Vehicle control device

Abstract

The present invention provides a vehicle control device that can suppress unintended vehicle behavior during the work confirmation process when performing work confirmation to confirm whether the vehicle will work normally when software for controlling the vehicle is to be updated. When performing work confirmation to confirm whether the vehicle (10) will work normally by executing the processing of the update software (126), since the work confirmation unit (128) executes the processing of the update software on the condition that the vehicle (10) is in a stopped state in which forward and reverse movement are suppressed, the work confirmation can be performed while suppressing unintended vehicle behavior during the work confirmation process, thereby improving the reliability of the vehicle (10).

Description

Technical Field

[0001] The present invention relates to a vehicle control device capable of updating software for controlling the vehicle. Background Art

[0002] A vehicle control device is known that can receive updated software from a server or the like and update the software stored in the vehicle with the updated software. Patent Document 1 discloses a vehicle control system that utilizes this type of vehicle control device. Patent Document 1 proposes a technique for minimizing the risk of malfunctioning vehicle-equipped units due to the software controlling the units being updated to the updated software. This technique involves performing a pre-processing of the software for the control units scheduled to be updated, thereby confirming whether the scheduled updated control can be executed normally.

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Publication No. 2019-137243 Summary of the Invention

[0006] Problems to be solved by the invention

[0007] In addition, although reliability is improved if, as shown in Patent Document 1, when the original software is to be updated with updated software, a work confirmation is performed in advance to determine whether the vehicle will work normally by executing the processing of the updated software, there is a possibility that the vehicle may behave in an unexpected manner during the work confirmation.

[0008] The present invention was completed against the background of the above situation, and its purpose is to provide a vehicle control device that can, when software for controlling a vehicle is to be updated, suppress unintended vehicle behavior during the work confirmation process by executing the processing of the updated software to confirm whether the vehicle will work normally.

[0009] Methods for solving problems

[0010] The main purpose of the first invention is a (a) vehicle control device, characterized in that it comprises: (b) a storage unit that stores software for controlling a vehicle; (c) a work confirmation unit that, when update software for updating existing software is stored in the storage unit, performs work confirmation on whether the vehicle will work normally by executing the processing of the update software; (d) an update unit that updates the existing software to the update software when it is confirmed by the work confirmation unit that the vehicle will work normally, and (e) the work confirmation unit is configured to execute the processing of the update software and perform the work confirmation on the condition that the vehicle is in a stopped state in which forward and reverse movement are suppressed.

[0011] The gist of the second invention is that, in the vehicle control device of the first invention, the operation confirmation unit is characterized in that the operation confirmation unit inquires of a vehicle occupant of the vehicle whether the operation confirmation is permitted, and executes the processing of the software for updating when the operation confirmation is permitted.

[0012] The gist of the third invention is that, in the vehicle control device of the first invention or the second invention, the operation confirmation unit suspends processing of the update software when the vehicle is switched to a drivable state during processing of the update software.

[0013] The gist of the fourth invention is that, in the vehicle control device of the third invention, it is characterized in that (a) the vehicle is configured to be electrically switched to a vehicle parking position in which the vehicle is stopped via an electric actuator, and (b) during the processing of the software for update, even if an operation to switch to a position other than the vehicle parking position is performed, the operation confirmation unit will delay the switching to a position other than the vehicle parking position until the processing of the software for update is terminated.

[0014] Effects of the Invention

[0015] According to the first invention, when performing work confirmation on whether the vehicle will work normally by executing the processing of the software for updating, the processing of the software for updating is performed on the condition that the vehicle is in a stopped state in which the forward and reverse movements are suppressed. Therefore, the work confirmation can be performed while suppressing the vehicle from moving in an unintended manner during the work confirmation process, thereby improving the reliability of the vehicle.

[0016] According to the second invention, the vehicle occupant is asked whether the operation confirmation is permitted, and the software update process is executed when the vehicle occupant permits the operation confirmation. This improves the convenience of the vehicle occupant.

[0017] According to the third invention, since the processing of the updating software is terminated when the vehicle is switched to a state where it can drive during the processing of the updating software, it is possible to suppress the occurrence of unintended vehicle behavior caused by executing the processing of the updating software while the vehicle is in a state where it can drive.

[0018] According to the fourth invention, since during the processing of the software for updating, even if an operation to switch to a gear other than the vehicle parking gear is performed, the switching to a gear other than the vehicle parking gear will be delayed until the processing of the software for updating is terminated, the vehicle behavior that is unexpected by the vehicle occupants can be suppressed. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A diagram illustrating a schematic structure of a vehicle to which the present invention is applied.

[0020] Figure 2 For execution Figure 1 A diagram illustrating an overview of the system configuration of various controls for a vehicle.

[0021] Figure 3 A flowchart illustrating the control work that can suppress unintended vehicle behavior during the work confirmation process when the main part of the control work of the vehicle control device installed on the vehicle, that is, the software that controls the vehicle, is updated while the work confirmation of the updated software is implemented. DETAILED DESCRIPTION

[0022] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following embodiments, the drawings are appropriately simplified or deformed, so that the dimensional ratios and shapes of each part are not necessarily accurately depicted.

[0023] Example

[0024] Figure 1This figure illustrates the schematic structure of a vehicle 10 to which the present invention is applied. The vehicle 10 is a hybrid vehicle that includes an engine 14, a first rotating machine MG1, and a second rotating machine MG2, and uses the engine 14 and the second rotating machine MG2 as driving force sources for traveling. In addition, the vehicle 10 includes a power transmission device 12 on the power transmission path between the engine 14 and the drive wheels 28. The power transmission device 12 includes an electric continuously variable transmission unit 18 and a mechanical stepped transmission unit 20, which are arranged in series on a common axis within a housing 16 that is a non-rotating member. The electric continuously variable transmission unit 18 is connected to the engine 14 directly or indirectly via a shock absorber, etc., not shown. The mechanical stepped transmission unit 20 is connected to the output side of the electric continuously variable transmission unit 18. The power transmission device 12 also includes a differential gear device 24 connected to an output shaft 22 serving as an output rotating member of the mechanical stepped transmission portion 20 , and a pair of axles 26 connected to the differential gear device 24 .

[0025] In the power transmission device 12, the power output from the engine 14 and the second rotating machine MG2 is transmitted to the mechanical stepped transmission unit 20, and is transmitted from the mechanical stepped transmission unit 20 to the drive wheels 28 of the vehicle 10 via the differential gear device 24 and the like. Hereinafter, the electric continuously variable transmission unit 18 is referred to as the continuously variable transmission unit 18, and the mechanical stepped transmission unit 20 is referred to as the stepped transmission unit 20. In addition, power is also synonymous with torque or force when no special distinction is made. In addition, the continuously variable transmission unit 18 and the stepped transmission unit 20 and the like are constructed roughly symmetrically with respect to the above-mentioned common axis, so that Figure 1 The lower half of the axis is omitted.

[0026] The engine 14 is a device that functions as a driving force source capable of generating a driving torque, and is, for example, a well-known internal combustion engine such as a gasoline engine or a diesel engine. The engine 14 controls the engine torque Te, which is the output torque of the engine 14, by controlling an engine control device 50 including a throttle actuator, a fuel injection device, and an ignition device included in the vehicle 10.

[0027] The first rotating machine MG1 and the second rotating machine MG2 are rotating electric machines that function as both an electric motor and a generator, namely, so-called motor generators. The first rotating machine MG1 and the second rotating machine MG2 are each connected to a battery 54, serving as an electrical storage device, provided in the vehicle 10 via an inverter 52. The inverter 52 is controlled by a travel control device 90 (described later) to control MG1 torque Tg and MG2 torque Tm, which are the output torques of the first rotating machine MG1 and the second rotating machine MG2, respectively.

[0028] The continuously variable transmission 18 includes a first rotating machine MG1 and a differential mechanism 32 serving as a power distribution mechanism. This differential mechanism 32 mechanically distributes the power of the engine 14 between the first rotating machine MG1 and an intermediate transmission member 30 serving as the output rotating member of the continuously variable transmission 18. The second rotating machine MG2 is power-transmittably connected to the intermediate transmission member 30. The differential mechanism 32 comprises a single-pinion planetary gear device. The engine 14 is power-transmittably connected to the planetary carrier CA0 of the planetary gear device via a connecting shaft 34. The first rotating machine MG1 is power-transmittably connected to the sun gear S0. The second rotating machine MG2 is power-transmittably connected to the ring gear R0. The continuously variable transmission 18 is an electric continuously variable transmission that controls the differential state of the differential mechanism 32 by controlling the operating state of the first rotating machine MG1. Furthermore, a mechanical oil pump 58 driven by the power of the engine 14 is connected to the connecting shaft 34 .

[0029] The stepped transmission 20 is a mechanical transmission mechanism that forms part of the power transmission path between the continuously variable transmission 18 and the drive wheels 28. The stepped transmission 20 is, for example, a planetary gear system comprising a plurality of planetary gear sets, including a first planetary gear set 36 and a second planetary gear set 38, and a plurality of engagement devices, including a clutch C1, a clutch C2, a brake B1, and a brake B2, including a one-way clutch F1, and is capable of shifting to multiple gear stages (speed steps). Hereinafter, the clutch C1, the clutch C2, the brake B1, and the brake B2 will be referred to simply as the engagement device CB unless otherwise specified. The engagement hydraulic pressure PRcb supplied to each engagement device CB is individually controlled by a hydraulic control circuit 56 provided in the vehicle 10. When the gear stage to be shifted is determined based on the accelerator operation amount (accelerator opening θacc) or the vehicle speed V, the stepped transmission unit 20 switches the engagement state of each engagement device CB to the engagement pattern of the engagement device CB predetermined for each gear stage. Furthermore, the hydraulic control circuit 56 is supplied with hydraulic oil discharged from a mechanical oil pump 58 or from an electric oil pump (not shown).

[0030] Furthermore, in the vehicle 10, a motor 40 (see FIG. Figure 2 ) and is electrically switched to the P position (vehicle parking position) where the vehicle stops, which is the so-called electronically controlled shift (SBW) method. Figure 2 As shown, the electric motor 40 is connected to a parking lock mechanism 42 for switching to the P position. Depending on the rotational position of the electric motor 40, the parking lock mechanism 42 is switched to either the parking lock state (in which the power transmission device 12 is in the P position) or the non-park lock state (in which the power transmission device 12 is in a non-P position). For example, when the shift lever 46's operating position POSsh is switched to the P position, a command signal Sp is output from the driving control device 90 to the electric motor 40, switching the parking lock mechanism 42 to the parking lock state. This causes the electric motor 40 to rotate to the rotational position corresponding to the P position. At this point, the parking lock mechanism 42 is activated, switching the shift range of the power transmission device 12 to the P position.

[0031] Figure 2 For execution Figure 1This figure schematically illustrates the system configuration of various controls for vehicle 10. Vehicle 10 includes a travel control device 90 that primarily performs various controls related to the travel of vehicle 10. Travel control device 90 is configured, for example, as a so-called microcomputer including a CPU, RAM, ROM, and input / output interfaces. The CPU utilizes the RAM's temporary storage function and performs signal processing according to programs pre-stored in the ROM to implement various controls for vehicle 10. Travel control device 90 is configured to be divided into multiple units, such as those for driving force source control and stepped transmission control, as needed.

[0032] The driving control device 90 is supplied with various sensors provided in the vehicle 10 (e.g., an engine speed sensor 60, an output speed sensor 62, an MG1 speed sensor 64, an MG2 speed sensor 66, an accelerator opening sensor 68, a throttle opening sensor 70, a brake pedal sensor 71, a steering sensor 72, a driver state sensor 73, a G sensor 74, a yaw rate sensor 76, a battery sensor 78, an oil temperature sensor 79, a vehicle periphery information sensor 80, a vehicle position sensor 81, an external network communication antenna 82). , navigation system 83, driving assistance setting switch group 84, shift position sensor 85, parking brake sensor 87, etc.) and various signals of detection values ​​(for example, engine speed Ne, output speed No corresponding to vehicle speed V, MG1 speed Ng as the speed of the first rotating machine MG1, MG2 speed Nm which is the same value as AT input speed Ni, accelerator opening θacc as the accelerator operation amount of the driver indicating the size of the driver's acceleration operation, throttle opening θth as the opening of the electronic throttle, brake pedal opening θth as an indication of the amount of the wheel brake to be operated). The brake on signal Bon, which is a signal indicating a state of being operated by the driver; the brake operation amount Bra, which is a signal indicating the magnitude of the brake pedal depression operation performed by the driver; the steering angle θsw and the steering direction Dsw of the steering wheel provided in the vehicle 10; the steering device on signal SWon, which is a signal indicating that the steering wheel is being held by the driver; the driver state signal Drv, which is a signal indicating the state of the driver; the longitudinal acceleration Gx and the lateral acceleration Gy of the vehicle 10; the yaw rate Ryaw, which is the angular velocity of rotation about the vertical axis of the vehicle 10; and the battery Temperature THbat or battery charge and discharge current Ibat or battery voltage Vbat, working oil temperature THoil as working oil temperature, vehicle peripheral information Iard, position information Ivp, communication signal Scom, navigation information Inavi, driving assistance setting signal Sset as a signal indicating the setting implemented by the driver under driving assistance control such as automatic driving control or cruise control, operating position POSsh of the shift lever 46 possessed by the vehicle 10, parking start signal PKBon as a signal indicating that the parking brake 75 is switched to on (working), etc.).

[0033] Various command signals (such as an engine control command signal Se for controlling the engine 14, a rotating machine control command signal Smg for controlling the first rotating machine MG1 and the second rotating machine MG2 respectively, a hydraulic control command signal Sat for controlling the working state of the engagement device CB, a communication signal Scom, a brake control command signal Sbra for controlling the braking torque generated by the wheel brakes, a steering control command signal Sste for controlling the steering of the wheels (especially the front wheels), an information awareness control command signal Sinf for warning and informing the driver, etc.) are output from the driving control device 90 to each device of the vehicle 10 (such as the engine control device 50, the inverter 52, the hydraulic control circuit 56, the external network communication antenna 82, the wheel brake device 86, the steering device 88, the information awareness control command signal Sinf, etc.)

[0034] To implement various controls related to the travel of the vehicle 10 , the travel control device 90 further includes an AT shift control unit 94 serving as an AT shift control means, a hybrid control unit 95 serving as a hybrid control means, and a driving control unit 96 serving as a driving control means.

[0035] The AT shift control unit 94 uses a predetermined relationship, i.e., an AT gear shift map (not shown), obtained and stored experimentally or by design, to determine the shifting of the stepped transmission unit 20 and, as needed, executes shift control of the stepped transmission unit 20. The AT gear shift map, for example, has a predetermined relationship on a two-dimensional coordinate system with the vehicle speed V and the required drive force Frdem as variables, including shift lines for determining the shifting of the stepped transmission unit 20.

[0036] The hybrid control unit 95 includes functions as an engine control unit (i.e., an engine control unit) that controls the operation of the engine 14, and as a rotating machine control unit (i.e., a rotating machine control unit) that controls the operation of the first rotating machine MG1 and the second rotating machine MG2 via the inverter 52. These control functions enable the hybrid drive control implemented by the engine 14, the first rotating machine MG1, and the second rotating machine MG2. The hybrid control unit 95 calculates the required driving force Frdem [N] for the drive wheels 28, which serves as the required driving force, by applying the accelerator opening θacc and the vehicle speed V to a predetermined relationship, such as a required driving force map. In addition to the required driving force Frdem, the required driving torque Trdem [Nm] for the drive wheels 28, the required driving power Prdem [W] for the drive wheels 28, the required AT output torque for the output shaft 22, and the like can be used as the required driving force.

[0037] In addition, when the hybrid power control unit 95 makes the continuously variable transmission unit 18 work as a continuously variable transmission, for example, the hybrid power control unit 95 will perform continuously variable transmission control of the continuously variable transmission unit 18 by controlling the engine 14 and the generated power Wg of the first rotating machine MG1 in order to obtain the engine speed Ne and engine torque Te that achieve the required drive power Prdem, so as to change the gear ratio γ0 of the continuously variable transmission unit 18.

[0038] Furthermore, the hybrid control unit 95 selectively establishes either the motor drive mode or the hybrid drive mode as a driving mode depending on the driving state. For example, when the vehicle is in the motor drive range where the required drive power Prdem is less than a predetermined threshold, the hybrid control unit 95 establishes the motor drive mode. On the other hand, when the vehicle is in the hybrid drive range where the required drive power Prdem is greater than the predetermined threshold, the hybrid control unit 95 establishes the hybrid drive mode.

[0039] The driving control unit 96 can control the driving of the vehicle 10 by implementing both manual driving control based on the driver's driving operations and automatic driving control, which automatically controls the driving of the vehicle 10 independently of the driver's driving operations. For example, the vehicle 10 automatically sets a target driving state based on a destination or map information input by the driver, and automatically accelerates, decelerates, and turns the vehicle based on this target driving state. When the driver selects automatic driving by operating the automatic driving select switch in the driving assistance setting switch group 84, the driving control unit 96 establishes an automatic driving mode and executes automatic driving control. Furthermore, the driving control unit 96 can execute cruise control, which activates the cruise control system as a driving assistance control system to maintain a constant vehicle speed, a constant distance from a preceding vehicle, or maintain the vehicle in a set lane.

[0040] The vehicle 10 further includes a transceiver 100, a first gateway ECU 110, a wireless update control device 120, a second gateway ECU 140, and a connector 150. Furthermore, a vehicle control device 180 for controlling the vehicle 10 is formed by including the driving control device 90, the first gateway ECU 110, the wireless update control device 120, and the second gateway ECU 140.

[0041] The transceiver 100 is a device that communicates with an external server 200, which is an external device outside the vehicle 10. The transceiver 100 is configured to be able to transmit and receive information with the external server 200 via wireless communication.

[0042] The first gateway ECU 110 is connected to the transceiver 100. The first gateway ECU 110 functionally includes a data receiving unit 112 for receiving multiple types of new software 202 transmitted from an external server 200 via wireless communication using the transceiver 100, and a data transmitting unit 114 for transmitting the received multiple types of new software 202 to the wireless update control device 120.

[0043] The wireless update control device 120 comprehensively manages updates of multiple types of vehicle control software 92 in the vehicle 10. The wireless update control device 120 has the function of updating (rewriting) part or all of the multiple types of vehicle control software 92 stored in the first storage unit 98 of the driving control device 90 using the multiple types of new software 202 transmitted from the first gateway ECU 110.

[0044] The first gateway ECU 110 and the wireless update control device 120 are each configured with the same hardware configuration as the driving control device 90. They have the function of receiving new software 202 from an external server 200, which is an external device outside the vehicle 10, via wireless communication, for example, and using the received new software 202 to update (or rewrite) the various types of vehicle control software 92 stored in the first storage unit 98, such as a rewritable ROM, included in the driving control device 90. The vehicle control software 92 is used for various types of vehicle 10 control implemented by the driving control device 90. Specifically, the driving control device 90 is configured to be able to rewrite the vehicle control software 92 stored in the first storage unit 98 at any time for controlling the vehicle 10. The vehicle control software 92 includes, for example, multiple types of vehicle control programs 92P that define the control procedures for the vehicle 10, and multiple types of control data 92D used when controlling the vehicle 10 in accordance with the vehicle control programs 92P.

[0045] The second gateway ECU 140 is also configured with the same hardware structure as the driving control device 90. The second gateway ECU 140 is connected to a connector 150 and is used to rewrite various types of vehicle control software 92 using an external rewriting device 160 connected via the connector 150. While the vehicle 10 and the external rewriting device 160 are configured to be wiredly connected via the connector 150, they may also be configured to be wirelessly connected.

[0046] Connector 150 is a component for connecting an external rewriting device 160, which is an external device outside vehicle 10. The shape and electrical signal of connector 150 are determined according to well-known standards. In addition, connector 150 can also be used as a connector for connecting a fault diagnosis device, which is also an external device.

[0047] The external rewriting device 160 is directly connected to the in-vehicle communication network and, like the driving control device 90 and the like, can receive CAN (Controller Area Network) frames flowing through the in-vehicle communication network and transmit CAN frames to the in-vehicle communication network.

[0048] The external server 200 is a system connected to a network outside the vehicle 10. The external server 200 stores the released new software 202. The external server 200 functions as a software distribution center that distributes multiple types of new software 202 by sending the new software 202 to the vehicle 10 as needed. The multiple types of new software 202 are software that uses the corresponding vehicle control software 92 as an update (rewrite) target. The multiple types of new software 202 include, for example, multiple types of new programs 202P that use the corresponding vehicle control program 92P as an update (rewrite) target, and multiple types of new data 202D that use the corresponding control data 92D as an update (rewrite) target. The new program 202P is a program that becomes the vehicle control program 92P after the current vehicle control program 92P is updated (rewritten) using the new program 202P, that is, the updated program 92Pr. The new data 202D is a program that becomes the control data 92D obtained by updating the current control data 92D using the new data 202D, that is, the updated data 92Dr.

[0049] To update various types of vehicle control software 92, the wireless update control device 120 includes a software update unit 122, which is a software update means, and a second storage unit 124, such as a rewritable ROM. The software update unit 122 corresponds to the update unit of the present invention.

[0050] Upon receiving new software 202 distributed for vehicle 10 from external server 200 via wireless communication, software update unit 122 writes new software 202 as update software 126 into second storage unit 124 and causes second storage unit 124 to store update software 126. Update software 126 includes update program 126P, which is a new program 202P written into second storage unit 124, and update data 126D, which is new data 202D written into second storage unit 124. Software update unit 122 determines whether update software 126 is written into second storage unit 124, i.e., whether update software 126 is stored in second storage unit 124. If update software 126 is stored in second storage unit 124, software update unit 122 uses update software 126 stored in second storage unit 124 to update vehicle control software 92, which is the target of updating or rewriting, with update software 126.

[0051] The vehicle control software 92 includes vehicle control programs 92P and control data 92D. The vehicle control programs 92P include, for example, an engine control program 92Peg, which is an engine control program used by the hybrid control unit 95 to control the engine 14; a first rotating machine control program 92Pm1, which is a first rotating machine control program used by the hybrid control unit 95 to control the first rotating machine MG1; a second rotating machine control program 92Pm2, which is a second rotating machine control program used by the hybrid control unit 95 to control the second rotating machine MG2; and an automatic transmission control program 92Pat, which is an automatic transmission control program used by the AT shift control unit 94 to control the stepped transmission unit 20.

[0052] The control data 92D includes, for example, multiple types of shift lines SH used to determine shifting in the stepped transmission portion 20, a driving range switching line CHt defining the boundary between the driving ranges of the motor drive mode and the hybrid drive mode, a control value Sct used in controlling the vehicle 10, and a limit value GD limiting a correction value or correction amount to a learned value obtained through learning control of the control value Sct. The control value Sct includes, for example, various command values ​​obtained based on the engine control command signal Se, the rotating machine control command signal Smg, the hydraulic control command signal Sat, the brake control command signal Sbra, and the steering control command signal Sste. For example, the control value Sct includes an engagement hydraulic pressure command value as the hydraulic control command signal Sat, which is controlled to change the engagement hydraulic pressure PRcb of the engagement device CB that switches its operating state during the transitional process of the shift control of the stepped transmission portion 20 executed by the AT shift control portion 94. Here, the engagement hydraulic pressure command value is constantly corrected through learning control to suppress shift shock and achieve a more appropriate shift time during the shift control of the stepped transmission portion 20. The limit value GD is, for example, a predetermined protection value for limiting the change in the control value Sct obtained through the learning control to prevent it from becoming excessive, and is predetermined for each different control value Sct.

[0053] The following describes how the vehicle control software 92 is updated when new software 202 (update software 126) is received from the external server 200. When the software update unit 122 determines that the update software 126 is stored in the second storage unit 124, it uses the update software 126 to execute an update process that updates part or all of the vehicle control software 92 to the update software 126.

[0054] However, when the vehicle control software 92 is updated to the update software 126, the vehicle 10 may be controlled based on the update software 126. However, if an error occurs during the update for some reason, the vehicle 10 may not operate normally. To prevent this from happening, the wireless update control device 120 functionally includes an operation confirmation unit 128 as operation confirmation means. When the update software 126 is stored in the second storage unit 124, the operation confirmation unit 128 preliminarily confirms whether the vehicle 10 will operate normally by executing the update software 126. When the operation confirmation unit 128 confirms that the vehicle 10 will operate normally, the software update unit 122 updates the vehicle control software 92 to the update software 126. By pre-checking whether the vehicle 10 will operate normally when the vehicle control software 92 is updated to the update software 126 before the update, the reliability of the vehicle 10 after the vehicle control software 92 is updated is improved. The first storage unit 98 and the second storage unit 124 correspond to the storage unit of the present invention, the vehicle control software 92 corresponds to the original software of the present invention, and the update software 126 corresponds to the updated software of the present invention.

[0055] Here, if the vehicle 10 is in a drivable state during the processing of the update software 126, there is a possibility that the processing of the update software 126 may cause the vehicle 10 to move, or otherwise behave in an unintended manner. Therefore, the operation confirmation unit 128 is configured to execute the processing of the update software 126 and perform operation confirmation only when the vehicle 10 is in a stopped state, mechanically inhibited from moving forward or backward.

[0056] Operation confirmation unit 128 determines whether the vehicle is in a pre-stopped state when executing processing and operation confirmation of update software 126. Operation confirmation unit 128 determines whether the vehicle is in a pre-stopped state based on whether the driving range of power transmission device 12 is the P range, which is the vehicle parking range that causes the vehicle to stop, or whether parking brake 75 is switched to the on (PKBon) state. Whether the driving range is the P range is determined, for example, based on whether the operating position POSsh of shift lever 46 is the P position corresponding to the P range. Furthermore, whether parking brake 75 is switched to the on state is determined, for example, based on the presence or absence of parking activation signal PKBon supplied by parking brake sensor 87.

[0057] When the vehicle is determined to be in a stopped state, the operation confirmation unit 128 determines that the processing of the update software 126 can be executed. On the other hand, when the vehicle is determined to be in a state other than the stopped state, that is, a state in which the vehicle 10 is able to travel, the operation confirmation unit 128 determines that the processing of the update software 126 cannot be executed. In this way, the processing of the update software 126 is executed on the condition that the vehicle 10 is in a stopped state, and an operation confirmation is performed to determine whether the vehicle 10 is operating normally. By executing the processing of the update software 126 and the operation confirmation on the condition that the vehicle is in a stopped state, the vehicle 10 is prevented from unintended vehicle behavior during the processing of the update software 126 (the operation confirmation process), thereby improving the reliability of the vehicle 10.

[0058] Furthermore, when the vehicle is determined to be stopped, the operation confirmation unit 128 inquires of the vehicle occupant regarding whether to perform operation confirmation. If the vehicle occupant grants permission for operation confirmation, the unit executes the processing of the update software 126. For example, the operation confirmation unit 128 displays a permission button for granting operation confirmation and a non-permission button for non-permission on an in-vehicle display, such as a touch panel. If the permission button is selected, the unit determines that operation confirmation has been granted. If the non-permission button is selected, the unit determines that operation confirmation has not been granted. If the vehicle occupant grants permission for operation confirmation, the unit executes the processing of the update software 126 and performs operation confirmation. If the vehicle occupant grants permission for operation confirmation, the unit 128 suspends the processing of the update software 126 and performs operation confirmation until permission is granted. Thus, even when the vehicle is stopped and the update software 126 can be processed, the vehicle occupants are asked in advance whether or not to confirm the operation. This allows the vehicle occupants to be aware of the progress of the update software 126 and the execution of the operation confirmation, thereby improving the convenience of the vehicle occupants. Furthermore, when the update software 126 is started, the operation confirmation unit 128 displays a message indicating that the operation confirmation is in progress on the in-vehicle display, thereby notifying the vehicle occupants that the operation confirmation is in progress.

[0059] When the vehicle is stopped and the vehicle occupant has received permission for operation confirmation, the operation confirmation unit 128 executes processing by the update software 126 and performs an operation confirmation to determine whether the electronic system drive components activated by the update software 126 are operating normally. Examples of electronic system drive components include electronic devices activated by the travel control device 90, such as the linear solenoids that control the first rotating machine MG1, the second rotating machine MG2, and the engagement devices CB of the stepped transmission portion 20, and the electric oil pump. While executing processing by the update software 126, the operation confirmation unit 128 determines whether the electronic system drive components activated by the update software 126 are operating normally based on whether command signals are normally output to the electronic system drive components activated by the update software 126, or whether the electronic system drive components are operating normally in response to the command signals. Thus, by determining whether the electronic system drive components activated by the update software 126 are operating normally, operation confirmation is performed to determine whether the vehicle 10 is operating normally. That is, the determination of whether the electronic system driving components are operating normally is synonymous with the operation confirmation of whether the vehicle 10 is operating normally.

[0060] If the update software 126 is, for example, software related to the shift control of the stepped transmission unit 20, the execution of the update software 126 outputs command signals (drive currents) to the linear solenoids corresponding to the electronic drive components that control the engagement device CB and are activated during the shift process. In this case, the operation confirmation unit 128 determines whether the linear solenoids are operating normally based on whether the command signals are output to the linear solenoids that are activated during the shift process. Alternatively, the operation confirmation unit 128 can drive the electric oil pump to activate the engagement device CB in the same manner as during the shift process, detect the actual hydraulic pressure of the hydraulic oil supplied to the engagement device CB during the shift transition period, and determine whether the linear solenoids are operating normally based on this actual hydraulic pressure. Furthermore, if multiple electronic drive components (such as linear solenoids) are activated simultaneously due to the processing of the update software 126, such as the shift control of the stepped transmission unit 20, the operation confirmation of the multiple electronic drive components is performed simultaneously.

[0061] Furthermore, if the update software 126 is software related to the operation of the first rotating machine MG1 or the second rotating machine MG2, and it is difficult to actually operate the electronic system drive components (such as the rotating machine) while the vehicle is stopped, the update software 126 may be operated in a simulation within the vehicle control device 180 to verify its operation. In this case, the update software 126 is processed in a simulation, and whether the electronic system drive components are operating normally is determined based on the simulated command signals output to the electronic system drive components.

[0062] Furthermore, if the update software 126 is software related to a specific shifting mode (e.g., a shift from first gear to second gear), the operation of the linear solenoids operating in the specific shifting mode is confirmed by executing the processing of the update software 126. Furthermore, if the update software 126 is software related to upshifting of the stepped transmission portion 20, the operation of all linear solenoids operating during the upshifting process is confirmed by executing the processing of the update software 126.

[0063] For example, if there are A linear solenoids activated during the upshift transition period from the lowest gear stage to the highest gear stage of the stepped transmission unit 20, the update software 126 processes each linear solenoid [n] (n=1 to A) activated during the upshift transition period to perform operation verification. In this case, the operation verification unit 128 sets a flag each time the operation verification for each linear solenoid [n] (n=1 to A) activated during the update software 126 process is completed. The operation verification unit 128 then determines whether the operation verification has been completed for all linear solenoids, i.e., whether the update software 126 process has completed, based on whether the flag has been set A times (a number corresponding to the number of linear solenoids activated during the process). The operation verification unit 128 continues the operation verification until the flag has been set A times, and terminates the operation verification when the flag has been set A times.

[0064] Furthermore, the operation confirmation unit 128 determines whether the vehicle is maintaining a stopped state based on whether the shift range is in the P position or the parking brake 75 is switched to the on (operated) state during the processing of the update software 126. The operation confirmation unit 128 continues processing the update software 126 and performs operation confirmation while it determines that the shift range is in the P position or the parking brake 75 is switched to the on state. On the other hand, if the operation confirmation unit 128 determines that the vehicle 10 has switched to a drivable state due to the operating position POSsh being switched to a non-P position or the parking brake 75 being switched to the off state during the processing of the update software 126, the processing of the update software 126 and the operation confirmation are promptly terminated. By terminating the processing of the update software 126, unintended vehicle behavior caused by continued processing of the update software 126 while the vehicle is drivable is suppressed. Furthermore, by suspending the processing of the update software 126 , the vehicle 10 can be quickly moved even when an unexpected external situation occurs, such as another vehicle approaching, thereby improving the reliability of the vehicle 10 .

[0065] Furthermore, as described above, since the shift to the P position in vehicle 10 is electrically implemented via electric motor 40, even if the shift lever 46's operating position POSsh is switched from the vehicle's parking position (i.e., the P position) to a non-P position, the shift to the non-P position can be delayed by delaying the command signal Sp to electric motor 40. Therefore, even if the shift lever 46's operating position POSsh is switched from the P position to a non-P position during processing by update software 126 (during operation confirmation), the operation confirmation unit 128 delays the switch to a non-P position until the processing by update software 126 is terminated. Delaying the switch to a non-P position in this manner can suppress unintended vehicle behavior by the vehicle occupants. Furthermore, electric motor 40 corresponds to the electric actuator of the present invention, and switching the shift lever 46's operating position POSsh to a non-P position corresponds to the switching to a position other than the vehicle's parking position according to the present invention.

[0066] Furthermore, the operation confirmation unit 128 determines whether the vehicle 10 is not moving during the processing of the update software 126 based on whether the absolute value Noabs of the output speed No, which is calculated at any time during the processing of the update software 126, is less than a preset vehicle movement determination threshold Nolim (Noabs < Nolim). The operation confirmation unit 128 continuously calculates the absolute value Noabs of the output speed No, which is detected at any time during the processing of the update software 126, and determines whether the calculated absolute value Noabs is less than the vehicle movement determination threshold Nolim. The vehicle movement determination threshold Nolim is a value previously determined experimentally or by design and is set to a rotational speed threshold that can determine that the vehicle 10 is moving.

[0067] When the absolute value Noabs is less than the vehicle movement judgment threshold Nolim, the work confirmation unit 128 determines that the vehicle 10 has not moved. At this time, the work confirmation unit 128 continues to implement the processing and work confirmation of the update software 126. On the other hand, when the absolute value Noabs becomes greater than the vehicle movement judgment threshold Nolim, the work confirmation unit 128 determines that the vehicle 10 has moved. At this time, the work confirmation unit 128 terminates the processing and work confirmation of the update software 126 and enters a standby state. In addition, the work confirmation unit 128 can execute the processing of the update software 126 again and start work confirmation again when the vehicle is switched to a stopped state thereafter. In this way, when it is determined that the vehicle 10 is moving during the processing of the update software 126, the processing is terminated, thereby suppressing unexpected vehicle behavior caused by the execution of the processing.

[0068] When the operation confirmation unit 128 determines that the flag creation count Nflag has reached A, corresponding to the number of electronic system driver components whose operation has been confirmed during the processing of the update software 126, it determines that the operation confirmation of all electronic system driver components has been completed and terminates the operation confirmation. Furthermore, the operation confirmation unit 128 notifies the vehicle occupants of the completion of the operation confirmation by displaying a message indicating the completion of the operation confirmation on an in-vehicle display. When the operation confirmation unit 128 confirms that the vehicle 10 will operate normally even after the vehicle control software 92 is updated to the update software 126, the software update unit 122 updates the vehicle control software 92 stored in the first storage unit 98 to the update software 126. On the other hand, if any of the electronic system driver components exhibit operational malfunctions during the operation confirmation process performed by the operation confirmation unit 128, resulting in the vehicle 10 not being confirmed to operate normally, the software update unit 122 suspends the update of the vehicle control software 92 using the update software 126.

[0069] Figure 3 This is a flowchart for explaining the control operation that can suppress unintended vehicle behavior during the operation confirmation process when the main part of the control operation of the vehicle control device 180 mounted on the vehicle 10, that is, the vehicle control software 92 that controls the vehicle 10, is updated while the operation confirmation of the update software 126 is being performed. This process is executed at any time at predetermined time intervals. Figure 3 In the flowchart, the portions surrounded by dotted lines ( S60 to S90 , S120 , S130 ) correspond to the steps in which the operation confirmation of the electronic system driving components is actually performed.

[0070] First, in step S10 corresponding to the control function of the software update unit 122 (hereinafter omitted), a determination is made as to whether the update software 126 has been received from the external server 200 and has been written to the second storage unit 124 of the wireless update control device 120. If the determination in S10 is negative, this routine ends. If the determination in S10 is positive, in step S20 corresponding to the control function of the software update unit 122, a determination is made as to whether, after the update software 126 has been written to the second storage unit 124, the operation verification of the electronic system driving components activated by the update software 126 has not been performed. If the determination in S20 is negative, that is, if the operation verification has been performed, this routine ends. If the determination in S20 is affirmative, i.e., if the operation confirmation has not been performed, then in S30 corresponding to the control function of the operation confirmation unit 128, it is determined whether the vehicle 10 is in the stopped state based on whether the shift range is the vehicle parking position, i.e., the P position, or whether the parking brake 75 is in the on state. If the determination in S30 is negative, this routine ends.

[0071] If the determination in S30 is affirmative, in S40 corresponding to the control function of operation confirmation unit 128, the vehicle occupant is asked whether the operation confirmation can be executed. Next, in S50 corresponding to the control function of operation confirmation unit 128, it is determined whether the vehicle occupant has permitted the execution of the operation confirmation. If the determination in S50 is negative, the process proceeds to S110 corresponding to the control function of operation confirmation unit 128, and the processing of the update software 126 and the execution of the operation confirmation are suspended until the vehicle occupant permits the operation confirmation.

[0072] If the determination in S50 is affirmative, in S60, corresponding to the control function of the operation confirmation unit 128, the processing and operation confirmation of the update software 126 are initiated. The vehicle occupants are informed of the ongoing operation confirmation by displaying a message indicating that the operation confirmation is in progress on the in-vehicle display. Furthermore, when the processing of the update software 126 is initiated, the absolute value Noabs of the output speed No, used to determine the movement of the vehicle 10 during the operation confirmation process, is initialized to zero. Furthermore, the flag creation count Nflag, used to determine whether the operation confirmation of each electronic system drive component [n] activated by the processing of the update software 126 has been completed, is initialized to zero.

[0073] Next, in S70 , corresponding to the control function of the operation confirmation unit 128 , the operation of each of the A electronic system driver components [n] (n=1 to A) that are activated by the processing of the update software 126 is sequentially confirmed. Whether the vehicle 10 is operating normally is determined based on whether normal command signals are output to the electronic system driver components during the processing of the update software 126 or whether the electronic system driver components are operating normally. Alternatively, the update software 126 is processed using a simulation within the vehicle control device 180 , and whether each electronic system driver component is operating normally is simulated and determined. Furthermore, each time the operation confirmation of each electronic system driver component [n] is completed, a flag is set, and the number of times the flag is set, Nflag, is counted.

[0074] In S80, corresponding to the control function of operation confirmation unit 128, a determination is made as to whether the driving range has been set to the P range or the parking brake 75 has been applied during the operation confirmation process for each electronic system drive component [n]. If the shift range has been switched to a non-P range or the parking brake 75 has been switched to the off state during the operation confirmation process, the determination in S80 is negative, and the processing and operation confirmation of update software 126 are terminated in S100, corresponding to the control function of operation confirmation unit 128. If the determination in S80 is positive, a determination is made in S90, corresponding to the control function of operation confirmation unit 128, as to whether vehicle 10 has not moved during the operation confirmation process, based on whether the absolute value Noabs of output speed No is less than vehicle movement determination threshold Nolim. If the determination in S90 is negative, it is determined that vehicle 10 has moved, and therefore the processing and operation confirmation of update software 126 are terminated in S100. If the determination at S90 is affirmative, then in S120, corresponding to the control function of the operation confirmation unit 128, a determination is made as to whether the flag creation count Nflag has reached A, that is, whether the operation confirmation of all electronic system drive components has been completed. If the determination at S120 is negative, the process returns to S70 to continue processing the update software 126 and the operation confirmation. If the determination at S120 is affirmative, since the operation confirmation of all electronic system drive components has been completed, in S130, corresponding to the control function of the operation confirmation unit 128, a message indicating that the operation confirmation has been completed is displayed on the in-vehicle display, thereby notifying the vehicle occupants of the completion of the operation confirmation.

[0075] As described above, according to this embodiment, since the work confirmation of whether the vehicle 10 works normally is implemented by executing the processing of the update software 126, the work confirmation unit 128 executes the processing of the update software 126 on the condition that the vehicle 10 is in a vehicle stop state in which forward and reverse movement are suppressed, the work confirmation can be implemented while suppressing the situation in which unintended vehicle behavior is caused during the work confirmation process, thereby improving the reliability of the vehicle 10.

[0076] Furthermore, according to this embodiment, the operation confirmation unit 128 inquires with the vehicle occupant regarding the possibility of operation confirmation and, upon obtaining the vehicle occupant's permission to perform the operation confirmation, executes the processing of the updating software 126, thereby improving the convenience of the vehicle occupant. Furthermore, if the vehicle 10 switches to a drivable state while the updating software 126 is processing, the processing of the updating software 126 is suspended. This prevents the occurrence of vehicle behavior caused by the execution of the updating software 126 while the vehicle 10 is drivable. Furthermore, even if a shift to a non-P range position is performed while the updating software 126 is processing, the shift to a non-P range position is delayed until the operation confirmation is suspended. This prevents unexpected vehicle behavior by the vehicle occupant.

[0077] Although the embodiments of the present invention have been described in detail above based on the drawings, the present invention may also be applied in other forms.

[0078] For example, although in the embodiment described above, a judgment is made as to whether the driving gear position becomes the P gear position or whether the parking brake 75 becomes the on state during the operation confirmation process of the electronic system drive component, and a judgment is made as to whether the vehicle 10 has not moved, it is not necessary to perform both judgments. It is also possible to perform any one of the judgments as to whether the driving gear position becomes the P gear position or whether the parking brake 75 becomes the on state, and whether the vehicle 10 has not moved.

[0079] In addition, although in the embodiment described above, when performing the operation confirmation of the electronic system driving component that is activated by the update software 126, the vehicle occupant is asked whether the operation confirmation is possible, and the operation confirmation is performed after obtaining permission for the operation confirmation from the vehicle occupant, it is not necessary to obtain permission for the operation confirmation from the vehicle occupant, and the operation confirmation can also be performed on the condition that the vehicle 10 is in a stopped state.

[0080] In addition, although in the embodiment described above, the execution of work confirmation will be put on standby if the vehicle occupant does not permit the execution of work confirmation, it can also be configured, for example, that in the case of update software 126 with higher importance, the vehicle 10 cannot be driven by switching the power switch of the vehicle 10 to the off state before the vehicle occupant permits the execution of work confirmation until the work confirmation is executed.

[0081] Furthermore, in the embodiment described above, the operation confirmation of the updating software 126 is executed when the updating software 126 is transmitted from the external server 200. However, the vehicle 10 may inquire whether the external server 200 has new software 202 (updating software 126) stored therein, and if the new software 202 is stored therein, the operation confirmation may be executed after the new software 202 is received from the external server 200. Furthermore, a configuration may be employed in which the operation confirmation is executed after a signal notifying the vehicle 10 that the new software 202 is stored therein is transmitted from the external server 200 to the vehicle 10, and after the new software 202 is received from the external server 200 based on the signal.

[0082] Furthermore, while in the aforementioned embodiment, vehicle 10 switches the shift position to either the P position or a non-P position by electrically transmitting the vehicle occupant's operation of the shift lever 46 to the power transmission device 12 via the electric motor 40, the present invention is not necessarily limited to this configuration. Specifically, a vehicle may also be employed in which the shift position is switched by mechanically transmitting the vehicle occupant's operation of the shift lever 46 to the power transmission device 12. In this case, since delaying the shift position switching is difficult, if the shift lever 46 is operated to a non-P position during operation confirmation, the operation confirmation is promptly terminated.

[0083] Furthermore, while in the aforementioned embodiment, whether the driving range of the power transmission device 12 is the P range is determined based on whether the operating position POSsh of the shift lever 46 is the P range, this is not necessarily limited to the above arrangement. For example, the means for determining the P range may be appropriately modified, such as determining based on whether the rotational position of the electric motor 40 driving the parking lock mechanism 42 is at a rotational position corresponding to the P range.

[0084] Furthermore, in the aforementioned embodiment, a button for inquiring whether or not to perform work confirmation is displayed on the in-vehicle display configured as a touch panel, and whether or not permission to perform work confirmation has been obtained from the vehicle occupant is determined based on the button selected. However, this is not necessarily limited to the above-described method. For example, the method of inquiring whether or not to perform work confirmation from the vehicle occupant can be appropriately modified, such as by inquiring for permission to perform work confirmation via voice.

[0085] Furthermore, while the vehicle 10 in the aforementioned embodiment is configured with a power transmission device 12 having a continuously variable transmission 18 and a stepped transmission 20 connected in series, the vehicle structure of the present invention is not necessarily limited to this. For example, the engine and the rotating machine may be directly connected without intervening a differential mechanism 32 or the like, with a stepped transmission provided between the engine and the rotating machine and the drive wheels. Furthermore, the transmission is not necessarily limited to a stepped transmission; a belt-type continuously variable transmission or the like may also be employed.

[0086] Furthermore, while the vehicle 10 in the aforementioned embodiment is a hybrid vehicle using the engine 14 and the second rotating machine MG2 as driving force sources, the present invention is not necessarily limited to hybrid vehicles. For example, the vehicle 10 may use only the engine 14 as a driving force source, or may be an electric vehicle using only the rotating machine as a driving force source. In other words, the present invention does not impose any particular limitations on the vehicle's driving force source or drive type.

[0087] The above-described embodiment is merely one embodiment, and the present invention can be implemented in various modified and improved forms based on the knowledge of those skilled in the art.

[0088] Explanation of symbols

[0089] 10…vehicles;

[0090] 40…Electric motor (electric actuator);

[0091] 92…vehicle control software (existing software);

[0092] 98 ...a first storage unit (storage unit);

[0093] 122…Software Update Department (Update Department);

[0094] 124 ... a second storage unit (storage unit);

[0095] 126…update software (update software);

[0096] 128…Work Confirmation Department;

[0097] 180…Vehicle control device.

Claims

1. A vehicle control device, characterized in that: have: a storage unit storing software for controlling the vehicle; an operation confirmation unit configured to confirm whether the vehicle is operating normally by executing processing of update software for updating existing software when update software for updating existing software is stored in the storage unit; an updating unit that updates the existing software to the updated software when the operation confirmation unit confirms that the vehicle operates normally, The operation confirmation is performed in advance before the original software is updated to the updated software. The operation confirmation unit is configured to execute the processing of the update software and perform the operation confirmation under the condition that the vehicle is in a stopped state in which forward and reverse movement are suppressed. The operation confirmation unit is configured as follows: Inquiring the occupants of the vehicle whether the work is confirmed or not, The software for updating is processed when permission for the operation confirmation is obtained, and a message indicating that the operation confirmation is in progress is displayed on an in-vehicle display to inform the vehicle occupant that the operation confirmation is in progress. sequentially performing operation confirmation of a plurality of electronic system drive components that operate in conjunction with the processing of the update software, During the operation confirmation process of the electronic system drive components, it is determined whether the driving gear is in the P gear or whether the parking brake is in the activated state. When the driving gear is in the P gear or the parking brake is in the activated state, whether the vehicle has not moved during the operation confirmation process is determined based on whether the absolute value of the output speed is less than a vehicle movement determination threshold. In the case where the vehicle does not move during the work confirmation process, determining whether the work confirmation of all electronic system drive components has been completed, When the work confirmation of all the electronic system driving components to be work confirmed has been completed, information indicating that the work confirmation has been completed is displayed on the in-vehicle display to inform the vehicle occupants that the work confirmation has been completed.

2. The vehicle control device according to claim 1, wherein: The operation confirmation unit suspends the processing of the update software when the vehicle is switched to a drivable state during the processing of the update software.

3. The vehicle control device according to claim 2, wherein: The vehicle is configured to be electrically switched to a vehicle parking position where the vehicle is stopped via an electric actuator. Even if an operation to switch to a gear position other than the vehicle parking position is performed during processing of the update software, the operation confirmation unit delays switching to a gear position other than the vehicle parking position until the processing of the update software is terminated.

Images