Control system, mobile object, information processing device, control method, information processing method, and computer-readable storage medium

Abstract

The control system includes a mobile body control unit for controlling the mobile body; an update control unit for controlling reception of an update program for the mobile body control unit from an external device and controlling updating of the mobile body control unit by the update program; and a notification control unit for notifying a user of functional information that is restricted in the mobile body during the updating of the mobile body control unit, wherein identification information for identifying functions that are restricted in the mobile body during the updating of the mobile body control unit by the update program is assigned to the update program, and the notification control unit controls notification of the restricted functional information to the user based on the identification information assigned to the update program.

Description

Technical Field

[0001] The present invention relates to a control system, a mobile object, an information processing device, a control method, an information processing method, and a computer-readable storage medium. Background Art

[0002] Patent Document 1 discloses an ECU capable of rewriting application programs as an ECU for a vehicle.

[0003] Patent Document 1: Japanese Patent Application Laid-Open No. 2020-27666. Summary of the Invention

[0004] In a first embodiment, a control system is provided. The control system includes a mobile body control unit that controls a mobile body. The control system includes an update control unit that controls reception of an update program for the mobile body control unit from an external device and controls updating of the mobile body control unit using the update program. The control system includes a notification control unit that notifies a user of information regarding functions that are restricted in the mobile body during the update of the mobile body control unit. Identification information for identifying functions that are restricted in the mobile body during the update of the mobile body control unit by the update program is assigned to the update program. The notification control unit controls notification of the restricted function information to the user based on the identification information assigned to the update program.

[0005] The update program may be assigned identification information and mobile object identification information for identifying a mobile object whose function is restricted. The control system may include a determination unit that determines, based on the identification information assigned to the update program and the mobile object identification information, the functions restricted in the mobile object while the mobile object control unit is being updated by the update program. The notification control unit may control notification of the restricted function information to a user based on the functions determined by the determination unit.

[0006] The update control unit may control reception of a plurality of update programs from an external device. The control system may further include a selection unit configured to select an update program from the plurality of update programs for updating the mobile object control unit. The determination unit may determine, based on identification information assigned to each of the plurality of update programs and the mobile object determination information, functions to be restricted in the mobile object while the mobile object control unit is being updated using the update program selected by the selection unit.

[0007] The notification control unit may notify the user of the function determined by the determination unit before starting to update the moving body control unit using the update program selected by the selection unit.

[0008] The selection unit may select one update program for updating the moving body control unit from among the plurality of update programs based on the remaining amount of a battery included in the moving body.

[0009] The selection unit may select one update program for updating the moving body control unit based on an amount of power consumed when the moving body control unit as an update target is updated by each of the plurality of update programs and a remaining amount of the battery.

[0010] In a second aspect, a mobile object is provided. The mobile object includes the above-mentioned control system.

[0011] The mobile object may be a vehicle.

[0012] In a third aspect, an information processing device is provided. The information processing device generates function restriction information indicating functions that are restricted in a mobile body while a mobile body control unit of the mobile body is updated by an update program. The update program is assigned identification information for identifying functions that are restricted in the mobile body while the mobile body control unit is updated by the update program. The information processing device includes an update program acquisition unit that acquires the update program. The information processing device includes an identification information acquisition unit that acquires the identification information assigned to the update program. The information processing device includes a message generation unit that generates a message to be output when the mobile body control unit is updated by the update program based on the identification information acquired by the identification information acquisition unit. The information processing device includes an output control unit that controls the output of the message generated by the message generation unit.

[0013] In a fourth aspect, a control method is provided. The control method includes the step of controlling reception of an update program for a mobile body control unit for controlling a mobile body from an external device. Identification information is embedded in the update program, and the identification information is used to identify functions that are restricted in the mobile body while the mobile body control unit is being updated by the update program. The control method includes the step of controlling notification to a user of information regarding functions that are restricted in the mobile body during the update of the mobile body control unit, based on the identification information assigned to the update program. The control method includes the step of controlling the update of the mobile body control unit by the update program.

[0014] In a fifth aspect, a program is provided. The program causes a computer to function as a mobile body control unit that controls a mobile body. The program causes the computer to function as an update control unit that controls receipt of an update program for the mobile body control unit from an external device and controls updating of the mobile body control unit using the update program. The program causes the computer to function as a notification control unit that notifies a user of information regarding functions that are restricted in the mobile body during the update of the mobile body control unit. Identification information is embedded in the update program, and this identification information is used to identify functions that are restricted in the mobile body during the update of the mobile body control unit using the update program. Through the program, the notification control unit controls notification of the restricted function information to the user based on the identification information assigned to the update program.

[0015] In a sixth aspect, an information processing method is provided. The information processing method generates function restriction information indicating functions that are restricted in a mobile body while a mobile body control unit included in the mobile body is being updated by an update program. The update program is assigned identification information for identifying functions that are restricted in the mobile body while the mobile body control unit is being updated by the update program. The information processing method includes the steps of obtaining the update program. The information processing method includes the steps of obtaining the identification information assigned to the update program. The information processing method includes the steps of generating a message to be output when the mobile body control unit is updated by the update program based on the identification information. The information processing method includes the steps of controlling the output of the message.

[0016] In a seventh aspect, a program is provided. The program causes a computer to function as an information processing device that generates function restriction information indicating functions that are restricted in a mobile body while a mobile body control unit of the mobile body is being updated by an update program. The update program is assigned identification information for identifying functions that are restricted in the mobile body while the mobile body control unit is being updated by the update program. The program causes the computer to function as an update program acquisition unit that acquires the update program. The program causes the computer to function as an identification information acquisition unit that acquires the identification information assigned to the update program. The program causes the computer to function as a message generation unit that generates a message to be output when the mobile body control unit is updated by the update program based on the identification information acquired by the identification information acquisition unit. The program causes the computer to function as an output control unit that controls the output of the message generated by the message generation unit.

[0017] In addition, the above summary of the invention does not list all the necessary features of the present invention. In addition, sub-combinations of these features may also be inventions. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 An updating system 10 according to one embodiment is schematically shown.

[0019] Figure 2 The system configuration of the information processing device 72 is schematically shown.

[0020] Figure 3 The system configuration of the control system 200 is schematically shown.

[0021] Figure 4 The process of generating an update package 62 that is sent to the vehicle 20 is schematically illustrated.

[0022] Figure 5 The data structure of the identification information given to the update program is shown in a table format.

[0023] Figure 6An example of user notification information 600 displayed on the IVI 299 is shown.

[0024] Figure 7 An example of user notification information 700 displayed on the IVI 299 before activation is performed is shown.

[0025] Figure 8 shows that when the vehicle 20 is corresponding to Figure 5 The program is updated when the vehicle A is selected as "Vehicle Type 1".

[0026] Figure 9 shows that when the vehicle 20 is corresponding to Figure 5 The program is updated when the vehicle B is selected in "Vehicle Type 2".

[0027] Figure 10 The flow of processing executed when the update program is activated is shown.

[0028] Figure 11 1 is a flowchart illustrating an example of an execution procedure of a process related to program update performed by the control system 200 .

[0029] Figure 12 An example of a computer 2000 is shown. DETAILED DESCRIPTION

[0030] The present invention will be described below by way of its embodiments, but the following embodiments do not limit the claimed invention. Furthermore, not all combinations of features described in the embodiments are essential to the solution of the present invention.

[0031] Figure 1 An update system 10 according to one embodiment is schematically shown. Update system 10 includes a vehicle 20, an external device 70, an information processing device 72, and a program registration device 74. Vehicle 20 includes a control system 200. Control system 200 is responsible for controlling vehicle 20 and communicating with external device 70 via a communication network 90. ​​Communication network 90 includes IP networks such as the Internet, peer-to-peer networks, dedicated lines including VPNs, virtual networks, and mobile communication networks.

[0032] In the vehicle 20, the control system 200 has a plurality of ECUs (Electronic Control Units) for controlling the vehicle 20. The control system 200 obtains an update program for the ECU provided in the control system 200 from the outside. For example, the control system 200 receives an update program 60 sent from an external device 70 via a communication network 90 using wireless communication. The control system 200 reprograms the ECU provided in the control system 200 using the update program 60. Reprogramming is performed for the purpose of upgrading the functions of the ECU provided in the control system 200, etc. Thus, the control system 200 updates the ECU by reprogramming the ECU via OTA (Over The Air). In this embodiment, a device that updates an ECU, etc., by an update program is referred to as a "program update."

[0033] exist Figure 1 In the example, the update program 60 is created by a software creator and registered in the program registration device 74. The update program 60 includes a program body and identification information. The program body is a program code executed by the ECU. The identification information is information for identifying functions that are restricted in the vehicle 20 when a program update is performed through the update program 60. For example, in the case where the update program 60 is a program for the ECU that controls the battery of the vehicle 20, there is a case where the charging function of the battery is restricted when the program is updated through the update program 60. In this case, the identification information of the update program 60 may be flag information indicating a "charging function". When generating the update program 60, the creator of the update program 60 embeds the identification information into the update program 60. The program registration device 74 uploads the update program 60 to the information processing device 72 via the communication network 90.

[0034] The information processing device 72 assigns an explanatory statement related to the update program 60 to the update program 60. For example, the explanatory statement is a statement explaining the functions added by the program update of the update program 60. The explanatory statement is input to the information processing device 72 by the creator of the explanatory statement. The information processing device 72 assigns the explanatory statement to the update program 60 and, based on the identification information embedded in the update program 60, automatically generates a message to notify the user before executing the program update of the update program 60 and assigns the message to the update program 60. The information processing device 72 uploads the update package 62 containing the update program 60, the explanatory statement, and the message to the external device 70. The external device 70 transmits the update package 62 to the vehicle 20.

[0035] Before executing a program update using the update program 60 included in the update package 62, the control system 200 displays the explanatory message and information contained in the update package 62 to notify the user. Furthermore, the control system 200 notifies the user of any functions that will be restricted during the program update based on the identification information contained in the update program 60. This clearly indicates the restricted functions to the user before they occur due to the program update. Furthermore, since the information processing device 72 automatically generates a message based on the identification information embedded in the update program 60 and assigns it to the update package 62, the possibility of the update package 62 being delivered to the vehicle 20 without an explanation of the functional restrictions due to human error or the like is reduced.

[0036] Figure 2 The system configuration of information processing device 72 is schematically shown. Information processing device 72 includes processing unit 300, storage unit 380, and communication unit 390. Processing unit 300 includes update program acquisition unit 310, identification information acquisition unit 320, message generation unit 330, and output control unit 340.

[0037] The processing unit 300 is implemented by, for example, a processing device including a processor. The storage unit 380 is implemented by including a nonvolatile storage medium. The processing unit 300 performs processing using information stored in the storage unit 380. The communication unit 390 is responsible for communication with the external device 70 and the program registration device 74.

[0038] Information processing device 72 generates function restriction information indicating functions restricted in vehicle 20 during the updating of the ECU installed in vehicle 20 by an update program. Identification information for identifying functions restricted in vehicle 20 during the updating of the ECU by the update program is assigned to the update program. Update program acquisition unit 310 acquires the update program. For example, update program acquisition unit 310 acquires the update program created by a software creator.

[0039] Identification information acquisition unit 320 acquires identification information assigned to the update program. Message generation unit 330, based on the identification information acquired by identification information acquisition unit 320, generates a message to be output when the ECU is updated by the update program. For example, message generation unit 330 generates a predetermined, fixed message associated with the identification information. Output control unit 340 controls the output of the message generated by message generation unit 330. For example, output control unit 340 outputs the message in association with the update program acquired by update program acquisition unit 310.

[0040] Figure 3The following schematically shows the system configuration of the control system 200. The control system 200 includes a TCU 201, an ECU 202, an ECU 204, an ECU 205, an ECU 206, an MID 298, and an IVI 299. Figure 2 , the FI 294 , the high-voltage battery 295 , the locking device 296 , and the low-voltage battery 297 are examples of controlled devices provided in the vehicle 20 .

[0041] ECU 202 is connected to TCU 201, ECU 204, ECU 205, and ECU 206 via in-vehicle communication line 280. ECU 202 communicates with TCU 201, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299 via in-vehicle communication line 280. ECU 202 controls TCU 201, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299 as a whole. In-vehicle communication line 280 can include, for example, a CAN (Controller Area Network) or Ethernet.

[0042] TCU 201 is a telematics control unit. TCU 201 is primarily responsible for mobile communications. Under the control of ECU 202, TCU 201 transmits and receives data to and from external device 70. Under the control of ECU 202, TCU 201 receives update programs from external device 70 via mobile communications. TCU 201 can function as a wireless communication unit.

[0043] MID 298 is a multi-information display. IVI 299 is, for example, an in-vehicle infotainment (IVI). MID 298 and IVI 299 can function as a display control unit. IVI 299 has a wireless LAN communication function. Based on the control of ECU 202, IVI 299 receives update programs sent from external device 70 via wireless communication.

[0044] ECU 204, ECU 205, and ECU 206 are each an ECU that serves as a vehicle control unit for controlling vehicle 20. ECU 204, ECU 205, and ECU 206 are examples of a "mobile body control unit." ECU 204, ECU 205, and ECU 206 control various devices installed in vehicle 20. For example, ECU 204 controls FI 294, which serves as a fuel injection device. ECU 205 controls a high-voltage battery 295, etc. The high-voltage battery 295 is, for example, a battery that stores power to supply the driving motor of vehicle 20. ECU 206 controls a locking device 296, a low-voltage battery 297, etc. The locking device 296 is a device for locking the doors of vehicle 20, etc. The low-voltage battery 297 functions as, for example, a 12-volt power supply for the vehicle. The low-voltage battery 297 is, for example, a lead-acid battery.

[0045] In this embodiment, the control system 200 is shown as having a system configuration including TCU 201, ECU 202, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299. However, the system configuration of the control system 200 is not limited to the example of this embodiment. In addition, in this embodiment, as an example, it is assumed that the mobile body control units that can be the subject of program updates are ECU 205 and ECU 206, and ECU 202 functions as the update control unit that controls program updates. In addition, the mobile body control units that can be the subject of program updates are not limited to these ECUs. The mobile body control unit that can be the subject of program updates can be any of TCU 201, ECU 202, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299.

[0046] ECU 202 includes an update control unit 220 , a notification control unit 230 , a determination unit 240 , and a selection unit 260 .

[0047] Update control unit 220 controls the reception of ECU update programs from external devices and controls the updating of the ECUs using the update programs. Notification control unit 230 notifies the user of information regarding restricted functions in vehicle 20 during the ECU update. For example, the user is a passenger in vehicle 20. Identification information for identifying the functions restricted in vehicle 20 during the ECU update using the update program is assigned to the update program. Notification control unit 230 controls notification of the restricted function information to the user based on the identification information assigned to the update program. For example, notification control unit 230 may cause MID 298 and IVI 299 to perform notification of the user.

[0048] The update program is assigned identification information and vehicle identification information for identifying the vehicle 20 in which the function restriction occurs. Based on the identification information and vehicle identification information assigned to the update program, determination unit 240 determines the functions that are restricted in vehicle 20 while the ECU is being updated using the update program. Notification control unit 230 controls notification of the restricted function information to the user based on the functions determined by determination unit 240.

[0049] Update control unit 220 controls the reception of multiple update programs from external devices. Selector 260 selects an update program from the multiple update programs for updating the ECU. Determination unit 240, based on identification information assigned to each of the multiple update programs and vehicle identification information, determines the functions that are restricted in vehicle 20 during the ECU update using the update program selected by selection unit 260. Notification control unit 230 notifies the user of the functions determined by determination unit 240 before starting the ECU update using the update program selected by selection unit 260.

[0050] The selection unit 260 can select one update program for updating the ECU from among the multiple update programs based on the remaining charge of the low-voltage battery 297 provided in the vehicle 20. The selection unit 260 selects the one update program for updating the ECU based on the amount of power consumed when updating the target ECU using each of the multiple update programs and the remaining charge of the low-voltage battery 297. The amount of power consumed when updating the ECU can be included in the update package transmitted from the external device 70.

[0051] Here, the program update is explained. The program update process is explained when the device that is the object of the program update is an ECU and the memory for storing the firmware of the ECU is a single-bank memory (so-called single-sided ROM). In this case, since the program storage area for storing the firmware of the ECU is single, when the ECU operates according to the program stored in the program storage area, the update program cannot be written to the program storage area. When the program of the ECU is updated, the update control unit 220 transmits the update program to the ECU to save the update program in a predetermined data storage area of ​​the ECU, and then instructs the ECU to update the program. When the program update is instructed, the ECU executes the control code for performing the program update, writes the update program transmitted to the data storage area into the program storage area, and activates the update program. The activation of the update program includes, for example, a process for setting the startup parameters of the ECU so that the update program is loaded when the ECU is started and control based on the update program is started.

[0052] Next, the program update process when the ECU's internal memory is a dual-bank memory (i.e., double-sided ROM) will be described. In this case, since the ECU has two program storage areas for firmware storage, while the ECU is operating according to the program stored in the first program storage area, the update program can be written to the second program storage area. In other words, through so-called back-side writing, the update program can be written to the second program storage area, which serves as the back side. Therefore, for example, the update program can be written to the second program storage area even while the vehicle 20 is driving. Therefore, when the update control unit 220 transmits the update program to the ECU, it instructs the ECU to write the update program to the second program storage area. When the update program is written to the second program storage area of ​​the ECU, the ECU becomes ready for program updates. When the update control unit 220 executes the ECU program update, it instructs the ECU to activate the update program written to the second program storage area. Activating the update program includes setting the ECU's startup parameters so that, for example, when the ECU starts up, the update program stored in the second program storage area is loaded and control based on the update program begins. For example, activating an update program involves validating the second program storage area as a program read area and deactivating the first program storage area as a program read area. Therefore, the concept of "program update" includes instructions for writing an update program to the program storage area of ​​the ECU. Furthermore, the concept of "program update" also includes instructions for activating the update program written to the program storage area.

[0053] When updating a program on an ECU with a single-bank memory, there's a possibility that the ECU may be unable to control the vehicle while the update program is being written to the program storage area and while the update program is active. Therefore, the period during which vehicle functionality is restricted is between the time the update program is being written to the program storage area and the time the update program is active. On the other hand, when updating a program on an ECU with a dual-bank memory, the ECU can control the vehicle while the update program is being written to the program storage area on the back side. Therefore, the period during which vehicle functionality is restricted is during the time the update program is active. This embodiment describes a case where ECUs 205 and 206, the update targets, are ECUs with dual-bank memory.

[0054] Figure 4 The flow of generating an update package 62 to be transmitted to the vehicle 20 is schematically shown. The update program 60 is created by a software creator and uploaded to the information processing device 72 via the program registration device 74. During the creation of the update program 60 by the software creator, identification information indicating functions that are restricted in the vehicle during the program update is embedded in the update program 60.

[0055] In information processing device 72, update program acquisition unit 310 stores update program 60 received from program registration unit 74 in storage unit 380. Program manager 490 inputs an explanatory statement for update program 60 into information processing device 72. For example, if update program 60 is for ECU 205, an explanatory statement describing the functions added by update program 60 is input. For example, the explanatory statement might be something like "You can now perform ○○ during fast charging." In information processing device 72, storage unit 380 stores the explanatory statement in association with update program 60.

[0056] In information processing device 72, identification information acquisition unit 320 reads identification information from update program 60. Message generation unit 330 generates a fixed message based on the identification information read from update program 60. For example, storage unit 380 stores the fixed message in association with the identification information. For example, storage unit 380 stores a message such as "The charging function may become unavailable during the update." in association with identification information representing "charging function." Message generation unit 330 generates the message stored in storage unit 380 in association with the identification information read from update program 60.

[0057] The output control unit 340 attaches the message generated by the message generation unit 330 to the update program 60. In addition, the output control unit 340 attaches power consumption information indicating the amount of power consumed when executing the update of the ECU to the update program 60. For example, the storage unit 380 stores the power consumption information consumed when executing the update of the ECU in correspondence with the identification information of the update program 60. The output control unit 340 attaches the power consumption information stored in the storage unit 380 in correspondence with the identification information of the update program 60 to the update program 60. Figure 4 In the illustrated example, power consumption information indicating that the amount of power consumed when the update of the ECU is executed is “XX Ah” is attached to the update program 60 .

[0058] Output control unit 340 generates an update package 62 including an update program body and identification information, and includes interpretation statement 410 , message 420 , and power information 430 . Output control unit 340 transmits generated update package 62 to external device 70 via communication unit 390 .

[0059] Figure 5 The data structure of the identification information given to the update program is shown in a table format. Figure 5 The data structures of the identification information of the update program of ECU 205 and the identification information of the update program of ECU 206 are illustrated. The identification information includes a function ID, vehicle type information, and ECU information. The function ID is information for identifying the function that is restricted in the vehicle when the program is updated.

[0060] The vehicle information is information indicating the type of vehicle whose function is restricted when the program is updated. "0" indicates that the function is not restricted when the program is updated, and "1" indicates that the function is restricted when the program is updated. When a program update is performed, there are cases where function restrictions occur only for specific vehicle types. For example, the restriction of the charging function occurs only in electric vehicles equipped with a high-voltage battery 295, and when a program update is performed on a gasoline vehicle that is not equipped with a high-voltage battery 295, the restriction of the charging function does not occur. According to the vehicle type information, it is set in which vehicle the function restriction occurs. In Figure 5 In the example shown in FIG, when the program is updated, functions are not restricted in vehicles of "Vehicle Type 1" but are restricted in vehicles of "Vehicle Type 2" and "Vehicle Type 3." The vehicle 20 can determine whether functions are restricted when the ECU program is updated by referring to the vehicle information.

[0061] ECU information indicates the combination of ECUs for which function restrictions occur during program updates. "0" indicates no function restrictions during program updates, while "1" indicates function restrictions during program updates. When performing program updates on multiple ECUs, function restrictions may only occur when the program update is performed in combination with a specific ECU. The ECU information determines the ECU combination with which function restrictions occur during program updates. The vehicle 20 can determine whether function restrictions occur during program updates by referring to the ECU information.

[0062] Figure 6 An example of user notification information 600 displayed on the IVI 299 is shown. When an update package 62 is downloaded from the external device 70, the notification control unit 230 displays the user notification information 600 on the IVI 299 before writing the updated program to the program storage area of ​​the ECU. Information 610 of the user notification information 600 is an explanation of the update package 62. Information 620 of the user notification information 600 is a message included in the update package 62. User notification information 600 can be used to inform the user of the functions added by the program update. Furthermore, the user can be informed in advance of the functions that will be restricted upon activation of the updated program 60.

[0063] The user can instruct to start the program update after turning off the IG switch of the vehicle by touching UI button 630 in user notification information 600. When the user touches UI button 630, update control unit 220 begins writing update program 60 to the program storage area on the back of ECU 205. After completing writing update program 60 to the program storage area on the back, update control unit 220 activates update program 60 after turning off the IG switch of vehicle 20.

[0064] Figure 7An example of user notification information 700 displayed on the IVI 299 before activation is performed is shown. If the IG switch of the vehicle 20 is turned off, then when the writing of the update program 60 to the program storage area on the rear side is completed, the notification control unit 230 displays the user notification information 700 on the IVI 299 before activation. At this time, the notification control unit 230 displays function restriction information 720 corresponding to the identification information contained in the update package 62 on the IVI 299. The function restriction information 720 includes an icon indicating that the charging function is restricted. By performing the icon display, the user can clearly identify the restricted function. The notification control unit 230 controls the IVI 299 so that the function restriction information 720 is displayed at the front of the display surface.

[0065] Thus, the notification control unit 230 displays the function restriction information 720 before executing the activation. Figure 6 In the case where the user does not fully realize that the charging function is restricted when the user notification information 600 is received, the user may be made aware that the charging function is restricted.

[0066] Figure 8 、 9 10 show the flow of processing performed when the update program is activated. Figure 8 shows that when the vehicle 20 is corresponding to Figure 5 The program is updated when the vehicle A is selected as "Vehicle Type 1". Figure 9 shows that when the vehicle 20 is corresponding to Figure 5 The program is updated when the vehicle B is selected in "Vehicle Type 2". Figure 10 shows that when the vehicle 20 is corresponding to Figure 5 The program is updated when the vehicle is of "Vehicle Type 3". Figure 8 and Figure 9 In the case shown, it is assumed that the update program has been written to the program storage area on the back of ECU 205 and ECU 206. Figure 10 The case where only the program update of the ECU 206 is performed is shown, and it is assumed that the writing of the update program to the program storage area on the back of the ECU 206 has been completed.

[0067] exist Figure 8In the example, if the IG switch is turned off at time t1, selection unit 260 selects an update program for program update from the update program for ECU 205 and the update program for ECU 206. Selection unit 260 obtains the remaining capacity of low-voltage battery 297 and calculates the amount of power available for program update based on the remaining capacity of low-voltage battery 297. Selection unit 260 determines the power consumption during program update for ECU 205 and the power consumption during program update for ECU 206 based on the power consumption information included in the update packages for ECU 205 and ECU 206, respectively. Selection unit 260 selects the update program so that the total power consumption does not exceed the power consumption available for program update.

[0068] Figure 8 FIG. 2 shows a case where the update program of ECU 206 is selected when the IG is disconnected at time t1. Figure 5 As shown, when executing a program update for ECU 206, the locking function of vehicle A, corresponding to "Vehicle Type 1," is restricted. Therefore, based on the vehicle type information of vehicle 20 itself, determination unit 240 determines the "locking function" as a function that is restricted when executing a program update for ECU 206. At time t2, notification control unit 230 displays function restriction information 820 on IVI 299 indicating that the locking function is restricted. Thereafter, update control unit 220 executes processing to activate the updated program for ECU 206 and switches vehicle 20 to the off state.

[0069] After the IG switch is turned on at time t3 and the vehicle 20 is driven, the IG switch is turned off at time t4. When the IG switch is turned off, if the selection unit 260 determines that the program update of the ECU 205 can be performed based on the remaining capacity of the low-voltage battery 297 and the power consumption when the program update of the ECU 205 is performed, the ECU 205 is selected as the ECU to perform the program update. Figure 5 As shown, when the program of ECU 205 is updated, the charging function of vehicle A corresponding to "Vehicle Type 1" is not restricted. Therefore, notification control unit 230 does not display the function restriction information on IVI 299, and update control unit 220 executes processing to activate the updated program of ECU 205 and turns the power supply state of vehicle 20 to off.

[0070] Next, we will refer to Figure 9 The vehicle 20 is described as corresponding to Figure 5 In the case of vehicle B of "Vehicle Type 2", in this case, and Figure 8 Similarly, it is assumed that the update program of ECU 206 is selected when the IG is disconnected at time t1, and the update program of ECU 205 is selected when the IG is disconnected next time.

[0071] like Figure 5As shown, when executing a program update for ECU 206, the locking function of vehicle B, corresponding to "Vehicle Type 2," is restricted. Therefore, determination unit 240 determines the "locking function" as a function restricted when executing a program update for ECU 206. At time t2, notification control unit 230 displays function restriction information 820 on IVI 299 indicating that the locking function is restricted. Thereafter, update control unit 220 executes processing to activate the updated program for ECU 206 and sets the power supply state of vehicle 20 to off.

[0072] After the IG switch is turned on at time t3 and the vehicle 20 is driven, the IG switch is turned off at time t4. The selection unit 260 selects the ECU 205 as the ECU to execute the program update. Figure 5 As shown, when the program of ECU 205 is updated, the charging function of vehicle B, which corresponds to "vehicle type 2," is restricted. Therefore, notification control unit 230 displays function restriction information 720 on IVI 299 indicating that the charging function is restricted. Thereafter, update control unit 220 executes processing to activate the updated program of ECU 205 and turns the power supply state of vehicle 20 to off.

[0073] Next, we will refer to Figure 10 The vehicle 20 is described as corresponding to Figure 5 In the case of vehicle C of "vehicle type 3" in Figure 8 Similarly, it is assumed that the selection unit 260 selects the update program of the ECU 206 at the time of IG disconnection at time t1 based on the remaining capacity and power consumption information of the low-voltage battery 297.

[0074] like Figure 5 As shown, when the program update of ECU206 is executed, the locking function of vehicle B corresponding to "vehicle type 3" is restricted. Therefore, the determination unit 240 determines the "locking function" as a function that is restricted when the program update of ECU206 is executed. At time t2, the notification control unit 230 displays function restriction information 820 indicating that the locking function is restricted on IVI299. Thereafter, the update control unit 220 executes a process for activating the update program of ECU206 and turns the power state of vehicle 20 to off. Thereafter, when the IG switch is turned on at time t3 so that vehicle 20 is traveling, the IG switch is turned off at time t4. Since there is no ECU that is the target of the program update, the power state of vehicle 20 is turned off at time t5.

[0075] As reference Figures 8 to 10 As described above, according to the update system 10 , it is possible to accurately notify the user of the functions that are restricted when updating each vehicle program.

[0076] Figure 111 is a flowchart illustrating an example of an execution procedure of a process related to program update performed by the control system 200 . Figure 11 The flowchart starts when the IG switch of the vehicle 20 is turned off. In S1002 , the selection unit 260 obtains the remaining capacity of the low-voltage battery 297 .

[0077] In S1004, selection unit 260 selects an update program for executing an ECU program update. For example, selection unit 260 selects an update program for executing an ECU program update based on the remaining capacity of low-voltage battery 297 and the power consumption information included in the update package. Alternatively, selection unit 260 may select an update program based on the available memory capacity of the ECU to be updated. For example, selection unit 260 may select an update program for executing an ECU program update if the available memory capacity of the ECU is greater than the capacity required to execute the program update.

[0078] In S1006, determination unit 240 determines the functions that are restricted when performing a program update using the update program selected in S1004. Determination unit 240 determines the functions that are restricted when performing a program update based on the vehicle type information of vehicle 20 and the identification information included in the update package. In S1008, notification control unit 230 notifies the user of information indicating the functions determined in S1006.

[0079] Next, at S1010, update control unit 220 initiates a program update. Furthermore, at S1010, when performing a program update on an ECU with dual-bank memory, update control unit 220 instructs the ECU to activate the program. On the other hand, when performing a program update on an ECU with single-bank memory, update control unit 220 instructs the ECU to write the updated program to the program storage area of ​​the ECU and instructs the ECU to activate the program.

[0080] In S1012 , when the program update process is completed, the power supply state of the vehicle 20 is turned off, and the process of this flowchart is terminated.

[0081] As described above, according to the update system 10 of this embodiment, the information processing device 72 automatically generates a message to be notified to the user before a program update is executed via the update program, based on the identification information embedded in the update program 60, and attaches this message to the update package containing the update program. This reduces the possibility of a message regarding function restrictions being sent to the vehicle without being included in the update package due to human error, etc. Furthermore, the control system 200 displays and notifies the user of the message contained in the update package before the program is updated via the update program. Furthermore, the control system 200 notifies the user of the functions that will be restricted during the program update based on the identification information contained in the update program. Thus, even if the user ignores the message contained in the update package, the restricted functions can be clearly indicated to the user before the function restrictions occur due to the program update.

[0082] In addition, the vehicle 20 is a vehicle as an example of a transport device. The vehicle may be a car having an internal combustion engine, an electric vehicle, or a fuel cell vehicle (FCV). Cars include buses, trucks, two-wheeled vehicles, etc. The vehicle may be a saddle-type vehicle, etc., or a motorcycle. As transport devices, in addition to vehicles, there are also devices such as aircraft including unmanned aerial vehicles and ships. Transport devices may be any device for transporting people or goods. Transport devices are an example of a mobile body. The mobile body is not limited to transport devices, and may be any movable device.

[0083] Figure 12 An example of a computer 2000 that can fully or partially embody various embodiments of the present invention is shown. Programs installed on computer 2000 can cause computer 2000 to function as a system, such as a control system, or as each unit of a system, or as a device, such as an information processing device, or as each unit of such a device, according to the embodiments; perform operations associated with the system, or as each unit of the system, or as each unit of the device, and / or perform processes or steps of such processes according to the embodiments. Such programs can be executed by CPU 2012 to cause computer 2000 to perform the processing described in this specification and specific operations associated with some or all of the functional blocks in the block diagrams.

[0084] The computer 2000 according to this embodiment includes a CPU 2012 and a RAM 2014, which are interconnected via a main controller 2010. The computer 2000 further includes a ROM 2026, a flash memory 2024, a communication interface 2022, and an input / output chip 2040. The ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040 are connected to the main controller 2010 via the input / output controller 2020.

[0085] The CPU 2012 operates according to the programs stored in the ROM 2026 and the RAM 2014 , thereby controlling each unit.

[0086] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 stores programs and data used by the CPU 2012 in the computer 2000. The ROM 2026 stores startup programs and the like executed by the computer 2000 when activated, and / or programs dependent on the hardware of the computer 2000. The input / output chip 2040 can also connect various input / output units such as a keyboard, mouse, and monitor to the input / output controller 2020 via input / output ports such as a serial port, a parallel port, a keyboard port, a mouse port, a monitor port, a USB port, and an HDMI (registered trademark) port.

[0087] The program is provided via a computer-readable medium such as a CD-ROM, DVD-ROM, or USB flash drive, or via a network. RAM 2014, ROM 2026, or flash memory 2024 are examples of computer-readable media. The program is installed in flash memory 2024, RAM 2014, or ROM 2026 and executed by CPU 2012. The information processing described in these programs is read by computer 2000, enabling collaboration between the program and the various types of hardware resources described above. A device or method can be constructed by implementing information manipulation or processing in accordance with the use of computer 2000.

[0088] For example, when communication is performed between the computer 2000 and an external device, the CPU 2012 can execute a communication program loaded into the RAM 2014 and, based on the processing described in the communication program, instruct the communication interface 2022 to perform communication processing. Under the control of the CPU 2012, the communication interface 2022 reads transmission data stored in a transmission buffer area provided in the RAM 2014 and a recording medium such as the flash memory 2024, transmits the read transmission data to the network, and writes reception data received from the network to a reception buffer area provided on the recording medium.

[0089] Furthermore, the CPU 2012 can read all or a required portion of a file or database stored in a recording medium such as the flash memory 2024 into the RAM 2014 and perform various processes on the data in the RAM 2014. The CPU 2012 then writes the processed data back to the recording medium.

[0090] Various types of programs, data, tables, and various information such as databases can be saved to a recording medium and applied to information processing. CPU2012 can perform various processing described in this specification, including various operations specified by the instruction sequence of the program, information processing, conditional judgment, conditional branching, unconditional branching, information retrieval / replacement, etc., on the data read from RAM2014, and write the results back to RAM2014. In addition, CPU2012 can retrieve information in files, databases, etc. in the recording medium. For example, when a plurality of items each having an attribute value of a first attribute associated with an attribute value of a second attribute are stored in a recording medium, CPU2012 can retrieve an item that specifies an attribute value of the first attribute and is consistent with the condition from the plurality of items, read the attribute value of the second attribute stored in the item, and thereby obtain the attribute value of the second attribute associated with the first attribute that meets the pre-set condition.

[0091] The programs or software modules described above can be stored in a computer-readable medium on or near the computer 2000. A recording medium such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet can be used as the computer-readable medium. The program stored in the computer-readable medium can be provided to the computer 2000 via the network.

[0092] Programs installed in computer 2000 and causing computer 2000 to function as control system 200 can be run on CPU 2012 and other devices, causing computer 2000 to function as each unit of control system 200. Information processing described in these programs is read into computer 2000, causing it to function as specific units that collaborate with the various hardware resources described above, namely, the units of control system 200. Furthermore, by utilizing these specific units to perform calculations or processing of information corresponding to the intended use of computer 2000 in this embodiment, a unique control system 200 corresponding to the intended use can be constructed.

[0093] Programs installed in computer 2000 and causing computer 2000 to function as information processing device 72 can be run on CPU 2012 and other devices, causing computer 2000 to function as each unit of information processing device 72. The information processing described in these programs is read into computer 2000, whereupon the software and the various hardware resources described above work together to form specific units, namely, the units of information processing device 72. Furthermore, by utilizing these specific units to perform calculations or processing of information corresponding to the intended use of computer 2000 in this embodiment, a unique information processing device 72 corresponding to the intended use is constructed.

[0094] Various embodiments are described with reference to block diagrams, etc. In the block diagrams, each functional block may represent (1) a step of a process for performing an operation or (2) each unit of a device having the function of performing an operation. Specific steps and each unit may be implemented by a dedicated circuit, a programmable circuit supplied together with computer-readable instructions stored on a computer-readable medium, and / or a processor supplied together with computer-readable instructions stored on a computer-readable medium. The dedicated circuit may include digital and / or analog hardware circuits, and may also include integrated circuits (ICs) and / or discrete circuits. The programmable circuit may include logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logical operations, flip-flops, registers, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and other reconfigurable hardware circuits including memory elements.

[0095] A computer-readable medium may include any tangible device capable of storing instructions for execution by an appropriate device. Consequently, a computer-readable medium having instructions stored therein constitutes at least a portion of an article containing instructions executable to implement a means for performing the operations specified in the process flow or block diagram. Examples of computer-readable media include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, and the like. More specific examples of computer-readable media include floppy disks (registered trademark), flexible magnetic disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), electrically erasable programmable read-only memories (EEPROM), static random access memories (SRAM), compact disc read-only memories (CD-ROMs), digital versatile disks (DVDs), Blu-ray discs (RTMs), memory sticks, integrated circuit cards, and the like.

[0096] Computer-readable instructions may include assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine delegate instructions, microcode, firmware instructions, state setting data, or any source code or object code described in any combination of one or more programming languages ​​including object-oriented programming languages ​​such as Smalltalk, JAVA (registered trademark), C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages.

[0097] Computer-readable instructions are provided to a processor or programmable circuit of a general-purpose computer, a special-purpose computer, or other programmable data processing device via a local area network (LAN) or a wide area network (WAN) such as the Internet. The computer-readable instructions can be executed to implement a unit for performing the operations specified in the processing flow or block diagram. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, etc.

[0098] While the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various modifications or improvements can be made to the above embodiments. It will be apparent from the claims that such modifications or improvements are also within the technical scope of the present invention.

[0099] Regarding the order in which actions, processes, steps, and processes, etc., in the apparatus, system, program, and method described in the claims, specifications, and drawings, it should be noted that unless specifically indicated by "before," "preceding," or the like, these processes may be performed in any order, as long as the output of a previous process is not used in a subsequent process. Even if the process flow in the claims, specifications, and drawings is described using "first," "next," or the like for convenience, this does not necessarily mean that the process must be performed in that order.

[0100] [Explanation of Reference Numerals]

[0101] 10. Update the system

[0102] 20 vehicles

[0103] 60 Updater

[0104] 62 Update Package

[0105] 70 External devices

[0106] 72 Information processing device

[0107] 74 Program Registration Device

[0108] 90 Communication Network

[0109] 200 Control System

[0110] 201 TCU

[0111] 202 ECU

[0112] 204 ECU

[0113] 205 ECU

[0114] 206 ECU

[0115] 220 Update Control Department

[0116] 230 Notification Control Department

[0117] 240 Determination Department

[0118] 260 Selection Department

[0119] 280 Vehicle Communication Line

[0120] 294 FI

[0121] 295 High Voltage Battery

[0122] 296 Locking Device

[0123] 297 Low Voltage Battery

[0124] 298 MID

[0125] 299 IVI

[0126] 300 Processing Department

[0127] 310 Update Program Acquisition Department

[0128] 320 Identification Information Acquisition Department

[0129] 330 Message Generation Department

[0130] 340 Output Control Unit

[0131] 380 Storage Department

[0132] 390 Ministry of Communications

[0133] 410 Explanation statement

[0134] 420 Message

[0135] 430 Battery Information

[0136] 490 Program Manager

[0137] 600 User Notification Information

[0138] 610 Information

[0139] 620 Information

[0140] 630 UI Button

[0141] 700 User notification information

[0142] 720 Functional restriction information

[0143] 820 Functional limitation information

[0144] 2000 Computer

[0145] 2010 Main Controller

[0146] 2012 CPU

[0147] 2014 RAM

[0148] 2020 Input / Output Controller

[0149] 2022 Communication Interface

[0150] 2024 Flash Memory

[0151] 2026 ROM

[0152] 2040 Input / Output Chip.

Claims

1. A control system, wherein: The control system comprises: a moving body control unit that controls the moving body; an update control unit configured to control reception of an update program for the mobile body control unit from an external device and control updating of the mobile body control unit using the update program; as well as a notification control unit that notifies a user of function information that is restricted in the mobile body during the update of the mobile body control unit, The update program is provided with identification information and mobile body identification information, the identification information being used to identify a function that is restricted in the mobile body during the period when the mobile body control unit is updated by the update program, and the mobile body identification information being used to identify the mobile body in which the restriction of the function occurs. The control system further includes a determination unit that determines, based on the identification information assigned to the update program and the mobile body determination information, a function that is restricted in the mobile body while the mobile body control unit is being updated by the update program. The notification control section controls notification of the restricted function information to the user based on the function determined by the determination section.

2. The control system according to claim 1, wherein: The update control unit controls reception of the plurality of update programs from the external device, The control system further includes a selection unit that selects an update program for updating the mobile body control unit from among the plurality of update programs. The determination unit determines, based on the identification information and the mobile body determination information assigned to each of the plurality of update programs, a function that is restricted in the mobile body while the mobile body control unit is being updated by the update program selected by the selection unit.

3. The control system according to claim 2, wherein: The notification control unit notifies the user of the function determined by the determination unit before starting to update the moving body control unit using the update program selected by the selection unit.

4. The control system according to claim 2, wherein: The selection unit selects one update program for updating the moving body control unit from among the plurality of update programs based on the remaining power of the battery included in the moving body.

5. The control system according to claim 4, wherein: The selection unit selects one update program for updating the moving body control unit based on the amount of power consumed when the moving body control unit to be updated is updated by each of the plurality of update programs and the remaining amount of the battery.

6. A mobile object, wherein: A control system according to any one of claims 1 to 5 is provided.

7. The moving object according to claim 6, wherein: The mobile object is a vehicle.

8. An information processing device that adds a message to an update program, the message being about a function that is restricted in a mobile body while a mobile body control unit included in the mobile body is being updated by the update program, wherein: The update program is provided with identification information for identifying a function that is restricted in the mobile body during the period when the mobile body control unit is updated by the update program, and mobile body identification information for identifying the mobile body in which the restriction of the function occurs. The information processing device comprises: an update program acquisition unit configured to acquire the update program; an identification information acquisition unit that acquires the identification information assigned to the update program; a message generating unit that generates the message to be output when the moving body control unit is updated by the update program, based on the identification information acquired by the identification information acquiring unit; as well as An output control unit is configured to attach the message generated by the message generation unit to the update program.

9. A control method, wherein: The method comprises the step of controlling the receiving of an update program of a mobile body control unit for controlling the mobile body from an external device, Identification information for identifying a function that is restricted in the mobile body during the updating of the mobile body control unit by the update program and mobile body identification information for identifying the mobile body in which the restriction of the function occurs are given to the update program. The control method has the following features: a step of determining, based on the identification information and the mobile body identification information assigned to the update program, a function to be restricted in the mobile body while the mobile body control unit is updated by the update program; controlling a step of notifying a user of information on a function restricted in the mobile body during an update of the mobile body control unit based on the function determined in the determining step; as well as A step of controlling the updating of the moving body control unit by the update program.

10. A computer-readable storage medium storing a program, wherein: The program causes the computer to function as the following unit: a moving body control unit that controls the moving body; an update control unit configured to control reception of an update program for the mobile body control unit from an external device and control updating of the mobile body control unit using the update program; as well as a notification control unit that notifies a user of function information restricted in the mobile body that occurs during the update of the mobile body control unit, Identification information for identifying a function that is restricted in the mobile body during the updating of the mobile body control unit by the update program and mobile body identification information for identifying the mobile body in which the restriction of the function occurs are given to the update program. The program further causes the computer to function as a determination unit that determines, based on the identification information and the mobile body determination information assigned to the update program, a function that is restricted in the mobile body while the mobile body control unit is being updated by the update program. With the program, the notification control section controls notification of the restricted function information to the user based on the function determined by the determination section.

11. An information processing method comprising: attaching a message to an update program, the message being about a function that is restricted in a mobile body while a mobile body control unit included in the mobile body is being updated by the update program, wherein: The update program is provided with identification information for identifying a function that is restricted in the mobile body during the period when the mobile body control unit is updated by the update program, and mobile body identification information for identifying the mobile body in which the restriction of the function occurs. The information processing method includes: The step of obtaining the update program; a step of acquiring the identification information assigned to the update program; generating, based on the identification information, the message to be output when the moving body control unit is updated by the update program; and The step of appending said message to said update program.

12. A computer-readable storage medium storing a program, wherein: The program causes a computer to function as an information processing device that adds a message to the update program regarding a function that is restricted in the mobile body while a mobile body control unit included in the mobile body is being updated by the update program. The update program is provided with identification information for identifying a function that is restricted in the mobile body during the period when the mobile body control unit is updated by the update program, and mobile body identification information for identifying the mobile body in which the restriction of the function occurs. The program causes the computer to function as the following means: an update program acquisition unit configured to acquire the update program; an identification information acquisition unit that acquires the identification information assigned to the update program; a message generating unit that generates the message to be output when the moving body control unit is updated by the update program, based on the identification information acquired by the identification information acquiring unit; as well as An output control unit is configured to attach the message generated by the message generation unit to the update program.

Images