with a specially programmed computer readable instruction, and / or a processor supplied with a computer readable instruction. The special purpose computer can include digital and / or analog hardware circuits, and can include integrated circuits (ICs) and / or discrete circuits. The programmable circuit can include logic AND, logic OR, logic XOR, logic NAND, logic NOR, and other logic operations, flip-flops, registers, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and other reconfigurable hardware circuits including memory elements, etc.

[0076] The computer readable medium can include any tangible device that can store instructions for execution by an appropriate device, and as a result, the computer readable medium having the instructions stored therein constitutes at least a part of a product that includes the instructions for implementing a unit for performing the operations specified in the processing flow or block diagram. As examples of the computer readable medium, there can be included an electric storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, etc. As more specific examples of the computer readable medium, there can be included a floppy disk (registered trademark), a flexible disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an electrically erasable programmable read only memory (EEPROM), a static random access memory (SRAM), a compact disk read only memory (CD-ROM), a digital versatile disk (DVD), a Blu-ray (RTM) disk, a memory stick, an integrated circuit card, etc.

[0077] The computer readable instruction can include any one of assembly instruction, instruction set architecture (ISA) instruction, machine instruction, machine delegate instruction, microcode, firmware instruction, state setting data, or source code or object code described by any combination of one or more programming languages including Smalltalk, JAVA (registered trademark), C++, and the like object-oriented programming languages, and "C" programming language or the like procedural programming language.

[0078] The computer readable instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, implement the functions / acts specified in the flowchart block or blocks or diagrams. As an example, these functions / acts can be implemented in hardware, software, firmware, middleware, microcode, or any combination thereof. A processor can be a physical or virtual processor.

[0079] The above-described embodiments of the present application are merely illustrative and all changes and modifications that come within the spirit of the present application are therefore intended to be embraced by the appended claims. It is intended to embrace all equivalents of the specific structures disclosed and their procedural equivalents.

[0080] As for the order of executing each process of the apparatuses, systems, programs, and methods, actions, flows, steps, and steps, etc. shown in the claims, the specification, and the drawings, it should be noted that there is no particular indication of "before", "prior", etc., and in addition, as long as the output of the previous process is not used in the subsequent process, it can be implemented in any order. For the action flow in the claims, specification, and drawings, even if it is described using "first", "next", etc. for convenience, it does not mean that it must be implemented in such an order.

[0081] [Legend of Reference Numerals]

[0082] 10 update system

[0083] 20 vehicle

[0084] 70 external device

[0085] 90 communication network

[0086] 180 in-vehicle communication line

[0087] 200 control system

[0088] 201 TCU

[0089] 202 ECU

[0090] 203 ECU

[0091] 204 ECU

[0092] 205 ECU

[0093] 206 ECU

[0094] 210 determination unit

[0095] 220 update control section

[0096] 230 notification control section

[0097] 240 instruction acquisition control section

[0098] 291 shifter

[0099] 292 drive device

[0100] 293 drive system sensor

[0101] 294 FI

[0102] 296 door system

[0103] 298 MID

[0104] 299 IVI

[0105] 300 update notification information

[0106] 310 waiting time information

[0107] 320 message information

[0108] 330 UI button

[0109] 340 UI button

[0110] 400 update notification information

[0111] 420 message information

[0112] 2000 computer

[0113] 2010 main controller

[0114] 2012 CPU

[0115] 2014 RAM

[0116] 2020 input / output controller

[0117] 2022 communication interface

[0118] 2024 flash memory

[0119] 2026 ROM

[0120] 2040 input / output chip

Claims

1. A vehicle control system, wherein, Possessing: a mobile body control section that controls a vehicle; an update control section that receives an update program of the mobile body control section from an external device and updates the mobile body control section by the update program; a determination section that determines whether or not an updatable condition, which is a determination condition that determines whether or not the vehicle is in an updatable state, is satisfied based on at least either of a state of a drive system of the vehicle or an open / close state of a door provided to the vehicle, a notification control section that controls notification to a user related to update of the mobile body control section with the condition that an ignition power source of the vehicle is turned off and the updatable condition is satisfied; and an instruction acquisition control section that controls with the condition that the ignition power source is turned off and the updatable condition is satisfied, the control acquiring an instruction of the user that means not to perform update of the mobile body control section based on the update program; after performing the notification to the user related to the update of the mobile body control section, when the instruction of the user is not acquired during a period until a predetermined time elapses, the update control section updates the mobile body control section by the update program with the condition that the updatable condition is satisfied, and when the updatable condition is not satisfied during the period until the predetermined time elapses, the update control section does not update the mobile body control section by the update program and turns off a power source state of the ignition power source.

2. The vehicle control system according to claim 1, wherein the predetermined time is 30 seconds or more and 600 seconds or less.

3. The vehicle control system according to claim 2, wherein the predetermined time is 300 seconds or less.

4. The vehicle control system according to claim 1, wherein the notification to the user includes a notification for causing the user to select whether or not to perform update of the mobile body control section, in a case where the instruction of the user that means to perform update of the mobile body control section is acquired by the instruction acquisition control section, the update control section updates the mobile body control section by the update program before the predetermined time elapses.

5. The vehicle control system according to any one of claims 1 to 4, wherein the state of the drive system includes at least either of a moving speed of the vehicle, a state of a drive device of the vehicle, and a state of a transmission possessed by the vehicle.

6. The vehicle control system according to claim 5, wherein the updatable condition includes: the moving speed is 0; the drive device is in a stopped state; a shift lever that operates the transmission is positioned at a position for fixing a gear possessed by the transmission; and the door is in a closed state.

7. The vehicle control system according to claim 5, wherein the door includes an open / close cover possessed by the vehicle for maintenance.

8. The vehicle control system according to claim 6, wherein the door includes an open / close cover possessed by the vehicle for maintenance.

9. The vehicle control system according to claim 7 or 8, wherein the door includes at least one of a hood and a cover of a fuel supply port, the drive device is an engine or a power unit. ​ 10. A vehicle, wherein the vehicle control system according to any one of claims 1 to 9 is provided.

11. A vehicle control method, wherein, has: a step of receiving, from an external device, an update program of a mobile body control section that controls the vehicle; a step of determining whether an updateable condition is satisfied based on at least either one of a state of a drive system of the vehicle or an opening / closing state of a door provided to the vehicle, the updateable condition being a determination condition that determines whether the vehicle is in an updateable state; a step of controlling notification to a user related to update of the mobile body control section, with a condition that an ignition power source of the vehicle is turned off and the updateable condition is satisfied; and a step of controlling with a condition that the ignition power source is turned off and the updateable condition is satisfied, the control acquiring a user instruction that means not to perform update of the mobile body control section based on the update program, after the notification to the user related to the update of the mobile body control section is performed, when the user instruction is not acquired during a period until a predetermined time elapses, the mobile body control section is updated by the update program with a condition that the updateable condition is satisfied, and when the updateable condition is not satisfied during the period until the predetermined time elapses, the update control section does not update the mobile body control section by the update program, and turns off a power source state of the ignition power source.

12. A computer-readable storage medium storing a program, wherein the program causes a computer to function as: a mobile body control section that controls a vehicle; an update control section that receives an update program of the mobile body control section from an external device, and updates the mobile body control section by the update program; a determination section that determines whether an updateable condition is satisfied based on at least either one of a state of a drive system of the vehicle or an opening / closing state of a door provided to the vehicle, the updateable condition being a determination condition that determines whether the vehicle is in an updateable state; a notification control section that controls notification to a user related to update of the mobile body control section, with a condition that an ignition power source of the vehicle is turned off and the updateable condition is satisfied; and an instruction acquisition control section that controls with a condition that the ignition power source is turned off and the updateable condition is satisfied, the control acquiring a user instruction that means not to perform update of the mobile body control section based on the update program, according to the program, after the notification to the user related to the update of the mobile body control section is performed, when the user instruction is not acquired during a period until a predetermined time elapses, the update control section updates the mobile body control section by the update program with a condition that the updateable condition is satisfied, and when the updateable condition is not satisfied during the period until the predetermined time elapses, the update control section does not update the mobile body control section by the update program, and turns off a power source state of the ignition power source.

Images