Control system, mobile body, control method, and computer-readable storage medium

Abstract

The control system includes a mobile body control unit that controls a mobile body, an update control unit that controls reception of an update program for the mobile body control unit from an external device and controls update of the mobile body control unit by the update program, and a determination unit that determines whether fuel replenishment to the mobile body is performed during a period until a predetermined time elapses before update of the mobile body control unit by the update program is started. When the determination unit determines that fuel replenishment to the mobile body is performed, the update control unit stops start of update of the mobile body control unit by the update program.

Description

TECHNICAL FIELD

[0001] The present application relates to a control system, a mobile body, a control method, and a computer-readable storage medium. BACKGROUND

[0002] In Patent Literature 1, as an ECU for a vehicle, an ECU capable of rewriting an application program is disclosed.

[0003] Patent Literature 1: Japanese Patent Application Publication No. 2020-27666 SUMMARY

[0004] In the first aspect, a control system is provided. The control system includes a mobile body control unit that controls a mobile body. The control system includes an update control unit that controls reception of an update program for the mobile body control unit from an external device and controls update of the mobile body control unit by the update program. The control system includes a determination unit that determines whether refueling of the mobile body is performed during a period until a predetermined time elapses before starting update of the mobile body control unit by the update program. When the determination unit determines that refueling of the mobile body is performed, the update control unit stops start of update of the mobile body control unit by the update program.

[0005] The control system can include an instruction acquisition control unit that acquires a user instruction indicating that update of the mobile body control unit by the update program is not performed during the period until the predetermined time elapses. When the user instruction is not acquired and the determination unit determines that refueling of the mobile body is not performed, the update control unit can start update of the mobile body control unit by the update program.

[0006] The control system can include a notification control unit that controls notification to a user about update of the mobile body control unit. The instruction acquisition control unit can acquire the user instruction during the period until the predetermined time elapses after the notification to the user by the notification control unit is performed. When the user instruction is not acquired during the period until the predetermined time elapses after the notification to the user by the notification control unit is performed and the determination unit determines that refueling of the mobile body is not performed, the update control unit can start update of the mobile body control unit by the update program.

[0007] The predetermined time can be 30 seconds or more and 600 seconds or less.

[0008] The predetermined time can be 300 seconds or less.

[0009] The notification to the user can include a notification for causing the user to select whether to perform the update of the mobile body control section. When the user instruction indicating the performance of the update of the mobile body control section is acquired by the instruction acquisition control section, the update control section can start the update of the mobile body control section by the update program before a predetermined time elapses.

[0010] The judgment section can judge that the fuel replenishment to the mobile body is performed when the fuel storage amount in the mobile body increases.

[0011] The judgment section can judge that the fuel replenishment to the mobile body is performed when the fuel replenishment port of the mobile body is opened.

[0012] The judgment section can judge that the fuel replenishment to the mobile body is performed when the mobile body exists in the fuel replenishment facility.

[0013] In the second aspect, a mobile body is provided. The mobile body includes the above-described control system.

[0014] The mobile body can be a vehicle.

[0015] In the third aspect, a control method is provided. The control method includes a step of receiving, from an external device, an update program of a mobile body control section that controls a mobile body. The control method includes a step of judging whether fuel replenishment to the mobile body is performed during a period until a predetermined time elapses before starting the update of the mobile body control section by the update program. The control method includes a step of stopping the start of the update of the mobile body control section by the update program when it is judged that the fuel replenishment to the mobile body is performed.

[0016] In the fourth aspect, a program is provided. The program causes a computer to function as a mobile body control section that controls a mobile body. The program causes the computer to function as an update control section that controls the reception of an update program of the mobile body control section from an external device and controls the update of the mobile body control section by the update program. The program causes the computer to function as a judgment section that judges whether fuel replenishment to the mobile body is performed during a period until a predetermined time elapses before starting the update of the mobile body control section by the update program. When the judgment section judges that the fuel replenishment to the mobile body is performed, the update control section stops the start of the update of the mobile body control section by the update program by the program.

[0017] In addition, the above summary of the invention does not list all the essential features of the invention. In addition, subcombinations of these features can also be inventions. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 An update system 10 relating to one embodiment is schematically shown.

[0019] Figure 2The system configuration of the control system 200 is schematically shown.

[0020] Figure 3 An example of the update notification information 300 displayed on the IVI 299 is shown.

[0021] Figure 4 An example of the update notification information 400 displayed on the MID 298 is shown.

[0022] Figure 5 A timing chart relating to the program update processing is schematically shown.

[0023] Figure 6 A flowchart showing an example of the execution steps of the processing relating to the update of the ECU 204 is shown.

[0024] Figure 7 An example of the computer 2000 is shown. DETAILED DESCRIPTION

[0025] Hereinafter, the present application will be described through embodiments of the present application, but the following embodiments do not limit the claimed application. In addition, the combination of features described in the embodiments is not necessarily all required for the solution means of the present application.

[0026] Figure 1 The update system 10 according to one embodiment is schematically shown. The update system 10 has a vehicle 20 and an external device 70. The vehicle 20 has a control system 200. The control system 200 is responsible for the control of the vehicle 20 and the communication between the control system 200 and the external device 70 through a communication network 90. The communication network 90 includes an IP network such as the Internet, a P2P network, a dedicated line including a VPN, a virtual network, a mobile communication network, and the like.

[0027] In the vehicle 20, the control system 200 has a plurality of ECUs (Electronic Control Units) that perform the control of the vehicle 20. The control system 200 externally acquires an update program for the ECUs provided in the control system 200. For example, the control system 200 receives the update program transmitted from the external device 70 through the communication network 90 using wireless communication. The control system 200 reprograms the ECUs provided in the control system 200 by the update program. The reprogramming is performed for the purpose of upgrading the functions of the ECUs provided in the control system 200, and the like. Thereby, the control system 200 updates the ECUs by reprogramming the ECUs by OTA (Over The Air).

[0028] When the ECU can be updated using the update program, if the ignition switch of vehicle 20 is turned off, control system 200 notifies the user of vehicle 20 that the update is being executed. If no update delay instruction is received from the user before a predetermined time has passed, control system 200 initiates the ECU update. At this point, control system 200 automatically initiates the update based on the condition that the fuel tank's fuel level has not increased since the ignition switch was turned off. When the ECU update is complete, control system 200 turns vehicle 20's power supply to off.

[0029] When an ECU update begins, the IG power supply is prohibited from being turned on until the ECU update is completed. Therefore, if an ECU update begins, vehicle 20 will be downtime until the ECU update is completed. Therefore, for example, if the ECU is updated while vehicle 20 is stopped at a fuel station, vehicle 20 cannot be driven unless the ECU update is completed before refueling is completed. On the other hand, the control system 200 can reduce the possibility of starting an ECU update after vehicle 20 stops at a fuel station. In addition, since the ECU is automatically updated when there is no update delay instruction from the user and no fuel is being supplied to vehicle 20, it is possible to prevent the ECU from being left unupdated when there is an important update program.

[0030] Furthermore, control system 200 receives an update delay instruction from the user until a predetermined time has passed after the IG switch is turned off. Therefore, if the user wishes to use vehicle 20 immediately after the IG switch is turned off, the ECU update can be prevented from starting. This prevents the user from experiencing unwanted downtime. Furthermore, since the update delay instruction is only received within a predetermined time after the IG switch is turned off and the power supply is turned off upon completion of the update, wasteful consumption of battery power in vehicle 20 can be prevented.

[0031] Figure 2 The system configuration of the control system 200 is schematically shown. The control system 200 includes a TCU 201, an ECU 202, an ECU 204, an ECU 205, an ECU 206, an MID 298, and an IVI 299. Figure 2 , the FI 294 , the battery 295 , the door system sensor 296 , the fuel system sensor 297 , and the GNSS receiver 290 are devices provided in the vehicle 20 .

[0032] ECU 202 is connected to TCU 201, ECU 204, ECU 205, and ECU 206 via an in-vehicle communication line 280. ECU 202 communicates with TCU 201, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299 via in-vehicle communication line 280. ECU 202 collectively controls TCU 201, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299. For example, in-vehicle communication line 280 may include a CAN (Controller Area Network), Ethernet, or the like.

[0033] The TCU 201 is a telematics control unit. The TCU 201 is primarily responsible for mobile communications. The TCU 201 transmits and receives data to and from the external device 70 under the control of the ECU 202. The TCU 201 receives update programs from the external device 70 via mobile communications under the control of the ECU 202. The TCU 201 is an example of a communication unit.

[0034] MID 298 is a multi-information display. IVI 299 is, for example, an in-vehicle infotainment (IVI). MID 298 and IVI 299 are connected to ECU 202 via in-vehicle communication line 280. MID 298 and IVI 299 can function as a display control unit. IVI 299 has wireless LAN communication capabilities. Under the control of ECU 202, IVI 299 receives updated programs from external device 70 via wireless LAN communication. IVI 299 obtains location information from GNSS receiver 290. IVI 299 outputs the location information obtained from GNSS receiver 290 to ECU 202.

[0035] ECU 204, ECU 205, and ECU 206 are each an ECU serving as a vehicle control unit for controlling vehicle 20. ECU 204, ECU 205, and ECU 206 are examples of a "mobile body control unit." ECU 204, ECU 205, and ECU 206 control various devices provided in vehicle 20. For example, ECU 204 controls FI 294, which serves as a fuel injection device. ECU 205 controls battery 295, which serves as a high-voltage battery. ECU 206 controls door system sensor 296 and fuel system sensor 297. Door system sensor 296 includes a fuel cap sensor for detecting the open / closed state of the fuel supply port. Fuel system sensor 297 includes a fuel level sensor for detecting the amount of fuel stored in the fuel tank.

[0036] In this embodiment, the control system 200 is shown as including a system configuration of TCU 201, ECU 202, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299. However, the system configuration of the control system 200 is not limited to the example of this embodiment. Furthermore, in this embodiment, as an example, the mobile control unit that can be the target of a program update is ECU 204, and ECU 202 functions as the update control unit for controlling the program update. Furthermore, the mobile control unit that can be the target of a program update is not limited to ECU 204. The mobile control unit that can be the target of a program update can be any of TCU 201, ECU 202, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299.

[0037] ECU 202 includes a determination unit 210 , an update control unit 220 , a notification control unit 230 , and an instruction acquisition control unit 240 .

[0038] Update control unit 220 controls reception of an update program for ECU 204 from an external device and controls updating of ECU 204 using the update program. Determination unit 210 determines whether vehicle 20 is being refueled during the period from the start of updating ECU 204 using the update program until a predetermined time has passed. If determination unit 210 determines that vehicle 20 is being refueled, update control unit 220 stops starting the update of ECU 204 using the update program.

[0039] Until a predetermined time has passed, instruction acquisition control unit 240 controls the acquisition of a user instruction indicating that the ECU 204 should not be updated using the update program. For example, instruction acquisition control unit 240 controls the acquisition of a user instruction input to IVI 299. If no user instruction is received and determination unit 210 determines that refueling of vehicle 20 is not to be performed, update control unit 220 starts updating ECU 204 using the update program.

[0040] The notification control unit 230 controls notification to the user regarding the update of the ECU 204. The user may be, for example, an occupant of the vehicle 20. The notification control unit 230 causes the MID 298 and the IVI 299 to display update notification information.

[0041] After notification control unit 230 notifies the user, instruction acquisition control unit 240 acquires a user instruction until a predetermined time has elapsed. If no user instruction is acquired before the predetermined time has elapsed after notification control unit 230 notifies the user, and determination unit 210 determines that refueling of vehicle 20 is not to be performed, update control unit 220 starts updating ECU 204 using the update program.

[0042] The predetermined time can be, for example, 30 seconds or longer and 600 seconds or shorter. It is preferably within 300 seconds. It is also preferably within 180 seconds. A shorter time reduces power consumption until the user's instruction is received, thus minimizing battery degradation. On the other hand, if the time is too short, the user's intention may not be properly recognized if the user does not wish to update.

[0043] The notification to the user may include a notification for the user to select whether to update ECU 204. When instruction acquisition control unit 240 receives a user instruction to update ECU 204, update control unit 220 may initiate the update of ECU 204 using the update program before a predetermined time has elapsed. This allows the update to begin upon receipt of the user's instruction to update, thereby reducing power consumption during the user notification period.

[0044] When the amount of fuel stored in the vehicle 20 increases, the determination unit 210 determines that fuel should be replenished to the vehicle 20. The determination unit 210 calculates the amount of fuel stored based on the detection result of the fuel level sensor included in the fuel system sensor 297.

[0045] When the fuel supply port of the vehicle 20 is open, the determination unit 210 determines that fuel is being supplied to the vehicle 20. The determination unit 210 determines the open state of the fuel supply port based on the output of the fuel cap sensor included in the door system sensor.

[0046] If vehicle 20 is at a refueling facility, determination unit 210 determines that vehicle 20 should be refueled. Determination unit 210 determines whether vehicle 20 is at a refueling facility based on location information acquired by the GNSS receiver and location information of the refueling facility. The location information of the refueling facility may be stored in IVI 299. Examples of fuel include gasoline, light oil, alcohol-based fuel, and hydrogen fuel. Examples of refueling facilities include gas stations.

[0047] Figure 3An example of update notification information 300 displayed on the IVI 299 is shown. When the ECU 204 can be updated by an update program downloaded from the external device 70, the notification control unit 230 displays the update notification information 300 on the IVI 299 when the IG switch of the vehicle 20 is turned off.

[0048] The update notification information 300 includes waiting time information 310 which is the time until the update of ECU204 starts, message information 320 to the user, a UI button 330 for obtaining an update execution instruction from the user indicating that the update is to be performed, and a UI button 340 for obtaining an update delay instruction from the user indicating that the update is not to be performed.

[0049] Waiting time information 310 includes information indicating the remaining time until update control unit 220 automatically starts updating ECU 204. Notification control unit 230 counts down the remaining time in waiting time information 310 as time passes. Message information 320 is information used to notify the user that the system update has started and that vehicle 20 should be parked in a safe location.

[0050] The instruction acquisition control unit 240 acquires that the position of the UI button 330 has been manipulated as an update execution instruction from the user. The instruction acquisition control unit 240 acquires that the display position of the UI button 340 has been manipulated as an update delay instruction from the user.

[0051] Figure 4 An example of update notification information 400 displayed on MID 298 is shown. When ECU 204 can be updated using an update program downloaded from external device 70, notification control unit 230 displays update notification information 400 on MID 298. Update notification information 400 includes message information 420 for the user. Message information 420 is information for notifying the user that a system update has started.

[0052] In addition to the IVI 299, the notification control unit 230 also notifies the user through the MID 298. This allows the user to reliably recognize the start of the update. For example, even if the IVI 299 fails, the user can be notified through the MID 298.

[0053] In addition, when the update notification information 300 and the update notification information 400 are displayed, the notification control unit 230 can output a sound effect from the MID 298. In addition, the notification control unit 230 can output the reference information in voice. Figure 3320. As described above, the notification control unit 230 can notify the user of updates through display and voice. Since the notification control unit 230 notifies the user through voice and display from the MID 298 and IVI 299, respectively, it is assumed that even if a malfunction occurs in either the MID 298 or IVI 299, the user can still recognize the update.

[0054] Figure 5 A timing chart related to program update processing is schematically shown. Figure 5 The status of the IG switch and the execution status of related processing related to program update in the control system 200 are shown. Figure 5 The timing chart in is a timing chart when ECU204 is in an updateable state.

[0055] At time t1, when the user turns off the IG switch, the update control unit 220 starts a countdown timer that expires at a predetermined time. The countdown timer expires, for example, in 120 seconds. Furthermore, when the IG switch is off, the notification control unit 230 notifies the user of the update. For example, the notification control unit 230 displays update notification information 300 on the IVI 299 and update notification information 400 on the MID 298.

[0056] At time t2, when time Δt has elapsed since the IG switch was turned off, determination unit 210 acquires the fuel storage amount based on the output of the fuel level sensor. Δt is set to a value of 0 or greater. By increasing Δt, the fuel storage amount can be acquired as the change in the fuel level in the storage tank becomes smaller. Δt can be set based on the detection method of the fuel level sensor installed in vehicle 20.

[0057] When the countdown timer expires, at time t3, determination unit 210 reacquires the fuel storage amount based on the output of the fuel level sensor. Determination unit 210 calculates the increase in the fuel storage amount based on the difference between the fuel storage amount acquired at time t3 and the fuel storage amount acquired at time t2. If the increase in the fuel storage amount is less than a predetermined reference value, determination unit 210 initiates a program update process for ECU 204. Upon completion of the update process, the power supply to vehicle 20 is turned off at time t4.

[0058] Furthermore, when the increase in the fuel storage amount exceeds a predetermined reference value, update control unit 220 does not initiate program update processing for ECU 204 and turns off the power supply of vehicle 20. This prevents the start of an update of ECU 204 when refueling vehicle 20 at a fuel station.

[0059] As Figure 5In the modification example of the timing chart of FIG. 10, the fuel storage amount can be acquired at time t2, and the increase amount of the fuel storage amount from time t2 can be calculated at a predetermined time interval until the update notification period of 120 seconds elapses. The judging section 210 can judge whether the increase amount of the fuel storage amount is less than the predetermined reference value at each time the fuel storage amount is acquired, and the update control section 220 can judge that the update of the ECU 204 does not start and cause the power supply of the vehicle 20 to be in the off state in the case where the increase amount of the fuel storage amount is the predetermined reference value or more. Thus, it is possible to judge that the update of the ECU 204 does not start before the update notification period of 120 seconds elapses.

[0060] Further, the judging section 210 can acquire the increase amount of the fuel storage amount by using the fuel level information of the fuel gauge displayed on the MID 298 or the like. In this case, the reference value of the increase amount of the fuel storage amount can be the fuel storage amount corresponding to one scale of the fuel gauge. For example, when the capacity of the fuel tank is 60 liters and the fuel gauge is displayed in 10 scales, the reference value of the increase amount of the fuel storage amount can be set to 6 liters.

[0061] The time at which the countdown timer expires can be set in accordance with the fuel supply amount per unit time in the fuel station. The fuel supply amount per unit time in the fuel station can be determined in accordance with the standard specifications of the fuel station in the country or region where the vehicle 20 is used. The longer the value obtained by dividing the reference value of the increase amount of the fuel storage amount by the fuel supply amount per unit time in the fuel station, the longer the time at which the countdown timer expires can be set. In addition, since the settlement method or the like in the fuel station differs depending on the country or region where the vehicle 20 is used, there are cases where the time until the fuel replenishment starts differs depending on the country or region. Therefore, the time at which the countdown timer expires can be set for each country or region.

[0062] Here, the update process of ECU 204 will be described. This will be described for the case where the memory used to store the firmware of ECU 204 is a single-bank memory (so-called single-sided ROM). In this case, since ECU 204 has a single program storage area for storing the firmware, while ECU 204 is operating according to the program stored in the program storage area, the update program cannot be written to the program storage area. When updating ECU 204, update control unit 220 transfers the update program to a predetermined storage area of ​​ECU 204 and then instructs ECU 204 to update. When instructed to update, ECU 204 executes control code for program update, writes the update program transferred to the predetermined storage area into the program storage area, and activates the update program. Activating the update program, for example, includes setting startup parameters for ECU 204 so that the update program is loaded upon startup of ECU 204 and control based on the updated program begins. Furthermore, if the memory used to store the firmware of ECU 204 is a single-bank memory, "a state in which the ECU can be updated" may mean a state in which the update program has been transferred to the predetermined storage area of ​​ECU 204.

[0063] Next, the update process will be described when the memory used to store firmware in ECU 204 is a dual-bank memory (i.e., double-sided ROM). In this case, since ECU 204 has two program storage areas for storing firmware, the update program can be written to the second program storage area while ECU 204 is operating according to the program stored in the first program storage area. For example, the update program can be written to the second program storage area even while vehicle 20 is driving. Therefore, after the update control unit 220 transfers the update program to ECU 204, it instructs ECU 204 to write the update program to the second program storage area. When the update program is written to the second program storage area, the ECU 204 is ready for updating. When the update control unit 220 executes the update of ECU 204, it instructs ECU 204 to activate the update program written to the second program storage area. Activating the update program includes setting the startup parameters of ECU 204 so that, for example, when ECU 204 starts up, the update program stored in the second program storage area is loaded and control based on the update program begins. For example, activating an update program involves validating the second program storage area as a program read area and deactivating the first program storage area as a program read area. Therefore, "updating an ECU using an update program" encompasses writing an update program to an ECU's program storage area. Furthermore, "updating an ECU using an update program" encompasses activating the update program written to the program storage area.

[0064] Figure 6This is a flowchart showing an example of the execution order of the processing related to the update of ECU204. Figure 6 Flowchart processing.

[0065] In S500, update control unit 220 determines whether a program update of ECU 204 is possible. If a program update of ECU 204 is not possible, in S522, power to vehicle 20 is turned off, and the process of this flowchart ends. If a program update of ECU 204 is possible, the process proceeds to S502.

[0066] In S502, determination unit 210 determines whether vehicle 20's current location is within a fuel station. Determination unit 210 determines whether vehicle 20's current location is within a fuel station based on the location information acquired by GNSS receiver 290 and the location information of fuel stations registered in IVI 299. For example, if the distance from vehicle 20's current location to the fuel station registered in IVI 299 is shorter than a predetermined distance, determination unit 210 determines that vehicle 20's current location is within a fuel station. If vehicle 20's current location is within a fuel station, processing proceeds to S522. If vehicle 20's current location is not within a fuel station, processing proceeds to S504.

[0067] In S504, notification control unit 230 notifies the user of the program update. For example, notification control unit 230 displays update notification message 300 on IVI 299 and update notification message 400 on MID 298. In S506, update control unit 220 starts a countdown timer. For example, the countdown timer expires in 120 seconds. In S508, determination unit 210 obtains and stores the fuel storage amount in the fuel tank of vehicle 20 based on the output of the fuel level sensor.

[0068] At S510, the instruction acquisition control unit 240 determines the user instruction. For example, when no user operation information is obtained from the IVI 299, the instruction acquisition control unit 240 determines that there is no user instruction. Figure 3 When the user operation information indicating that the position of the UI button 330 in the instruction acquisition control unit 240 is operated is obtained, the instruction acquisition control unit 240 determines that the user instruction is an update execution instruction. Figure 3 When the user operation information indicates that the position of the UI button 340 in FIG. 1 is operated, the instruction acquisition control unit 240 determines that the user instruction is an update delay instruction.

[0069] If it is determined in S510 that the user instruction is an update delay instruction, the process proceeds to S522. If it is determined in S510 that the user instruction is an update execution instruction, the process proceeds to S516. If it is determined in S510 that there is no user instruction, the process proceeds to S512.

[0070] In S512, the update control unit 220 determines whether the countdown timer has expired. If the countdown timer has expired, the process proceeds to S516. If the countdown timer has not expired, the process proceeds to S514. In S514, the determination unit 210 determines whether the fuel lid is open. If the fuel lid is not open, the process proceeds to S510. If the fuel lid is open, the process proceeds to S522.

[0071] When the countdown timer expires, determination unit 210 determines in S516 whether the fuel storage amount in the fuel tank has increased. For example, determination unit 210 obtains the fuel storage amount in the fuel tank within vehicle 20 based on the output of the fuel level sensor and calculates the increase in the fuel storage amount based on the difference between the newly obtained fuel storage amount and the fuel storage amount stored in S508. If the increase in the fuel storage amount exceeds a predetermined value, determination unit 210 determines that the fuel storage amount in the fuel tank has increased. If the increase in the fuel storage amount is below the predetermined value, determination unit 210 determines that the fuel storage amount in the fuel tank has not increased. If the fuel storage amount in the fuel tank has increased, processing proceeds to S522. If the fuel storage amount in the fuel tank has not increased, processing proceeds to S518.

[0072] In S518, determination unit 210 determines whether the fuel lid is open. If the fuel lid is not open, the process proceeds to S520. If the fuel lid is open, the process proceeds to S522. In S520, update control unit 220 executes an update of ECU 204 using the update program. When the update of ECU 204 is complete, the process proceeds to S522.

[0073] in addition, Figure 6 is Figure 5 The flowchart described in the timing diagram of FIG5 is when Δt is set to 0. When Δt is set to a value greater than 0, the process of S508 may be executed when the time Δt has elapsed since the countdown timer was started.

[0074] As described above, according to the control system 200 of this embodiment, the start of ECU updates can be suppressed when fuel is being supplied to vehicle 20. This prevents vehicle 20 from experiencing downtime due to the initiation of ECU updates while vehicle 20 is temporarily stopped at a fuel station. For example, at a self-service fuel station where the user of vehicle 20 refuels themselves, there is a possibility that the user may not be able to confirm the update notification displayed after the IG is disconnected because the user exits the vehicle to refuel. Even in this case, since the ECU update does not start when refueling of vehicle 20 is detected, the possibility of undesirable downtime can be reduced. Furthermore, since the initiation of ECU updates is determined based on the increase in fuel storage, appropriate determination of the initiation of ECU updates can be made even in vehicles without a fuel cap sensor.

[0075] The vehicle 20 may be an automobile with an internal combustion engine. The vehicle 20 may be a fuel cell vehicle (FCV), etc. The vehicle 20 is an example of a mobile object. Examples of mobile objects include automobiles such as passenger cars and buses, saddle-type vehicles, aircraft, and ships. A transport device may be any device that transports people or goods. A mobile object is not limited to transport devices and may be any movable device.

[0076] Figure 7 This figure illustrates an example of a computer 2000 that can fully or partially embody various embodiments of the present invention. Programs installed on computer 2000 can cause computer 2000 to function as a system, device, or each unit of a control system, etc., related to the embodiments, to perform operations associated with the device or each unit of the device, and / or to perform processes or steps related to the embodiments. Such programs can be executed by CPU 2012 to cause computer 2000 to perform the processing flow described in this specification and specific operations associated with some or all of the functional blocks in the block diagrams.

[0077] The computer 2000 according to this embodiment includes a CPU 2012 and a RAM 2014, which are interconnected via a main controller 2010. The computer 2000 further includes a ROM 2026, a flash memory 2024, a communication interface 2022, and an input / output chip 2040. The ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040 are connected to the main controller 2010 via the input / output controller 2020.

[0078] The CPU 2012 operates according to the programs stored in the ROM 2026 and the RAM 2014 , thereby controlling each unit.

[0079] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 holds programs and data used by the CPU 2012 within the computer 2000. The ROM 2026 holds a boot program or the like executed by the computer 2000 when activated, and / or a program dependent on the hardware of the computer 2000. The input / output chip 2040 can also connect various input / output units such as a keyboard, a mouse, and a monitor to the input / output controller 2020 via an input / output port of a serial port, a parallel port, a keyboard port, a mouse port, a monitor port, a USB port, an HDMI (registered trademark) port, or the like.

[0080] A program is provided via a computer-readable medium such as a CD-ROM, a DVD-ROM, or a USB memory, or a network. The RAM 2014, the ROM 2026, or the flash memory 2024 is an example of the computer-readable medium. The program is installed to the flash memory 2024, the RAM 2014, or the ROM 2026, and executed by the CPU 2012. Information processing described within these programs is read by the computer 2000, and cooperation between the program and various types of hardware resources described above is achieved. An apparatus or a method can be configured by operating or processing information in compliance with the use of the computer 2000.

[0081] For example, in a case where communication is performed between the computer 2000 and an external device, the CPU 2012 can execute a communication program loaded to the RAM 2014, and instruct the communication interface 2022 to perform communication processing based on processing described in the communication program. The communication interface 2022 reads transmission data held in a transmission buffer processing area provided in a recording medium such as the RAM 2014 and the flash memory 2024 under the control of the CPU 2012, transmits the read transmission data to a network, and writes reception data received from the network to a reception buffer processing area or the like provided in the recording medium.

[0082] In addition, the CPU 2012 can cause all or a required part of a file or a database held in a recording medium such as the flash memory 2024 to be read to the RAM 2014, and perform various processing on the data on the RAM 2014. The CPU 2012 then writes the processed data back to the recording medium.

[0083] Various types of programs, data, tables, and various information such as databases can be saved to a recording medium and applied to information processing. CPU2012 can perform various processing described in this specification, including various operations specified by the instruction sequence of the program, information processing, conditional judgment, conditional branching, unconditional branching, information retrieval / replacement, etc., on the data read from RAM2014, and write the results back to RAM2014. In addition, CPU2012 can retrieve information in files, databases, etc. in the recording medium. For example, when a plurality of items each having an attribute value of a first attribute associated with an attribute value of a second attribute are stored in a recording medium, CPU2012 can retrieve an item that specifies an attribute value of the first attribute and is consistent with the condition from the plurality of items, read the attribute value of the second attribute stored in the item, and thereby obtain the attribute value of the second attribute associated with the first attribute that meets the pre-set condition.

[0084] The programs or software modules described above can be stored in a computer-readable medium on or near the computer 2000. A recording medium such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet can be used as the computer-readable medium. The program stored in the computer-readable medium can be provided to the computer 2000 via the network.

[0085] Programs installed in computer 2000 and causing computer 2000 to function as control system 200 can be run on CPU 2012 and other devices, causing computer 2000 to function as each unit of control system 200. Information processing described in these programs is read into computer 2000, causing it to function as specific units that collaborate with the various hardware resources described above, namely, the units of control system 200. Furthermore, by utilizing these specific units to perform calculations or processing of information corresponding to the intended use of computer 2000 in this embodiment, a unique control system 200 corresponding to the intended use can be constructed.

[0086] Various embodiments are described with reference to block diagrams, etc. In the block diagrams, each functional block may represent (1) a step of a process for performing an operation or (2) each unit of a device having the function of performing an operation. Specific steps and each unit may be implemented by a dedicated circuit, a programmable circuit supplied together with computer-readable instructions stored on a computer-readable medium, and / or a processor supplied together with computer-readable instructions stored on a computer-readable medium. The dedicated circuit may include digital and / or analog hardware circuits, and may also include integrated circuits (ICs) and / or discrete circuits. The programmable circuit may include logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logical operations, flip-flops, registers, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and other reconfigurable hardware circuits including memory elements.

[0087] A computer-readable medium may include any tangible device capable of storing instructions for execution by an appropriate device. Consequently, a computer-readable medium having instructions stored therein constitutes at least a portion of an article containing instructions executable to implement a means for performing the operations specified in the process flow or block diagram. Examples of computer-readable media include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, and the like. More specific examples of computer-readable media include floppy disks (registered trademark), flexible magnetic disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), electrically erasable programmable read-only memories (EEPROM), static random access memories (SRAM), compact disc read-only memories (CD-ROMs), digital versatile disks (DVDs), Blu-ray discs (RTMs), memory sticks, integrated circuit cards, and the like.

[0088] Computer-readable instructions may include assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine delegate instructions, microcode, firmware instructions, state setting data, or any source code or object code described in any combination of one or more programming languages ​​including object-oriented programming languages ​​such as Smalltalk, JAVA (registered trademark), C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages.

[0089] Computer-readable instructions are provided to a processor or programmable circuit of a general-purpose computer, a special-purpose computer, or other programmable data processing device via a local area network (LAN) or a wide area network (WAN) such as the Internet. The computer-readable instructions can be executed to implement a unit for performing the operations specified in the processing flow or block diagram. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, etc.

[0090] While the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various modifications or improvements can be made to the above embodiments. It will be apparent from the claims that such modifications or improvements are also within the technical scope of the present invention.

[0091] Regarding the order in which actions, processes, steps, and processes, etc., in the apparatus, system, program, and method described in the claims, specifications, and drawings, it should be noted that unless specifically indicated by "before," "preceding," or the like, these processes may be performed in any order, as long as the output of a previous process is not used in a subsequent process. Even if the process flow in the claims, specifications, and drawings is described using "first," "next," or the like for convenience, this does not necessarily mean that the process must be performed in that order.

[0092] [Explanation of Reference Numerals]

[0093] 10. Update the system

[0094] 20 vehicles

[0095] 70 External devices

[0096] 90 Communication Network

[0097] 200 Control System

[0098] 201 TCU

[0099] 202 ECU

[0100] 204 ECU

[0101] 205 ECU

[0102] 206 ECU

[0103] 210 Judgment Department

[0104] 220 Update Control Department

[0105] 230 Notification Control Department

[0106] 240 Instruction acquisition control unit

[0107] 280 Vehicle Communication Line

[0108] 290 GNSS receiver

[0109] 294 FI

[0110] 295 battery

[0111] 296 Door System Sensor

[0112] 297 Fuel System Sensor

[0113] 298 MID

[0114] 299 IVI

[0115] 300 Update notification information

[0116] 310 Waiting time information

[0117] 320 Message Information

[0118] 330 UI Button

[0119] 340 UI Button

[0120] 400 Update notification information

[0121] 420 Message Information

[0122] 2000 Computer

[0123] 2010 Main Controller

[0124] 2012 CPU

[0125] 2014 RAM

[0126] 2020 Input / Output Controller

[0127] 2022 Communication Interface

[0128] 2024 Flash Memory

[0129] 2026 ROM

[0130] 2040 Input / Output Chip.

Claims

1. A control system, wherein: have: a moving body control unit that controls the moving body; an update control unit configured to control reception of an update program for the mobile body control unit from an external device and control updating of the mobile body control unit using the update program; a determination unit that determines whether to refuel the mobile body during a period from the start of updating the mobile body control unit by the update program until a predetermined time has passed; and an instruction acquisition control unit that performs control to acquire a user instruction indicating not to execute the update of the moving body control unit by the update program until the predetermined time has elapsed, When the user instruction is not obtained and the judgment unit determines that fuel replenishment to the mobile body is not to be performed, the update control unit starts to update the mobile body control unit through the update program; when the judgment unit determines that fuel replenishment to the mobile body is to be performed, the update control unit stops starting to update the mobile body control unit through the update program.

2. The control system according to claim 1, wherein: further comprising a notification control unit for controlling notification to a user regarding update of the mobile body control unit, After the notification control unit has notified the user, the instruction acquisition control unit acquires the user instruction until the predetermined time has elapsed. After the notification control unit has executed notification to the user, if the user instruction is not obtained until the predetermined time has passed and the judgment unit determines that fuel replenishment to the mobile body is not to be performed, the update control unit starts updating the mobile body control unit through the update program.

3. The control system according to claim 2, wherein: The predetermined time is greater than or equal to 30 seconds and less than or equal to 600 seconds.

4. The control system according to claim 3, wherein: The predetermined time is within 300 seconds.

5. The control system according to any one of claims 2 to 4, wherein: The notification to the user includes a notification for the user to select whether to execute the update of the mobile body control unit, When the instruction acquisition control unit acquires a user instruction to execute the update of the moving body control unit, the update control unit starts updating the moving body control unit using the update program before the predetermined time elapses.

6. The control system according to any one of claims 1 to 4, wherein: The determination unit determines that the fuel supply to the mobile body is to be performed when the storage amount of the fuel in the mobile body increases.

7. The control system according to any one of claims 1 to 4, wherein: The determination unit determines that fuel is to be supplied to the mobile body when a fuel supply port of the mobile body is opened.

8. The control system according to any one of claims 1 to 4, wherein: The determination unit determines that fuel is to be supplied to the mobile object when the mobile object is present in a fuel supply facility.

9. A mobile object, wherein: A control system according to any one of claims 1 to 8 is provided.

10. The moving object according to claim 9, wherein The mobile object is a vehicle.

11. A control method, wherein: have: a step of receiving an update program of a mobile body control unit that controls the mobile body from an external device; a step of determining whether to refuel the mobile body during a period from the start of updating the mobile body control unit by the update program until a predetermined time has passed; performing a control step of acquiring a user instruction indicating not to execute the update of the mobile body control unit by the update program until the predetermined time has elapsed; as well as When the user instruction is not obtained and it is determined that fuel is not to be replenished to the mobile body, the step of starting the update of the mobile body control unit through the update program is started; when it is determined that fuel is to be replenished to the mobile body, the step of starting the update of the mobile body control unit through the update program is stopped.

12. A computer-readable storage medium storing a program, wherein: The program causes the computer to function as the following unit: a moving body control unit that controls the moving body; an update control unit configured to control reception of an update program for the mobile body control unit from an external device and control updating of the mobile body control unit using the update program; a determination unit that determines whether to refuel the mobile body during a period from the start of updating the mobile body control unit by the update program until a predetermined time has passed; and an instruction acquisition control unit that performs control to acquire a user instruction indicating not to execute the update of the moving body control unit by the update program until the predetermined time has elapsed, When the user instruction is not obtained and the judgment unit determines that fuel replenishment to the mobile body is not to be performed, the update control unit starts to update the mobile body control unit through the update program; when the judgment unit determines that fuel replenishment to the mobile body is to be performed, the update control unit stops the start of the update of the mobile body control unit through the update program through the program.

Images