Program update control device, program update control method, and computer-readable storage medium

Abstract

The present invention relates to a program update control device, a program update control method, and a computer-readable storage medium. The program update control device includes: a rewrite control unit that controls rewriting a program executed by a mobile object control unit, the mobile object control unit controlling at least a portion of the mobile object, into a new program; an acquisition unit that acquires a new program and information related to the amount of power required for rewriting from an external device; and a power information acquisition unit that acquires the remaining capacity of a battery of the mobile object used for rewriting. The rewrite control unit starts rewriting based on the information related to the amount of power required for rewriting. The power information acquisition unit acquires the remaining capacity of the battery during rewriting. The rewrite control unit determines whether to continue rewriting based on the remaining capacity of the battery acquired by the power information acquisition unit during rewriting and the amount of power required for rewriting.

Description

Technical Field

[0001] The present invention relates to a program update control device, a program update control method and a computer-readable storage medium. Background Art

[0002] Patent Document 1 discloses an ECU capable of rewriting application programs as an ECU for a vehicle.

[0003] Patent Document 1: Japanese Patent Application Laid-Open No. 2020-27666. Summary of the Invention

[0004] In the first embodiment, a program update control device is provided. The program update control device includes a rewrite control unit that controls the rewriting of a program executed by a mobile body control unit into a new program, and the mobile body control unit controls at least a part of the mobile body. The program update control device includes an acquisition unit that acquires a new program and information related to the amount of power required for the rewrite from an external device. The program update control device includes a power information acquisition unit that acquires the remaining capacity of the battery of the mobile body used in the rewrite. The rewrite control unit starts the rewrite based on the information related to the amount of power required for the rewrite. The power information acquisition unit acquires the remaining capacity of the battery during the rewrite. The rewrite control unit determines whether to continue the rewrite based on the remaining capacity of the battery acquired by the power information acquisition unit during the rewrite process and the amount of power required for the rewrite.

[0005] The mobile body control unit may include a storage unit having a first storage area and a second storage area. The mobile body control unit may read either the program stored in the first storage area or the program stored in the second storage area upon startup. The rewrite control unit may initiate writing of a new program to the second storage area when the program being executed by the mobile body control unit is stored in the first storage area. The power information acquisition unit may notify the rewrite control unit of the remaining capacity obtained from the program stored in the first storage area during the rewrite process.

[0006] The mobile body control unit may include a storage unit having a first storage area and a second storage area. The mobile body control unit may read any one of the program stored in the first storage area and the program stored in the second storage area at startup. The acquisition unit may acquire the first program and the second program from an external device as new programs, and acquire information showing the amount of power required to write the first program and the amount of power required to write the second program. The rewrite control unit may start writing the first program to the second storage area when the program executed by the mobile body control unit is stored in the first storage area. The power information acquisition unit may acquire the remaining capacity of the battery during writing of the first program to the second storage area and before writing of the second program to the second storage area begins. The rewrite control unit may determine whether to continue rewriting based on the remaining capacity acquired by the power information acquisition unit during writing of the first program to the second storage area and the amount of power required to write the second program.

[0007] The rewrite control unit may suspend writing of the first program and not start writing of the second program if the difference between the remaining capacity acquired by the power information acquisition unit and the power required to write the second program is smaller than a predetermined value during writing of the first program to the second storage area.

[0008] The program update control device may include a warning control unit that outputs a warning when the difference between the remaining capacity acquired by the power information acquisition unit and the power required for writing the second program during writing of the first program to the second storage area is smaller than a predetermined value.

[0009] The mobile body control unit may include a storage unit having a single storage area for storing the program executed by the mobile body control unit. The acquisition unit may acquire the first program and the second program from an external device as new programs, and acquire the amount of power required for writing the first program and the amount of power required for writing the second program. The rewrite control unit may start writing the first program to the storage area in which the program executed by the mobile body control unit is written. The power information acquisition unit may acquire the remaining capacity of the battery before writing the second program to the storage area when writing of the first program to the storage area is completed. The rewrite control unit may determine not to start writing the second program when the difference between the remaining capacity acquired by the power information acquisition unit before writing the second program to the storage area and the amount of power required for writing the second program is less than a predetermined value.

[0010] The program update control device may include a warning control unit configured to output a warning when a difference between the remaining capacity indicated by the information acquired by the power information acquisition unit and the amount of power required for rewriting acquired by the acquisition unit is smaller than a predetermined value.

[0011] The rewriting control unit may start rewriting of the new program when the charger is connected to the battery after the warning is output.

[0012] The mobile object may be a vehicle.

[0013] After the acquisition unit acquires the new program and information related to the amount of power required for rewriting from an external device, when the ignition power of the mobile body is turned off, the rewrite control unit can start rewriting based on the information related to the amount of power required for rewriting, the power information acquisition unit can obtain the remaining capacity of the battery during the execution of the rewrite, and the rewrite control unit can determine whether to continue the rewriting based on the amount of power required for rewriting and the remaining capacity.

[0014] The battery may be a different battery from the battery that supplies electric power to an engine that generates power for traveling of the vehicle.

[0015] The program update control device may be an external reprogramming device that is connected to a communication path in the mobile body by wire and controls rewriting of the program from outside the mobile body through the wired connection.

[0016] In a second aspect, a mobile object is provided. The mobile object includes the above-mentioned program update control device.

[0017] In a third embodiment, a program update control method is provided. The program update control method includes the steps of acquiring a new program and information from an external device, the new program rewriting a program executed by a mobile body control unit that controls at least a portion of the mobile body, and the information relating to the amount of power required for the rewrite. The program update control method includes the steps of starting control to rewrite the program executed by the mobile body control unit to the new program based on the information relating to the amount of power required for the rewrite. The program update control method includes the steps of acquiring the remaining capacity of a battery used in the rewrite during the rewrite. The program update control method includes the steps of determining whether to continue the rewrite based on the remaining capacity of the battery acquired during the rewrite and the amount of power required for the rewrite.

[0018] In a fourth aspect, a program is provided. The program causes a computer to execute the following steps: a step of acquiring a new program and information from an external device, the new program rewriting a program executed by a mobile body control unit that controls at least a portion of the mobile body, the information relating to the amount of power required for the rewriting; a step of starting control to rewrite the program executed by the mobile body control unit to the new program based on the information relating to the amount of power required for the rewriting; a step of acquiring the remaining capacity of a battery used for the rewriting during the rewriting process; and a step of determining whether to continue the rewriting process based on the remaining capacity of the battery and the amount of power required for the rewriting acquired during the rewriting process.

[0019] In addition, the above summary of the invention does not list all the necessary features of the present invention. In addition, the combination of branch features among the above multiple features can also constitute an invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 An updating system 10 is schematically shown in accordance with one embodiment.

[0021] Figure 2 The system configuration and controlled devices of the control system 200 are schematically shown.

[0022] Figure 3 An example of the data structure of the required power amount information managed by the external device 70 is shown.

[0023] Figure 4 An example of temporal change in the remaining capacity of the battery 295 predicted when the program updates of the first program and the second program are continuously performed is shown.

[0024] Figure 5 An example of temporal change in the remaining capacity of the battery 295 when the program of the ECU with a single memory set is updated is shown.

[0025] Figure 6 This is a flowchart showing the execution procedure of a process when a program of an ECU with a single memory set is updated.

[0026] Figure 7 An example of temporal change in the remaining capacity of the battery 295 when the program of the ECU with dual memory is updated is shown.

[0027] Figure 8 This is a flowchart showing the execution procedure of a process when a program of an ECU having a dual-bank memory is updated.

[0028] Figure 9 An example of the data structure of the actual power consumption information managed by the external device 70 is shown.

[0029] Figure 10 An example of the temperature dependency of power consumption during program update for each vehicle and a design value of the required power are schematically shown.

[0030] Figure 11 The required amount of power generated by the external device 70 is shown.

[0031] Figure 12 An example of a computer 2000 is shown. DETAILED DESCRIPTION

[0032] The present invention will be described below by way of embodiments of the invention, but the following embodiments are not intended to limit the invention as defined in the claims. Furthermore, not all combinations of features described in the embodiments are essential for achieving the solution of the invention.

[0033] Figure 1 An update system 10 according to one embodiment is schematically shown. The update system 10 includes a vehicle 20, a reprogramming device 74, and an external device 70. The vehicle 20 includes a control system 200. The control system 200 is responsible for controlling the vehicle 20 and communicating with the external device 70 via a communication network 90. ​​The communication network 90 includes IP networks such as the Internet, peer-to-peer networks, dedicated lines including VPNs, virtual networks, and mobile communication networks.

[0034] In the vehicle 20, the control system 200 has a plurality of ECUs (Electronic Control Units), which control the vehicle 20. The control system 200 obtains an update program for the ECU possessed by the control system 200 from the outside. For example, the control system 200 receives the update program sent from the external device 70 via wireless communication through the communication network 90. ​​The control system 200 rewrites the program executed by the ECU possessed by the control system 200 with the update program, thereby reprogramming the ECU possessed by the control system 200. Such reprogramming is performed for the purpose of upgrading the functions of the ECU possessed by the control system 200, etc. In this way, the control system 200 reprograms the ECU via OTA (Over The Air), thereby updating the ECU. In this embodiment, rewriting the program executed by a device such as an ECU using an update program is referred to as a "program update."

[0035] When external device 70 transmits an update program to control system 200, it transmits the update program to control system 200 along with information indicating the amount of power required for program updates using the update program. If a specific ECU needs to be reprogrammed sequentially using two update programs, external device 70 transmits information indicating the amount of power required for each of the two update programs to control system 200. Before starting the program update, control system 200 obtains the remaining capacity of the battery included in vehicle 20. After confirming that the remaining capacity of the battery, predicted upon completion of the program update using the second update program, is greater than the power required to start vehicle 20, control system 200 begins the program update.

[0036] When operating the vehicle 20's sheet heaters, lights, and other components during a program update, power consumption increases. Therefore, even if the battery's remaining capacity is determined to be sufficient at the start of the program update, the remaining capacity at the completion of the program update may be less than the power required to start the vehicle 20.

[0037] Therefore, the control system 200 sequentially obtains the remaining capacity of the battery during the program update of the ECU using the first update program. Based on the remaining capacity of the battery obtained during the program update of the ECU and the amount of power required for the program update of the ECU using the second update program, the control system 200 determines whether the predicted remaining capacity of the battery upon completion of the program update using the second update program is less than the amount of power required to start the vehicle 20. If it is determined that the predicted remaining capacity of the battery upon completion of the program update using the second update program is less than a predetermined value, at least the program update using the second update program is not executed. In this way, even if power consumption increases due to the usage environment of the vehicle 20 during the program update, the amount of power required to start the vehicle 20 can be ensured.

[0038] In addition to OTA, the program of the ECU included in the control system 200 can also be updated using a reprogramming device 74. The reprogramming device 74 is connected to the diagnostic port 34 via a diagnostic cable. The diagnostic port 34 is, for example, an OBD (On Board Diagnostics) connector. The reprogramming device 74 is connected to the diagnostic port 34 via a communication cable 32.

[0039] The reprogramming device 74 transfers the update program received from the external device 70 to the control system 200, causing the ECU of the control system 200 to execute the program update. When the reprogramming device 74 is used to perform the program update, the power consumption during the program update may also vary depending on the model of the reprogramming device 74, etc. Therefore, similar to the case of performing multiple program updates via OTA as described above, when the reprogramming device 74 is used to perform the program update, the reprogramming device 74 also sequentially obtains the remaining battery capacity during the rewriting of the first update program. Then, based on the remaining battery capacity obtained during the rewriting execution of the ECU and the amount of power required for the rewriting of the second update program to the ECU, the reprogramming device 74 determines that the remaining battery capacity predicted upon completion of the rewriting of the second update program is below a predetermined value, and at least does not execute the program update using the second update program. In this way, even if the power consumption increases due to the use of the reprogramming device 74, the amount of power required for starting the vehicle 20 can be ensured.

[0040] Figure 2The figure schematically shows the system configuration and controlled devices included in the control system 200. The control system 200 includes a TCU 201, an ECU 202, an ECU 204, an ECU 205, an ECU 206, an MID 298, an IVI 299, and a diagnostic port 34.

[0041] ECU 202 is connected to TCU 201, ECU 204, ECU 205, and ECU 206 via in-vehicle communication line 280. ECU 202 communicates with TCU 201, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299 via in-vehicle communication line 280. ECU 202 comprehensively controls TCU 201, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299. In-vehicle communication line 280 can be configured to include, for example, CAN (Controller Area Network) or Ethernet.

[0042] The TCU 201 is a telematics control unit. It primarily handles mobile communications. Under the control of the ECU 202, the TCU 201 transmits and receives data to and from the external device 70. Under the control of the ECU 202, the TCU 201 receives updated programs from the external device 70 via mobile communications. The TCU 201 can function as a wireless communication unit.

[0043] The diagnostic port 34 is a port to which a diagnostic device for diagnosing ECU 202, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299, or a communication cable connected to the reprogramming device 74 is mounted. The diagnostic port 34 is connected to the in-vehicle communication line 280. Devices connected to the diagnostic port can communicate with ECU 202, ECU 204, ECU 205, ECU 206, MID 298, and IVI 299 via the in-vehicle communication line 280 and the communication cable.

[0044] MID 298 is a multi-function information display. IVI 299 is, for example, an in-vehicle entertainment (IVI). MID 298 and IVI 299 function as a display control unit. IVI 299 has wireless LAN communication capabilities. Under the control of ECU 202, IVI 299 receives update programs sent from external device 70 using wireless LAN communication.

[0045] ECU204, ECU205 and ECU206 are ECUs that are vehicle control units that control at least a part of the vehicle 20. ECU204, ECU205 and ECU206 are examples of "mobile body control units". ECU204, ECU205 and ECU206 control various devices that the vehicle 20 has. For example, ECU204 controls FI294, which is a fuel injection device. ECU205 controls battery 295, etc. Battery 295 is, for example, a low-voltage battery that functions as a 12V power supply for the vehicle. Battery 295 is, for example, a lead-acid battery. In contrast, battery 296 is a high-voltage battery that stores electrical energy, and the electrical energy is supplied to an engine such as an electric motor that generates power for the vehicle 20 to move. In addition, in Figure 2 FI294, battery 295 and battery 296 are examples of controlled devices provided by the vehicle 20. The vehicle 20 may be provided with Figure 2 Controlled equipment other than the equipment shown.

[0046] In this embodiment, the system structure of the control system 200 is illustrated as including TCU201, ECU202, ECU204, ECU205, ECU206, MID298, and IVI299. However, the system structure of the control system 200 is not limited to the example of this embodiment. In addition, in this embodiment, as an example, it is described that the mobile body control units that can be the subject of program update are ECU204 and ECU205, and ECU202 functions as a "program update control device" that controls the program update. In addition, the mobile body control units that can be the subject of program update are not limited to these ECUs. The mobile body control unit that can be the subject of program update can be any one of TCU201, ECU202, ECU204, ECU205, ECU206, MID298, and IVI299.

[0047] The ECU 202 functions as a program update control device that controls program updates of the ECU. The ECU 202 includes a rewrite control unit 220 , an acquisition unit 240 , a power supply information acquisition unit 230 , and a warning control unit 250 .

[0048] The rewrite control unit 220 controls the rewriting of the program executed by the ECU that controls at least a part of the vehicle 20 into a new program. In the description of this embodiment, the new program is sometimes referred to as an "update program." The acquisition unit 240 acquires the new program and information related to the amount of power required for the rewrite from an external device. The power information acquisition unit 230 acquires the remaining capacity of the battery 295 of the vehicle 20 used in the rewrite. The rewrite control unit 220 starts the rewrite based on the information related to the amount of power required for the rewrite. The power information acquisition unit 230 acquires the remaining capacity of the battery 295 during the rewrite. The rewrite control unit 220 determines whether to continue the rewrite based on the remaining capacity of the battery 295 acquired by the power information acquisition unit 230 during the rewrite and the amount of power required for the rewrite.

[0049] The program update of an ECU having multiple storage areas as storage areas for programs is described. Here, it is assumed that ECU205 has multiple storage areas. ECU205 has a storage unit having a first storage area and a second storage area as storage areas for programs. ECU205 reads in either the program stored in the first storage area or the program stored in the second storage area at startup. When the program executed by the ECU is stored in the first storage area, the rewrite control unit 220 starts writing a new program to the second storage area. The power information acquisition unit 230 can notify the rewrite control unit 220 of the remaining capacity obtained from the program stored in the first storage area during the rewrite process.

[0050] Furthermore, acquisition unit 240 acquires the first and second programs from an external device as new programs and acquires information indicating the amount of power required to write the first program and the amount of power required to write the second program. If the program executed by ECU 205 is stored in the first storage area, rewrite control unit 220 begins writing the first program to the second storage area. Power supply information acquisition unit 230 acquires the remaining capacity of battery 295 while the first program is being written to the second storage area and before the second program begins being written to the second storage area. Rewrite control unit 220 determines whether to continue rewriting based on the remaining capacity acquired by power supply information acquisition unit 230 during the writing of the first program to the second storage area and the amount of power required to write the second program.

[0051] If the difference between the remaining capacity acquired by the power information acquisition unit 230 and the power required to write the second program during writing of the first program to the second storage area is less than a predetermined value, the rewrite control unit 220 may suspend writing of the first program and not start writing of the second program. If the difference between the remaining capacity acquired by the power information acquisition unit 230 and the power required to write the second program during writing of the first program to the second storage area is less than a predetermined value, the warning control unit 250 may output a warning.

[0052] The following describes program updates for an ECU that has a single storage area as a program storage area. In this embodiment, it is assumed that ECU 204 has a single storage area. ECU 204 includes a storage unit having a single storage area for storing programs executed by ECU 204. Acquisition unit 240 acquires a first program and a second program from external device 70 as new programs for ECU 204, and acquires the power required to write the first program and the power required to write the second program. Rewrite control unit 220 begins writing the first program to the storage area where the programs executed by the ECU are written. After writing the first program to the storage area is complete, power information acquisition unit 230 acquires the remaining capacity of battery 295 before writing the second program to the single storage area. If the difference between the remaining capacity acquired by power information acquisition unit 230 before writing the second program to the single storage area and the power required to write the second program is less than a predetermined value, rewrite control unit 220 determines not to begin writing the second program.

[0053] Warning control unit 250 may output a warning if the difference between the remaining capacity indicated by the information obtained by power supply information obtaining unit 230 and the amount of power required for rewriting obtained by obtaining unit 240 is less than a predetermined value. Rewriting control unit 220 may start rewriting a new program after outputting the warning and when a charger is connected to battery 295.

[0054] After the acquisition unit 240 acquires the new program and information related to the amount of power required for rewriting from the external device 70, when the ignition power of the vehicle 20 is turned off, the rewrite control unit 220 can start rewriting based on the information related to the amount of power required for rewriting, and the power information acquisition unit 230 can acquire the remaining capacity of the battery 295 during the execution of the rewrite, and the rewrite control unit 220 can determine the continuation of the rewrite based on the amount of power required for rewriting and the remaining capacity.

[0055] Here, the program update is explained. The program update process is explained in the case where the device that becomes the object of the program update is an ECU and the memory for storing the firmware of the ECU is a single-group memory (single-bank memory, so-called single-sided ROM). In this case, the program storage area for storing the firmware of the ECU is one, so when the ECU operates according to the program stored in the program storage area, the update program cannot be written to the program storage area. When the program of the ECU is updated, the rewrite control unit 220 transfers the update program to the ECU, stores the update program in a predetermined data storage area of ​​the ECU, and then instructs the ECU to update the program. When the ECU is instructed to update the program, it executes the control code for performing the program update and writes the update program transferred to the data storage area to the program storage area to activate the update program. The activation of the update program includes the processing of setting the startup parameters of the ECU so that the update program is loaded when the ECU is started, for example, and control based on the update program is started.

[0056] Next, the program update process in the case where the internal memory of the ECU is a dual-group memory (dual-bank memory, so-called double-sided ROM) will be described. In this case, the ECU has two program storage areas for storing firmware. Therefore, when the ECU operates according to the program stored in the first program storage area, the update program can be written to the second program storage area. In other words, the update program can be written to the second program storage area, which is the back side, through so-called back-side writing. Therefore, for example, the update program can be written to the second program storage area even when the vehicle 20 is moving. Therefore, when transferring the update program to the ECU, the rewrite control unit 220 instructs the ECU to write the update program to the second program storage area. When the writing of the update program to the second program storage area of ​​the ECU is completed, the ECU becomes in a state where the program update can be performed. When the rewrite control unit 220 performs an ECU program update, the rewrite control unit 220 instructs the ECU to activate the update program written to the second program storage area. Activating the update program involves setting the ECU's startup parameters so that, for example, when the ECU is started, the update program stored in the second program storage area is loaded and control based on the update program begins. For example, activating the update program involves activating the second program storage area as a program readout area and deactivating the first program storage area as a program readout area. Thus, "program update" is a concept that includes an instruction to write the update program to the ECU's program storage area. Furthermore, "program update" is a concept that includes an instruction to activate the update program written to the program storage area. Upon completion of activation, the existing program is rewritten with the new update program.

[0057] When updating a program in an ECU with a single-bank internal memory, the ECU may be unable to control the vehicle while the updated program is being written to the program storage area and while the updated program is being activated. On the other hand, when updating a program in an ECU with a dual-bank internal memory, the ECU can control the vehicle using the program stored on the other surface (active surface) while the updated program is being written to the program storage area on the back surface (inactive surface). In this embodiment, the description may include that ECU 204 has a single-bank internal memory and ECU 205 has a dual-bank internal memory.

[0058] Figure 3 This figure shows an example of the data structure of the required power information managed by the external device 70. The required power information is information that associates an "ID" with a "required power amount." The "ID" is identification information for the update program. The "required power amount" is the amount of power required when using the update program to update the program. The required power amount is a design value set for each update program.

[0059] When the IG power supply is turned on, the rewrite control unit 220 transmits configuration information including version information of the programs for each ECU to the external device 70 via the TCU 201. Based on the configuration information transmitted from the vehicle 20, the external device 70 selects an update program for rewriting the programs of the ECUs included in the vehicle 20. The external device 70 refers to the required power information to determine information indicating the required power for the selected update program. The external device 70 transmits the information indicating the determined required power along with the selected update program to the vehicle 20.

[0060] Furthermore, in this embodiment, it is assumed that the first program identified by "P1_1" is version 1.1 for a specific ECU, and the second program identified by "P1_2" is version 1.2 for the same ECU. If the program version of the ECU included in control system 200 is 1.0, and the latest program version is 1.2, external device 70 transmits a program package to control system 200 that includes the first program version 1.1, the second program version 1.2, and required power amounts ΔA1 and ΔA2. Upon receiving the program package from external device 70, rewrite control unit 220 rewrites the ECU program using the first program version 1.1 and then rewrites the ECU program using the second program version 1.2, thereby performing a program update.

[0061] Figure 4 An example of temporal change in the remaining capacity of battery 295 predicted when program updates using the first program and the second program are continuously performed is shown. Figure 4The line of reference numeral 410 shows the change in the remaining battery capacity when the program is updated using the first program. The line of reference numeral 420 shows the change in the remaining battery capacity when the program is updated using the second program.

[0062] like Figure 4 As shown, if the remaining capacity before the program update is A3, it is predicted that the program update using the first and second programs will reduce the remaining capacity to A4. As an example, A4 = A3 - (ΔA1 + ΔA2). If A4 is greater than a threshold, the rewrite control unit 220 determines to start the program update using the first and second programs. Alternatively, the threshold can be set to a value higher than the amount of power required to start the vehicle 20.

[0063] Figure 5 The following is an example of the time change of the remaining capacity of the battery 295 when the program of the ECU with a single memory is updated. If the remaining capacity before the program update is A3, the power supply information acquisition unit 230 acquires the remaining capacity A10 of the battery 295 at the time when the program update using the first program is completed under the control of the rewrite control unit 220. Figure 5 The line of symbol 510 shows the change of the actual remaining capacity of the battery 295 when the program is updated using the first program. Figure 5 As shown, the amount of power consumed during the period of program update using the first program is higher than the design value indicated by reference numeral 410 .

[0064] The line of symbol 520 shows a prediction of the change in the remaining battery capacity assuming that a program update using the second program is performed after a program update using the first program. The slope and length of the line of symbol 520 are respectively equal to the slope and length of the line of symbol 420. The rewrite control unit 220 predicts the remaining capacity A12 at the completion of the program update using the second program based on A10 and ΔA2. For example, the rewrite control unit 220 predicts the remaining capacity A12 at the completion of the program update using the second program by A12=A10-ΔA2. Then, if A12 is below the threshold, the rewrite control unit 220 determines that the program update using the second program will not be performed. In this way, by not performing the program update using the second program, it is possible to prevent a malfunction from occurring during the start-up of the vehicle 20.

[0065] Alternatively, the rewrite control unit 220 may estimate the remaining capacity upon completion of the program update using the second program based on the difference between A3 and A10, ΔA1, and ΔA2. For example, the amount of power required during the program update using the second program may be corrected to ΔA2 + (A3 - A10 - ΔA1), and the remaining capacity upon completion of the program update using the second program may be estimated based on the corrected amount of power and the current remaining capacity A10.

[0066] Figure 6 This is a flowchart showing the execution procedure of a process when a program of an ECU with a single memory set is updated. Figure 6 The processing of the flowchart starts when the IG power supply is turned off.

[0067] In S602, the power information acquisition unit 230 acquires the remaining capacity of the battery 295. In S604, the rewrite control unit 220 determines whether the remaining capacity of the battery 295 predicted upon completion of the program update using the first and second programs is greater than a threshold value.

[0068] If the predicted remaining capacity of battery 295 at the completion of the program update is greater than a threshold, the rewrite control unit 220 determines to start the program update and executes the program update using the first program in S606. When the program update using the first program is completed, the power supply information acquisition unit 230 acquires the remaining capacity of battery 295 in S608. In S610, the rewrite control unit 220 predicts the remaining capacity of battery 295 at the completion of the program update of the second program to the ECU and determines whether the predicted remaining capacity is greater than a threshold. If the predicted remaining capacity is greater than the threshold, the program update using the second program is started in S612. When the program update is completed, the processing of this flowchart ends.

[0069] If it is determined in S604 that the remaining capacity of the battery 295 predicted upon completion of the program update is below the threshold, the warning control unit 250 notifies the user in S620 that the program update was not performed due to insufficient remaining battery capacity. For example, the warning control unit 250 may notify the user via the IVI 299. Furthermore, if it is determined in S610 that the remaining capacity of the battery 295 predicted upon completion of the program update is below the threshold, the process is also transferred to S620 to notify the user that the program update was not performed due to insufficient remaining battery capacity. Furthermore, after the notification in S620, if the power supply information acquisition unit 230 senses that the battery charger is connected to the battery 295, the program update using the second program may be started.

[0070] Figure 7FIG. 2 shows an example of a time change of the remaining capacity of the battery 295 when the program of the ECU with dual memory is updated. Figure 5 Similarly, it is assumed that the remaining capacity of the battery 295 at the start of the program update is A3. The power information acquisition unit 230 acquires the remaining capacity A20 of the battery 295 during the execution of the program update of the ECU by the first program. Figure 7 The solid line of symbol 710 shows the change of the actual remaining capacity of the battery 295 when the program is updated using the first program. Figure 7 As shown, the amount of power consumed during execution of the program update using the first program is higher than the design value indicated by reference numeral 410 .

[0071] During the execution of a program update using the first program, the rewrite control unit 220 determines whether the remaining capacity at the time of completion of the program update using the second program is below a threshold. If the remaining capacity at the time of completion of the program update using the second program falls below the threshold, the rewrite control unit 220 determines to abort the program update using the first program. As an example, the rewrite control unit 220 determines whether the difference between the remaining capacity of the battery 295 and ΔA2 during the program update using the first program falls below a threshold. If the difference between the remaining capacity of the battery 295 and ΔA2 during the program update falls below the threshold, the rewrite control unit 220 determines to abort the program update using the first program. As another example, the rewrite control unit 220 predicts the remaining capacity A21 at the time of completion of the program update using the first program. For example, during the writing of the first program to the ECU, the rewrite control unit 220 predicts the remaining capacity A21 at the time of completion of the program update using the first program based on the current remaining capacity A20, the data size of the completed first program, and the overall data size of the first program. The rewrite control unit 220 then predicts the remaining capacity A22 upon completion of the program update using the second program using the equation A22 = A21 - ΔA2. Specifically, in this example, as indicated by the line 720, the change in remaining battery capacity is predicted assuming that a program update using the second program is performed after a program update using the first program. The inclination and length of the line 720 are identical to those of the line 420. If the predicted remaining capacity A22 falls below the threshold, the rewrite control unit 220 determines not to perform the program update using the second program and to terminate the program update using the first program.

[0072] Even when writing a first program to one program storage area of ​​the dual-bank memory, an ECU equipped with a dual-bank memory can operate based on a valid second program stored in the other program storage area. Since an ECU equipped with a dual-bank memory can operate even if writing of the first program is interrupted midway, when updating a program in an ECU equipped with a dual-bank memory, the remaining capacity of battery 295 is periodically obtained during the program update using the first program. If the remaining capacity is less than a threshold value when determining completion of the program update using the second program, the program update using the first program can be interrupted before completion. This allows for early determination to interrupt the program update, before completion of the program update using the first program.

[0073] Furthermore, the rewrite control unit 220 can predict the remaining capacity upon completion of the program update using the second program based on the difference between A3 and A21, ΔA1, and ΔA2. For example, the amount of power required during the program update using the second program can be corrected to ΔA2 + (A3 - A21 - ΔA1), and the remaining capacity upon completion of the program update using the second program can be predicted based on the corrected power amount and the remaining capacity A21.

[0074] Figure 8 This is a flowchart showing the execution procedure of a process when a program of an ECU having a dual-bank memory is updated. Figure 8 The processing of the flowchart starts when the IG power supply is turned off.

[0075] In S802, the power information acquisition unit 230 acquires the remaining capacity of the battery 295. In S804, the rewrite control unit 220 determines whether the remaining capacity of the battery 295 predicted upon completion of the program update using the first and second programs is greater than a threshold value.

[0076] In the case where it is determined that the remaining capacity of the battery 295 predicted at the time of completion of the program update is greater than the threshold value, the rewrite control unit 220 determines to start the program update, and starts the program update using the first program in S806. In S808, the power information acquisition unit 230 acquires the remaining capacity of the battery 295. In S810, the rewrite control unit 220 determines whether the remaining capacity at the time of completion of the program update using the second program is greater than the threshold value. In the case where the remaining capacity at the time of completion of the program update using the second program is greater than the threshold value, in S812, it is determined whether the program update using the first program is completed. In the case where the program update using the first program is not completed, the processing is transferred to S808. In the case where the program update using the first program is completed, in S814, the rewrite control unit 220 executes the program update using the second program, and ends the processing of this flowchart.

[0077] If it is determined in S804 that the remaining capacity of the battery 295 predicted at the time of completion of the program update is below the threshold, the warning control unit 250 notifies the user in S820 that the program update was not performed due to insufficient remaining battery capacity. For example, the warning control unit 250 may notify the user through the IVI 299. In addition, if it is determined in S810 that the remaining capacity at the time of completion of the program update using the second program is below the threshold, the processing is also transferred to S820 to notify the user that the program update was not performed due to insufficient remaining battery capacity. In addition, after the notification in S820, if the power information acquisition unit 230 senses that the battery charger is connected to the battery 295, the program update using the first program can be continued.

[0078] As described above, control system 200 obtains the remaining capacity of battery 295, for example, when a program update is complete or during a program update, and determines whether to continue the program update. This prevents the occurrence of so-called battery deadlock. Furthermore, even if power consumption increases due to factors such as the vehicle 20's operating environment during a program update, the required power for starting vehicle 20 can be maintained. Furthermore, the likelihood of battery deadlock is reduced even in situations where the remaining capacity does not change as expected relative to power consumption, such as when battery 295 deteriorates or when a non-genuine battery is used. In particular, when performing multiple program updates, the longer the program update period, the greater the error between the actual power consumption and the required power, increasing the likelihood of battery deadlock. However, control system 200 obtains the remaining capacity of battery 295 upon completion of each program update or during each program update, and determines whether to continue the program update. This reduces the likelihood of battery deadlock even when performing multiple program updates.

[0079] use Figures 9 to 11 A method in which the external device 70 calculates the required power amount stored in the required power amount information using the actual measured value of the power consumption amount when the program is updated in each vehicle will be described.

[0080] The external device 70 collects information indicating the amount of power consumed when a program update is performed in each vehicle from each vehicle. Figure 9 The following shows an example of the data structure of the actual power consumption information managed by the external device 70. In the actual power consumption information, "VID", "ID", "power consumption", and "temperature" are associated with each other.

[0081] "VID" is vehicle identification information. "ID" is update program identification information. "Power consumption" is the amount of power consumed when performing a program update using the update program. "Air temperature" is the temperature in each vehicle when the program update is performed.

[0082] For example, in vehicle 20, ECU 202 measures the amount of discharge from battery 295 while a program update using an update program is in progress. Based on the measured amount of discharge, it calculates power consumption and transmits actual performance information to external device 70. The actual performance information includes the calculated power consumption, the ID of the update program, the ID assigned to vehicle 20, the location of vehicle 20 at the time of the program update, and information indicating the time of the program update. External device 70 obtains the temperature in vehicle 20 at the time of the program update based on the vehicle 20 location information obtained from ECU 202, the information indicating the time of the program update, and historical temperature information for various regions. External device 70 associates the determined temperature with the vehicle identification information, the update program ID, and the power consumption included in the actual performance information collected from each vehicle, and stores the information as actual power consumption information.

[0083] Figure 10 An example of the temperature dependency of power consumption during program update for each vehicle and the design value of the required power are schematically shown. For example, when the temperature is low, the user may operate a sheet heater, etc., which may increase power consumption. Figure 10 As shown, the power consumption when performing a program update using the same update program of the same version may depend on the temperature.

[0084] The external device 70 uses the actual power consumption information to generate Figure 3 For example, the external device 70 classifies the power consumption during program update collected from each vehicle by temperature, and calculates the required power stored in the required power information by temperature. Figure 10 As shown in reference numeral 1000 , when there is a power consumption amount that is significantly different from the power consumption amount measured in other vehicles, the required power amount can be calculated by removing the data of the power consumption amount.

[0085] like Figure 10 As shown, if the power consumption actually measured in each vehicle is lower than the design value, the calculated required power amount may be lower than the design value. If the calculated required power amount is lower than the design value, more program updates may be possible within the remaining battery capacity. Therefore, the external device 70 can select more update programs based on the required power amount and transmit them to the vehicle 20, allowing program updates for more ECUs to be performed simultaneously.

[0086] Figure 11 The external device 70 stores the required power amount calculated based on the actual measurement value as a memory element. Figure 3 The required power amount is described in conjunction with the required power amount. The required power amount is stored in the "required power amount" field, which is calculated by the external device 70 based on the actual measurement value. The required power amount is the amount of power with temperature T as a parameter. The required power amount can be expressed as a function with temperature T as a parameter. The required power amount can be discrete numerical information corresponding to multiple temperatures T.

[0087] When external device 70 transmits an update program to vehicle 20, it transmits a program package including the update program and the required power amount calculated from the actual measured value. In vehicle 20, rewrite control unit 220 determines the required power amount corresponding to the current temperature based on the required power amount received from external device 70 and the current temperature. Based on the determined required power amount, rewrite control unit 220 determines whether to initiate a program update. Furthermore, based on the determined required power amount, rewrite control unit 220 determines whether to terminate a program update upon completion of a program update using the first program or during execution of a program update using the first program.

[0088] In addition, if Figure 10 As shown in the symbol 1000, for a vehicle whose measured power consumption deviates from the power consumption measured in other vehicles, instead of directly using the design value of the required power or the required power calculated from the actual measured values ​​of other vehicles, the measured power consumption can be classified in units of vehicles and the required power can be calculated in units of vehicles.

[0089] In the above description, it is described that the program update using OTA is mainly controlled uniformly by ECU202. However, as a control in the case of controlling the program update using the reprogramming device 74, the same processing as the control performed by ECU202 in the case of the program update using OTA can be applied. In this case, the reprogramming device 74 can have a functional structure corresponding to the rewrite control unit 220, the power information acquisition unit 230 and the warning control unit 250. The reprogramming device 74 is connected to the in-vehicle communication line 280 via the communication cable 32, and controls the rewriting of the program from the outside of the vehicle 20 via the communication cable 32. In addition, in the method of controlling the program update using the reprogramming device 74, in the case of outputting a warning message that is output when the program update is not started, etc., the warning message can be displayed on the display screen of the reprogramming device 74.

[0090] In the case of using a reprogramming device to perform a program update, the power consumption during the program update may sometimes be different from that in the case of a program update performed using OTA. In addition, the power consumption during a program update may sometimes change depending on the model of the reprogramming device used or the individual of the reprogramming device. Therefore, the external device 70 can collect actual results information from the reprogramming device and calculate the required amount of electricity when the reprogramming device is used based on the collected actual results information, wherein the actual results information shows the amount of electricity consumed when the reprogramming device is used to control the program update in each vehicle. At this time, the external device 70 can classify the required amount of electricity by each model or each individual of the reprogramming device based on the power consumption included in the actual results information, and calculate the required amount of electricity by each model or each individual of the reprogramming device.

[0091] Vehicle 20 is a vehicle as an example of transportation equipment. The vehicle may be a car with an internal combustion engine, an electric car, a fuel cell vehicle (FCV), or the like. Cars include buses, trucks, two-wheeled vehicles, and the like. The vehicle may be a saddle-type vehicle or a motorcycle. As transportation equipment, in addition to vehicles, there are also aircraft including drones, ships, and other equipment. Transportation equipment may be any equipment that transports people or goods. Transportation equipment is an example of a mobile body. The mobile body is not limited to transportation equipment, and may be any movable equipment.

[0092] Figure 12 An example of a computer 2200 capable of embodying, in whole or in part, various embodiments of the present invention is shown. Programs installed in computer 2200 can cause computer 2000 to function as a system, such as a control system, or various parts of a system, or as an information processing device, or various parts of such a device, according to the embodiments; can cause computer 2000 to perform operations associated with the system, or various parts of the system, or with the device, or various parts of such a device; and / or can cause computer 2000 to perform processes, or steps of such processes, according to the embodiments. Such programs can be executed by CPU 2012 to cause computer 2000 to perform specific operations associated with the processing steps described in this specification and with some or all of the items in the blocks of the block diagrams.

[0093] The computer 2000 of this embodiment includes a CPU 2012 and a RAM 2014, which are interconnected by a main controller 2010. The computer 2000 also includes a ROM 2026, a flash memory 2024, a communication interface 2022, and an input / output chip 2040. The ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040 are connected to the main controller 2010 via the input / output controller 2020.

[0094] The CPU 2012 operates according to the programs stored in the ROM 2026 and the RAM 2014 , thereby controlling each unit.

[0095] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 stores programs and data that can be used by the CPU 2012 in the computer 2000. The ROM 2026 stores programs such as a boot program executed by the computer 2000 when activated, and / or programs that depend on the hardware of the computer 2000. The input / output chip 2040 can also connect various input / output units such as a keyboard, mouse, and display to the input / output controller 2020 via input / output ports such as a serial port, parallel port, keyboard port, mouse port, display port, USB port, and HDMI (registered trademark) port.

[0096] The program is provided via a computer-readable storage medium such as a CD-ROM, DVD-ROM, or memory card, or via a network. RAM 2014, ROM 2026, or flash memory 2024 are examples of computer-readable storage media. The program is installed into flash memory 2024, RAM 2014, or ROM 2026 and executed by CPU 2012. The information processing described in these programs is read into computer 2000, providing a link between the program and the various types of hardware resources described above. The apparatus or method can be constructed by a process that implements information manipulation or processing as computer 2000 is used.

[0097] For example, when communication is performed between the computer 2000 and an external device, the CPU 2012 may execute a communication program loaded in the RAM 2014 and, based on the processing described in the communication program, instruct the communication interface 2022 to perform communication processing. Under the control of the CPU 2012, the communication interface 2022 reads transmission data stored in a transmission buffer processing area provided in a recording medium such as the RAM 2014 and the flash memory 2024, transmits the read transmission data to the network, and writes reception data received from the network to a reception buffer processing area provided on the recording medium.

[0098] Alternatively, the CPU 2012 may execute various processes on the data in the RAM 2014 so that all or a required portion of a file or database stored in a recording medium such as the flash memory 2024 is read into the RAM 2014. The CPU 2012 then writes the processed data back to the recording medium.

[0099] It is possible that various types of information such as various types of programs, data, data tables, and databases are stored in a recording medium and subjected to information processing. CPU2012 can perform various operations described in this specification and specified by the instruction sequence of the program, including various processing including information processing, conditional judgment, conditional branching, unconditional branching, information retrieval / replacement, etc., on the data read from RAM2014, and write the results back to RAM2014. In addition, CPU2012 can retrieve information from files, databases, etc. in a recording medium. For example, in a case where a plurality of entries are stored in a recording medium and the plurality of entries respectively have attribute values ​​of a first attribute related to an attribute value of a second attribute, it is possible that CPU2012 retrieves an entry that is consistent with the condition specified by the attribute value of the first attribute from the plurality of entries, and reads the attribute value of the second attribute stored in the entry, thereby obtaining the attribute value of the second attribute related to the first attribute that meets the predetermined condition.

[0100] The programs or software modules described above can be stored in a computer-readable storage medium on or near the computer 2000. A recording medium such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet can be used as the computer-readable storage medium. The program stored in the computer-readable storage medium can be provided to the computer 2000 via the network.

[0101] Programs installed on computer 2000 and causing computer 2000 to function as control system 200 can be run on CPU 2012 and other devices, causing computer 2000 to function as various components of control system 200. The information processing described in these programs is read into computer 2000, thereby enabling various components of control system 200 to function as specific means for the software to work in conjunction with the various hardware resources described above. By employing these specific means to perform calculations or processing of information corresponding to the intended use of computer 2000 in this embodiment, a unique control system 200 tailored to the intended use can be constructed.

[0102] Various embodiments are described with reference to block diagrams and the like. In the block diagrams, each block may represent (1) a step of a process in which an operation is performed or (2) a portion of an apparatus having the function of performing the operation. Specific steps and portions may be implemented by dedicated circuits, programmable circuits supplied with computer-readable instructions stored on a computer-readable storage medium, and / or processors supplied with computer-readable instructions stored on a computer-readable storage medium. Dedicated circuits may include digital circuits and / or analog hardware circuits, and may include integrated circuits (ICs) and / or discrete circuits. Programmable circuits may include logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logical operations, and reconfigurable hardware circuits including flip-flops, registers, memory elements such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and the like.

[0103] A computer-readable storage medium may include any tangible device capable of storing instructions for execution by an appropriate device. Consequently, a computer-readable storage medium having instructions stored therein constitutes at least a portion of a product containing the following instructions, capable of executing the instructions for the purpose of providing a means for performing the operations specified by the process sequence or block diagram. Examples of computer-readable storage media include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, and the like. More specific examples of computer-readable storage media include floppy disks (registered trademark), optical disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), electrically erasable programmable read-only memory (EEPROM), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital versatile disks (DVD), Blu-ray disks (RTM), memory sticks, integrated circuit cards, and the like.

[0104] Computer-readable instructions may include assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or any source code or object code described using any combination of one or more programming languages ​​including object-oriented programming languages ​​such as Smalltalk, JAVA (registered trademark), C++, and existing procedural programming languages ​​such as the "C" programming language or similar programming languages.

[0105] Computer-readable instructions may be provided to a processor or programmable circuit of a general-purpose computer, a special-purpose computer, or other programmable data processing device via a local area network (LAN) or a wide area network (WAN) such as the Internet, and the computer-readable instructions may be executed for the purpose of providing a means for performing the operations specified by the described processing steps or block diagrams. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, and the like.

[0106] While the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. Those skilled in the art will appreciate that various modifications or improvements can be made to the above embodiments. As can be seen from the claims, embodiments resulting from such modifications or improvements are also encompassed within the technical scope of the present invention.

[0107] It should be noted that, with respect to the order in which the various processes, such as the tasks, processes, steps, and stages, in the claimed scope, the apparatuses, systems, programs, and methods illustrated in the specification, and the accompanying drawings, are executed in any order, unless specifically indicated by the phrases "before," "prior to," or "preceding," and unless a subsequent process specifies that the output of a previous process is to be used. Regarding the workflows in the claims, specification, and accompanying drawings, the phrases "first," "second," and the like are used for convenience. However, even such phrases do not necessarily imply that the processes must be executed in that order.

[0108] Description of Reference Signs

[0109] 10. Update the system

[0110] 20 vehicles

[0111] 32 Communication cables

[0112] 34 Diagnostic port

[0113] 70 External devices

[0114] 74 Reprogramming device

[0115] 90 Communication Network

[0116] 200 Control System

[0117] 201 TCU

[0118] 202 ECU

[0119] 204 ECU

[0120] 205 ECU

[0121] 206 ECU

[0122] 220 Rewrite Control Unit

[0123] 230 Power Information Acquisition Department

[0124] 240 Acquisition Department

[0125] 250 Warning Control Unit

[0126] 280 In-vehicle communication lines

[0127] 294 FI

[0128] 295 battery

[0129] 296 Batteries

[0130] 298 MID

[0131] 299 IVI

[0132] 2000 Computer

[0133] 2010 Main Controller

[0134] 2012 CPU

[0135] 2014 RAM

[0136] 2020 Input / Output Controller

[0137] 2022 Communication Interface

[0138] 2024 Flash Memory

[0139] 2026 ROM

[0140] 2040 Input / Output Chip.

Claims

1. A program update control device, wherein: have: a rewriting control unit that controls rewriting a program executed by a moving body control unit that controls at least a portion of the moving body into a new program; an acquiring unit that acquires the new program and information related to the amount of power required for the rewriting from an external device; as well as a power source information acquiring unit for acquiring a remaining capacity of a battery of the mobile object used in the rewriting; The moving body control unit includes a first storage area and a second storage area. The mobile body control unit reads any one of the program stored in the first storage area and the program stored in the second storage area at the time of activation. The acquisition unit acquires a first program and a second program as the new program from the external device, and acquires information indicating an amount of power required for writing the first program and an amount of power required for writing the second program. When the program executed by the mobile body control unit is stored in the first storage area, the rewrite control unit starts writing the first program into the second storage area based on information indicating the amount of power required for writing the first program and the amount of power required for writing the second program; The power information acquisition unit acquires the remaining capacity of the battery (i) before the first program is written to the second storage area, and (ii) during the writing of the first program to the second storage area and before the writing of the second program to the second storage area begins. During writing of the first program to the second storage area, the rewrite control unit predicts the remaining capacity of the battery when writing of the first program to the second storage area is completed based on the remaining capacity of the battery acquired by the power information acquisition unit during writing of the first program to the second storage area, and predicts the remaining capacity of the battery when writing of the second program to the second storage area is completed based on (i) the difference between the remaining capacity of the battery acquired by the power information acquisition unit before writing of the first program to the second storage area and the predicted remaining capacity of the battery when writing of the first program to the second storage area is completed, (ii) the amount of power required for writing of the first program, and (iii) the amount of power required for writing of the second program. If the predicted remaining capacity of the battery when writing of the second program to the second storage area is completed is less than a predetermined value, it is determined not to continue rewriting.

2. The program update control device according to claim 1, wherein: The power source information acquisition unit notifies the rewriting control unit of the remaining capacity of the battery acquired by the program stored in the first storage area during execution of the rewriting.

3. The program update control device according to claim 1 or 2, wherein: When the difference between the remaining capacity of the battery obtained by the power information acquisition unit during writing of the first program to the second storage area and the amount of power required to write the second program is less than a predetermined value, the rewrite control unit terminates writing of the first program and does not start writing of the second program.

4. The program update control device according to claim 1 or 2, wherein: The device further includes a warning control unit configured to output a warning when a difference between the remaining capacity of the battery acquired by the power information acquisition unit and the power required for writing the second program is smaller than a predetermined value during writing of the first program into the second storage area.

5. The program update control device according to claim 1, wherein: During writing of the first program to the second storage area, the rewrite control unit predicts the remaining capacity of the battery when writing of the first program to the second storage area is completed based on the remaining capacity of the battery acquired by the power information acquisition unit, the size of the data completed by writing the first program to the second storage area, and the overall data size of the first program.

6. The program update control device according to claim 1, wherein: The mobile object is a vehicle.

7. The program update control device according to claim 6, wherein: After the acquisition unit acquires the new program and the information related to the amount of power required for the rewrite from the external device, when the ignition power of the mobile body is turned off, the rewrite control unit starts the rewrite based on the information related to the amount of power required for the rewrite, the power information acquisition unit acquires the remaining capacity of the battery during the execution of the rewrite, and the rewrite control unit determines the continuation of the rewrite based on the amount of power required for the rewrite and the remaining capacity of the battery.

8. The program update control device according to claim 6, wherein: The battery is a different battery from a battery that supplies electric power to an engine that generates power for traveling the vehicle.

9. The program update control device according to claim 1, wherein: The program update control device is an external reprogramming device that is connected to a communication path in the moving body by wire and controls rewriting of the program from outside the moving body through the wired connection.

10. A mobile object, wherein: A program update control device according to any one of claims 1 to 9 is provided.

11. A computer-readable storage medium storing a program, wherein: The program is for causing a computer to function as the program update control device according to any one of claims 1 to 9.

12. A program update control device, wherein: include: a rewriting control unit that controls rewriting a program executed by a moving body control unit that controls at least a portion of the moving body into a new program; an acquiring unit that acquires the new program and information related to the amount of power required for the rewriting from an external device; as well as a power source information acquiring unit for acquiring a remaining capacity of a battery of the mobile object used in the rewriting; The rewriting control unit starts the rewriting based on information on the amount of power required for the rewriting. The mobile body control unit includes a single storage area for storing a program executed by the mobile body control unit. The acquisition unit acquires a first program and a second program as the new program from the external device, and acquires an amount of power required for writing the first program and an amount of power required for writing the second program. The power source information acquisition unit acquires the remaining capacity of the battery before writing the first program into the storage area. The rewrite control unit starts writing the first program into the storage area in which the program executed by the mobile body control unit is written. The power supply information acquisition unit acquires the remaining capacity of the battery before writing the second program to the storage area when writing of the first program to the storage area is completed. The rewrite control unit predicts the remaining capacity of the battery when the writing of the second program to the storage area is completed based on (i) the difference between the remaining capacity of the battery obtained by the power information acquisition unit before writing the first program to the storage area and the remaining capacity of the battery obtained by the power information acquisition unit before writing the second program to the storage area, (ii) the amount of power required for writing the first program, and (iii) the amount of power required for writing the second program. If the predicted remaining capacity of the battery is less than a predetermined value, it is determined that the writing of the second program will not be started.

13. The program update control device according to claim 12, wherein: The system further includes a warning control unit configured to output a warning when a difference between the remaining capacity of the battery indicated by the information acquired by the power source information acquisition unit and the amount of power required for rewriting acquired by the acquisition unit is smaller than a predetermined value.

14. The program update control device according to claim 13, wherein: The rewriting control unit starts the rewriting of the new program when a charger is connected to the battery after the warning is output.

15. The program update control device according to claim 12, wherein: The mobile object is a vehicle.

16. The program update control device according to claim 15, wherein: After the acquisition unit acquires the new program and the information related to the amount of power required for the rewrite from the external device, when the ignition power of the mobile body is turned off, the rewrite control unit starts the rewrite based on the information related to the amount of power required for the rewrite, the power information acquisition unit acquires the remaining capacity of the battery during the execution of the rewrite, and the rewrite control unit determines the continuation of the rewrite based on the amount of power required for the rewrite and the remaining capacity of the battery.

17. The program update control device according to claim 15 or 16, wherein: The battery is a different battery from a battery that supplies electric power to an engine that generates power for traveling the vehicle.

18. The program update control device according to claim 12, wherein: The program update control device is an external reprogramming device that is connected to a communication path in the moving body by wire and controls rewriting of the program from outside the moving body through the wired connection.

19. A mobile object, wherein: A program update control device according to any one of claims 12 to 18 is provided.

20. A computer-readable storage medium storing a program, wherein: The program is for causing a computer to function as the program update control device according to any one of claims 12 to 18.

21. A program update control method, wherein: have: a step of acquiring a new program and information from an external device, the new program rewriting a program executed by a mobile body control unit that controls at least a portion of the mobile body, the information relating to an amount of electric power required for the rewriting; as well as a step of starting control for rewriting the program executed by the mobile body control unit into a new program based on information on the amount of electric power required for the rewriting; The moving body control unit includes a first storage area and a second storage area. The mobile body control unit reads any one of the program stored in the first storage area and the program stored in the second storage area at the time of activation. In the step of acquiring a new program and information from an external device, a first program and a second program are acquired from the external device as the new program, and information indicating the amount of power required for writing the first program and the amount of power required for writing the second program is acquired. The step of starting control for rewriting the program executed by the mobile body control unit to a new program includes, when the program executed by the mobile body control unit is stored in the first storage area, starting the step of writing the first program to the second storage area based on information indicating the amount of power required for writing the first program and the amount of power required for writing the second program; The program update control method further includes the following steps: Before writing the first program into the second storage area, obtaining a remaining capacity of a battery of the mobile object used in the rewriting; acquiring the remaining capacity of the battery during writing of the first program into the second storage area and before starting writing of the second program into the second storage area; During writing of the first program to the second storage area, the remaining capacity of the battery when writing of the first program to the second storage area is predicted based on the remaining capacity of the battery obtained during writing of the first program to the second storage area, and the remaining capacity of the battery when writing of the second program to the second storage area is completed is predicted based on (i) the difference between the remaining capacity of the battery obtained before writing of the first program to the second storage area and the predicted remaining capacity of the battery when writing of the first program to the second storage area is completed, (ii) the amount of power required for writing of the first program, and (iii) the amount of power required for writing of the second program. If the predicted remaining capacity of the battery when writing of the second program to the second storage area is completed is less than a predetermined value, it is determined not to continue rewriting.

22. A program update control method, wherein: have: a step of acquiring a new program and information from an external device, the new program rewriting a program executed by a mobile body control unit that controls at least a portion of the mobile body, the information relating to an amount of electric power required for the rewriting; as well as a step of starting control for rewriting the program executed by the mobile body control unit into a new program based on information on the amount of electric power required for the rewriting; The mobile body control unit includes a single storage area for storing a program executed by the mobile body control unit. In the step of acquiring a new program and information from an external device, a first program and a second program are acquired from the external device as the new program, and the amount of power required for writing the first program and the amount of power required for writing the second program are acquired. The step of starting control of rewriting the program executed by the mobile body control unit to a new program includes starting writing the first program to a storage area in which the program executed by the mobile body control unit is written, The program update control method further includes: Before writing the first program into the storage area, the remaining capacity of the battery of the mobile object used in the rewriting is obtained. When writing of the first program to the storage area is completed, before writing the second program to the storage area, the remaining capacity of the battery is obtained. Based on (i) the difference between the remaining capacity of the battery obtained before writing the first program to the storage area and the remaining capacity of the battery obtained before writing the second program to the storage area, (ii) the amount of power required for writing the first program, and (iii) the amount of power required for writing the second program, the remaining capacity of the battery when writing the second program to the storage area is completed is predicted. If the predicted remaining capacity of the battery is less than a predetermined value, it is determined that writing of the second program will not be started.

Images