Server, information processing system and information processing method

Abstract

To appropriately update a control program of an ECU mounted on an automatic driving vehicle.SOLUTION: A vehicle that is an automatic driving vehicle is configured to acquire a control program for an ECU from a control center by wireless communication. A server 1 includes a keyboard 13 and mouse 14 to accept handling by an operation manager that manages the operation of the vehicle from outside of the vehicle, a display 16 to present information to the operation manager, a communication IF17 configured to communicate with the control center, and a processor 11. The processor 11 controls the display 16 to present an update condition of the control program to the operation manager when an updatable control program exists. The processor 11 controls the communication IF17 to notify the control center of an approval of an update of the control program when the keyboard 13 and mouse 14 accept handling by the operation manager for approving the update of the control program.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a server and an information processing method, and more particularly to a server that manages the operation of an autonomously driven vehicle, an information processing system including the server, and an information processing method for managing information related to the operation of the autonomously driven vehicle by the server. [Background technology]

[0002] Japanese Patent Laid-Open Publication No. 2018-132979 (Patent Document 1) discloses a software update system that manages software updates for a control device mounted on a vehicle. The system updates the software through wireless communication (so-called OTA (Over The Air)). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-132979 A Summary of the Invention [Problem to be solved by the invention]

[0004] When updating software on electrical devices such as personal computers and smartphones, it is common to require the user's permission before updating the software. Similarly, when updating a control program for a control device installed in a vehicle, it is considered necessary to obtain the user's permission in advance.

[0005] The present inventors have focused on the fact that the following problems may arise in autonomous vehicles. In conventional vehicles, the driver is in the vehicle cabin, so it is sufficient to obtain permission to update the control program from the driver. On the other hand, autonomous vehicles may be operated and managed from outside the autonomous vehicle. In other words, the operation manager is not necessarily in the vehicle cabin in autonomous vehicles. Therefore, how to obtain permission to update the control program may be an issue. Patent Document 1 does not consider such a situation at all.

[0006] The present disclosure has been made to solve the above-mentioned problems, and an object of the present disclosure is to appropriately update a control program of a control device installed in an autonomous driving vehicle. [Means for solving the problem]

[0007] (1) A server according to an aspect of the present disclosure manages the operation of an autonomous vehicle. The autonomous vehicle is configured to obtain a control program for a control device mounted on the autonomous vehicle from a control center via wireless communication. The server includes an input device that accepts an operation of an operations manager who manages the operation of the autonomous vehicle from outside the autonomous vehicle, an output device that presents information to the operations manager, a communication device configured to be able to communicate with at least one of the autonomous vehicle and the control center, and a processor that controls the input device, the output device, and the communication device. When an updatable control program exists, the processor controls the output device to present an update condition for the control program to the operations manager. When an operation of the operations manager authorizing the update of the control program is accepted by the input device, the processor controls the communication device to notify at least one of the autonomous vehicle and the control center of the authorization for the update of the control program.

[0008] (2) The server further includes an authentication device configured to authenticate the fleet manager. The processor controls the output device to present the update conditions to the fleet manager authenticated by the authentication device.

[0009] (3) The processor controls the input device to accept operations from an operations manager authenticated by the authentication device, while not accepting operations from an operator not authenticated by the authentication device.

[0010] (4) The update conditions include conditions regarding the time required to update the control program.

[0011] (5) The update conditions include conditions regarding the period during which the control program can be updated.

[0012] (6) The server manages the operation of a plurality of vehicles, each of which is equipped with a plurality of control devices. The update conditions include conditions for identifying a vehicle, among the plurality of vehicles, whose control program is to be updated, and conditions for identifying a control device, among the plurality of control devices installed in the vehicle, whose control program is to be updated.

[0013] (7) The update conditions include conditions regarding the functions of the autonomous vehicle that are updated by the control program.

[0014] (8) The update conditions include conditions regarding the functions of the autonomous vehicle that are restricted as a result of updating the control program.

[0015] (9) The update conditions include conditions regarding the control center's exemption from liability for malfunctions that may occur as a result of updating the control program.

[0016] (10) An information processing system according to another aspect of the present disclosure includes the above-described server and an autonomous driving vehicle.

[0017] (11) When at least one of the autonomous vehicle and the control center receives a notification approving the update of the control program, the autonomous vehicle obtains the control program from the control center, and when at least one of the autonomous vehicle and the control center receives a notification rejecting the update of the control program, the autonomous vehicle does not obtain the control program from the control center.

[0018] (12) An information processing method according to yet another aspect of the present disclosure manages information related to the operation of an autonomous vehicle by a server. The autonomous vehicle is configured to obtain a control program of a control device mounted on the autonomous vehicle from a control center via wireless communication. The information processing method includes first and second steps. The first step is a step in which, when an updatable control program exists, the server presents update conditions for the control program to an operations manager who manages the operation of the autonomous vehicle from outside the autonomous vehicle. The second step is a step in which, when the operations manager performs an operation to authorize the update of the control program, the server notifies at least one of the autonomous vehicle and the control center of the authorization for the update of the control program. Effect of the Invention

[0019] According to the present disclosure, it is possible to appropriately update a control program of a control device installed in an autonomous driving vehicle. [Brief description of the drawings]

[0020] [Figure 1] 1 is a diagram showing a schematic configuration of an information processing system according to an embodiment of the present invention; [Diagram 2] FIG. 2 is a block diagram showing a typical hardware configuration of a server. [Diagram 3] FIG. 2 is a block diagram showing a typical hardware configuration of a server. [Figure 4] FIG. 2 is a functional block diagram showing a functional configuration of a server regarding updating of a control program. [Diagram 5] FIG. 2 is a functional block diagram showing a functional configuration of a server related to starting driving after a control program is updated. [Figure 6] 1 is a first flowchart illustrating the flow of processing executed in the information processing system. [Figure 7] 13 is a diagram showing an example of an image displayed on a display before an inquiry is made to an operations manager about whether or not a control program can be updated. FIG. [Figure 8]13 is a diagram showing an example of an image displayed on a display when an inquiry is made to an operations manager about whether or not a control program can be updated. FIG. [Figure 9] 11 is a second flowchart illustrating the flow of processes executed in the information processing system. [Figure 10] FIG. 13 is a diagram showing an example of an image displayed on a display before an inquiry is made to a remote monitor as to whether or not the vehicle can start traveling. [Figure 11] 13 is a diagram showing an example of an image displayed on a display when inquiring of a remote monitor as to whether or not the vehicle can start traveling; FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference characters and their description will not be repeated.

[0022] [Embodiment Mode] <Outline of information processing system configuration> Fig. 1 is a diagram showing a schematic configuration of an information processing system according to the present embodiment. The information processing system 100 includes a server 1, a control center 2, and a plurality of vehicles 3A, 3B, and 3C. For ease of explanation, any one of the terminal devices of the vehicles 3A, 3B, and 3C will be referred to as a vehicle 3 below. Although three vehicles 3 are shown in Fig. 1, the number of vehicles 3 is an arbitrary value.

[0023] The server 1 is, for example, a server owned by a business operator (such as a bus business operator, a taxi business operator, or a ride-sharing service operator) that manages the operation of the vehicle 3. The server 1 may be a shared server shared by a plurality of businesses including the business operator in question. The server 1 may be a cloud server provided by a cloud server management company.

[0024] The server 1 is used by the operation manager of the vehicle 3 and also by a remote monitor of the vehicle 3. The operation manager is, for example, an employee (a so-called higher-level manager) who works for an entity that manages the operation of the vehicle 3 and has the authority to update the control program of the vehicle 3. The remote monitor is an employee (a so-called operator) who remotely monitors the vehicle 3 and operates the vehicle 3 as appropriate. The operation manager and the remote monitor are usually different persons, but may be the same person. In this example, a situation will be described in which the operation manager and the remote monitor are different persons.

[0025] The control center 2 is a server of a business entity (eg, a vehicle manufacturer) that provides a control program for an ECU (Electronic Control Unit) 31 (see FIG. 2) mounted on a vehicle 3.

[0026] Each vehicle 3 is an autonomous vehicle. Each vehicle 3 is used for the services provided by the above-mentioned business operator. The type (model) of the vehicle 3 is appropriately selected according to the services provided by the business operator. In this example, the vehicle 3 is a bus. The server 1, the control center 2, and each vehicle 3 are connected to each other so as to be able to communicate with each other via a wired or wireless network NW.

[0027] <Vehicle hardware configuration> 2 is a block diagram showing a typical hardware configuration of the vehicle 3. The vehicle 3 includes an ECU 31, an automatic driving system 32, a sensor group 33, a navigation system 34, and a DCM (Data Communication Module) 35. The ECU 31, the automatic driving system 32, the sensor group 33, the navigation system 34, and the DCM 35 are connected to each other via a wired in-vehicle network such as a Controller Area Network (CAN) or Ethernet (registered trademark).

[0028] The ECU 31 includes a processor 311 and a memory 312. The memory 312 includes a read only memory (ROM) 312A, a random access memory (RAM) 312B, and a flash memory 312C. The processor 311 controls the overall operation of the vehicle 3 by executing a control program. The memory 312 stores software executed by the processor 311. In particular, the flash memory 312C stores a control program that is updated by OTA. Note that the flash memory 312C may be another rewritable non-volatile memory.

[0029] The ECU 31 controls devices so that the vehicle 3 is in a desired state in response to signals from the sensor group 33 and the like. The ECU 31 outputs commands for controlling various systems in cooperation with the automatic driving system 32. Although none of the various systems are shown, they may include a brake system, a steering system, a power train system (e.g., an electric parking brake system, a parking lock system, a shift device, a motor generator), a body system (e.g., a turn signal, a horn, and windshield wipers), and the like.

[0030] The ECU 31 transmits various information indicating the state of the vehicle 3 to the server 1 and transmits various requests to the server 1 via the DCM 35. The ECU 31 also receives commands or notifications from the server 1 via the DCM 35. In addition, in this embodiment, the ECU 31 receives (downloads) a control program from the control center 2 via the DCM 35 and installs the downloaded control program in the memory 312 at an appropriate timing. Then, the ECU 31 activates the installed control program at an appropriate timing. The ECU 31 may be divided into multiple ECUs for each function. In an example described later (see FIG. 8), the ECU 31 includes a camera ECU.

[0031] The automatic driving system 32 is configured to realize automatic driving of the vehicle 3. Automatic driving is a control in which the operation of the vehicle 3 is executed without the driving operation of the driver of the vehicle 3 (unmanned driving). In this example, the automatic driving system 32 is configured to enable fully automatic driving of the vehicle 3. However, the automatic driving may include control to assist the driving operation of the driver of the vehicle 3 during operations such as acceleration, deceleration, and steering of the vehicle 3 (manned driving). The automatic driving system 32 may be a part of the ECU 31.

[0032] The sensor group 33 includes a sensor configured to detect the external situation of the vehicle 3, and also includes sensors (none of which are shown) configured to detect information corresponding to the traveling state of the vehicle 3, as well as a steering operation, an accelerator operation, and a brake operation. Specifically, the sensor group 33 may include, for example, a camera, a radar, a LIDAR (Laser Imaging Detection and Ranging), a vehicle speed sensor, an acceleration sensor, and a yaw rate sensor (none of which are shown).

[0033] The navigation system 34 includes a GPS (Global Positioning System) receiver (not shown). The GPS receiver identifies the position of the vehicle 3 based on radio waves from an artificial satellite (not shown). The navigation system 34 executes navigation processing for the vehicle 3 using the position information of the vehicle 3 identified by the GPS receiver.

[0034] The DCM 35 is an in-vehicle communication module that is configured to enable two-way data communication between the ECU 31 and the server 1, and to enable two-way data communication between the ECU 31 and the control center 2.

[0035] <Server hardware configuration> 3 is a block diagram showing a typical hardware configuration of the server 1. The server 1 includes a processor 11, a memory 12, a keyboard 13, a mouse 14, a camera 15, a display 16, and a communication interface (IF) 17. The memory 12 includes a ROM 121, a RAM 122, and a HDD (Hard Disk Drive) 123. The processor 11, the memory 12, the keyboard 13, the mouse 14, the camera 15, the display 16, and the communication IF 17 are connected to each other via a bus.

[0036] The processor 11 controls the overall operation of the server 1. The memory 12 stores an operating system and application programs executed by the processor 11. The keyboard 13 and mouse 14 accept user input. The camera 15 photographs the operator of the server 1. In this embodiment, the operator of the server 1 is an operation manager or a remote monitor of the vehicle 3. The display 16 displays various information to the operator of the server 1. The communication IF 17 is configured to be capable of communicating with the control center 2 and each vehicle 3.

[0037] At least one of the keyboard 13 and the mouse 14 corresponds to the "input device" according to the present disclosure. The "input device" may be an operation terminal dedicated to vehicle operation management, a touch panel, a microphone, etc. At least one of the display 16 and the communication IF 17 corresponds to the "output device" according to the present disclosure. The "output device" may be, for example, a speaker. At least one of the keyboard 13, the mouse 14, and the camera 15 corresponds to the "authentication device" according to the present disclosure.

[0038] <Control program update> When updating software for electrical devices such as personal computers and smartphones, it is common to require the user's permission. However, since the vehicle 3, which is an autonomous vehicle, is operated and managed from outside the vehicle 3, there is no operation manager inside the vehicle. Therefore, how to obtain permission to update the control program can be an issue.

[0039] In this embodiment, if an updatable control program exists, the server 1 (processor 11) displays the update conditions for the control program on the display 16. Then, when the operations manager operates the keyboard 13 or mouse 14 to permit the update of the control program, the server 1 notifies the control center 2 and / or the vehicle 3 of the permission for the control program update. On the condition that the notification of permission has been received, the control center 2 and the vehicle 3 carry out an update of the control program via wireless communication (OTA). This allows the control program to be updated appropriately even if the vehicle 3 is unmanned.

[0040] <Server Functional Configuration> 4 is a functional block diagram showing the functional configuration of the server 1 regarding the update of the control program. The server 1 includes a communication unit 41, a calculation processing unit 42, an input unit 43, a display unit 44, and an image capturing unit 45. The calculation processing unit 42 is a functional block realized by the processor 11 executing the operating system and application programs stored in the memory 12. The calculation processing unit 42 includes a communication control unit 421, a notification unit 422, an operation acceptance unit 423, an image generation unit 424, a storage unit 425, and an authentication unit 426.

[0041] The communication unit 41 communicates with the outside (the control center 2 and / or the vehicle 3). More specifically, the communication unit 41 receives update conditions for the control program of the ECU 31 of the vehicle 3 from the outside. Details of the update conditions will be described later. The communication unit 41 also transmits to the outside a notification indicating whether or not the operation manager of the vehicle 3 who has confirmed the update conditions for the control program approves the update of the control program (approval / rejection). The communication unit 41 corresponds to the communication IF 17 in FIG. 3.

[0042] The communication control unit 421 controls communication with the outside via the communication unit 41. The communication control unit 421 outputs the update condition of the control program received by the communication unit 41 to the image generation unit 424, and transmits the notification generated by the notification unit 422 from the communication unit 41 to the outside.

[0043] The operation acceptance unit 423 outputs an input operation to the input unit 43 by the operations manager of the vehicle 3 to the notification unit 422 or the authentication unit 426. More specifically, the operation acceptance unit 423 outputs a result of the operations manager's selection of whether or not to approve the update of the control program (in an example described later, a result of operation of the Yes button / No button) to the notification unit 422. The operation acceptance unit 423 can also output a password input by the operations manager to the authentication unit 426. The input unit 43 corresponds to the keyboard 13 or the mouse 14 in FIG. 3.

[0044] The image generating unit 424 generates an image showing the update conditions of the control program received by the communication control unit 421. The image generating unit 424 also generates an image for the operations manager who has confirmed the update conditions to select whether or not to approve the update of the control program. The display unit 44 displays the image generated by the image generating unit 424 to the operations manager. The display unit 44 corresponds to the display 16 in FIG. 3.

[0045] The photographing unit 45 photographs the operation manager of the vehicle 3, and outputs the photographed image to the authentication unit 426. The photographing unit 45 corresponds to the camera 15 in FIG.

[0046] The storage unit 425 stores data for authenticating the operations manager of the vehicle 3. The authentication method for the operations manager is not particularly limited, and various known methods can be adopted. In this example, the storage unit 425 stores features for face authentication of the operations manager. The storage unit 425 may also store data for other biometric authentication (fingerprint authentication, iris authentication, voice authentication, etc.). The storage unit 425 may also store a password set by the operations manager.

[0047] The authentication unit 426 authenticates the operations manager based on the image captured by the imaging unit 45 and the feature amount stored in the storage unit 425. The authentication unit 426 may authenticate the operations manager based on the password input to the input unit 43 and the password stored in the storage unit 425. The authentication unit 426 outputs the authentication result to the notification unit 422.

[0048] When the authentication unit 426 authenticates that the person operating the server 1 is a legitimate operations manager registered in advance, the notification unit 422 generates a notification indicating whether the operations manager approves the update of the control program. More specifically, when the operations manager performs an operation to approve the update of the control program (when the Yes button is pressed), the notification unit 422 generates a control program update approval notification. On the other hand, when the operations manager performs an operation to not approve the update of the control program (when the No button is pressed), the notification unit 422 generates a control program update rejection notification. The notification generated by the notification unit 422 is output to the communication control unit 421 and transmitted from the communication unit 41 to the outside.

[0049] 5 is a functional block diagram showing the functional configuration of the server 1 with respect to the start of traveling after the control program is updated. The server 1 includes a communication unit 51, a calculation processing unit 52, an input unit 53, and a display unit 54. The calculation processing unit 52 is a functional block realized by the processor 11 executing the operating system and application programs stored in the memory 12, similar to the calculation processing unit 42. The calculation processing unit 52 includes a communication control unit 521, a notification unit 522, an operation acceptance unit 523, and an image generation unit 524.

[0050] The communication unit 51 communicates with the outside. The communication unit 51 receives the changes to the control program from the outside. The changes will be described in detail later. The communication unit 51 also transmits to the outside a notification indicating whether or not the remote monitor of the vehicle 3 who has confirmed the changes to the control program approves (rejects / prohibits) the start of driving (restart of driving) of the vehicle 3. The communication unit 51 corresponds to the communication IF 17 in FIG. 3.

[0051] The communication control unit 521 controls communication with the outside via the communication unit 51. The communication control unit 521 outputs the change content of the control program received by the communication unit 51 to the image generation unit 524, and transmits the notification generated by the notification unit 522 from the communication unit 51 to the outside.

[0052] The operation receiving unit 523 outputs an input operation to the input unit 53 by the remote monitor of the vehicle 3 to the notification unit 522. More specifically, the operation receiving unit 523 outputs a result of the remote monitor's selection of whether or not to approve the update of the control program (operation result of the Yes button / No button) to the notification unit 522.

[0053] The image generation unit 524 generates an image showing the changes to the control program received by the communication control unit 521. The image generation unit 524 also generates an image for the remote monitor who has confirmed the changes to select whether or not to permit the vehicle 3 to start traveling after the control program is updated. The display unit 54 displays the image generated by the image generation unit 524 to the remote monitor. The display unit 54 corresponds to the display 16 in FIG. 3.

[0054] The notification unit 522 generates a notification indicating whether or not the remote monitor approves the start of traveling of the vehicle 3. More specifically, when the remote monitor performs an operation to approve the start of traveling of the vehicle 3 (when the Yes button is pressed), the notification unit 522 generates a notification of permission for the start of traveling of the vehicle 3. On the other hand, when the remote monitor performs an operation to not approve the start of traveling of the vehicle 3 (when the No button is pressed), the notification unit 522 generates a notification of prohibition for the start of traveling of the vehicle 3. The notification generated by the notification unit 522 is output to the communication control unit 521 and transmitted from the communication unit 51 to the outside.

[0055] <Processing flow> FIG. 6 is a first flowchart for explaining the flow of processing executed by the information processing system 100. The flowcharts shown in FIG. 6 and FIG. 9 described later are executed, for example, at predetermined time intervals. The left side shows processing executed by the server 1, and the right side shows processing executed by the control center 2. The processing on the right side may be executed by the vehicle 3. This is because the control center 2 and the vehicle 3 are capable of communicating with each other, and therefore a notification from the server 1 may reach the vehicle 3 via the control center 2, and may reach the control center 2 via the vehicle 3. Each step is realized by software processing, but may also be realized by hardware (electrical circuitry). Hereinafter, a step is abbreviated as "S".

[0056] In S21, the control center 2 determines whether or not an updatable control program exists for the ECU 31 of the vehicle 3. If an updatable control program exists (YES in S21), the control center 2 notifies the server 1 of that fact. At this time, the control center 2 also notifies the server 1 of the update conditions (described later) for the control program (S22).

[0057] Upon receiving a notification from the control center 2, the server 1 detects the operator of the server 1, for example, by using the camera 15 (S11). Then, the server 1 authenticates whether the operator of the server 1 is a legitimate operations manager registered in advance (S12). If the operator of the server 1 is authenticated (YES in S13), the server 1 displays the update conditions for the control program on the display 16 (S14). The server 1 inquires of the operations manager as to whether or not the control program should be updated. Then, the server 1 accepts an operation by the operations manager regarding whether or not the control program should be updated (S15).

[0058] 7 is a diagram showing an example of an image displayed on the display 16 before an inquiry is made to the operation manager about whether or not the control program can be updated. Before an inquiry is made to the operation manager, the running status of each of the multiple vehicles 3 (buses in this example) under the management of the server 1 is displayed on the operation management screen of the display 16. More specifically, the time, the name of the running route of the vehicle 3, the identification number of the vehicle 3, and the status of the vehicle 3 (delay relative to the time specified in the timetable, decrease in SOC (State Of Charge), etc.) are displayed. In addition, a map showing the current location of each vehicle 3 on the running route is displayed on the display 16.

[0059] FIG. 8 is a diagram showing an example of an image displayed on the display 16 when an inquiry is made to the operations manager about whether or not the control program can be updated. When making an inquiry to the operations manager, a dialog box is displayed on the screen shown in FIG. 7. The dialog box displays, for example, information identifying the target vehicle 3 (car No. 1 in this example), information identifying the target ECU (camera ECU), a brief explanation of the update contents of the control program (supporting additional video codec formats), a disclaimer in case of a defect in the updated control program (none in particular), and functional constraints associated with the control program update (none in particular). In addition, the dialog box displays, for example, the planned update period for the control program (from 6:00 p.m. today to 8:00 a.m. the following day) and the time required to update the control program (about 5 minutes).

[0060] The server 1 displays each of the above update conditions and then asks the operation manager of the vehicle 3 whether or not to approve the update of the control program. In this example, if the operation manager clicks the "Yes" button, the update of the control program is approved (permitted). On the other hand, if the operation manager clicks the "No" button, the update of the control program is rejected (prohibited). The operation manager can click the "Check details" button to check more detailed content of each update condition and then decide whether to approve or reject the update.

[0061] 6 again, when the operation permitting the update of the control program is performed by the operations manager (YES in S16), the server 1 notifies the control center 2 of the permission to update the control program (S18). When the control center 2 receives the notification of the permission to update (YES in S23), if the conditions suitable for updating the control program are met (for example, when the vehicle 3 that has completed the provision of the operation service returns to the garage and is parked), the control center 2 executes the update of the control program (OTA) in cooperation with the vehicle 3 (S24). That is, the control program is downloaded from the control center 2 to the vehicle 3 and installed in the flash memory 312C of the ECU 31.

[0062] On the other hand, if the operations manager performs an operation to reject the control program update (NO in S16), the server 1 notifies the control center 2 of the rejection of the control program update (S17). If the control center 2 receives the notification of the rejection of the update (NO in S23), it does not execute the control program update (OTA). Although not shown, the control center 2 also does not execute the control program update if the operation to permit the control program update is not performed within the time limit.

[0063] 9 is a second flowchart for explaining the flow of processes executed in the information processing system 100. These processes are executed after the control program is updated according to the first flowchart shown in FIG.

[0064] In S41, the vehicle 3 determines whether or not the travel start condition of the vehicle 3 has been satisfied. For example, when the travel start time approaches for the vehicle 3 parked in the garage after the control program has been updated, the vehicle 3 determines that the travel start condition of the vehicle 3 has been satisfied. When the travel start condition of the vehicle 3 has been satisfied (YES in S41), the vehicle 3 notifies the server 1 of the changes to the control program (S42). This notification is sent to a remote monitor other than the operation manager.

[0065] When the server 1 receives the notification from the vehicle 3, the server 1 displays the changes to the control program on the display 16 (S31). The server 1 inquires of the remote monitor as to whether or not the vehicle 3 can start traveling after the control program has been updated. The server 1 then accepts an operation by the remote monitor regarding whether or not the vehicle 3 can start traveling (S32).

[0066] 10 is a diagram showing an example of an image displayed on the display 16 before an inquiry is made to the remote monitor as to whether or not the vehicle 3 can start traveling. Before an inquiry is made to the remote monitor, the operation status of the target vehicle 3 (in this example, the timetable for each stop and the actual time), the status of the vehicle 3 (e.g., speed), switching of the driving mode of the vehicle 3, and the operation of the vehicle 3 (opening / closing of the doors, emergency stop, etc.) are displayed, as well as an image of the interior of the vehicle 3.

[0067] Fig. 11 is a diagram showing an example of an image displayed on the display 16 when making an inquiry to the remote monitor about whether the vehicle 3 can start traveling. When making an inquiry to the remote monitor, a dialog box is displayed on the screen shown in Fig. 10. The dialog box displays, for example, information identifying the target vehicle 3 (car No. 1 in this example), information identifying the target ECU (camera ECU), a brief explanation of the update contents of the control program (supporting the addition of video codec formats), a disclaimer in case of a defect in the updated control program (none in particular), and functional constraints accompanying the update of the control program (none in particular).

[0068] In addition, the dialog box displays the changes to the control program (increasing the number of screens showing images captured by the on-board camera). In this way, it is preferable to present to the remote monitor the functions before and after the control program update in a manner that allows them to be compared. It is also preferable to present to the remote monitor information that the remote monitor uses when monitoring the vehicle 3.

[0069] After displaying the above changes, the server 1 inquires of the remote monitor of the vehicle 3 as to whether or not to permit the vehicle 3 to be driven after the control program has been updated. In this example, if the remote monitor clicks the "Yes" button, the vehicle 3 is permitted to be driven. On the other hand, if the remote monitor clicks the "No" button, the vehicle 3 is prohibited from being driven. The remote monitor can click the "Check details" button to check the changes in more detail and then decide whether to permit or prohibit driving.

[0070] 9 again, when an operation to permit the vehicle 3 to start traveling is performed by the remote monitor (YES in S33), the server 1 notifies the vehicle 3 of the permission to start traveling (S35). When the vehicle 3 receives the notification of the permission to start traveling (YES in S43), it starts traveling (S44). For example, the vehicle 3 activates a control program installed in the flash memory 312C of the ECU 31 to start traveling.

[0071] On the other hand, if an operation to prohibit the vehicle 3 from starting to travel is performed by the remote monitor (NO in S33), the server 1 notifies the vehicle 3 of the prohibition of the vehicle 3 from starting to travel (S34). When the vehicle 3 receives the notification of the prohibition of the vehicle 3 from starting to travel (NO in S43), the vehicle 3 waits without starting to travel.

[0072] As described above, in this embodiment, when an updatable control program exists for the ECU 31 of the vehicle 3, the control center 2 (which may be the vehicle 3) inquires of the server 1 whether or not the control program can be updated. The server 1, upon receipt of the inquiry, responds to the control center 2 (which may be the vehicle 3) with the operation result (approval / rejection) by the operations manager regarding whether or not the control program can be updated. This allows the control program to be updated even if a person with authority to update the control program is not on board the vehicle 3. Therefore, according to this embodiment, the control program of the ECU 31 mounted on the vehicle 3 can be appropriately updated.

[0073] Furthermore, in this embodiment, after updating the control program of the ECU 31 of the vehicle 3, the vehicle 3 inquires of the server 1 as to whether or not the vehicle 3 can start traveling, along with the changes to the control program (changes to the control, operation, functions, etc. of the vehicle 3). The server 1, upon receiving the inquiry, responds to the vehicle 3 with the operation result (permitted / prohibited) by the remote monitor regarding whether or not the vehicle 3 can start traveling. This allows the remote monitor, who is not on board the vehicle 3, to start the vehicle 3 traveling after understanding the changes to the control program. Therefore, according to this embodiment, the vehicle 3 can be operated appropriately after the control program has been updated.

[0074] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present disclosure is defined by the claims, not by the description of the embodiments described above, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0075] 1 server, 11 processor, 12 memory, 121 ROM, 122 RAM, 123 HDD, 13 keyboard, 14 mouse, 15, ECU camera, 16 display, 17 communication IF, 2 control center, 3, 3A, 3B, 3C vehicle, 31 ECU, 311 processor, 312 memory, 312A ROM, 312B RAM, 312C flash memory, 32 autonomous driving system, 33 sensor group, 34 navigation system, 35 DCM, 41, 51 communication unit, 42, 52 calculation processing unit, 421, 521 communication control unit, 422, 522 notification unit, 423, 523 operation reception unit, 424, 524 image generation unit, 425 memory unit, 426 authentication unit, 43, 53 input unit, 44, 54 display unit, 45 shooting unit, 100 Information processing system, NW network.

Claims

1. A server that manages the operation of an autonomous vehicle, The autonomous vehicle is configured to obtain a control program of a control device mounted on the autonomous vehicle from a control center via wireless communication, The server, A first input device that receives an operation of an operation manager that manages the operation of the autonomous driving vehicle from outside the autonomous driving vehicle; A first output device that presents information to the operation manager; a second input device that receives remote operation by a remote monitor who monitors the autonomous driving vehicle from outside; a second output device for presenting information to the remote monitor; A communication device configured to be able to communicate with at least one of the autonomous driving vehicle and the control center; a processor that controls the first input device, the first output device, the second input device, the second output device, and the communication device; The processor, When an updatable control program is present, the first output device is controlled to present an update condition of the control program to the operation manager. When an operation of the operations manager authorizing the update of the control program is received by the first input device, the communication device is controlled to notify at least one of the autonomously driven vehicle and the control center of the authorization to update the control program, thereby causing the control program to be downloaded and installed in the autonomously driven vehicle; After the download and installation, controlling the second output device to present the changes to the control program to the remote monitor; A server that, when an operation of the remote monitor to permit the autonomous vehicle to drive after the control program is updated is accepted by the second input device, activates the control program installed in the autonomous vehicle by controlling the communication device to notify the autonomous vehicle of the permission to drive.

2. An authentication device configured to authenticate the operations manager, The server according to claim 1 , wherein the processor controls the first output device to present the update condition to the fleet manager authenticated by the authentication device.

3. The server according to claim 2 , wherein the processor controls the first input device to accept operations of the operations manager authenticated by the authentication device, while not accepting operations of an operator not authenticated by the authentication device.

4. 4. The server according to claim 1, wherein the update condition includes a condition regarding a time required for updating the control program.

5. 5. The server according to claim 1, wherein the update condition includes a condition regarding a period during which the control program can be updated.

6. The server manages the operation of a plurality of vehicles, each of which is equipped with a plurality of control devices; A server according to any one of claims 1 to 5, wherein the update conditions include conditions for identifying a vehicle from among the plurality of vehicles that is to be updated for the control program, and conditions for identifying a control device that is to be updated for the control program from among the plurality of control devices installed in the vehicle.

7. The server according to any one of claims 1 to 6, wherein the update conditions include conditions regarding functions of the autonomous driving vehicle that are updated by the control program.

8. The server according to any one of claims 1 to 7, wherein the update conditions include conditions regarding functions of the autonomous vehicle that are restricted in association with the update of the control program.

9. 9. The server according to claim 1, wherein the update condition includes a condition regarding an exemption for the control center from liability for defects that may occur with the update of the control program.

10. A server according to any one of claims 1 to 9; and the autonomous driving vehicle.

11. The autonomous vehicle includes: When at least one of the autonomous driving vehicle and the control center receives a notification that the update of the control program is permitted, the control program is acquired from the control center, 11. The information processing system according to claim 10, wherein when at least one of the autonomous driving vehicle and the control center receives a notification rejecting the update of the control program, the control program is not acquired from the control center.

12. An information processing method for managing information regarding the operation of an autonomous vehicle by a server, comprising: The autonomous vehicle is configured to obtain a control program of a control device mounted on the autonomous vehicle from a control center via wireless communication, The information processing method includes: When an updatable control program exists, the server presents an update condition of the control program to an operation manager who manages the operation of the autonomous driving vehicle from outside the autonomous driving vehicle; When the operations manager performs an operation to permit the update of the control program, the server notifies at least one of the autonomous vehicle and the control center of the permission to update the control program, thereby causing the autonomous vehicle to download and install the control program; After the downloading and installing step, the server presents the changes to the control program to a remote monitor who monitors the autonomous vehicle from outside; and when the remote monitor performs a remote operation to permit the autonomous vehicle to drive after the control program has been updated, the server notifies the autonomous vehicle of the permission to drive, thereby activating the control program installed in the autonomous vehicle.

Images