Charging control method, charging control device, and program

Abstract

The charging control method is used in a charging control device, the charging control device is connected with charging equipment in a communication mode, the charging equipment is provided with a power supply device used for charging an electric vehicle, and in the charging control method, the charging control device is connected with the charging equipment in a communication mode. On the basis of software information including at least firmware information of at least one electronic control device mounted in the electric vehicle, the presence or absence of a security risk in the charging function of the electric vehicle caused by firmware of the at least one electronic control device is determined, and whether the security risk of the charging equipment can be avoided by degrading the function of the power supply device is determined. And a control unit that determines a degradation mode for degrading the function of the power supply device on the basis of the determination result of the second determination when there is a risk of safety as the determination result of the first determination, and controls the power supply of the power supply device to the electric vehicle in the determined degradation mode.

Description

Technical Field

[0001] This disclosure relates to charging control methods, charging control devices, and procedures. Background Technology

[0002] Previously, a technology was known to protect multiple onboard computers, such as the ECU (Electronic Control Unit) used to control a vehicle, from security risks that could affect vehicle control, such as abnormal (improper, inappropriate) communication.

[0003] Existing technical documents

[0004] Patent Document 1: Japanese Patent Application Publication No. 2018-133721

[0005] Patent Document 2: Japanese Patent Application Publication No. 2022-037442 Summary of the Invention

[0006] The problem the invention aims to solve

[0007] In this scenario, vehicles such as electric cars, which are powered by electricity from batteries, connect to charging equipment via charging cables. Furthermore, there are cases where charging control is achieved through communication via the charging cables. Therefore, if there are security risks associated with the onboard computer, the charging equipment could also be affected.

[0008] One of the issues this disclosure aims to address is protecting charging equipment connected to electric vehicles from safety risks posed by the electric vehicles when they are powered.

[0009] means for solving problems

[0010] The charging control method disclosed herein is a charging control method used in a charging control device. The charging device and the charging equipment are connected in a communicable manner. The charging equipment has: a power supply device for charging an electric vehicle, and a communication network connected to the power supply device. In the charging control method, based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle, the following steps are performed: a first determination, determining whether there is a safety risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; a second determination, determining whether the charging equipment can avoid the safety risk by degrading (reducing, downgrading) the function of the power supply device. If the determination result of the first determination is that there is a safety risk, based on the determination result of the second determination, a degradation mode for degrading the function of the power supply device is determined, and the power supply device is controlled to supply power to the electric vehicle in accordance with the determined degradation mode.

[0011] Invention Effects

[0012] According to this disclosure, charging equipment connected to an electric vehicle can be protected from safety risks caused by the electric vehicle when power is supplied. Attached Figure Description

[0013] Figure 1 This is a diagram showing an example of the configuration of the charging system according to the first embodiment.

[0014] Figure 2 This is a diagram showing an example of the configuration of the charging device according to the first embodiment.

[0015] Figure 3 This is a diagram illustrating an example of the configuration of the charging station management terminal according to the first embodiment.

[0016] Figure 4 This is a diagram illustrating an example of the configuration of the charging station management server according to the first embodiment.

[0017] Figure 5 This is a diagram showing an example of the configuration of the charging control unit in the first embodiment.

[0018] Figure 6 This is a diagram showing an example of the configuration of the electric vehicle according to the first embodiment.

[0019] Figure 7 This is a diagram illustrating an example of the configuration of the vehicle management server according to the first embodiment.

[0020] Figure 8 This is a diagram illustrating an example of vehicle software configuration information according to the first embodiment.

[0021] Figure 9 This is a diagram illustrating an example of vehicle management information in the first embodiment.

[0022] Figure 10A This is a flowchart illustrating an example of power supply processing performed in the charging control unit of the first embodiment when vehicle detection is set to trigger.

[0023] Figure 10B This is a flowchart illustrating an example of the power supply process performed in the charging control unit of the first embodiment when the vehicle detection is triggered.

[0024] Figure 11 This is a flowchart illustrating an example of a verification process performed in the charging control unit of the first embodiment for reconnecting the power supply device to the device communication network.

[0025] Figure 12This is a timing diagram showing an example of the power supply processing performed in the charging system of the first embodiment when vehicle detection is set to trigger.

[0026] Figure 13 This is a timing diagram illustrating an example of a verification process performed in the charging system of the first embodiment for reconnecting the power supply device to the device communication network.

[0027] Figure 14 This is a diagram showing an example of the configuration of the charging system according to the second embodiment.

[0028] Figure 15 This is a flowchart illustrating an example of power supply processing performed in the charging control unit and reservation management unit of the third embodiment when a charging reservation is set to trigger.

[0029] Figure 16 This is a timing diagram illustrating an example of power supply processing performed in the charging system of the third embodiment when a charging reservation is set to trigger.

[0030] Figure 17 This is a diagram showing an example of the configuration of the charging device according to the fourth embodiment.

[0031] Figure 18 This is a diagram showing an example of the configuration of the charging control unit in the fourth embodiment.

[0032] Figure 19 This is a diagram illustrating an example of vehicle software configuration information according to the fourth embodiment.

[0033] Figure 20 This is a diagram illustrating an example of vehicle management information in the fourth embodiment.

[0034] Figure 21 This diagram illustrates an example of the corresponding function of the ECU related to autonomous driving control in the fourth embodiment.

[0035] Figure 22 This diagram illustrates an example of the corresponding function of the ECU related to manual driving control in the fourth embodiment.

[0036] Figure 23 This is a flowchart illustrating an example of power supply processing performed in the charging control unit of the fourth embodiment when vehicle detection is set to trigger.

[0037] Figure 24 This is a timing diagram illustrating an example of power supply processing performed in the charging system of the fourth embodiment when vehicle detection is set to trigger.

[0038] Figure 25This is a flowchart illustrating an example of power supply processing performed in the charging control unit and reservation management unit of the fifth embodiment when a charging reservation is set to trigger.

[0039] Figure 26 This is a timing diagram illustrating an example of power supply processing performed in the charging system of the fifth embodiment when a charging reservation is set to trigger. Detailed Implementation

[0040] Hereinafter, with reference to the accompanying drawings, various embodiments of the charging system, charging control method, charging control device, program, and recording medium of this disclosure will be described.

[0041] Furthermore, in the description of this disclosure, sometimes the same reference numerals are used for components that have the same or substantially the same function as those described in the foregoing figures, and descriptions are appropriately omitted. Additionally, even when representing the same or substantially the same parts, the dimensions and ratios may vary depending on the figure. Furthermore, for example, from the viewpoint of ensuring the visibility of the figures, sometimes only reference numerals are used for the main components in the description of each figure, while reference numerals are not used for components that have the same or substantially the same function as those described in the foregoing figures.

[0042] Furthermore, in the description of this disclosure, constituent elements having the same or substantially the same function are sometimes distinguished by adding alphanumeric characters to the end of the reference numerals. Alternatively, when multiple constituent elements having the same or substantially the same function are not distinguished, the alphanumeric characters appended to the end of the reference numerals are sometimes omitted for uniform description.

[0043] (First Embodiment)

[0044] Previously, a technology was known to protect multiple onboard computers, such as the ECU (Electronic Control Unit) used to control a vehicle, from security risks that could affect vehicle control, such as abnormal communication.

[0045] In this scenario, vehicles such as electric cars, which are powered by batteries, connect to charging equipment via charging cables. Additionally, charging control is sometimes achieved through communication via the charging cables. Therefore, if there are security risks associated with the onboard computer, the charging equipment could also be affected.

[0046] Therefore, in this embodiment, a charging system that can protect charging equipment connected to an electric vehicle from safety risks caused by the electric vehicle when powered is described.

[0047] Figure 1This diagram illustrates an example of the configuration of the charging system 1a according to the first embodiment. The charging system 1a includes: a charging device 3, a charging station management server 4, an electric vehicle 5, and a vehicle management server 6. Here, the charging system 1a of the first embodiment is an example of the charging system 1 of the embodiments of this disclosure.

[0048] The charging equipment 3, the charging station management server 4, the electric vehicle 5, and the vehicle management server 6 are each connected to the external network N in a manner that enables communication.

[0049] The charging device 3 is configured to supply power to the battery of the electric vehicle 5. The charging device 3 is installed at a charging station to provide charging services to electric vehicles 5 visiting the station. In other words, in this disclosure, a charging station refers to a facility equipped with the charging device 3, capable of charging visiting electric vehicles 5. This charging station can be a dedicated facility for charging electric vehicles 5, or it can be a facility in a parking lot or other facility where electric vehicles 5 can park, and equipped with the charging device 3.

[0050] Figure 2 This diagram illustrates an example of the configuration of the charging device 3 according to the first embodiment. The charging device 3 includes a charging station management terminal 31 and multiple power supply devices 32.

[0051] Figure 2 In this embodiment, power supply devices 32a-32i connected to the device communication network 33 and power supply devices 32j-32n connected to the verification network 34 are exemplified as multiple power supply devices 32. Here, the device communication network 33 in this embodiment is an example of a communication network. Furthermore, the number of power supply devices 32 provided on the charging device 3 can be appropriately changed, and there can be one or more than two such devices.

[0052] Here, device communication network 33 refers to the network used for communication between the charging station management terminal 31 and each of the multiple power supply devices 32. Additionally, verification network 34 refers to a network disconnected from device communication network 33, used to verify whether the power supply devices 32 connected to the electric vehicle 5, which pose a safety risk, have been abnormally altered. Furthermore, it is preferable that device communication network 33 and verification network 34 are physically isolated, but software isolation may also be used.

[0053] The charging station management terminal 31 is connected to the charging station management server 4 via an external network N. The charging station management terminal 31 is connected to each of the multiple power supply devices 32 via the device communication network 33 or the authentication network 34.

[0054] Figure 3This diagram illustrates an example of the configuration of the charging station management terminal 31 according to the first embodiment. The charging station management terminal 31 includes a processor and memory, and is configured using typical computer hardware. The processor, for example, executes a program loaded into memory such as RAM (Random Access Memory) to implement the detection unit 311, the first communication control unit 312, and the power supply management unit 313. Various processors such as CPU (Central Processing Unit), GPU (Graphics Processing Unit), ASIC (Application Specific Integrated Circuit), and FPGA (Field Programmable Gate Array) can be appropriately used as the processor. Various recording media and recording devices such as RAM, ROM (Read Only Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), and Flash memory can be appropriately used as the memory.

[0055] The detection unit 311 detects the electric vehicle 5, which is the object of charging, in the charging station management terminal 31. Additionally, the first communication control unit 312, upon detecting the electric vehicle 5, outputs a detection notification to the charging station management server 4. The detection notification includes vehicle identification information used to identify the detected electric vehicle 5.

[0056] For example, the detection unit 311 can also detect the electric vehicle 5, which is the object of charging, based on images captured within the charging station. For instance, the detection unit 311 acquires an image of at least the license plate of the captured electric vehicle 5, and obtains the license plate number of the electric vehicle 5 as vehicle identification information through image analysis, such as character recognition, on the acquired image. Furthermore, the image analysis of the acquired image can be performed externally by the charging station management terminal 31, such as the charging station management server 4. For example, image analysis can be performed through edge detection processing or using a machine learning model such as a CNN (Convolutional Neural Network). When using a machine learning model, the model can determine its parameters, for example, by outputting vehicle-related features based on input containing vehicle images. Vehicle-related features include, for example, at least one of the vehicle's shape, size, license plate number, and body color, but can also be other information. Furthermore, image analysis can also be performed using other models of machine learning.

[0057] Furthermore, the charging system 1a of the embodiment may also include a camera configured to capture at least the license plate of the electric vehicle 5. This camera may be located within a charging station where the power supply unit 32 is installed, such as at the vehicle entrance gate of the charging station. Alternatively, the charging system 1a of the embodiment may be configured to acquire images from an external camera configured to capture at least the license plate of the electric vehicle 5. As an external camera, for example, in a parking lot where the charging equipment 3 is provided, a surveillance camera installed at the location of the power supply unit 32 can be appropriately utilized.

[0058] Furthermore, in order to obtain an image of at least the license plate of the electric vehicle 5, the camera may be configured to capture images when the electric vehicle 5 is parked in an area predetermined based on the position of the power supply unit 32, when the power supply unit 32 is operated, or when the electric vehicle 5 is connected via the connecting member 301. Alternatively, a sensor may be separately provided in the charging system 1a, configured to detect the electric vehicle 5 within the area predetermined based on the position of the power supply unit 32. Furthermore, in the configuration where the image of at least the license plate of the electric vehicle 5 is captured upon connection to the electric vehicle 5 via the connecting member 301, power and communication between the electric vehicle 5 and the power supply unit 32 are disconnected during the connection phase.

[0059] Here, the connecting member 301 refers to a member used for supplying power from the power supply device 32 of the charging device 3 to the electric vehicle 5, and for communication between the power supply device 32 and the electric vehicle 5. For example, the power supply device 32 and the electric vehicle 5 can be connected in a manner that allows them to be attached and detached using the connecting member 301. The connecting member 301 is constructed using elements such as cables and connectors. Furthermore, the connecting member 301 can be a member belonging to either the charging device 3 or the electric vehicle 5. In addition, although the supply of power from the power supply device 32 to the electric vehicle 5 and the communication between the power supply device 32 and the electric vehicle 5 can be achieved, for example, through a common connecting member 301, it can also be achieved through connecting members 301 of different systems. Furthermore, the communication between the power supply device 32 and the electric vehicle 5 is not limited to wired communication via the connecting member 301, but can also be carried out wirelessly. Furthermore, as this wireless communication, various communication standards such as 4G, 5G, 6G, Wi-Fi, Bluetooth, and infrared communication can be appropriately utilized.

[0060] Alternatively, for example, the detection unit 311 can detect the electric vehicle 5 to be charged based on the user's check-in at the charging station. In this case, the detection unit 311 can obtain the authentication information at the time of check-in as the vehicle identification information. Here, check-in at the charging station refers to the user authentication process using a card issued to a user who has registered for the charging service, an application installed on a user's portable terminal such as a smartphone, or an in-vehicle terminal such as a car navigation system. In addition, the authentication information as vehicle identification information includes, for example, at least one of the user information entered at the time of check-in and the user information used for authentication at the time of check-in. Furthermore, the authentication information as vehicle identification information includes, for example, the vehicle information used to identify the electric vehicle 5 at any time after registering for the charging service or at the time of check-in. Moreover, there are cases where one user owns multiple electric vehicles 5. Therefore, for example, the user can specify the electric vehicle 5 to be charged at the time of check-in.

[0061] The power supply unit management unit 313 activates the power supply unit 32 connected to the electric vehicle 5 according to the instructions from the charging station management server 4.

[0062] The power supply management unit 313, following instructions from the charging station management server 4, degrades the functionality of the charging device 3. For example, the power supply management unit 313 disconnects the target power supply device 32 from the device communication network 33. For example, the power supply management unit 313 connects the target power supply device 32 to the verification network 34. For example, the power supply management unit 313 reconnects the target power supply device 32 to the device communication network 33. As an example, the power supply management unit 313 reconnects the power supply device 32 to the device communication network 33 if there is no abnormal (improper) change in the first verification performed by the first verification unit 416. As an example, the power supply management unit 313 reconnects the power supply device 32 to the device communication network 33 even if there is an abnormal change in the first verification, but no abnormal operation in the second verification. In other words, the power supply management unit 313 switches the connection target of the target power supply device 32 between the device communication network 33 and the verification network 34. For example, the power supply management unit 313 limits the power supply speed. For example, the power supply management unit 313 restricts the vehicle communication function that communicates with the electric vehicle 5 via the connecting member 301. Here, the restriction on the vehicle communication function refers, for example, to the restriction on communication between the electric vehicle 5 and the outside of the charging system 1a.

[0063] Each of the multiple power supply devices 32 is configured to be detachably connected to the electric vehicle 5 via a connecting member 301, and is capable of supplying power to the connected electric vehicle 5 and communicating with the electric vehicle 5. Each of the multiple power supply devices 32 has: a communication interface for connecting to the device communication network 33, a communication interface for connecting to the verification network 34, a connection interface for connecting to the electric vehicle 5 via the connecting member 301, a connection interface for connecting to a power supply device or an external power source, and a control device for controlling the operation of the device.

[0064] The control unit of the power supply device 32 includes a processor and a memory, thus utilizing a typical computer hardware configuration. The processor executes programs loaded into memory such as RAM to perform various functions of the power supply device 32. Various processors such as CPUs, GPUs, ASICs, and FPGAs can be appropriately used as the processor. Various recording media and recording devices such as RAM, ROM, HDDs, SSDs, and Flash memory can be appropriately used as the memory.

[0065] As an example, the power supply device 32 supplies power to the electric vehicle 5 connected to the power supply device 32 under the control of the power supply device management unit 313 of the charging station management terminal 31.

[0066] The charging station management server 4 is connected via an external network N to communicate with the charging equipment 3, the electric vehicle 5, and the vehicle management server 6 respectively. The charging station management server 4 is configured to control the power supply from the charging equipment 3 to the electric vehicle 5. The charging station management server 4 may be located in a different location than the charging station, but it can also be located within the charging station, just like the charging equipment 3. Alternatively, the charging equipment 3 and the charging station management server 4 can be integrated into one unit. Or, a portion of the functions of the charging station management server 4, such as the charging control unit 41, can be implemented through the charging station management terminal 31 of the charging equipment 3. Similarly, a portion of the functions of the charging station management terminal 31 can be implemented within the charging station management server 4. The charging station management server 4 can be operated by the same operator as the charging equipment 3, but it can also be operated by a different operator.

[0067] Figure 4 This diagram illustrates an example of the configuration of the charging station management server 4 according to the first embodiment. The charging station management server 4 includes: a charging control unit 41, a first storage unit 42, a reservation management unit 43, a display unit 44, and a first communication unit 45.

[0068] The charging station management server 4 has a processor and memory, making it a typical computer hardware configuration. The processor executes programs loaded into memory such as RAM to implement the charging control unit 41 and the reservation management unit 43. Various processors such as CPUs, GPUs, ASICs, and FPGAs can be appropriately used as the processor. Various recording media and recording devices such as RAM, ROM, HDDs, SSDs, and Flash memory can be appropriately used as the memory. Furthermore, the charging control unit 41 and the reservation management unit 43 can each be a hardware configuration using a typical computer as an independent device, including a processor and memory.

[0069] The charging control unit 41 performs charging control based on the safety risks of the electric vehicle 5 being charged. Figure 5 This is a diagram showing an example of the configuration of the charging control unit 41 in the first embodiment. The charging control unit 41 includes: a first determination unit 411, a second determination unit 412, a charging control indication unit 413, a storage control unit 414, a second communication control unit 415, a first verification unit 416, and a second verification unit 417.

[0070] The first determination unit 411 performs a first determination to determine whether there is a safety risk or threat to the charging function of the electric vehicle 5. As an example, the first determination includes: vehicle software configuration information based on at least the ECUFW (firmware) version of the ECU installed in the electric vehicle 5 (see reference). Figure 7 This determines whether there is a security risk to the charging function of electric vehicle 5 caused by the ECU's FW.

[0071] The second determination unit 412 performs a second determination to determine whether charging is possible and / or whether safety risks to the charging function need to be avoided. As an example, the second determination includes: based on vehicle software configuration information including at least one version of the ECUFW installed in the electric vehicle 5, degrading (downgrading) the function of the power supply device 32, thereby determining whether safety risks to the charging device 3 can be avoided. As an example, the second determination includes: determining whether the safety risk is a first-category safety risk that can be avoided by disconnecting the power supply device 32 from the device communication network 33.

[0072] Furthermore, the first determination unit 411 and the second determination unit 412 can also be integrally formed. Here, the first determination unit 411 is an example of a determination unit that performs the first determination. Similarly, the second determination unit 412 is an example of a determination unit that performs the second determination.

[0073] The charging control instruction unit 413 outputs a charging control instruction corresponding to the determination results of the first determination unit 411 and the second determination unit 412, and the verification results of the first verification unit 416 and the second verification unit 417, to the charging station management terminal 31. Here, the charging control instruction unit 413 is an example of a control unit.

[0074] As an example, if the first determination indicates a safety risk, the charging control instruction unit 413 determines a degradation mode that degrades the function of the power supply device 32 based on the second determination. Furthermore, the charging control instruction unit 413 controls the power supply to the electric vehicle 5 by the power supply device 32 in the determined degradation mode.

[0075] As an example, in the event that the safety risk is a Class 1 safety risk such as "malicious software", the charging control instruction unit 413 controls the power supply to the electric vehicle 5 in a degradation mode that disconnects the power supply device 21 from the device communication network 33.

[0076] The storage control unit 414 controls the first storage unit 42, through which various information is stored. For example, the storage control unit 414 causes the first storage unit 42 to store vehicle software configuration information about the electric vehicle 5 (object electric vehicle 5) obtained from the vehicle management server 6 (see reference). Figure 7 ) and vehicle management information (refer to Figure 8 ).

[0077] The second communication control unit 415 controls the first communication unit 45 to conduct communication with the external charging station management server 4.

[0078] After disconnecting the power supply device 32 from the device communication network 33 to avoid safety risks to the charging device 3, the first verification unit 416 and the second verification unit 417 verify whether the power supply device 32 can be safely reconnected to the device communication network 33. For example, the first verification unit 416 performs a memory file system check on the power supply device 32 connected to the verification network 34 to determine whether any abnormal changes (modifications) such as abnormal programs are found in the power supply device 32. As an example, the first verification unit 416 performs a first verification to check whether there are any abnormal changes on the power supply device 32 that has been disconnected from the device communication network 33. Here, the memory file system check refers to the check for defects in the memory of the power supply device 32, the consistency of various programs and data stored in the memory, and corruption. For example, the second verification unit 417 performs a second verification to check whether there are any abnormal communications and operations on the power supply device 32 connected to the verification network 34. As an example, if an abnormal change occurs during the first verification, the second verification unit 417 rolls back the power supply device 32 to further verify whether there is any abnormal operation. Alternatively, the first verification unit 416 and the second verification unit 417 can also be integrally formed.

[0079] The first storage unit 42 stores various data and programs used by the charging station management server 4. As a hardware component, the first storage unit 42 can appropriately utilize various recording media and recording devices such as ROM, HDD, SSD, and Flash memory. RAM can also be provided in the first storage unit 42 to temporarily store data during operation.

[0080] The reservation management unit 43 manages charging reservations made by the driver (the user of the electric vehicle 5). For example, the reservation management unit 43 accepts charging reservations from the electric vehicle 5, the driver's portable terminal, etc., via an external network N. Furthermore, the reservation management unit 43 provides the charging reservation information related to the accepted charging reservations to the charging control unit 41.

[0081] Display unit 44 displays information about the charging schedule, safety risks related to the charging function of electric vehicle 5, safety risks of charging equipment 3, or information required for monitoring related to power supply to the user of charging station management server 4. Display unit 44 can be a liquid crystal display (LCD), an organic EL (electro-luminescence) display, a projector, etc. Display unit 44 can also be configured as a touch panel display. In this case, the touch panel of display unit 44 is provided on the surface of display unit 44, and outputs information corresponding to the touched position. The touch panel of display unit 44 is an example of an input interface for obtaining user operation input from charging station management server 4.

[0082] In addition, the charging station management server 4, which serves as the input interface for obtaining user operation input, can also be equipped with a keyboard or other interface, not limited to a touch panel.

[0083] The first communication unit 45 communicates with the charging station management server 4 via an external network N. The first communication unit 45, as a hardware component, has a communication circuit for wired or wireless communication. As for the wireless communication circuit, it can appropriately utilize communication circuits corresponding to various standards such as 4G, 5G, 6G, Wi-Fi, Bluetooth, and infrared communication.

[0084] Electric vehicle 5 is an example of a mobile body powered by electricity from its onboard battery. As this mobile body, electric bicycles, electric kickboards, electric wheelchairs, and other electric vehicles, not limited to passenger cars, trucks, and two-wheeled vehicles, can be appropriately used. Furthermore, as a mobile body, it is not limited to passenger use; it can also be used for cargo transport such as luggage carriers. Electric vehicle 5 is connected to charging station management server 4 and vehicle management server 6 via external network N in a communicable manner. Additionally, electric vehicle 5 is connected to charging equipment 3 via connection member 301 in a charging and communication manner.

[0085] Figure 6 This diagram illustrates an example of the configuration of the electric vehicle 5 according to the first embodiment. The electric vehicle 5 is equipped with an in-vehicle network 51 including CAN (Controller Area Network), Ethernet (registered trademark), etc. The electric vehicle 5 has an external communication interface (I / F) 53, a power supply interface (I / F) 54, and multiple ECUs (Electronic Control Units) 55. The in-vehicle network 51 is communicatively connected to the external communication interface 53, the power supply interface 54, and the multiple ECUs 55.

[0086] The external communication interface 53 is used for communication with the outside of the electric vehicle 5 via an external network N. The external communication interface 53 includes communication circuits corresponding to various standards such as 4G, 5G, 6G, Wi-Fi (registered trademark), Bluetooth (registered trademark), and infrared communication.

[0087] The power supply interface 54 is an interface for connecting to the power supply device 32 via the connecting member 301. As an example, the power supply interface 54 includes a mating member that engages with the connector of the connecting member 301.

[0088] Multiple ECUs 55 control various functions of the electric vehicle 5, such as power steering, acceleration, braking, charging, and autonomous driving. Furthermore, the control of each function of the electric vehicle 5 can be achieved by at least one ECU, or, for example, by the coordinated operation of multiple ECUs 55. Alternatively, the control of multiple functions of the electric vehicle 5 can also be achieved by a single ECU 55. Figure 6 Examples of multiple ECUs 55 include ECUs 55a, 55b, 55c, ..., 55n. Furthermore, the number of ECUs 55 installed in the electric vehicle 5 can be arbitrarily designed. Here, each of the multiple ECUs 55 is an example of at least one electronic control device.

[0089] Vehicle management server 6 is connected to charging station management server 4 and electric vehicle 5 via external network N in a communicable manner. Vehicle management server 6 is configured to manage information related to electric vehicle 5. Vehicle management server 6 can be installed at the charging station along with charging equipment 3, together with charging station management server 4, or in a different location. Furthermore, vehicle management server 6 can be operated by an operator different from, for example, charging equipment 3 and charging station management server 4, but it can also be operated by the same operator as at least one of them. Alternatively, charging station management server 4 and vehicle management server 6 can be integrated into one unit.

[0090] Figure 7 This diagram illustrates an example of the configuration of the vehicle management server 6 according to the first embodiment. The vehicle management server 6 includes: an information retrieval unit 61, a second communication unit 62, and a second storage unit 63.

[0091] The information retrieval unit 61 includes a processor and memory, thus utilizing the hardware configuration of a typical computer. The processor, for example, executes programs loaded into memory such as RAM to perform the various functions of the information retrieval unit 61. Various processors such as CPUs, GPUs, ASICs, and FPGAs can be appropriately utilized as the processor. Various recording media and recording devices such as RAM, ROM, HDDs, SSDs, and Flash memory can be appropriately utilized as the memory.

[0092] As an example, the information retrieval unit 61 receives retrieval information, such as vehicle identification information, from the charging station management server 4 via the second communication unit 62.

[0093] As an example, the information retrieval unit 61 may, for instance, retrieve vehicle software configuration information 71a related to the electric vehicle 5 connected to the power supply unit 32 via the second communication unit 62 (see reference). Figure 8 ) and vehicle management information 72a (refer to Figure 9 The search results, such as those for charging station management server 4, are output to the charging station management server 4.

[0094] As an example, the information retrieval unit 61 is configured to output vehicle management information 72a and vehicle software configuration information 71a of the electric vehicle 5 connected to the power supply device 32, based on a request from the charging station management server 4. For example, the information retrieval unit 61 outputs vehicle management information 72a corresponding to the vehicle identification information from the charging station management server 4, such as vehicle identifier 721 and owner information 723. Furthermore, based on the vehicle identification information and vehicle management information 72a, the information retrieval unit 61 determines the vehicle model 724 and vehicle firmware (FW) version 725 of the electric vehicle 5 connected to the power supply device 32. Additionally, the information retrieval unit 61 outputs vehicle software configuration information 71a corresponding to the determined vehicle model 724 and vehicle FW version 725, such as ECUID 713, corresponding functions 714, ECUFW version 715, and details 716.

[0095] The second communication unit 62 communicates with the vehicle management server 6 via an external network N. The second communication unit 62, as a hardware component, has communication circuits for wired or wireless communication. For wireless communication, it can appropriately utilize communication circuits corresponding to various standards such as 4G, 5G, 6G, Wi-Fi, Bluetooth, and infrared communication.

[0096] The second storage unit 63 stores various data and programs used by the vehicle management server 6. For example, the second storage unit 63 stores vehicle software configuration information 71a by vehicle model (see...). Figure 8 ), and vehicle management information 72a (refer to) Figure 9The second storage unit 63, as a hardware component, can appropriately utilize various recording media and recording devices such as ROM, HDD, SSD, and Flash memory. The second storage unit 63 can also include RAM for temporarily storing data during operation.

[0097] Furthermore, the vehicle management information 72a can also be stored in the first storage unit 42 of the charging station management server 4. In addition, the vehicle management information 72a can also store information required for establishing communication between the power supply unit 32 and the electric vehicle 5.

[0098] Hereinafter, the vehicle software configuration information 71a and vehicle management information 72a of this embodiment will be described with reference to the accompanying drawings.

[0099] Figure 8 This diagram illustrates an example of vehicle software configuration information 71a according to the first embodiment. Vehicle software configuration information 71a includes items such as: vehicle model 711, vehicle firmware version 712, ECU ID 713, corresponding ECU functions 714, ECU firmware version 715, and details 716. Vehicle software configuration information 71a represents the latest vehicle firmware information for a certain vehicle model 711, and also represents the functions and firmware versions of each ECU installed in the electric vehicle 5 included in that firmware. Furthermore, vehicle software configuration information 71a may also include update content such as release notes, thereby enabling its use in determining safety risks when the vehicle software configuration information 71a is obtained. Here, vehicle software configuration information 71a is an example of software information that at least includes firmware information for the electronic control unit. Similarly, ECU firmware version 715 is an example of firmware information for the electronic control unit.

[0100] exist Figure 8 In the example, as vehicle software configuration information 71a, it stores vehicle FW versions 712 of "Ver. 1.0" and "Ver. 1.1" related to the car model 711 of "Car-Model01", and vehicle FW versions 712 of "Ver. 1.0" and "Ver. 2.0" related to the car model 711 of "Car-Model02". For example, "Ver. 1.1" for "Car-Model01" and "Ver. 2.0" for "Car-Model02" refer to the latest FW version 712 for each car model. Figure 8In the example, regarding the latest FW "Ver.1.1" for "Car-Model01", the unique information identifying the associated ECU, ECUID 713, is "ECU-001", "ECU-002", "ECU-003", etc. Furthermore, the corresponding functions 714 for these ECUs are "Power Steering", "Acceleration Control", "Charging Control", etc. Additionally, the ECUFW versions 715 for these ECUs are "Ver.1.0.0", "Ver.1.0.1", "Ver.1.1.0", etc. Furthermore, the details 716 for these ECUs contain release notes such as "Initial Release", "Functional Improvements", "Security Update Addresses Malware Infection Issue (CVW-2023-XXXX1)", etc.

[0101] Figure 9 This diagram illustrates an example of vehicle management information 72a according to the first embodiment. Vehicle management information 72a includes items such as: vehicle identifier 721, license plate number 722, owner information 723, vehicle model 724, and vehicle firmware version 725. Vehicle management information 72a represents information about the owner of a vehicle and the current firmware version. Vehicle management information 72a is collected, for example, during user registration for charging services provided by charging equipment 3, and / or updated during firmware updates for the electric vehicle 5. Additionally, vehicle management information 72a may also include other information such as the shape, size, and body color of the electric vehicle 5.

[0102] exist Figure 9 In the example, vehicle management information 72a stores information related to each electric vehicle 5, uniquely identified by vehicle identifiers 721 such as "CAR-A01", "CAR-A02", "CAR-A03", etc. For example, for the electric vehicle 5 with the vehicle identifier 721 "CAR-A01", the license plate number 722 displayed on the license plate, the owner information 723 indicating the owner, the vehicle model 724, and the vehicle FW version 725 indicating the current vehicle FW used by the electric vehicle 5 are registered as "12-34", "Owner001", "Car-Model01", and "Ver.1.0", respectively. Here, the license plate number 722 in vehicle management information 72a is an example of vehicle identification information sent from charging station management server 4 to vehicle management server 6. Furthermore, if it can be determined in vehicle management server 6, other vehicle management information 72a related to the license plate number 722 can also be used as vehicle identification information.

[0103] For example, when considering the electric vehicle 5 with the vehicle identifier 721 "CAR-A01", the latest version of the vehicle's software configuration (FW) is "Ver.1.1" according to the vehicle software configuration information 71a, while the currently applied version is "Ver.1.0" according to the vehicle management information 72a, which is not the latest. Furthermore, in the case of the vehicle FW using "Ver.1.0", the vehicle software configuration information 71a indicates that the corresponding function 714 for "charging control" was applied before a security update, posing a security risk.

[0104] Hereinafter, with reference to the accompanying drawings, an example of the operation of the charging system 1a according to the embodiment will be described. Furthermore, the process described below is just one example; changes to the processing order, deletion of some processes, and addition of other processes are also possible.

[0105] Figure 10A as well as Figure 10B This is a flowchart illustrating an example of power supply processing performed in the charging control unit 41 of the first embodiment when vehicle detection is triggered.

[0106] The charging control unit 41 obtains vehicle identification information such as the license plate number of the electric vehicle 5 (S101). For example, if a camera is installed at the charging station, the charging control unit 41 obtains the license plate number obtained from the captured image of the license plate as vehicle identification information. For example, the charging control unit 41 obtains the authentication information of the user of the electric vehicle 5 when checking in at the charging station as vehicle identification information.

[0107] The charging control unit 41 outputs the acquired vehicle identification information to the vehicle management server 6, and retrieves the vehicle software configuration information 71a and vehicle management information 72a corresponding to the acquired vehicle identification information from the vehicle management server 6 (S102). As an example, based on the vehicle identification information and vehicle management information 72a, the charging control unit 41 retrieves vehicle management information 72a, which includes at least model 724 and vehicle FW version 725, for the electric vehicle 5 to which the charging target is determined by the vehicle management server 6. Furthermore, based on the vehicle software configuration information 71a, the charging control unit 41 also retrieves association information for each of the latest vehicle FW version 712 and the current vehicle FW version 725 of the model 711 to which the electric vehicle 5 to which the charging target belongs.

[0108] The charging control unit 41 determines whether there is a safety risk in the vehicle firmware (FW) of the electric vehicle 5 (S103). As an example, the charging control unit 41 determines whether there is a safety risk in the vehicle firmware (FW) of the electric vehicle 5, based on the difference between the latest vehicle firmware (FW) version 712 of the model 711 and the currently used vehicle firmware (FW) version 725. For example, if the latest vehicle firmware (FW) version 712 of the model 711 is different from the currently used vehicle firmware (FW) version 725, the charging control unit 41 determines that there is a safety risk in the vehicle firmware (FW) of the electric vehicle 5.

[0109] If there is no safety risk in the vehicle FW (S103: No), the charging control unit 41 outputs a power supply notification allowing power supply and then supplies power via the power supply device 32 (S104). Afterwards, Figure 10A as well as Figure 10B The process is complete.

[0110] On the other hand, if a safety risk is determined to exist in the vehicle FW of electric vehicle 5 (S103: Yes), the charging control unit 41 extracts the FW of electric vehicle 5 that poses a safety risk (S105). As an example, the charging control unit 41 extracts the FW that poses a safety risk based on the differences between ECU FW versions 715. For example, the charging control unit 41 extracts the ECU FW of the latest vehicle FW version 712 of the model 711, and the ECU FW of ECU 55 that has a different ECU FW version 715 from the vehicle FW version 725 currently used by electric vehicle 5.

[0111] The charging control unit 41 determines whether there is a safety risk to the charging function (S106). As an example, if the corresponding function 714 of the extracted ECUFW is a charging function such as "charging control", the charging control unit 41 determines that there is a safety risk to the charging function.

[0112] If it is determined that there is no safety risk to the charging function (S106: No). Figure 10A as well as Figure 10B The process then proceeds to S104 for processing.

[0113] On the other hand, if a security risk to the charging function is determined (S106: Yes), the charging control unit 41 determines whether the security risk can be avoided (S107). For example, the charging control unit 41 refers to the items in the details 716 between different ECUFW versions 715. The charging control unit 41 determines whether the damage can be prevented from escalating, i.e., whether the charging device 3 can avoid the security risk, by referring to the CVE (Common Vulnerabilities and Exposures) information and / or corresponding content between the ECUFWs. For example, if the corresponding or reported security risk between different ECUFW versions 715 is a security risk such as "infection with malware" and / or "ability to execute arbitrary code," the charging control unit 41 determines that the security risk can be avoided in the charging device 3. For example, if the corresponding or reported security risk is a security risk such as an attack causing communication disruption between the electric vehicle 5 and the power supply unit 32, or if the security risk cannot be clearly identified based on the items in the details 716, the charging control unit 41 determines that the security risk cannot be avoided in the charging device 3.

[0114] If it is determined that the charging device 3 poses an unavoidable safety risk (S107: No), the charging control unit 41 notifies the driver that power supply is unavailable (power supply not possible) and requests an update to the vehicle's firmware (S108). As an example, the charging control unit 41 sends a power supply failure notification and a vehicle firmware update request to the power supply device 32, the electric vehicle 5, and the driver's portable terminal (not shown) via the external network N, thereby notifying the driver of the power supply failure notification and the vehicle firmware update request. The notification to the driver can be made by displaying a notification screen on a monitor or by outputting a notification tone or sound through a speaker. Therefore, at least one of a display and a speaker can be installed on the power supply device 32. Afterwards, Figure 10A as well as Figure 10B The process ends. Here, the inability of power supply device 32 to supply power due to safety risks is an example of a degradation mode that causes the function of power supply device 32 to degrade.

[0115] On the other hand, if it is determined that the charging device 3 can avoid security risks (S107: Yes), the charging control unit 41 determines whether there is a security risk that could infect the power supply device 32 with malware (S109). As an example, the charging control unit 41 refers to the items in the details 716 between different ECUFW versions 715, and if the corresponding or reported security risk is "infection with malware", it determines that there is a security risk that could infect the power supply device 32 with malware. Here, the corresponding or reported security risk of "infection with malware" is an example of a first-category security risk that the charging device 3 can avoid by disconnecting the power supply device 32 from the device communication network 33.

[0116] If a security risk is determined to exist that could infect the power supply device 32 with malware (S109: Yes), the charging control unit 41 creates a snapshot of the power supply device 32 (S110). Here, the snapshot of the power supply device 32 represents the data state of the power supply device 32's memory file system at that point in time, such as information about the status of each firmware and control program version. The charging control unit 41 then maintains the created snapshot via the first storage unit 42. Additionally, the charging control unit 41 disconnects the power supply device 32 from the device communication network 33 (S111). For example, the charging control unit 41 outputs a power supply device disconnection instruction (allowing power supply from the device communication network 33) to the charging station management terminal 31 via the external network N, thereby enabling power supply by the power supply device 32 while it is disconnected from the device communication network 33 (S104). Afterwards, Figure 10A as well as Figure 10B The process ends. Here, allowing power supply on the basis of disconnecting the power supply device 32 from the device communication network 33 based on security risks is an example of a degradation mode that degrades the function of the power supply device 32.

[0117] On the other hand, if it is determined that there is no security risk of infecting the power supply device 32 with malware (S109: No), the charging control unit 41 determines whether there is a security risk of the charging device 3 related to the battery and power supply (S112).

[0118] If a safety risk related to the battery or power supply is determined to exist (S112: Yes), the charging control unit 41 limits the power supply speed (S113). Then, the charging control unit 41 outputs a power supply notification allowing power supply under the power supply speed limit to the charging station management terminal 31, thereby enabling power supply by the power supply device 32 while limiting the power supply speed (S104). Afterwards, Figure 10A as well as Figure 10BThe process ends here. Here, allowing power supply based on limiting the power supply speed of the power supply device 32 according to safety risks is an example of a degradation mode that degrades the function of the power supply device 32.

[0119] On the other hand, if it is determined that there is no safety risk related to the battery or power supply (S112: No), the charging control unit 41 determines whether there is a safety risk of the charging device 3 being charged remotely (S114).

[0120] If a safety risk of remote charging is detected (S114: Yes), the charging control unit 41 restricts the vehicle communication function (S115). Then, the charging control unit 41 outputs a power supply notification allowing power supply to the charging station management terminal 31 while restricting the vehicle communication function, thus providing power supply via the power supply device 32 (S104). Afterwards, Figure 10A as well as Figure 10B The process ends. Here, allowing power supply based on the restriction of the vehicle communication function of the power supply device 32 according to security risks is an example of a degradation mode that degrades the function of the power supply device 32.

[0121] On the other hand, if it is determined that there is no safety risk of remote charging (S114: No), the charging control unit 41, for example, requests the driver to update the vehicle's firmware (S116), similar to the process in S108. Afterwards, Figure 10A as well as Figure 10B The process then proceeds to the processing of S104.

[0122] Figure 11 This is a flowchart illustrating an example of the verification process performed in the charging control unit 41 of the first embodiment for reconnecting the power supply device 32 to the device communication network 33. Figure 11 The process, for example, is as follows Figure 10A as well as Figure 10B The power supply process begins when the power supply device 32, which has been disconnected from the device communication network 33, has completed power supply, triggered by this condition. Furthermore, Figure 11 The process can also be triggered when the power supply device 32 changes to a state where it is no longer connected to the electric vehicle 5. Or, Figure 11 The process can also begin at any timing after the power supply implemented by the power supply device 32 is completed or after the power supply device 32 changes to a state where it is not connected to the electric vehicle 5.

[0123] The charging control unit 41 connects the power supply device 32, which is disconnected from the device communication network 33, to the verification network 34 (S201). As an example, the charging control unit 41 outputs a verification network connection instruction to the charging station management terminal 31 via the external network N, thereby connecting the power supply device 32 to the verification network 34.

[0124] The charging control unit 41 performs a memory file system check on the power supply device 32 of the object connected to the verification network 34 (S202). As an example, the charging control unit 41 checks for memory defects and / or inconsistencies and corruption of the file system within the power supply device 32.

[0125] The charging control unit 41 determines whether any abnormal changes to the file system, such as programs, have been detected (S203). If no abnormal changes to the file system, such as programs, have been detected (S203: No). Figure 11 The process then proceeds to S207 for processing.

[0126] On the other hand, if it is determined that abnormal changes to the file system such as programs have been discovered (S203: Yes), the charging control unit 41 uses the snapshot made during the disconnection to roll back the file system of the power supply device 32 (S204).

[0127] Subsequently, the charging control unit 41 verifies whether there are any abnormal communications or operations in the power supply device 32 (S205). For example, the charging control unit 41 causes the power supply device 32 to perform a test process to determine whether the communication and operation are as specified. The verification program used to perform the test process and / or the verification data specifying normal communication and operation are, for example, predetermined and stored in the first storage unit 42. For example, the charging control unit 41 supplies and executes the verification program to the power supply device 32. For example, the charging control unit 41 obtains the execution result of the verification program and uses the verification data to detect abnormal communications and operations.

[0128] The charging control unit 41 determines whether there is abnormal communication or operation in the target power supply device 32 (S206). If there is no abnormal communication or operation in the target power supply device 32 (S206: No), the charging control unit 41 connects the power supply device 32 to the device communication network 33 (S207). As an example, the charging control unit 41 outputs a device communication network connection instruction to the charging station management terminal 31 via the external network N, thereby disconnecting the power supply device 32 from the verification network 34 and reconnecting it to the device communication network 33. On the other hand, if there is abnormal communication or operation in the target power supply device 32 (S206: Yes), the charging control unit 41 notifies the owner of the charging equipment 3 of the irrecoverable (unrecoverable) condition of the power supply device 32 (S208). After the processing of S207 or S208, Figure 11 The process is complete.

[0129] Here, a more detailed explanation will be given regarding an example of the operation of the charging system 1a according to the embodiment.

[0130] Figure 12 This is a timing diagram illustrating an example of power supply processing performed in the charging system 1a of the first embodiment, when vehicle detection is triggered. Figure 12 This example illustrates the power supply process when there is a safety risk in the charging function of an electric vehicle 5, which is being charged, and the charging device 3 is able to avoid that safety risk.

[0131] The power supply unit 32 of the charging device 3 detects the electric vehicle 5 to be charged (S301), and outputs a detection notification to the charging station management server 4 when the electric vehicle 5 to be charged is detected (S302). Here, it is assumed that the electric vehicle 5 assigned the vehicle identifier 721 "CAR-A01" is detected, and a detection notification containing the license plate number 722 "12-34" as vehicle identification information is output.

[0132] The charging control unit 41 of the charging station management server 4 outputs the vehicle software configuration information 71a and vehicle management information 72a corresponding to the electric vehicle 5 with license plate number "12-34" to the vehicle management server 6 (S303).

[0133] The information retrieval unit 61 of the vehicle management server 6 refers to the vehicle management information 72a based on the license plate number 722, which is the vehicle identification information "12-34". As a result, the information retrieval unit 61 determines that the model 724 of the electric vehicle 5 being charged is "Car-Model01" and the vehicle FW version 725 currently in use is "Ver.1.0".

[0134] Furthermore, the information retrieval unit 61 further refers to the vehicle software configuration information 71a, and reads the vehicle software configuration information 71a for the determined "Car-Model01" vehicle model 724. Moreover, the information retrieval unit 61 outputs the determined vehicle management information 72a and the read vehicle software configuration information 71a to the charging station management server 4 (S304).

[0135] The charging control unit 41 of the charging station management server 4 obtains vehicle software configuration information 71a and vehicle management information 72a from the vehicle management server 6 (S305).

[0136] In the safety risk determination (S306), the charging control unit 41 determines that there is a safety risk based on the difference between the current vehicle FW version 725 (Ver. 1.0) used by the electric vehicle 5, which has been assigned the vehicle identifier 721 "CAR-A01", and the latest vehicle FW version 712 (Ver. 1.1) of the model 711 "Car-Model01" read from the vehicle software configuration information 71a. Furthermore, for the model 711 "Car-Model01", the charging control unit 41 extracts the ECUFW of the corresponding functions 714 of "acceleration control" and "charging control" where the ECUFW version 715 differs between the vehicle FW versions 725 of "Ver. 1.0" and "Ver. 1.1". Moreover, because the charging control unit 41 has extracted the ECUFW of the corresponding function 714 of "charging control", it determines that there is a safety risk to the charging function.

[0137] Furthermore, in the safety risk avoidance determination (S307), the charging control unit 41 refers to the details 716 recorded between "Ver. 1.0" and "Ver. 1.1" of the vehicle FW version 725 corresponding to the "charging control" function 714. Moreover, the charging control unit 41 determines that the safety risk corresponding to the ECUFW version 715 between "Ver. 1.0.0" and "Ver. 1.1.0" is the safety risk of "infection with malware", and determines that it is a safety risk that the charging device 3 can avoid, and that the currently used "Ver. 1.0.0" ECUFW version 715 has the safety risk of "infection with malware".

[0138] Therefore, the charging control unit 41 takes a snapshot of the power supply device 32 and outputs a power supply disconnection instruction indicating that the power supply device 32 is powered off from the device communication network 33 to the charging device 3 (S308).

[0139] The power supply device 32 of the charging device 3 disconnects the target power supply device 32 from the device communication network 33 according to the power supply device disconnection instruction from the charging station management server 4 (S309). In addition, the power supply device 32 outputs a power supply notification to the electric vehicle 5, clears the communication between the power supply device 32 and the electric vehicle 5, and starts power supply (S310).

[0140] Figure 13 This is a timing diagram illustrating an example of the verification process performed in the charging system 1a of the first embodiment for reconnecting the power supply device 32 to the device communication network 33. Figure 13 This example illustrates the verification process in the case where there is an abnormal change in the power supply device 32, and the verification is determined to be without abnormal communication and action by using a snapshot rollback.

[0141] The charging control unit 41 of the charging station management server 4 outputs a verification network connection indication to the charging device 3, which indicates that the power supply device 32, which was disconnected from the device communication network 33 during the power supply process, is connected to the verification network 34 (S401).

[0142] The power supply device 32 of the charging device 3 connects the power supply device 32 of the object to the verification network 34 according to the verification network connection instruction from the charging station management server 4 (S402).

[0143] The charging control unit 41 of the charging station management server 4 verifies abnormal changes to the file system, such as abnormal programs, by performing a memory file system check on the power supply device 32 connected to the verification network 34 (S403). When the charging control unit 41 detects abnormal changes in the power supply device 32, it rolls back the file system of the power supply device 32 using a snapshot created when disconnecting from the device communication network 33 during power supply processing.

[0144] In addition, the charging control unit 41 performs a verification procedure by causing the power supply device 32 to perform test processing of simulated communication and operation, and verifies the presence or absence of abnormal communication and operation (S404).

[0145] In addition, when the charging control unit 41 determines that there is no abnormal communication or operation, it outputs a device communication network connection instruction to the charging device 3, which instructs the power supply device 32 to reconnect with the device communication network 33 (S405).

[0146] The power supply device 32 of the charging device 3 switches the connection target of the power supply device 32 from the verification network 34 to the device communication network 33 according to the device communication network connection instruction from the charging station management server 4 (S406).

[0147] Thus, the charging control in this embodiment, based on the vehicle software configuration information 71a, determines whether there is a safety risk to the charging function of the electric vehicle 5, and further determines whether the charging device 3 can avoid the safety risk by degrading the function of the power supply device 32. Moreover, in the event of a safety risk to the charging function of the electric vehicle 5, the charging control in this embodiment determines a degradation mode for degrading the function of the power supply device 32 based on the determination result of whether the charging device 3 can avoid the safety risk by degrading the function of the power supply device 32.

[0148] According to this configuration, the function of the power supply device 32 can be degraded based on the safety risks associated with the charging function of the electric vehicle 5. Therefore, according to the charging control of this embodiment, the safety of the charging station can be ensured as much as possible without losing its original charging function, and power can be continuously supplied to the moving body being charged. In other words, the charging device 3 connected to the electric vehicle 5 during power supply can be protected from safety risks caused by the electric vehicle 5.

[0149] Hereinafter, other embodiments of the charging system 1 of this disclosure will be described with reference to the accompanying drawings. Furthermore, in the following descriptions of each embodiment, the differences will be mainly explained, and content that overlaps with the above description will be appropriately omitted.

[0150] (Second Implementation)

[0151] The charging system 1b of this embodiment is the same as the charging system 1a of the first embodiment, except that the communication method between the charging device 3 and the charging station management server 4 is different. Here, the charging system 1b of the second embodiment is an example of the charging system 1 of the embodiments of this disclosure. In addition, in the various embodiments of this disclosure, the charging system 1a and the charging system 1a are sometimes uniformly referred to as the charging system 1 without distinguishing between them.

[0152] Figure 14 This diagram illustrates an example of the configuration of the charging system 1b according to the second embodiment. In the charging system 1b of this embodiment, the charging device 3 is directly connected to the charging station management server 4 without going through an external network N.

[0153] Thus, even with a configuration that connects the charging device 3 and the charging station management server 4 without using an external network N, the same effects as the described embodiment can be achieved. Furthermore, according to this configuration, communication between the charging device 3 and the charging station management server 4 can be made faster and more stable, and intrusion paths to the charging device 3 via the external network N can be limited, thereby improving the security related to charging control.

[0154] (Third implementation)

[0155] The charging system 1 of this embodiment is the same as the charging system 1a of the first embodiment, except that it uses a charging reservation as a trigger to start the power supply process instead of vehicle detection.

[0156] In this embodiment, the reservation management unit 43 sets a predetermined waiting time based on the results of a safety risk assessment and / or a safety risk avoidance assessment when accepting a charging reservation. For example, if there is a safety risk and the charging device 3 can avoid the safety risk, the reservation management unit 43 sets a predetermined waiting time to schedule the start of power supply. Here, the reservation management unit 43 in this embodiment is an example of a control unit.

[0157] Figure 10A as well as Figure 15 This is a flowchart illustrating an example of power supply processing performed in the charging control unit 41 and reservation management unit 43 of the third embodiment, triggered by a charging reservation. Here, the power supply processing in the first embodiment (see...) will be primarily explained. Figure 10A as well as Figure 10B The differences between them.

[0158] exist Figure 10A as well as Figure 15 During the process, the charging control unit 41 obtains vehicle identification information such as owner information 723 and vehicle model 724 (S101). As an example, the charging control unit 41 obtains vehicle identification information based on reservation information in a charging reservation registration that includes at least owner information 723 and vehicle model 724. This reservation information can be obtained, for example, based on information entered by the user of the electric vehicle 5 in the charging reservation registration and / or the authentication information of the user when logging into the charging reservation registration service.

[0159] In addition, Figure 10A as well as Figure 15 In the process, if it is determined that there is no safety risk in the vehicle FW of electric vehicle 5 (S103: No), after the reservation management unit 43 accepts the charging reservation (S501), the charging control unit 41 outputs a power supply notification that allows power supply and performs power supply by the power supply device 32 (S104).

[0160] In addition, Figure 10A as well as Figure 15 In the process, if it is determined that there is no safety risk to the charging function (S106: No), after the reservation management department 43 accepts the charging reservation (S501), the process proceeds to S104.

[0161] In addition, Figure 10A as well as Figure 15In the process, if it is determined that a safety risk can be avoided in the charging device 3 (S107: Yes), the reservation management unit 43 sets a predetermined waiting time to accept the charging reservation (S502). For example, unlike the case without a safety risk (S501), the reservation management unit 43 accepts the charging reservation at a reservation time with a predetermined waiting time of 30 minutes. Furthermore, the predetermined waiting time is, for example, preset and saved in the first storage unit 42. At this time, the charging control unit 41 can also make an update request to the driver to request a vehicle FW update. Here, the reservation time in this embodiment is an example of a power supply time.

[0162] When the scheduled charging time arrives, the charging control unit 41 determines whether the safety risk to the charging function has been eliminated (S503). As an example, the charging control unit 41 determines whether there is a safety risk to the charging function based on the vehicle FW version 725 used by the electric vehicle 5 to be charged at the scheduled time, for example, in the same manner as in S102-S106. If it is determined that the safety risk to the charging function has been eliminated (S503: Yes)... Figure 10A as well as Figure 15 The process then proceeds to step S104. On the other hand, if it is not determined that the safety risk to the charging function has been eliminated (S503: No). Figure 10A as well as Figure 15 The process then proceeds to S109 for processing.

[0163] Thus, in this embodiment, the charging control unit 41 performs the first determination again before the scheduled time. If the determination result of the first determination changes to no safety risk before the scheduled time, the unit controls the power supply to the electric vehicle 5 without degrading the function of the power supply device 32. Alternatively, if the determination result of the first determination does not change to no safety risk before the scheduled time, the charging control unit 41 controls the power supply to the electric vehicle 5 in a degradation mode that disconnects the power supply device 32 from the device communication network 33.

[0164] Figure 16 This is a timing diagram illustrating an example of power supply processing performed in the charging system 1 of the third embodiment, where a charging reservation is triggered. Figure 16 This example illustrates a power supply process where a safety risk exists in the charging function of an electric vehicle 5, which can be avoided in the charging device 3, and the safety risk to the charging function is not eliminated at the scheduled time. Here, the power supply process in the first embodiment (see [reference]) will be primarily discussed. Figure 12 Explain the differences between them.

[0165] The reservation management unit 43 begins charging reservation registration (S601). Furthermore, based on the information input by the user of the electric vehicle 5 and / or the authentication information used by the user when logging into the charging reservation registration service, the reservation management unit 43 obtains reservation information containing at least owner information 723 and vehicle model 724 and outputs it to the charging control unit 41 (S602). Here, it is assumed that the output includes the owner information 723 "Owner001" and the vehicle model 724 "Car-Model01".

[0166] The charging control unit 41 of the charging station management server 4 outputs the vehicle software configuration information request to the vehicle management server 6 (S303), requesting the owner information 723 of "Owner001", the vehicle software configuration information 71a corresponding to the model 724 of "Car-Model01", and the vehicle management information 72a.

[0167] The information retrieval unit 61 of the vehicle management server 6 refers to the vehicle management information 72a based on the owner information 723, "Owner001", which serves as vehicle identification information, and the vehicle model 724, "Car-Model01". Thus, the information retrieval unit 61 determines that the electric vehicle 5 being charged is using "Ver.1.0" of vehicle version 725 at the current time.

[0168] Following the safety risk avoidance determination (S307), the charging control unit 41, upon determining a safety risk of "malicious software infection" affecting the charging function, instructs the reservation management unit 43 to schedule a charging operation within a predetermined waiting time (S603). Alternatively, the charging control unit 41 can also request the driver to update the vehicle's firmware (FW) within a predetermined waiting time set before the scheduled appointment time by outputting a vehicle firmware update request to the electric vehicle 5 (S604).

[0169] The reservation management unit 43 accepts charging reservations for scheduled times with predetermined waiting periods, based on instructions from the charging control unit 41 (S605). Furthermore, when a scheduled time arrives, the charging control unit 41 determines whether the safety risks to the charging function have been eliminated (S606). If it determines that the safety risks to the charging function have not been eliminated, it takes a snapshot of the power supply device 32 and issues an instruction to disconnect from the device communication network 33 (S308).

[0170] Thus, the charging system 1 of this embodiment uses charging reservation as a trigger for power supply processing, and sets a waiting time to set the reservation time when a safety risk to the charging function is determined. According to this configuration, in addition to the same effects as the embodiment described above, it also achieves the effect of updating the vehicle's firmware during the waiting time before the reservation time. Therefore, the charging system 1 of this embodiment can further improve the safety of charging control.

[0171] Furthermore, the waiting time set during charging reservation can be a predetermined period, or it can be extended depending on the assessment of safety risks, such as limiting the power supply speed due to safety concerns regarding the charging function. Additionally, the length of the waiting time can be related to the latest vehicle firmware update applicable to the electric vehicle 5 being charged, varying based on the number of updated ECU firmware, the amount of data, and the predicted update time. This configuration allows for easy updating of the vehicle firmware during the waiting time before the reservation time, thus further improving the safety of charging control.

[0172] Furthermore, the technology of this embodiment can be appropriately applied to the charging system 1 of each of the above embodiments.

[0173] (Fourth implementation)

[0174] If the onboard computer is not updated with the latest patches, unresolved security risks may be misused, leading to malfunctions of the vehicle's functions and threatening the safety of the vehicle and driver.

[0175] Therefore, in this embodiment, a charging system 1 that can protect electric vehicles connected to the charging equipment from safety risks caused by electric vehicles when power is supplied will be described.

[0176] The charging system 1 of this embodiment is the same as the charging system 1a of the first embodiment, except that it replaces the electric vehicle 5 which is being charged with safety risks related to the charging function and performs charging control corresponding to safety risks related to the driving function. In this embodiment, the differences from the charging system 1a of the first embodiment will be mainly explained.

[0177] Figure 17 This diagram illustrates an example of the configuration of the charging device 3 according to the fourth embodiment. The charging device 3 of this embodiment, except for the inclusion of a device communication network 33 and a verification network 34, is similar to the charging device 3 of the first embodiment (see Figure 1). Figure 2 Similarly, in this embodiment of the charging device 3, the charging station management terminal 31 is connected to each of the plurality of power supply devices 32 via a network.

[0178] Figure 18This diagram illustrates an example of the configuration of the charging control unit 41 in the fourth embodiment. The charging control unit 41 of this embodiment and the charging control unit 41 of the first embodiment (see reference...) Figure 5 Unlike other embodiments, this one does not include a first verification unit 416 or a second verification unit 417. Here, the first determination unit 411 and the second determination unit 412 of this embodiment are also examples of determination units. Similarly, the charging control indication unit 413 of this embodiment is also an example of a control unit.

[0179] Furthermore, in this embodiment, the first determination unit 411 and the second determination unit 412 determine the safety risk to the driving function instead of the safety risk to the charging function in the first embodiment. For example, the first determination unit 411 performs a first determination to determine whether there is a safety risk to the driving function of the electric vehicle 5 caused by the fault of the ECU 55. For example, if the first determination results in a safety risk, the second determination unit 412 performs a second determination to determine whether the electric vehicle 5 can be driven by other driving functions and avoid the safety risk by disabling at least one driving function with a safety risk. In other words, the first determination in this embodiment determines whether there is a safety risk to at least one driving function of the electric vehicle 5 caused by the fault of at least one ECU 55. Furthermore, the second determination in this embodiment determines whether the electric vehicle 5 can avoid the safety risk by disabling a predetermined function among the at least one driving function of the electric vehicle 5 if there is a safety risk.

[0180] In addition to outputting charging control instructions corresponding to the determination results of the first determination unit 411 and the second determination unit 412 to the charging station management terminal 31, the charging control instruction unit 413 also outputs instructions to the electric vehicle 5 to be charged. For example, if the electric vehicle 5 can be driven using other driving functions after disabling at least one driving function with a safety risk, and the electric vehicle 5 can avoid the safety risk, the charging control instruction unit 413 allows power supply to the electric vehicle 5 after disabling at least one driving function with a safety risk. For example, if the electric vehicle 5 can be driven using other driving functions after disabling at least one driving function with a safety risk, and the electric vehicle 5 to be charged can avoid the safety risk, the charging control instruction unit 413 outputs notification information to the driver to confirm whether the at least one driving function with a safety risk has been disabled. For example, if the charging control instruction unit 413 receives notification information indicating that the driver agrees to disable at least one driving function with a safety risk, the charging control instruction unit 413 outputs instruction information to disable at least one driving function with a safety risk to the electric vehicle 5.

[0181] Figure 19 This is a diagram illustrating an example of vehicle software configuration information 71b in the fourth embodiment. Figure 19 The vehicle software configuration information 71b shown is different from the ECUFW version 715 related to the model "Car-Model02" 711, except that it is different from... Figure 8 The same applies to the vehicle software configuration information 71a shown.

[0182] Figure 20 This is a diagram illustrating an example of vehicle management information 72b in the fourth embodiment. Figure 20 The vehicle management information 72b shown is different from the vehicle FW version 725 related to the electric vehicle 5 with vehicle identifiers 721, except that "CAR-A02" and "CAR-A03" are different. Figure 9 The same applies to the vehicle management information 72a shown.

[0183] Hereinafter, an outline of the charging control performed by the charging system 1 of this embodiment, corresponding to the safety risks to the driving function, will be described with reference to the accompanying drawings.

[0184] Figure 21 This diagram illustrates an example of the corresponding function 714 of the ECU 55 related to autonomous driving control in the fourth embodiment. In this embodiment, the charging control unit 41 restricts charging control of autonomous driving based on safety risks when a safety risk exists in the electric vehicle 5 being charged, specifically in relation to driving functions related to autonomous driving such as lane keeping function (No. 1), follow-the-car function (No. 2), parking assist function (No. 3), and fully autonomous driving function (No. 4) among the corresponding functions 714 of the ECU 55. For example, if a safety risk exists for at least one of the autonomous driving functions No. 1 to No. 3, the charging control unit 41 restricts that function and the higher-level fully autonomous driving function No. 4. For example, if a safety risk exists for the autonomous driving function No. 4, the charging control unit 41 restricts only that fully autonomous driving function (No. 4). These restrictions are based on the following conditions: each of the autonomous driving functions No. 1 to No. 3 is an independent function, while the fully autonomous driving function (No. 4) includes all the autonomous driving functions No. 1 to No. 3. Furthermore, the levels assigned to each autonomous driving function can be changed appropriately.

[0185] Figure 22This diagram illustrates an example of the corresponding function 714 of the ECU 55 related to manual driving control in the fourth embodiment. In this embodiment, the charging control unit 41 restricts manual driving based on safety risks when a safety risk exists in the electric vehicle 5 being charged, specifically in the corresponding function 714 of the ECU 55, such as power steering (No. 1), acceleration control (No. 2), and braking control (No. 3). For example, the charging control unit 41 restricts manual driving when a safety risk exists for any of the manual driving functions No. 1 to No. 3. These restrictions are based on the fact that each of the manual driving functions No. 1 to No. 3 is a driving function required for manual driving.

[0186] Figure 23 This is a flowchart illustrating an example of the power supply processing performed in the charging control unit 41 of the fourth embodiment when vehicle detection is triggered. Here, the power supply processing in the first embodiment (see [reference]) will be primarily explained. Figure 10A as well as Figure 10B The differences between them.

[0187] exist Figure 23 In the process, after extracting a function (FW) with a safety risk (S105), the charging control unit 41 determines whether the corresponding function 714 of the extracted FW is a safety risk related to the autonomous driving function (S701). As an example, if the corresponding function 714 of the extracted ECUFW is a driving function such as "autonomous driving control", the charging control unit 41 determines that it is a safety risk related to the autonomous driving function.

[0188] If the risk is determined not to be related to the autonomous driving function (S701: No), the charging control unit 41 determines whether the corresponding function 714 of the extracted FW is a safety risk related to the manual driving function (S702). As an example, if the corresponding function 714 of the extracted ECUFW is a driving function such as "power steering", "acceleration control", or "braking control", the charging control unit 41 determines that it is a safety risk related to the manual driving function.

[0189] If it is determined that there is no safety risk related to manual driving function (S702: No). Figure 23 The process then proceeds to S104 for processing.

[0190] On the other hand, if a safety risk is determined to be related to the autonomous driving function or the manual driving function (S701: Yes, S702: Yes), the charging control unit 41 will notify the driver of whether to disable (restrict) at least one driving function that poses a safety risk before implementing countermeasures such as vehicle firmware updates (S703). Here, at least one driving function that poses a safety risk refers to the autonomous driving function or the manual driving function that is determined to pose a safety risk.

[0191] The charging control unit 41 determines whether the user of the electric vehicle 5 agrees to disable the automatic driving function or the manual driving function (S704). If it is determined that the user agrees to disable the automatic driving function or the manual driving function (S704: Yes), the charging control unit 41 disables the automatic driving function or the manual driving function that the user has agreed to (S705). Afterwards, Figure 23 The process then proceeds to S104 for processing.

[0192] On the other hand, if it is determined that the user of electric vehicle 5 does not agree to the invalidation of the autonomous driving function or the manual driving function (S704: No), the charging control unit 41 requests an update of the vehicle's fuel gauge (FW) from the user (S706). Afterwards, Figure 23 The process is complete.

[0193] Figure 24 This is a timing diagram illustrating an example of power supply processing performed in the charging system 1 of the fourth embodiment, triggered by vehicle detection. Figure 24 This example illustrates a power supply process where the manual driving function and automatic driving function of the electric vehicle 5 being charged pose a safety risk, and the driver has consented to disabling the manual driving function. Here, the power supply process described is primarily the same as that in the first embodiment (see [reference]). Figure 12 The differences between them.

[0194] After the charging control unit 41 of the charging station management server 4 obtains the vehicle software configuration information 71b and vehicle management information 72b from the vehicle management server 6 (S305), it performs a safety risk assessment related to the autonomous driving function (S801) and a safety risk assessment related to the autonomous driving function (S802). Here, it is assumed that the model 724 of the electric vehicle 5 being charged is "Car-Model02", and the vehicle FW version 725 currently in use is "Ver.1.0".

[0195] In the safety risk determination related to the autonomous driving function (S801) and the safety risk determination related to the manual driving function (S802), the charging control unit 41 determines that there is a safety risk based on the difference between the current vehicle FW version 725, i.e., "Ver. 1.0", of the electric vehicle 5 being charged, and the latest vehicle FW version 712, i.e., "Ver. 2.0", of the "Car-Model 02" model 711 read from the vehicle software configuration information 71b. Furthermore, for the "Car-Model 02" model 711, the charging control unit 41 extracts the ECUFW of the corresponding functions 714 of "autonomous driving control" and "braking control" that differ in ECUFW version 715 between the vehicle FW versions 725 of "Ver. 1.0" and "Ver. 2.0". Moreover, since the charging control unit 41 has extracted the ECUFW of the corresponding functions 714 of "autonomous driving control" and "braking control", it determines that there is a safety risk to both the autonomous driving function and the manual driving function.

[0196] The charging control unit 41 of the charging station management server 4 outputs a notification of consent to disable driving functions with safety risks to the electric vehicle 5 (S803). Here, the consent confirmation notification in this embodiment is an example of notification information. In addition, the ECU 55, which controls the vehicle display or vehicle speaker of the electric vehicle 5, confirms the consent of the user of the electric vehicle 5 regarding the disabling of driving functions with safety risks (S804). As an example, the ECU 55 displays a confirmation screen for the user to confirm consent or outputs a confirmation sound. In addition, along with the driver's consent to disable the manual driving function, the ECU 55 outputs a notification of consent to disable driving functions with safety risks to the charging station management server 4 (S805). This notification of consent to disable driving functions with safety risks is also an example of notification information. Furthermore, these consent confirmations are not limited to being output to the electric vehicle 5, but can also be made using a portable terminal used by the driver, such as a smartphone, or a display or speaker mounted on the power supply device 32.

[0197] The charging control unit 41 of the charging station management server 4 outputs an instruction to disable the manual driving function to the electric vehicle 5 upon the driver's consent (S806). Here, the instruction to disable the manual driving function in this embodiment is an example of an instruction message used to disable at least one driving function that poses a safety risk. In addition, the ECU 55 that implements the corresponding function 714 of the electric vehicle 5, which is assigned the ECU ID 713 "ECU-004", or the ECU 55 that controls all manual driving functions, disables the manual driving function (S807) and outputs a notification of disabling the manual driving function to the charging station management server 4 (S808).

[0198] Subsequently, the charging control unit 41 of the charging station management server 4 outputs a power supply instruction to the charging device 3 based on the invalidation notification from the electric vehicle 5 (S809). In addition, the power supply device 32 of the charging device 3 outputs a power supply notification to the electric vehicle 5 based on the power supply instruction from the charging station management server 4, clears the communication between the power supply device 32 and the electric vehicle 5, and starts power supply (S310).

[0199] Furthermore, the charging control unit 41 may also output instruction information for disabling at least one driving function with safety risks to the vehicle management server 6 (S806) if the electric vehicle 5 can be driven by other driving functions after disabling at least one driving function with safety risks, and the electric vehicle 5 can avoid safety risks. In this case, the charging control unit 41 may also allow power supply to the electric vehicle 5 after receiving notification from the electric vehicle 5 that at least one driving function with safety risks has been disabled (S808).

[0200] Furthermore, in the charging system 1 of this embodiment, the charging control unit 41 may also be configured to, as a condition, deactivate (i.e., activate) the at least one driving function with a safety risk when the latest FW indicating the deactivation of at least one driving function with a safety risk is confirmed by referring to the vehicle management information 72b of the vehicle management server 6. Alternatively, the electric vehicle 5 may be configured to, maintain information on the latest FW indicating the deactivation of at least one driving function with a safety risk, and, if the FW applied in the FW update is consistent with the latest FW indicated by the maintained information, output a notification indicating consistency to the charging station management server 4 or the vehicle management server 6. In this case, the charging control unit 41 of the charging station management server 4 may also be configured to, upon confirming the notification of consistency from the electric vehicle 5, output an instruction to deactivate the driving function with a safety risk.

[0201] Thus, the charging control of the charging system 1 in this embodiment determines, based on the vehicle software configuration information 71b, whether there is a safety risk to the driving function of the electric vehicle 5. Furthermore, it determines whether the electric vehicle 5 can be driven using other driving functions and avoid the safety risk if at least one driving function with a safety risk is disabled. Moreover, if the charging control of this embodiment allows the electric vehicle 5 to be driven using other driving functions and avoids the safety risk if at least one driving function with a safety risk is disabled, then it allows power supply to the electric vehicle 5 even after disabling at least one driving function with a safety risk.

[0202] According to this configuration, by taking advantage of the power supply from the charging station, the driving function of the electric vehicle 5, which poses a safety risk, can be disabled, thus ensuring the safety of the electric vehicle 5. By allowing power supply under the condition of disabling the driving function that poses a safety risk, the electric vehicle 5 can safely drive after receiving power during charging. In other words, it is possible to protect the electric vehicle 5 connected to the charging device 3 from safety risks caused by the electric vehicle 5 itself when it is powered on.

[0203] Furthermore, the technology of this embodiment can be appropriately applied to the charging system 1 of each of the above embodiments.

[0204] (Fifth implementation)

[0205] The charging system 1 of this embodiment is the same as the charging system 1 of the fourth embodiment, except that it uses a charging reservation as a trigger to start the power supply process instead of vehicle detection. In other words, the differences between the charging system 1 of this embodiment and the charging system 1 of the fourth embodiment are the same as the differences between the charging system 1a of the first embodiment and the charging system 1 of the third embodiment.

[0206] Figure 25 This is a flowchart illustrating an example of power supply processing performed in the charging control unit 41 and reservation management unit 43 of the fifth embodiment, triggered by a charging reservation. Here, the power supply processing in the fourth embodiment (see [reference]) will be primarily explained. Figure 23 The differences between them.

[0207] exist Figure 25 In the process, if it is determined that there is no safety risk in the vehicle FW of electric vehicle 5 (S103: No), after the reservation management unit 43 accepts the charging reservation (S501), the charging control unit 41 outputs a power supply notification that allows power supply and performs power supply by the power supply device 32 (S104).

[0208] exist Figure 25In the process, if a safety risk is determined to be related to the autonomous driving function or the manual driving function (S701: Yes, S702: Yes), the charging control unit 41 notifies the user of the electric vehicle 5 of a vehicle FW update request (S901). Afterwards, the reservation management unit 43 sets a predetermined waiting time to accept charging reservations (S502). In other words, if there is a safety risk, and the electric vehicle 5 being charged can avoid the safety risk, the reservation management unit 43 sets a predetermined waiting time to set the reservation time for starting power supply. Furthermore, when the reservation time arrives, the charging control unit 41 determines whether the safety risk to the charging function has been eliminated (S503). If it is determined that the safety risk to the charging function has been eliminated (S503: Yes), then... Figure 25 The process then proceeds to S104. That is, the charging control unit 41 performs the first determination again before the scheduled time. If the result of the first determination before the scheduled time changes to no safety risk, power supply to the electric vehicle 5 is allowed without invalidating at least one driving function that poses a safety risk. On the other hand, if it is not determined that the safety risk to the charging function has been eliminated (S503: No). Figure 25 The process then proceeds to S703. That is, the charging control unit 41 performs the first determination again before the scheduled time. If the result of the first determination before the scheduled time does not change to no safety risk, power is supplied to the electric vehicle 5 on the basis of disabling at least one driving function that poses a safety risk.

[0209] Figure 26 This is a timing diagram illustrating an example of power supply processing performed in the charging system 1 of the fifth embodiment, triggered by a charging reservation. Here, the power supply processing in the fourth embodiment (see reference...) will be primarily explained. Figure 24 The differences between them.

[0210] The reservation management unit 43 begins charging reservation registration (S601). Furthermore, based on the information input by the user of the electric vehicle 5 and / or the authentication information used by the user when logging into the charging reservation registration service, the reservation management unit 43 obtains reservation information containing at least owner information 723 and vehicle model 724 and outputs it to the charging control unit 41 (S602). Here, it is assumed that the output is reservation information containing the owner information 723 "Owner002" and the vehicle model 724 "Car-Model02".

[0211] The charging control unit 41 of the charging station management server 4 outputs the vehicle software configuration information request to the vehicle management server 6 (S303), requesting the owner information 723 of "Owner002", the vehicle software configuration information 71b corresponding to the model 724 of "Car-Model02", and the vehicle management information 72b.

[0212] The information retrieval unit 61 of the vehicle management server 6 refers to the vehicle management information 72b based on the owner information 723, which is the vehicle identification information, and the vehicle model 724, which is the "Car-Model02". As a result, the information retrieval unit 61 determines that the vehicle FW version 725 used by the electric vehicle 5 to be charged at the current time is "Ver.1.0".

[0213] In the safety risk determination related to the autonomous driving function (S801) and the safety risk determination related to the manual driving function (S802), if a safety risk is determined to exist for both the autonomous driving function and the manual driving function, the charging control unit 41 instructs the reservation management unit 43 to schedule a charging plan including a predetermined waiting time (S603). Additionally, the charging control unit 41 outputs a vehicle FW update request to the electric vehicle 5 (S604), requesting the driver to update the vehicle FW during a predetermined waiting time set before the scheduled time.

[0214] The reservation management unit 43 accepts charging reservations at the scheduled time with a predetermined waiting time, according to the instructions from the charging control unit 41 (S605). In addition, when the scheduled time arrives, the charging control unit 41 determines whether the safety risk to the driving function has been eliminated (S606). If it determines that the safety risk to the driving function has not been eliminated, it outputs a notification confirming the invalidation of the driving function with safety risk to the electric vehicle 5 (S803).

[0215] Thus, the charging system 1 of this embodiment initiates power supply processing based on a charging reservation, and sets a waiting time to determine the reservation time when a safety risk to the driving function is identified. According to this configuration, in addition to the same effects as in the fifth embodiment, it achieves the effect of updating the vehicle's firmware during the waiting time before the reservation time. Therefore, the charging system 1 of this embodiment further improves the safety of charging control.

[0216] Furthermore, the technology of this embodiment can be appropriately applied to the charging system 1 of each of the above embodiments. Additionally, the charging system 1 of this embodiment can also be a charging system 1 of the fourth embodiment applying the technology of the third embodiment.

[0217] Furthermore, in the above embodiments, the determination of "whether it is A" can be achieved by determining "is A", or by determining "is not A", or by determining both.

[0218] The programs executed by each device of the charging system 1 of this embodiment are provided in an installable or executable form on a computer-readable recording medium such as a CD-ROM, FD, CD-R, or DVD.

[0219] Alternatively, the program executed by each device of the charging system 1 of this embodiment can be stored on a computer connected to a network such as the Internet, and provided by downloading it via the network. Alternatively, the program executed by each device of the charging system 1 of this embodiment can be provided or published via a network such as the Internet.

[0220] Alternatively, it can be configured such that the program executed by each device of the charging system 1 of this embodiment is pre-loaded into a ROM or the like.

[0221] According to at least one embodiment described above, it is possible to protect charging equipment connected to an electric vehicle from safety risks caused by the electric vehicle when power is supplied.

[0222] Several embodiments of the present invention have been described, but these embodiments are merely examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other ways, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the scope of the invention as described in the claims and their equivalents.

[0223] (Postscript)

[0224] The following technology is disclosed through the above description of the embodiments.

[0225] (A1)

[0226] A charging control method is disclosed, which is used in a charging control device connected to a charging equipment in a communicative manner. The charging equipment includes: a power supply device for charging an electric vehicle and a communication network connected to the power supply device. In this charging control method...

[0227] Based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle, the following is performed:

[0228] The first determination is to determine whether there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and

[0229] The second determination is whether the charging device can avoid the safety risk by degrading the function of the power supply device.

[0230] If the first determination indicates a safety risk, based on the second determination, a degradation mode is determined that causes the power supply device to malfunction.

[0231] The power supply device is controlled to supply power to the electric vehicle according to the determined degradation mode.

[0232] (A2)

[0233] According to the charging control method described in (A1) above,

[0234] The second determination includes: determining whether the security risk is a Class 1 security risk that can be avoided by disconnecting the power supply device from the communication network.

[0235] In the case where the security risk is a security risk of the first category, the power supply to the electric vehicle is controlled by the degradation mode in which the power supply device is disconnected from the communication network.

[0236] (A3)

[0237] According to the charging control method described in (A1) or (A2) above,

[0238] If the first determination indicates the existence of the security risk, and the second determination indicates that the security risk can be avoided, a predetermined waiting time is set, and the power supply start time is set.

[0239] The first determination is performed again before the power supply time.

[0240] If the result of the first determination changes to no safety risk before the power supply moment, the power supply to the electric vehicle is controlled without causing the power supply device to degrade its function.

[0241] If the result of the first determination before the power supply time does not become no safety risk, the power supply device is controlled to supply power to the electric vehicle in the degradation mode where the power supply device is disconnected from the communication network.

[0242] (A4)

[0243] According to any one of the charging control methods described in (A1) to (A3) above,

[0244] The fact that no abnormal changes were made to the power supply device after it was disconnected from the communication network was verified.

[0245] Without any abnormal changes, reconnect the power supply to the communication network.

[0246] In the event of the aforementioned abnormal changes, the power supply device is rolled back to further verify whether there are any abnormal actions. If there are no abnormal actions, the power supply device is reconnected to the communication network.

[0247] (A6)

[0248] According to any one of the charging control methods described in (A1) to (A5) above,

[0249] In the first determination, based on the software information, it is further determined whether there is a safety risk to at least one driving function of the electric vehicle caused by the firmware of the at least one electronic control device.

[0250] If the determination result of the first determination is that the predetermined function among the at least one driving function has a safety risk, and if the safety risk can be avoided by disabling the predetermined function, then the power supply device is allowed to supply power to the electric vehicle on the basis of disabling the predetermined function of the electric vehicle.

[0251] (A7)

[0252] A charging control device is communicatively connected to a charging device, the charging device comprising: a power supply for charging an electric vehicle and a communication network connected to the power supply; the charging control device includes a determination unit and a control unit.

[0253] The determination unit performs the following based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle:

[0254] The first determination is to determine whether there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and

[0255] The second determination is whether the charging device can avoid the safety risk by degrading the function of the power supply device.

[0256] If the first determination results in a safety risk, the control unit determines a degradation mode that degrades the function of the power supply device based on the second determination result, and controls the power supply device to supply power to the electric vehicle in the determined degradation mode.

[0257] (A8)

[0258] A program for executing on a computer that is communicatively connected to a charging device having a power supply for charging an electric vehicle and a communication network connected to said power supply:

[0259] Based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle, the following is performed:

[0260] The first determination is to determine whether there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and

[0261] The second determination is whether the charging device can avoid the safety risk by degrading the function of the power supply device.

[0262] If the first determination indicates a safety risk, based on the second determination, a degradation mode is determined that causes the power supply device to malfunction.

[0263] The power supply device is controlled to supply power to the electric vehicle according to the determined degradation mode.

[0264] (B1)

[0265] A charging control method is provided, which is used in a charging control device connected communicatively to an electric vehicle and a power supply device for charging the electric vehicle. In this charging control method...

[0266] Based on software information that includes at least firmware information of the electronic control device installed in the electric vehicle, the following is performed:

[0267] The first determination is to determine whether there are any safety risks to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device; and

[0268] The second determination, if the result of the first determination is that there is a safety risk, determines whether, after disabling at least one of the plurality of driving functions that poses the safety risk, it is possible to drive using the other driving functions and avoid the safety risk of the electric vehicle.

[0269] If, while disabling at least one driving function, the vehicle can still be driven using the other driving functions and the safety risks can be avoided, then, while disabling at least one driving function, the power supply device is allowed to supply power to the electric vehicle.

[0270] (B2)

[0271] According to the charging control method described in (B1) above,

[0272] If, after disabling at least one driving function, the vehicle can still drive using the other driving functions and avoid the safety risks, a notification message regarding whether to disable at least one driving function will be output to the driver.

[0273] If a notification is received from the driver indicating consent to disable at least one driving function, an instruction to disable at least one driving function is output to the electric vehicle.

[0274] (B3)

[0275] According to the charging control method described in (B1) or (B2) above, if the first determination result indicates the existence of the safety risk and the second determination indicates that the safety risk can be avoided, a predetermined waiting time is set to determine the power supply start time.

[0276] The first determination is performed again before the power supply time.

[0277] If the result of the first determination changes to no safety risk before the power supply time, power supply to the electric vehicle is permitted without disabling at least one driving function.

[0278] If the result of the first determination before the power supply time does not become no safety risk, the power supply device is allowed to supply power to the electric vehicle on the basis of disabling at least one driving function.

[0279] (B4)

[0280] According to any one of the charging control methods described in (B1) to (B3) above,

[0281] If, after disabling at least one driving function, the vehicle can still travel using the other driving functions and avoid the safety risks, then an instruction message for disabling at least one driving function is output.

[0282] Upon receiving notification that at least one of the driving functions of the electric vehicle has been disabled, the power supply device is permitted to supply power to the electric vehicle.

[0283] (B5)

[0284] According to any one of the charging control methods described in (B1) to (B4) above,

[0285] In the first determination, based on the software information, it is further determined whether there is a safety risk to the charging function of the electric vehicle caused by the firmware of the electronic control device.

[0286] If the first determination indicates that there is a safety risk to the charging function, and the safety risk can be avoided by degrading the function of the power supply device, then a degradation mode for degrading the function of the power supply device is determined based on the category of the safety risk.

[0287] The power supply device is controlled to supply power to the electric vehicle according to the determined degradation mode.

[0288] (B6)

[0289] A charging control device is communicatively connected to an electric vehicle and a power supply device for charging the electric vehicle, the charging control device comprising:

[0290] The determination unit performs the following based on software information, which includes at least firmware information of the electronic control device installed in the electric vehicle:

[0291] The first determination is to determine whether there are any safety risks to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device; and

[0292] The second determination, if the result of the first determination is that there is a safety risk, determines whether, after disabling at least one of the plurality of driving functions that poses the safety risk, it is possible to drive using the other driving functions among the plurality of driving functions and avoid the safety risk of the electric vehicle; and

[0293] The control unit, while enabling the vehicle to operate via the other driving functions and avoiding the safety risks by disabling at least one driving function, allows the power supply device to supply power to the electric vehicle while disabling at least one driving function.

[0294] (B7)

[0295] A program for executing on a computer connected in a communicative manner to an electric vehicle and a power supply device for charging the electric vehicle:

[0296] Based on software information that includes at least firmware information of the electronic control device installed in the electric vehicle, the following is performed:

[0297] The first determination is whether there is a safety risk to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device.

[0298] The second determination, if the result of the first determination is that there is a safety risk, determines whether, after disabling at least one of the plurality of driving functions that poses the safety risk, it is possible to drive using the other driving functions among the plurality of driving functions and avoid the safety risk of the electric vehicle; and

[0299] If the vehicle can be driven by the other driving functions while disabling at least one driving function and the safety risks can be avoided, the power supply device is permitted to supply power to the electric vehicle while disabling at least one driving function.

[0300] (C1)

[0301] A recording medium (Computer Program Product) containing a program described in (A8) or (B7) above, which is executed by a computer.

[0302] Label Explanation

[0303] 1. Charging System

[0304] 3. Charging equipment

[0305] 31 Charging Station Management Terminal

[0306] 311 Testing Department

[0307] 312 First Communications Control Department

[0308] 313 Power Supply Equipment Management Department

[0309] 32 Power supply device

[0310] 33. Device Communication Network

[0311] 34. Verify the network

[0312] 301 Connecting Components

[0313] 4. Charging Station Management Server

[0314] 41 Charging Control Unit

[0315] 411 First Judgment Department

[0316] 412 Second Judgment Section

[0317] 413 Charging control indicator

[0318] 414 Storage Control Department

[0319] 415 Second Communications Control Department

[0320] 416 Verification Department 1

[0321] 417 Verification Department 2

[0322] 42 First Storage Unit

[0323] 43 Reservation Management Department

[0324] 44 Display Section

[0325] 45 1st Communications Department

[0326] 5 Electric vehicles

[0327] 51 Vehicle Network

[0328] 53 External communication I / F

[0329] 54 Power Supply I / F

[0330] 55 ECU

[0331] 6. Vehicle Management Server

[0332] 61 Information Retrieval Department

[0333] 62 2nd Communications Department

[0334] 63 Second Storage Section

[0335] N External network.

Claims

1. A charging control method, used in a charging control device, the charging control device being communicatively connected to a charging equipment, the charging equipment comprising: a power supply device for charging an electric vehicle, and a communication network connected to the power supply device, wherein the charging control method, Based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle, the following is performed: The first determination is to determine whether there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and The second determination is whether the charging device can avoid the safety risk by degrading the function of the power supply device. If the first determination indicates a safety risk, based on the second determination, a degradation mode is determined that causes the power supply device to malfunction. The power supply device is controlled to supply power to the electric vehicle according to the determined degradation mode.

2. The charging control method according to claim 1, The second determination includes: The determination of whether the security risk is a Category 1 security risk that can be avoided by disconnecting the power supply device from the communication network. In the case where the security risk is a security risk of the first category, the power supply to the electric vehicle is controlled by the degradation mode in which the power supply device is disconnected from the communication network.

3. The charging control method according to claim 1, If the first determination indicates the existence of the aforementioned safety risk, and the second determination indicates that the safety risk can be avoided, a predetermined waiting time is set to determine the power supply start time. The first determination is performed again before the power supply time. If the result of the first determination changes to no safety risk before the power supply moment, the power supply to the electric vehicle is controlled without causing the power supply device to degrade its function. If the result of the first determination before the power supply time does not become no safety risk, the power supply device is controlled to supply power to the electric vehicle in the degradation mode where the power supply device is disconnected from the communication network.

4. The charging control method according to claim 2 or 3, The fact that no abnormal changes were made to the power supply device after it was disconnected from the communication network was verified. Without any abnormal changes, reconnect the power supply to the communication network. In the event of the aforementioned abnormal changes, the power supply device is rolled back to further verify whether there are any abnormal actions. If there are no abnormal actions, the power supply device is reconnected to the communication network.

5. The charging control method according to claim 4, After the power supply device, which has been disconnected from the communication network, has completed supplying power to the electric vehicle, or after the power supply device has become disconnected from the electric vehicle, it is verified that there are no abnormal changes in the power supply device.

6. The charging control method according to claim 1, In the first determination, based on the software information, it is further determined whether there is a safety risk to at least one driving function of the electric vehicle caused by the firmware of the at least one electronic control device. If the determination result of the first determination is that the predetermined function among the at least one driving function has a safety risk, and if the safety risk can be avoided by disabling the predetermined function, then the power supply device is allowed to supply power to the electric vehicle on the basis of disabling the predetermined function of the electric vehicle.

7. A charging control device, communicatively connected to a charging device, the charging device comprising: a power supply for charging an electric vehicle and a communication network connected to the power supply; the charging control device comprising a determination unit and a control unit. The determination unit performs the following based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle: The first determination is to determine whether there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and The second determination is whether the charging device can avoid the safety risk by degrading the function of the power supply device. If the first determination results in a safety risk, the control unit determines a degradation mode that degrades the function of the power supply device based on the second determination result, and controls the power supply device to supply power to the electric vehicle in the determined degradation mode.

8. A program for causing a computer connected in a communicative manner to a charging device having a power supply for charging an electric vehicle and a communication network connected to said power supply: Based on software information containing firmware information of at least one electronic control device mounted on the electric vehicle, the following is performed: The first determination is to determine whether there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and The second determination is whether the charging device can avoid the safety risk by degrading the function of the power supply device. If the first determination indicates a safety risk, based on the second determination, a degradation mode is determined that causes the power supply device to malfunction. The power supply device is controlled to supply power to the electric vehicle according to the determined degradation mode.

Images