Control device and control method

Abstract

The present application provides a control device and a control method, which realize a method for updating software of a device related to a safety function of a vehicle. The control device has: an alarm unit that executes a monitoring function that detects an inappropriate action with respect to the vehicle, and outputs an alarm through an alarm output unit in a case where an inappropriate action is detected by the monitoring function; a software update unit that performs an update of software possessed by an electronic device mounted on the vehicle; and an alarm output control unit that restricts the output of the alarm in a case where the update of the software of the electronic device is performed by the software update unit.

Description

Technical Field

[0001] This invention relates to a control device and a control method. Background Technology

[0002] In recent years, the functionality of software installed in vehicles has been evolving to improve traffic safety and ride comfort. Consequently, solutions have been proposed for updating the software of vehicle equipment to enhance its functionality. For example, Patent Document 1 discloses a method for downloading and installing a program from a server to an in-vehicle unit.

[0003] Furthermore, software-based solutions have been proposed to enhance security functions such as preventing vehicle theft. For example, Patent Document 2 discloses a structure in which an ECU executes a program to detect abnormalities such as intrusion into the vehicle.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2012-113394

[0007] Patent Document 2: Japanese Patent Application Publication No. 2014-056561 Summary of the Invention

[0008] The problem the invention aims to solve

[0009] When updating the software of in-vehicle equipment or ECUs, the functions of the equipment or ECUs being updated may sometimes be temporarily stopped or restarted. Therefore, when updating the software of in-vehicle equipment or ECUs related to safety functions, the stopping or restarting of these devices or ECUs may be falsely detected as an anomaly. Consequently, updating the software of in-vehicle equipment or ECUs related to safety functions is difficult.

[0010] The present invention was made in view of the above background, and its object is to increase the opportunity to improve the functionality of vehicles by implementing a method for updating the software of devices related to the safety functions of vehicles, thereby contributing to the development of sustainable transportation systems.

[0011] means for solving problems

[0012] One aspect of the present invention provides a control device comprising: an alarm unit that performs a monitoring function to detect inappropriate behavior toward a vehicle, and outputs an alarm via an alarm output unit when the inappropriate behavior is detected by the monitoring function; a software update unit that updates the software of an electronic device mounted in the vehicle; and an alarm output control unit that restricts the output of the alarm when the software of the electronic device is updated by the software update unit.

[0013] According to another aspect of the invention, the software update unit updates the software of the electronic device after the restriction of the alarm output control unit begins.

[0014] According to another aspect of the present invention, after the software update unit completes the software update of the electronic device, the alarm output control unit removes the restriction on the output of the alarm.

[0015] According to another aspect of the invention, when a software update of the electronic device is scheduled to be performed by the software update unit while the monitoring function of the alarm unit is not being executed, the alarm output control unit restricts the start of the monitoring function until the software update of the electronic device is completed.

[0016] According to another aspect of the invention, the control device has a camera unit that takes pictures outside the vehicle, and the alarm output control unit uses the pictures taken by the camera unit to detect people when the output of the alarm is restricted, and restricts the output of the alarm by the alarm unit when there are no people near the vehicle.

[0017] According to another aspect of the present invention, the alarm output control unit determines whether the person detected by the photographic image of the camera unit is approaching the vehicle. If the person is approaching the vehicle, the software update of the electronic device performed by the software update unit is stopped, and the restriction on the output of the alarm is lifted.

[0018] According to another aspect of the present invention, the alarm output control unit determines whether the person detected by the photographic image of the camera unit is a legitimate user of the vehicle, and if the person is a legitimate user of the vehicle, restricts the output of the alarm by the alarm unit.

[0019] According to another aspect of the invention, when inappropriate behavior toward the vehicle is detected after the software update unit has started updating the software of the electronic device, the alarm output control unit causes the software update of the electronic device to be suspended and the restriction on the output of the alarm to be lifted.

[0020] According to another aspect of the invention, the electronic device includes a first electronic device and a second electronic device, wherein the alarm output control unit, when the software of the first electronic device is updated by the software update unit, restricts the output of the alarm when inappropriate behavior is detected by the monitoring function for the first electronic device, and does not restrict the output of the alarm when inappropriate behavior is detected by the monitoring function for the second electronic device.

[0021] According to another aspect of the invention, the alarm output unit includes a communication device connected to a designated external device via a communication line, wherein the alarm unit sends an alarm message to the external device via the communication device when the inappropriate behavior is detected by the monitoring function.

[0022] Another aspect of the present invention provides a control method comprising the steps of: performing a monitoring function to detect inappropriate behavior of a vehicle; outputting an alarm via an alarm output unit when the inappropriate behavior is detected by the monitoring function; and limiting the output of the alarm when the software of an electronic device mounted on the vehicle is updated via a software update unit.

[0023] Invention Effects

[0024] According to the present invention, the software of electronic devices mounted in a vehicle can be updated without causing safety-related functions to malfunction. This increases the opportunity to improve vehicle functionality through software updates and contributes to the development of sustainable transportation systems. Attached Figure Description

[0025] Figure 1 It is a diagram illustrating the schematic structure of the management system.

[0026] Figure 2 This is a block diagram showing the main structural components of a vehicle's control system.

[0027] Figure 3 This is a flowchart illustrating an example of the operation of a control system.

[0028] Figure 4 This is a flowchart illustrating an example of the operation of a control system.

[0029] Figure 5 This is a flowchart illustrating an example of the operation of a control system.

[0030] Figure 6 This is a flowchart illustrating an example of the operation of a control system.

[0031] Explanation of reference numerals in the attached figures:

[0032] 1…Control system, 2…Server, 3…Portable terminal (external device), 10…ECU, 11…1st ECU, 12…2nd ECU, 13…3rd ECU, 14…Alarm device, 21…TCU, 22…Horn, 23…Camera (photography unit), 24…Light ECU, 25…Hazard warning light, 31…Hood switch, 32…Door switch, 33…Internal door lock switch, 41…Communication line, 42…Communication line, 100…Management system, 110…Processor, 111…Program management unit (… 112… Detection Department, 115… Memory, 116… Control Program, 117… Device Information, 118… Reservation Information, 120… Processor, 121… Alarm Department, 122… Alarm Output Control Department, 125… Memory, 126… Control Program, 130… Processor, 131… Program Execution Department, 135… Memory, 136… Control Program, 137… Application Program, 141… Ultrasonic Sensor, 142… Buzzer, N… Communication Network, TG… Monitored Object, V… Vehicle. Detailed Implementation

[0033] Figure 1 This is a diagram illustrating the schematic structure of the management system 100.

[0034] The management system 100 includes a control system 1 that performs overall control and information processing of the vehicle V, and is a system capable of updating the programs executed by the various ECUs (Electronic Control Units) constituting the control system 1. The management system 100 includes the control system 1, a server 2, and a portable terminal 3.

[0035] Server 2 connects to control system 1 via communication network N.

[0036] A communication network N is a network composed of wired or wireless communication lines. For example, a communication network N includes cellular communication networks, Wi-Fi networks, Bluetooth, the Internet, WAN (Wide Area Network), LAN (Local Area Network), public lines, vendor equipment, dedicated lines, base stations, etc. Figure 1 The diagram illustrates a base station B included in the communication network N. The control system 1 performs cellular communication with the base station B using the TCU 21 described later, thereby performing data communication with external devices through the communication network N.

[0037] Control system 1 is a system installed in vehicle V, including various electronic devices present in vehicle V. For example, electronic devices refer to ECUs. Control system 1 performs various functions of vehicle V by comprehensively controlling multiple ECUs.

[0038] Control system 1 can download data from server 2 and use the downloaded data to update the ECU installation program and the program installed in the ECU. The data that control system 1 downloads from server 2 to update the program is called update data.

[0039] The management system 100 may have a different server than server 2. In this case, the control system 1 can download updated data from the different server. Furthermore, server 2 may be a single server computer, multiple server computers, or a cloud server.

[0040] Control system 1 has a TCU 21 (described later) as a communication unit. Control system 1 uses TCU 21 to communicate with server 2, thereby downloading update data from server 2. The process of downloading update data to control system 1 and using the update data to install and update programs is called OTA (Over The Air).

[0041] The control system 1 is connected to the portable terminal 3 via a communication network N in a manner capable of data communication. The portable terminal 3 is a portable computer used by the user of vehicle V. The portable terminal 3 can be, for example, a tablet computer, a laptop computer, or a smartphone. The control system 1 sends text messages, emails, voice data, etc., to the portable terminal 3 through data communication. The portable terminal 3 performs processing such as receiving text messages or emails sent from the control system 1 and displaying them on a screen, and receiving voice data sent from the control system 1 and outputting sound based on that voice data. The portable terminal 3 is an example of an external device.

[0042] Vehicle V can be any of the following: an electric vehicle powered by an electric motor, or a vehicle equipped with an internal combustion engine. The internal combustion engine can function as the power source to drive vehicle V. Alternatively, the vehicle V may have an internal combustion engine that drives a generator (not shown) to generate electricity from the power used to drive the motor.

[0043] In the following description, "vehicle V in a starting state" means that the internal combustion engine of vehicle V is in operation or can be started immediately, or that the motor of vehicle V can be started immediately. The starting state of vehicle V is generally known as the ignition-on state or the Ready state. "Vehicle V in a stopping state" means that the internal combustion engine or motor of vehicle V cannot be started immediately. The stopping state of vehicle V may be, for example, a state where starting the fuel supply system, etc., is required to start the internal combustion engine of vehicle V, or a state where starting an inverter circuit (not shown) installed in vehicle V is required to start the motor of vehicle V. The stopping state of vehicle V is also known as the ignition-off state.

[0044] Vehicle V has an operating unit (not shown) for starting and stopping vehicle V. This operating unit includes, for example, a user-operated SSSW (Start-Stop Switch) and a receiving unit that accepts instructions to start and / or stop vehicle V remotely. Users of vehicle V include, for example, the driver of vehicle V, the owner of vehicle V, but may also include persons other than the driver who use vehicle V. Starting vehicle V is, for example, an ignition-on operation, and stopping vehicle V is an ignition-off operation.

[0045] When the vehicle V is running, the control system 1 is in the ON state. In the ON state, power is supplied to most of the functional units constituting the control system 1 as described later, and these functional units operate.

[0046] When the vehicle V is stationary, the control system 1 is in a closed state. In this closed state, some of the functional components of the control system 1 are de-energized, while others are maintained and operate. In this embodiment, the control system 1 performs safety functions while the vehicle V is stationary. When the control system 1 detects an anomaly during the execution of these safety functions, it outputs an alarm. The anomaly detected by the control system 1 refers to an event that could lead to theft or damage to the vehicle V. An anomaly detected by the safety functions of the control system 1 corresponds to improper behavior towards the vehicle. Specifically, examples of anomalies detected by the safety functions of the control system 1 include situations where the doors of the vehicle V are opened inappropriately, unnatural vibrations are applied to the vehicle body, or attempts are made to start the vehicle V inappropriately. In this embodiment, the control system 1 can perform safety functions even when the vehicle V is stationary.

[0047] Furthermore, the control system 1 can also operate in an "on" state when the vehicle V is stationary. In this embodiment, the control system 1 can perform the installation program functions even when the vehicle V is stationary.

[0048] Figure 2 This is a block diagram showing the main structure of the control system 1.

[0049] like Figure 2 As shown, the control system 1 includes a first ECU 11, a second ECU 12, and a third ECU 13, which are referred to as ECU 10 without distinction. The first ECU 11 performs overall control and information processing of the vehicle V and controls the ECU 10 constituting the control system 1. The second ECU 12 is connected to the first ECU 11 via communication line 41, and the third ECU 13 is connected to the first ECU 11 via communication line 42. Communication lines 41, 42, and other communication lines of the control system 1 are composed of a bus for communication according to standards such as CAN and Ethernet (registered trademark), or communication lines for P2P (Peer to Peer) communication. These communication lines can be a single communication line, multiple communication lines for communication according to the same standard, or multiple communication lines for communication according to different standards.

[0050] The first ECU 11 functions as a gateway, managing the transmission and reception of communication data between communication lines 41 and 42. Furthermore, the first ECU 11 performs OTA management. OTA management includes processing the system 1 to download update data from the server 2, and controlling the installation or updating of programs on the ECU 10 using the downloaded update program.

[0051] The first ECU 11 is connected to a TCU (Telematics Control Unit) 21, a horn 22, and a camera 23. The TCU 21 is a wireless communication device based on the communication standards of a mobile communication system. The horn 22 sounds according to the operation of a horn switch (not shown) and the control of the first ECU 11. The camera 23 is a digital camera installed in the vehicle V to photograph the exterior of the vehicle V, and performs the photographing under the control of the first ECU 11. The first ECU 11 acquires the photographic image data from the camera 23. The camera 23 can be a monocular camera, a stereo camera, or a camera that uses light wavelengths outside the visible range to photograph. Furthermore, the camera 23 can include multiple cameras, including a camera that photographs the interior of the vehicle V. The camera 23 corresponds to one example of a photographic unit.

[0052] The second ECU 12 executes the safety functions of vehicle V. The third ECU 13 detects the state of vehicle V by acquiring detection values ​​from various sensors mounted on vehicle V. As an example of a sensor connected to the second ECU 12, Figure 2The diagram shows a hood switch 31, a door switch 32, and an interior door lock switch 33. These switches are switch-type sensors that detect the opening and closing states of the opening and closing mechanisms of the vehicle V. The hood switch 31 detects the opening and closing state of the vehicle V's hood. The door switch 32 detects the opening and closing state of the vehicle V's doors. The interior door lock switch 33 detects the locked state of the vehicle V's doors. Multiple door switches 32 and interior door lock switches 33 can be provided, corresponding to the doors and rear doors of the vehicle V.

[0053] A lamp-type ECU 24 is connected to the second ECU 12. The lamp-type ECU 24 has a processor connected to the lighting device of the vehicle V, and controls the lighting device by turning it on, flashing it, and turning it off. As an example of a lighting device controlled by the lamp-type ECU 24, Figure 2 Hazard warning light 25 is displayed.

[0054] Figure 2 The parts shown are a subset of the multiple ECUs constituting control system 1, and of the devices controlled by these ECUs, without impairing the functionality of control system 1. Figure 2 Structures not shown. For example, ECU 10 may include ECUs such as ICB (Infotainment control box), MPU (Map Positioning Unit), MVC-ECU (Multi View Camera), PKS-ECU (Parking Support), ADAS-ECU (Advanced Driver-Assistance System), or ECUs that control the operation of various other devices and sensors present in the vehicle V. These devices and sensors may include actuators such as the vehicle's drive motor, accelerator, and brakes, VSA (Vehicle Stability Assist) devices, battery, window motors for driving doors and windows, actuators for driving door lock mechanisms, temperature sensors, etc. Furthermore, ECU 10 may connect to V2X (Vehicle to Everything) communication devices, GNSS (Global Navigation Satellite System) sensors, touch panels, displays, speakers, etc. Figure 2The functions of ECU 11, ECU 12, and ECU 13 are one example. These functions can be installed in more ECUs or in a single ECU. Furthermore, the connection methods between ECUs 10 and between ECUs 10 and various devices are also an example; of course, it is also possible to configure each device to connect to... Figure 2 Different ECU 10 connection structures.

[0055] In control system 1, the first ECU 11 has a processor 110 and a memory 115. The processor 110 is, for example, a CPU (Central Processing Unit), an MCU (Micro Controller Unit), or an MPU (Micro Processor Unit). The memory 115 non-volatilely stores the program executed by the processor 110 and the data processed by the processor 110. The memory 115 is, for example, a ROM (Read Only Memory). The memory 115 may have RAM (Random Access Memory) forming a working area for temporarily storing programs and data. The first ECU 11 may be constructed as an integrated circuit that integrates the processor 110 and the memory 115. Alternatively, the first ECU 11 may have a structure with the processor 110, memory 115, and other circuitry as separate hardware components.

[0056] The memory 115 stores the control program 116, device information 117, and reservation information 118.

[0057] The processor 110 controls the various parts of the first ECU 11 and the devices constituting the control system 1 by executing the control program 116. As a functional unit related to the application program executed by the ECU included in the control system 1, the processor 110 has a program management unit 111 and a detection unit 112.

[0058] The program management unit 111 manages the installation and execution of programs in the control system 1. The ECU 10, which constitutes the control system 1, has a program for controlling devices mounted on the vehicle V; the device is controlled by executing the program. This program is called firmware, middleware, or control program. The program managed by the program management unit 111 is a type of software. The program management unit 111 corresponds to an example of a software update unit.

[0059] The program managed by the program management unit 111 can be any program, including firmware, middleware, control programs, and applications. In this embodiment, as an example, the case where the program management unit 111 manages an application will be described. This application is provided by the manufacturer or dealer of vehicle V, and is downloaded to vehicle V from server 2 managed by that dealer via communication network N. The program managed by the program management unit 111 can also be downloaded to vehicle V from a diagnostic device (not shown) installed in a dealership or repair shop of vehicle V by connecting it to control system 1. Furthermore, the application can be developed or provided by a third party unrelated to the manufacturer or dealer of vehicle V.

[0060] The program management unit 111 determines the ECU 10 to be installed and updated. In the following description, program installation and updates will be collectively referred to as installation. The program management unit 111 communicates with the server 2 via the TCU 21, requesting updated data from the server 2 regarding the model, specifications, and version of the ECU 10 suitable for installation. The program management unit 111 downloads the updated data from the server 2 and installs the program according to the updated data. After installing the program, the program management unit 111 verifies the status of the installed program, and completes the installation after confirming that the installation was completed normally.

[0061] The detection unit 112 detects the various ECUs 10 included in the control system 1 and the various devices of the vehicle V controlled by the ECUs 10. For example, during the operation of the control system 1, the detection unit 112 detects the ECUs 10 and the various devices and updates the device information 117.

[0062] Device information 117 includes information relating to the ECU 10 constituting the control system 1 and the devices controlled by the ECU 10. Device information 117 may include, for example, information such as the model, specifications, and version of the program installed in each ECU 10.

[0063] The program management unit 111 accepts program installation reservations based on user actions. For example, the program management unit 111 checks the server 2 for the availability of new update data corresponding to the ECU 10 included in the control system 1. If new update data exists, the program management unit 111 notifies the user to expedite installation using a display or touch panel (not shown). When installation is instructed by a user, the program management unit 111 accepts the reservation based on that action. When a reservation is accepted while the vehicle V is running, the program management unit 111 generates or updates reservation information 118. Reservation information 118, for example, specifies that program installation will be performed after the vehicle V has stopped. Reservation information 118 includes information indicating the type of update data to be installed, the ECU 10 to be installed, etc. Upon accepting a reservation, the program management unit 111 can download the update data while the vehicle V is running or after the vehicle V has stopped.

[0064] The program management unit 111 can install programs while the vehicle V is running. In this case, the control system 1 installs the program after stopping the vehicle V, and then starts the vehicle V again after installation is complete. Furthermore, sometimes it is not necessary to stop the vehicle V for the installation process. For example, it is possible to install programs for performing image playback on the vehicle V without stopping it. In this case, the program management unit 111 maintains the running state of the vehicle V and directly installs the program.

[0065] The second ECU 12 has a processor 120 and a memory 125. The processor 120 is, for example, a CPU, an MCU, or an MPU. The memory 125 non-volatilely stores the program executed by the processor 120 and the data processed by the processor 120. The memory 125 is, for example, a ROM. The memory 125 may have RAM forming a working area for temporarily storing programs and data. The second ECU 12 may be constructed as an integrated circuit that integrates the processor 120 and the memory 125. Alternatively, the second ECU 12 may also have a structure with the processor 120, memory 125, and other circuitry as separate hardware components.

[0066] Memory 125 stores control program 126.

[0067] The processor 120 functions as the alarm unit 121 and the alarm output control unit 122 by executing the control program 126.

[0068] The alarm unit 121 performs the monitoring function of vehicle V. The monitoring function of the alarm unit 121 is equivalent to the safety function of vehicle V. The monitoring function is to detect abnormalities in vehicle V and output an alarm when vehicle V is stationary. When vehicle V stops, the alarm unit 121 begins to execute the monitoring function. The control system 1 can be configured such that the monitoring function performed by the alarm unit 121 is not executed if the monitoring function is deactivated by user operation.

[0069] The alarm unit 121 monitors the status of monitored objects in the devices of the vehicle V. The monitored objects of the alarm unit 121 can be any of the ECU 10 included in the control system 1, or any device connected to the ECU 10. In this embodiment, the monitored objects TG of the alarm unit 121 are the hood switch 31, the door switch 32, and the interior door lock switch 33, as an example. In this case, the alarm unit 121 detects an abnormality in the vehicle V when the hood or door of the vehicle V is opened by an inappropriate method, or when the lock of the door of the vehicle V is released by an inappropriate method.

[0070] The alarm unit 121 determines the state of vehicle V and, if it determines that the state requires monitoring, performs a monitoring operation. For example, the state requiring monitoring is when vehicle V is stationary.

[0071] The alarm unit 121 detects the status of the monitored object TG during monitoring operations. Based on the status of the monitored object TG, the alarm unit 121 detects an anomaly in vehicle V. Upon detecting an anomaly in vehicle V, the alarm unit 121 outputs an alarm. The alarm output can be, for example, by sounding the horn 22. In this case, the alarm unit 121 outputs a signal to the first ECU 11 requesting that the horn 22 sound. The alarm output can also be by flashing the hazard warning lights 25. In this case, the alarm unit 121 outputs a signal to the third ECU 13 requesting that the hazard warning lights 25 flash. The alarm output can also be by sending a text message or email to the portable terminal 3. In this case, the alarm unit 121 can output a signal to the first ECU 11 requesting that a text message or email be sent to the portable terminal 3 via the TCU 21.

[0072] The alarm output control unit 122 restricts the output of alarms issued by the alarm unit 121. When the program is installed by the program management unit 111, the alarm output control unit 122 restricts the output of alarms for the ECU 10 that is monitored by the alarm unit 121, or for the ECU 10 that controls the device monitored by the alarm unit 121.

[0073] The alarm output restriction performed by the alarm output control unit 122 may include, for example, prohibiting or stopping the alarm output performed by the alarm unit 121. Prohibiting the alarm output means prohibiting the start of the alarm output, and stopping the alarm output includes: the alarm unit 121 stopping the alarm output during the execution of the monitoring function; and / or stopping the monitoring function.

[0074] The restrictions imposed by the alarm output control unit 122 may partially limit the function of the alarm unit 121. Specifically, the restrictions imposed by the alarm output control unit 122 may be as follows: prohibiting or stopping the alarm unit 121 from outputting through the horn 22 and through the TCU 21, but not restricting the alarm unit 121 from outputting through the hazard warning light 25. Furthermore, the restrictions imposed by the alarm output control unit 122 on alarm output may be to prohibit or stop the alarm unit 121 from performing monitoring operations.

[0075] The third ECU 13 has a processor 130 and a memory 135. The processor 130 is, for example, a CPU, an MCU, or an MPU. The memory 135 non-volatilely stores the program executed by the processor 130 and the data processed by the processor 130. The memory 135 is, for example, a ROM. The memory 135 may have RAM forming a working area for temporarily storing programs and data. The third ECU 13 may be constructed as an integrated circuit that integrates the processor 130 and the memory 135. Alternatively, the third ECU 13 may also have a structure with the processor 130, memory 135, and other circuitry as separate hardware components.

[0076] The memory 135 stores the control program 136 and the application program 137. The processor 130, by executing the control program 136, constitutes a platform for executing the application program 137. This platform is equivalent to the program execution unit 131. That is, the processor 130 becomes capable of executing the application program 137 by executing the control program 136.

[0077] The third ECU 13 controls the devices connected to it by executing application program 137. For example, when a touch panel (not shown), a speaker, and the third ECU 13 are connected, the third ECU 13 executes application program 137 to perform functions such as reproducing video content, reproducing music, and hands-free calling.

[0078] The control system 1 may include an alarm device 14. The alarm device 14 includes an ultrasonic sensor 141 and a buzzer 142. The ultrasonic sensor 141 is a sensor that detects the movement of objects inside the passenger compartment of the vehicle V. The ultrasonic sensor 141 detects moving objects, including people. When instructed to begin alarm operation by the ECU 10, the ultrasonic sensor 141 performs an alarm action according to the instruction. When movement of an object is detected during the alarm action, the ultrasonic sensor 141 causes the buzzer 142 to sound. In this embodiment, the alarm device 14 begins the alarm action under the control of the first ECU 11. The alarm device 14 can perform the alarm action independently of the alarm unit 121. For example, the alarm device 14 can perform the alarm action even when the alarm output is restricted by the alarm output control unit 122. Similar to the monitoring function performed by the alarm unit 121, the alarm action of the alarm device 14 is a safety function of the vehicle V.

[0079] Figure 3 , Figure 4 , Figure 5 as well as Figure 6 This is a flowchart illustrating an example of the operation of control system 1. Figures 3-6 The actions shown are those of the system 1 installation procedure, and in particular, an example of the installation procedure is shown when the vehicle V is stationary.

[0080] The control system 1 is equipped with a monitoring function performed by the second ECU 12. Through this monitoring function, abnormalities of the vehicle V when it is parked are detected and an alarm is output. Figures 3-6 This shows an example of the installation program's operation when it is set to perform the monitoring function by the alarm unit 121. Figure 3 Steps S11 to S15 and S22 are executed by the program management unit 111. Steps S16 to S21 and S23 are executed by the alarm output control unit 122.

[0081] Figure 3 The action is taken when the installation of the program is scheduled through the reservation information 118.

[0082] When the system detects that the vehicle V has stopped through user operation (step S11), the control system 1 begins monitoring operations performed by the alarm unit 121 (step S12). Next, the control system 1 refers to the reservation information 118 (step S13). In step S13, for example, the control system 1 determines the ECU 10, which is the object of the installation program, and the program to be installed.

[0083] The control system 1 determines whether the ECU 10 to be installed is the ECU 10 related to the monitored object TG of the alarm unit 121 (step S14). Figure 2In the illustrated structural example, the monitored object TG is connected to the third ECU 13. In this structure, the third ECU 13 corresponds to the ECU 10 associated with the monitored object TG.

[0084] If the control system 1 determines that the ECU 10 to be installed is not an ECU 10 related to the monitored object TG of the alarm unit 121 (step S14; no), the update process is performed (step S15), and the process ends. In this case, the vehicle V remains stationary, and the monitoring actions performed by the alarm unit 121 are executed.

[0085] If the ECU 10 to be installed is determined to be an ECU 10 related to the monitored object TG of the alarm unit 121 (step S14; Yes), the control system 1 begins monitoring based on the photographed image of the camera 23 (step S16). The control system 1 acquires the photographed image of the camera 23 and determines whether there is a person around the vehicle V (step S17). Step S17 is, for example, the following process: analyzing the photographed image of the camera 23 and determining whether a person is captured in the photographed image.

[0086] If the control system determines that there is no one around the vehicle V (step S17; no), the process proceeds to step S20, which will be described later.

[0087] If it is determined that there is someone around the vehicle V (step S17; Yes), the control system 1 determines whether the person detected in the photographic image is approaching the vehicle V (step S18). Step S18 is, for example, as follows: comparing the position of the detected person in multiple photographic images captured by the camera 23 at different times, thereby determining whether the person captured in the photographic image is moving towards the vehicle V.

[0088] If it is determined that the person detected in the photographic image is not approaching the vehicle V (step S18; no), the control system 1 proceeds to step S20.

[0089] If it is determined that a person detected in the photographed image is approaching the vehicle V (step S18; Yes), the control system 1 determines whether the person detected in the photographed image is a user of the vehicle V (step S19). Step S19, for example, involves determining whether the face, etc., of the person detected in the photographed image of the camera 23 is similar to or consistent with the face, etc., of a user pre-registered in the control system 1. To perform this process, users of the vehicle V are pre-registered in the control system 1. Specifically, information such as features of the image representing the user's face, etc., is stored in the first ECU 11.

[0090] If it is determined that the person detected in the photographic image is not the user of vehicle V (step S19; no), the control system 1 returns to step S17.

[0091] If it is determined that the person detected in the photographic image is the user of vehicle V (step S19; Yes), control system 1 proceeds to step S20 and begins the monitoring installation process (step S20). For details on the monitoring installation process, please refer to [link / reference] later. Figure 5 To describe.

[0092] After the installation monitoring process begins, the control system 1 begins to limit the alarm outputs made by the alarm unit 121 (step S21).

[0093] After the control system 1 implements the restrictions imposed by the alarm output control unit 122, it performs an update process (step S22).

[0094] After the update process is completed, the control system 1 removes the restriction on alarm output imposed by the alarm output control unit 122 (step S23) and ends the process.

[0095] Figure 4 Shown in Figure 3 The update process performed in steps S15 and S22. Figure 4 The action is executed by the Program Management Department 111.

[0096] Control system 1 requests server 2 to download update data (step S31). The update data requested by control system 1 is, for example, update data for installing the program of ECU 10 specified by reservation information 118.

[0097] Control system 1 downloads updated data from server 2 (step S32).

[0098] Control system 1 obtains the downloaded update data (step S33) and installs the program on ECU 10 based on the obtained update data (step S34). Then, to determine whether the program has been installed correctly, control system 1 verifies the installed program (step S35). After the program verification is complete, control system 1 ends the update process and returns to normal. Figure 3 The action.

[0099] Control system 1 can perform the update process before proceeding. Figure 4In steps S31 to S32 of the update process shown, update data is downloaded from server 2 in advance. For example, if the program management unit 111 generates or updates reservation information 118 in response to a reservation being received, it can execute steps S31 to S32 based on the generated or updated reservation information 118. These steps S31 to S32 can be executed while vehicle V is running, that is, before vehicle V stops. In this case, control system 1 only needs to... Figure 3 In steps S15 and S22, steps S33 to S35 can be executed.

[0100] Furthermore, the control system 1 can download multiple update data from the server 2 before performing the update process, based on the reservation information 118. In this case, in step S33, the control system 1 selects and obtains the update data corresponding to the ECU 10, which is the object of the installation program, from the downloaded update data.

[0101] Additionally, if an error is detected during program verification, control system 1 will either retry the program installation or output an error to terminate the installation and return the result. Figure 3 The action.

[0102] Figure 5 The installation monitoring process is shown. The installation monitoring process is related to... Figure 3 The update process performed in step S22 is executed in parallel by either the program management unit 111 or the alarm output control unit 122.

[0103] Control system 1 begins monitoring based on the photographic images captured by camera 23 (step S41). Control system 1 acquires the photographic images captured by camera 23 and determines whether there are people around vehicle V (step S42). Step S42 is, for example, the same process as step S17.

[0104] If it is determined that there is no one around vehicle V (step S42; no), the control system 1 proceeds to step S45 as described below.

[0105] If it is determined that there is someone around vehicle V (step S42; yes), the control system 1 determines whether the person detected from the photographic image is approaching vehicle V (step S43). Step S43 is, for example, the same process as step S18.

[0106] If it is determined that the person detected in the photographic image is not approaching vehicle V (step S43; No), the control system 1 proceeds to step S45. If it is determined that the person detected in the photographic image is approaching vehicle V (step S43; Yes), the control system 1 determines whether the person detected in the photographic image is a user of vehicle V (step S44). Step S44 is, for example, the same process as step S19.

[0107] If it is determined that the person detected from the photographic image is not the user of vehicle V (step S44; no), the control system 1 interrupts the ongoing update process (step S46). Next, the control system 1 releases the restriction on alarm output performed by the alarm output control unit 122 (step S47) and ends the process. The process of interrupting the update process can be executed as a so-called interruption process. In the case of interrupting the update process, the control system 1 may output an error and end the operation, or it may transfer to another operation. Figure 3 Step S16.

[0108] If it is determined that the person detected in the photographic image is the user of vehicle V (step S44; Yes), the control system 1 proceeds to step S45. In step S45, the control system 1 determines whether the update process has ended (step S45). If it is determined that the update process has not ended (step S45; No), the control system 1 returns to step S42. If it is determined that the update process has ended (step S45; Yes), the control system 1 ends this process.

[0109] Figure 6 Showing with Figure 3 Different action examples. Alternatives in Figure 3 The monitoring of images captured by camera 23, performed in steps S16 to S19, and the installation monitoring processing in step S20, are followed by the actions in steps S51 and S52. Steps S51 and S52 are executed by the program management unit 111 or the alarm output control unit 122. Figure 6 In the middle, to and Figure 3 The same process is assigned the same step number, and the description is omitted.

[0110] When the control system 1 determines in step S14 that the ECU 10 to be installed is related to the monitored object TG (step S14; Yes), it begins monitoring based on the alternative alarm function (step S51). The alternative alarm function refers to the function of detecting abnormalities in the vehicle V and outputting an alarm instead of the alarm unit 121. For example, the function of the alarm device 14 detecting an abnormality by the ultrasonic sensor 141 and announcing it by the buzzer 142 is equivalent to this alternative alarm function. In this embodiment, in step S51, the control system 1 begins monitoring performed by the alarm device 14. Thus, monitoring of the vehicle V by the ultrasonic sensor 141 is performed.

[0111] Then, the control system 1 executes steps S21 to S23. After the restriction on the alarm output of the alarm unit 121 is lifted in step S23, the monitoring that started in step S51 is stopped (step S52).

[0112] In this way, the control system 1 can monitor the vehicle V using the monitoring function of the alarm unit 121, and limit the alarm output when installing an ECU 10 related to the monitored object TG. During the installation of an ECU 10, events such as ECU 10 restarting, control program reloading, interruption of detection using sensors connected to the ECU 10, and interruption of communication with other ECUs 10 may occur. If these events occur, an anomaly may be detected by the monitoring function, potentially leading to false alarm output, i.e., false alarms. According to the control system 1 of this embodiment, by limiting the alarm output, false alarms during ECU 10 installation can be prevented.

[0113] exist Figure 3 In the operation, before restricting alarm output, a judgment is made based on the photographic image from camera 23, and the control system 1 determines whether there is a risk of vehicle V being stolen or damaged. Then, if it is determined that there is a risk of vehicle V being stolen or damaged, the alarm output restriction is not initiated, thus maintaining the safety performance of vehicle V. Furthermore, during the period of restricting alarm output, by executing... Figure 5 The installation monitoring process shown maintains the safety performance of vehicle V even during program installation. Furthermore, when vehicle V is equipped with a different safety function than alarm unit 121, this safety function can also be used to monitor the installation process. Therefore, it is possible to maintain the safety performance of vehicle V while preventing false alarm outputs during installation.

[0114] exist Figure 6 In the example of the action, the alarm device 14 is used for Figure 3 Examples of the actions have been described, but for example, alarm device 14 can be used for Figure 5Installation monitoring and processing. That is, it can replace... Figure 5 Steps S41 to S44 are executed to perform a warning action by the ultrasonic sensor 141. In this case, if the ultrasonic sensor 141 detects an abnormality, steps S46 to S47 are executed to interrupt the installation performed by the program management unit 111.

[0115] The above embodiments illustrate a specific example of the application of the present invention, but are not intended to limit the way the present invention is applied.

[0116] The above embodiments are described Figures 3-6 The actions shown can also be applied to situations where the program management unit 111 installs programs on multiple ECUs 10. Specifically, multiple ECUs 10 can be executed in parallel. Figure 3 or Figure 6 The operation of the alarm output control unit 122 is as follows: In this case, during the installation of the third ECU 13, the alarm output by the alarm unit 121 for the monitored object TG is limited. In contrast, in the case of the installation of the second ECU 12, the alarm output by the alarm unit 121 is not limited. When the installation of the program for the second ECU 12 and the installation of the program for the third ECU 13 are performed in parallel, the alarm output control unit 122 can be configured to limit the alarm output by the alarm unit 121 for the monitored object TG associated with the third ECU 13, while not limiting the alarm output when improper behavior is detected by other devices. In this example, the third ECU 13 corresponds to an example of the first electronic device, and the second ECU 12 corresponds to an example of the second electronic device.

[0117] In the above embodiment, an example of installing an application for the third ECU 13 by means of a program management unit 111 in the first ECU 11 of the ECU 10 constituting the control system 1 has been described. This structure is one example; the program management unit 111 can install applications for the first ECU 11 itself, or for other ECUs 10. Furthermore, it could also be a structure capable of installing applications for the alarm device 14 and the lamp ECU 24.

[0118] In the above embodiment, the operation was described in the case where the installation of the program is scheduled while the vehicle V is running, and then the vehicle V stops. However, the execution... Figures 3-6 The opportunities for the actions shown are not limited to this. For example, control system 1 can perform actions when the vehicle V is stationary, provided that the user has initiated an operation or the server 2 has instructed the program to be updated. Figures 3-6 The actions shown.

[0119] In the above embodiments, an example of using alarm device 14 as an alternative alarm function has been described, but the alternative alarm function of the control system 1 is not limited to the structure of alarm device 14. For example, the control system 1 may include an alarm device with a vibration sensor or an alarm device using a sensor that detects contact with the vehicle body of the vehicle V.

[0120] In the above embodiment, an example was described in which the monitored object TG of the alarm unit 121 is set as the hood switch 31, the door switch 32, and the interior door lock switch 33. This is just one example; the monitored object TG can be any device, as long as it is an ECU 10 or other device in the control system 1, and there are no restrictions on the type or number of monitored objects TG.

[0121] Figure 1 and Figure 2 The following schematic diagram is shown for ease of understanding of the present invention. This schematic diagram illustrates the functional structure of each device of the management system 100 by distinguishing the main processing contents. Figure 1 and Figure 2 The structure of the device is not limited. Figures 3-6 Each of the processes shown can be executed by one program or by multiple programs.

[0122] Furthermore, the vehicle V is, for example, a four-wheeled vehicle. There is no particular limitation on the type of vehicle V; it can be a large car, a commercial vehicle, a two-wheeled vehicle, a three-wheeled vehicle, etc. In addition, the structure of each part in the control system 1 can be arbitrarily changed.

[0123] [Structures supported by the above embodiments]

[0124] The above implementation supports the following structure.

[0125] (Structure 1)

[0126] A control device includes: an alarm unit that performs a monitoring function to detect inappropriate behavior toward a vehicle and outputs an alarm via an alarm output unit when the inappropriate behavior is detected by the monitoring function; a software update unit that updates the software of an electronic device mounted in the vehicle; and an alarm output control unit that restricts the output of the alarm when the software of the electronic device is updated by the software update unit.

[0127] According to the control device of Structure 1, false alarms caused by the vehicle's monitoring function can be prevented, and the software of the electronic equipment installed in the vehicle can be updated. This increases the opportunity to improve vehicle functionality through software updates, contributing to the development of sustainable transportation systems.

[0128] (Structure 2) According to the control device described in Structure 1, the software update unit updates the software of the electronic device after the restriction of the alarm output control unit begins.

[0129] According to the control device of structure 2, false alarms caused by the monitoring function can be prevented more reliably.

[0130] (Structure 3) According to the control device described in Structure 1 or Structure 2, after the software update unit completes the software update of the electronic device, the alarm output control unit removes the restriction on the output of the alarm.

[0131] According to the control device of structure 3, the vehicle monitoring function can be performed without the possibility of false alarm output, thereby protecting the vehicle more reliably.

[0132] (Structure 4) According to any one of Structures 1 to 3, when a software update of the electronic device is scheduled to be performed by the software update unit while the monitoring function of the alarm unit is not being executed, the alarm output control unit restricts the start of the monitoring function until the software update of the electronic device is completed.

[0133] According to the control device of structure 4, the monitoring function is not started when a software update is scheduled, thus preventing false alarm output caused by the software update.

[0134] (Structure 5) The control device according to any one of Structures 1 to 4, wherein the control device has a camera unit for taking pictures of the exterior of the vehicle, and the alarm output control unit uses the pictures taken by the camera unit to detect people when the output of the alarm is restricted, and restricts the output of the alarm by the alarm unit when there are no people near the vehicle.

[0135] According to the control device of structure 5, after confirming with photographic images that the possibility of improper behavior against the vehicle is low, the output of the alarm is limited, thus maintaining the vehicle's safety performance during the period when the alarm output is limited.

[0136] (Structure 6) According to the control device described in Structure 5, the alarm output control unit determines whether the person detected by the photographic image of the camera unit is approaching the vehicle. If the person is approaching the vehicle, the software update of the electronic device performed by the software update unit is stopped, and the restriction on the output of the alarm is lifted.

[0137] According to the control device of structure 6, it is possible to more reliably confirm situations where the possibility of improper behavior towards the vehicle is low based on photographic images.

[0138] (Structure 7) According to the control device described in Structure 5 or Structure 6, the alarm output control unit determines whether the person detected by the photographic image of the camera unit is a legitimate user of the vehicle, and if the person is a legitimate user of the vehicle, it restricts the output of the alarm by the alarm unit.

[0139] According to the control device of structure 7, the vehicle user can be excluded from the object of the warning, thus protecting the vehicle while improving convenience.

[0140] (Structure 8) According to any one of Structures 1 to 7, when an inappropriate behavior against the vehicle is detected after the software update unit starts updating the software of the electronic device, the alarm output control unit causes the software update of the electronic device to be stopped and the restriction on the output of the alarm to be lifted.

[0141] According to the control device of structure 8, when inappropriate behavior against the vehicle is detected during software updates, the restriction on alarm output is lifted, thus enabling alarm output. Therefore, the vehicle can be protected even during software updates that restrict alarm output.

[0142] (Structure 9) The control device according to any one of Structures 1 to 8, wherein the electronic device includes a first electronic device and a second electronic device, wherein the alarm output control unit, when the software of the first electronic device is updated by the software update unit, restricts the output of the alarm when improper behavior is detected by the monitoring function for the first electronic device, and does not restrict the output of the alarm when improper behavior is detected by the monitoring function for the second electronic device.

[0143] According to the control device of structure 9, when updating the software of electronic devices that will not affect the monitoring function due to software updates, the output of alarms is not restricted, thereby maintaining the safety performance of the vehicle.

[0144] (Structure 10) The control device according to any one of Structures 1 to 9, wherein the alarm output unit includes a communication device connected to a designated external device via a communication line, and the alarm unit sends an alarm message to the external device via the communication device when the improper behavior is detected by the monitoring function.

[0145] According to the control device of structure 10, as an action to output an alarm, it is possible to send alarm information to an external device. This allows for notification of inappropriate behavior towards the vehicle to users located far from the vehicle.

[0146] (Structure 11) A control method comprising the steps of: performing a monitoring function to detect improper behavior of a vehicle; outputting an alarm via an alarm output unit when the improper behavior is detected by the monitoring function; and limiting the output of the alarm when the software of an electronic device mounted on the vehicle is updated via a software update unit.

[0147] According to the control method of structure 11, false alarm outputs caused by the vehicle's monitoring function can be prevented, and the software of the electronic equipment installed in the vehicle can be updated. This increases the opportunity to improve vehicle functionality through software updates, contributing to the development of sustainable transportation systems.

Claims

1. A control device, wherein, The control device has: The alarm unit performs a monitoring function to detect improper behavior toward the vehicle, and outputs an alarm through the alarm output unit when the improper behavior is detected by the monitoring function. The software update unit updates the software of the electronic devices installed in the vehicle. as well as The alarm output control unit limits the output of alarms when the software of the electronic device is updated via the software update unit. The electronic device includes a first electronic device and a second electronic device. When the software update unit updates the software of the first electronic device, the alarm output control unit restricts the output of the alarm when inappropriate behavior is detected by the monitoring function on the first electronic device, but does not restrict the output of the alarm when inappropriate behavior is detected by the monitoring function on the second electronic device. If, after the software update unit begins updating the software of the electronic device, inappropriate behavior toward the vehicle is detected, the alarm output control unit causes the software update of the electronic device to be stopped and the restriction on the alarm output to be lifted.

2. The control device according to claim 1, wherein, The software update unit updates the software of the electronic device after the restriction imposed by the alarm output control unit is initiated.

3. The control device according to claim 1, wherein, After the software update unit completes the software update of the electronic device, the alarm output control unit removes the restriction on the output of the alarm.

4. The control device according to claim 1, wherein, If a software update for the electronic device is scheduled by the software update unit when the monitoring function of the alarm unit is not being performed, the alarm output control unit restricts the start of the monitoring function until the software update of the electronic device is completed.

5. The control device according to claim 1, wherein, The control device includes a camera unit for taking pictures of the exterior of the vehicle. The alarm output control unit uses photographic images from the camera unit to detect people when the alarm output is restricted. When no people are present near the vehicle, the alarm output by the alarm unit is restricted.

6. The control device according to claim 5, wherein, The alarm output control unit determines whether the person detected by the photographic image from the camera unit is approaching the vehicle. If the person is approaching the vehicle, the software update of the electronic device performed by the software update unit is stopped, and the restriction on the alarm output is lifted.

7. The control device according to claim 5, wherein, The alarm output control unit determines whether the person detected by the photographic image from the camera unit is a legitimate user of the vehicle. If the person is a legitimate user of the vehicle, the alarm output by the alarm unit is restricted.

8. The control device according to claim 1, wherein, The alarm output unit includes a communication device that is connected to a designated external device via a communication line. When the alarm unit detects the improper behavior through the monitoring function, it sends an alarm message to the external device through the communication device.

9. A control method, wherein, The control method includes the following steps: Perform monitoring functions to detect improper behavior of vehicles; If the improper behavior is detected by the monitoring function, an alarm is output via the alarm output unit; and When the software of the electronic devices installed in the vehicle is updated via the software update unit, the output of the alarm is restricted. The electronic device includes a first electronic device and a second electronic device. When the software of the first electronic device is updated by the software update unit, the output of the alarm when inappropriate behavior is detected by the monitoring function is limited for the first electronic device, while the output of the alarm when inappropriate behavior is detected by the monitoring function is not limited for the second electronic device. If, after the software update unit has started updating the software of the electronic device, inappropriate behavior toward the vehicle is detected, the software update of the electronic device is stopped, and the restriction on the output of the alarm is lifted.

Images