MOBILE BODY CONTROL DEVICE, MOBILE BODY CONTROL METHOD, AND PROGRAM

Abstract

To enable start-up of power of a movable body by improving security performance in a low cost configuration when identification information for authenticating a user is not stored in the movable body.SOLUTION: A movable body control device 1 comprises: a first ECU 10; and a second ECU 20. When a movable body 100 is turned off and when the first ECU 10 recognizes a prescribed operation of a power switch 40 in a case that identification information is not stored in a storage part 32, a clock part 13 starts clocking of a first prescribed time, a communication establishment processing between the first ECU 10 and the second ECU 20 is started to establish the communication between the first ECU 10 and the second ECU 20 so that a terminal device 50 connected with the second ECU 20 can operate the first ECU 10 through the second ECU 20.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a mobile object control device, a mobile object control method, and a program. [Background technology]

[0002] Conventionally, there is known a technology in a vehicle fault diagnosis system that, when a vehicle has not yet been delivered and the vehicle identification number has not yet been stored in the vehicle, performs fault diagnosis under conditions that are different from the normal fault mode that occurs when the vehicle identification number has already been stored (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2012-126331 A Summary of the Invention [Problem to be solved by the invention]

[0004] When a vehicle is delivered, a process is performed to store the identification information of the vehicle key in the vehicle so that the vehicle key and the vehicle can be used only with a specific vehicle key. When a user gets in the vehicle, authentication is performed based on the identification information stored in the vehicle for the vehicle key held by the user, and if authentication is successful, so-called smart entry systems are becoming widespread, which allow operations from locking and unlocking the vehicle to turning on the power. In such a configuration compatible with smart entry, if the identification information of the vehicle key before the vehicle is delivered has not yet been stored in the vehicle, the power supply of the vehicle cannot be started by operating the power switch. Therefore, there is an inconvenience that the power supply of the vehicle before delivery cannot be started by operating the power switch to store the identification information of the vehicle key or to perform vehicle diagnosis for improving road safety, etc. It is possible to add a dedicated part to the vehicle to enable the power supply of the vehicle to be started without operating the power switch, but this is not preferable because it increases costs. In addition, the number of ECUs used in the vehicle has increased recently, and the vehicle electronic system tends to become complicated, so it is necessary to consider the layout configuration of the ECUs while also taking security performance into account. The present invention has been made in consideration of the above background, and an object of the present invention is to enable the power supply of a mobile body, such as a vehicle, to be started while improving security performance with a low-cost configuration in a state in which identification information used for user authentication is not stored in the mobile body. The present application aims to improve the safety of moving bodies in order to solve the above problems, and by extension, to further improve traffic safety and contribute to the development of sustainable transportation systems. [Means for solving the problem]

[0005] As a first aspect for achieving the above-mentioned object, there is provided a mobile body control device comprising: a memory unit in which identification information used to authenticate a user of a mobile body is stored; a timing unit which measures a first predetermined time; a first ECU to which a power switch for instructing powering on of the mobile body is connected, and which turns the mobile body into a power-on state in response to operation of the power switch if authentication of the user using the identification information stored in the memory unit is successful when the mobile body is in a power-off state; and a second ECU which is capable of connecting to a terminal device and communicates with the first ECU, wherein when the first ECU recognizes a predetermined operation of the power switch while the identification information is not stored in the memory unit when the mobile body is in a power-off state, the first ECU starts measuring the first predetermined time using the timing unit and starts a process of establishing communication between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU.

[0006] In the above-mentioned mobile body control device, the second ECU may be configured to not accept operation instructions from the terminal device to the second ECU when the mobile body is in a power-off state, even if the terminal device is connected, unless communication between the first ECU and the second ECU is established by the first ECU.

[0007] In the above-mentioned mobile body control device, the specified operation may be that the power switch is operated for a second specified time, and the first ECU may be configured to start a process of establishing communication between the first ECU and the second ECU when it recognizes that the power switch has been operated for the second specified time when the mobile body is in a power-off state and the identification information is not stored in the memory unit.

[0008] The above-mentioned mobile object control device may be configured so that a direct communication connection between the first ECU and the terminal device is not possible.

[0009] In the above-mentioned mobile body control device, the first ECU may be configured to, if communication between the first ECU and the second ECU is established before the timing unit finishes timing the first predetermined time, but authentication of the terminal device based on information transmitted from the terminal device fails, cut off communication between the first ECU and the second ECU, and then prohibit acceptance of the establishment of communication between the first ECU and the second ECU in response to the predetermined operation of the power switch until a third predetermined time has elapsed.

[0010] In the above-mentioned mobile body control device, the first ECU may be configured to abort the process of establishing communication between the first ECU and the second ECU if the first ECU is unable to establish communication with the second ECU and turn the mobile body on in response to receiving a forced power-on signal transmitted from the terminal device before the timing unit finishes timing the first predetermined time.

[0011] In the above-mentioned mobile body control device, when the first ECU recognizes an operation on an operating unit provided on the mobile body when the identification information is not stored in the memory unit, the first ECU may be configured to display an alarm image on a display unit provided on the mobile body indicating that the identification information is not stored in the memory unit.

[0012] In the above-mentioned mobile body control device, the first ECU may be configured to, when it recognizes the specified operation of the power switch and starts the process of establishing communication between the first ECU and the second ECU, display a notification image on a display unit provided in the mobile body, indicating that the process of establishing communication between the first ECU and the second ECU has started.

[0013] As a second aspect for achieving the above object, there is provided a mobile object control method executed by a mobile object control device having a memory unit in which identification information used for authenticating a user of a mobile object is stored, a timer unit for timing a first predetermined time, a first ECU connected to a power switch for instructing power-on of the mobile object, and a second ECU to which a terminal device can be connected and which communicates with the first ECU, wherein, when the mobile object is in a power-off state, if authentication of the user using the identification information stored in the memory unit is successful, the first ECU turns on the mobile object in response to an operation of the power switch. and a maintenance response step of, when the first ECU recognizes a predetermined operation of a power switch while the mobile body is in a power-off state and the identification information is not stored in the memory unit, starting the measurement of the first predetermined time by the timing unit and starting a process of establishing communication between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU.

[0014] As a third aspect for achieving the above object, in a mobile body control device having a memory unit in which identification information used to authenticate a user of a mobile body is stored, a timing unit that measures a first predetermined time, a first ECU connected to a power switch for instructing powering on of the mobile body, and a second ECU to which a terminal device can be connected and which communicates with the first ECU, the program is executed by the first ECU to cause the first ECU to execute a normal operation response process in which, when the mobile body is in a power-off state and authentication of the user using the identification information stored in the memory unit is successful, the first ECU turns on the mobile body in response to operation of the power switch, and when the mobile body is in a power-off state and the identification information is not stored in the memory unit, the program causes the first ECU to execute a maintenance response process in which, when the mobile body is in a power-off state and a predetermined operation of the power switch is recognized, the program starts measuring the first predetermined time by the timing unit and starts a communication establishment process between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU. Effect of the Invention

[0015] According to the above mobile object control device, mobile object control method, and program, a process of establishing communication between the first ECU and the second ECU is started by a simple process of a predetermined operation of a power switch, and the progress of the process of establishing communication can be recognized by the time measured by the timer. Therefore, in a state where identification information used for user authentication is not stored in the mobile object, a cost-saving configuration can be used to improve security performance and enable the power supply of the mobile object to be started. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a configuration diagram of a mobile object control device. [Diagram 2] FIG. 2 is a first flowchart of a process of establishing communication with a terminal device by the first ECU. [Diagram 3] FIG. 3 is a second flowchart of the process of establishing communication with the terminal device by the first ECU. [Figure 4] FIG. 4 is a third flowchart of the process of establishing communication with the terminal device by the first ECU. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] [1. Configuration of the mobile control device] The configuration of a mobile object control device 1 will be described with reference to Fig. 1. The mobile object control device 1 of this embodiment is provided in a vehicle 100 (corresponding to a mobile object in this disclosure) and controls the operation of the vehicle 100. The mobile object control device 1 includes a plurality of ECUs (Electronic Control Units) 10, 20, 30 and a timer unit 13. The timer unit 13 measures a set time in order to monitor timeout of a target process. The timer unit 13 may be configured to be included in the first ECU 10 as a function of the first ECU 10.

[0018] The first ECU 10 is a control unit composed of a first processor 11, a first memory 12, etc., and by executing a program stored in the first memory 12, it performs control of an area including the area around the driver's seat of the vehicle 100, control of turning the power on and off of the vehicle 100, etc.

[0019] Connected to the first ECU 10 are a start-stop switch 40 (hereinafter referred to as an SS switch 40, which corresponds to a power switch in this disclosure) for instructing power-on and power-off of the vehicle 100, a door switch 41 for detecting opening and closing of a door of the vehicle 100, an IG (ignition) unit 42 for switching power-on and power-off of the vehicle 100, and a display unit 43. The display unit 43 is, for example, a flat panel display such as a liquid crystal display or an organic EL display.

[0020] The second ECU 20 is a control unit including a second processor 21, a second memory 22, etc., and controls the overall operation of the vehicle 100 by executing a program stored in the second memory 22. The second ECU 20 is connected to the first ECU 10 by a first CAN (Controller Area Network) 70, and a terminal device 50 for maintenance of the vehicle 100 is detachably connected to the second ECU 20 by a second CAN 71. A worker W connects the terminal device 50 to the second ECU 20 to perform maintenance work when the vehicle 100 is delivered. The terminal device 50 is a notebook PC (personal computer), a tablet PC, etc.

[0021] The third ECU 30 is a control unit including a third processor 31, a third memory 32, etc., and performs authentication processing of the user of the vehicle 100 by executing a program stored in the third memory 32. Specifically, the third ECU 30 authenticates the user by comparing identification information transmitted from a portable key 61 and a mobile terminal 60 (more specifically, a virtual key application executed on the mobile terminal 60) carried by the user with the identification information stored in the third memory 32. The mobile terminal 60 is, for example, a communication terminal such as a smartphone, a mobile phone, or a tablet terminal.

[0022] In addition, the authentication process of the user may be performed using the user's biometric information (fingerprint, iris, face image, etc.) as identification information. When the vehicle 100 is delivered, the identification information is transmitted from the terminal device 50 to the third ECU 30 by the worker W operating the terminal device 50, and is stored in the third memory 32 (corresponding to the storage unit in this disclosure). The third ECU 30 is connected to the first ECU 10 by the first CAN 70. In addition, the programs stored in the first memory 12, the second memory 22, and the third memory 32 may be read from a recording medium (optical disk, flash memory, etc.) by the mobile object control device 1 and stored in each memory, or may be downloaded by the mobile object control device 1 from an external server (not shown) and stored in each memory.

[0023] When the first ECU 10 recognizes the operation of the SS switch 40 in a state where the authentication of the mobile terminal 60 or the portable key 61 by the 3ECU 30 has been successful, the IG unit 42 turns on the power of the vehicle 100. Here, when the power is off, the first ECU 10, the second ECU 20, and the third ECU 30 are in a sleep state in which power consumption is reduced compared to the active state (normal operating state). However, in order to recognize the operation to start using the vehicle 100 by the user, the authentication of the mobile terminal 60 or the portable key 61 by the 3ECU 30, the recognition of the operation of the SS switch 40 by the first ECU 10, the recognition of the opening and closing of the door by the door switch 41, and the image display by the display unit 43 are executed even in the sleep state.

[0024] Therefore, when the power is off, communication between the first ECU 10 and the second ECU 20 is not possible, and even if the terminal device 50 is connected to the second ECU 20, communication between the terminal device 50 and the first ECU 10 cannot be performed via the second ECU 20. Although it is possible to add a wiring system 72 that directly connects the terminal device 50 and the first ECU 10, in this case, the addition of the wiring system 72 increases costs. Therefore, even if the identification information has not yet been stored in the third memory 32, such as before the delivery of the vehicle 100, the first ECU 10 performs a process to enable communication between the terminal device 50 and the first ECU 10. This process will be described below.

[0025] [2. Processing for establishing communication between the terminal device and the first ECU] 2 to 4, a process executed by the first ECU 10 to establish communication between the terminal device 50 and the first ECU via the second ECU 20 and enable maintenance operations of the vehicle 100 by the terminal device 50 will be described. The process according to the flowcharts in Figs. 2 to 4 is executed when the vehicle 100 is in a power-off state, such as when the vehicle 100 has just been shipped from the factory and identification information for authenticating the portable key 61 or the portable terminal 60 has not yet been stored in the third memory 32.

[0026] 2, when the first ECU 10 recognizes from the detection signal of the door switch 41 that the door of the vehicle 100 has been opened, the process proceeds to step S2. In this case, the door on which the door switch 41 is provided corresponds to the operation unit provided in the moving body of the present disclosure. Note that the operation unit provided in the moving body of the present disclosure may be any unit capable of recognizing an operation by the user of the vehicle 100, such as a trunk or tailgate of the vehicle 100 provided with an opening / closing switch, or a configuration in which the third ECU 30 receives an activation request signal transmitted in response to an operation of the portable key 61 or portable terminal 60 by the user.

[0027] In step S2, the first ECU 10 causes the display unit 43 to display a notification image indicating that the identification information of the key (the portable key 61 or the virtual key app of the mobile terminal 60) is not registered in the vehicle 100 (the identification information is not stored in the third memory 32). This notification image allows the worker W who opens the door and gets into the vehicle 100 to easily recognize that the identification information of the key is not registered.

[0028] In the next step S3, the first ECU 10 determines whether or not the SS switch 40 has been pressed and holds for a long time, and proceeds to step S4 when the first ECU 10 recognizes the long press of the SS switch 40. Here, the first ECU 10 recognizes that the press of the SS switch 40 continues for a second predetermined time (e.g., 0.2 seconds) as a long press of the SS switch 40. In the next step S4, a notification image indicating that a connection request from the terminal device 50 has been accepted is displayed on the display unit 43. This notification image allows the worker W to recognize that a connection request made by a long press of the SS switch 40 has been accepted, thereby improving the workability of preparation for maintenance of the vehicle 100 by the terminal device 50.

[0029] In the next step S5, the first ECU 10 starts timing a first predetermined time (for example, set to 30 seconds) by the timer unit 13, and in step S6, transmits an opening request signal for the first CAN 70 to the second ECU 20. In the next steps S7 and S30, the first ECU 10 monitors the timeout in step S30, and determines whether or not an opening completion signal for the first CAN 70 has been received from the second ECU 20 in step S7.

[0030] Here, the timeout monitoring process is executed according to the flowchart shown in Fig. 4. In step S50 in Fig. 4, the first ECU 10 recognizes the current time measured by the timer unit 13 (the elapsed time from the point when timing was started in step S5). In the following step S51, when the current time measured by the timer unit 13 exceeds a first predetermined time, the first ECU 10 advances the process to step S60, and when the measured time is equal to or less than the first predetermined time, the first ECU 10 advances the process to step S52 and ends the timeout monitoring process.

[0031] In step S60, if communication between the first ECU 10 and the second ECU 20 via the first CAN 70 has not yet been established, the first ECU 10 cancels the communication establishment process. If communication between the first ECU 10 and the second ECU 20 via the first CAN 70 has already been established, the first ECU 10 cuts off communication between the first ECU 10 and the second ECU 20 via the first CAN 70. In the following step S61, the first ECU 10 displays a notification image indicating a connection error with the terminal device 50 on the display unit 43, and proceeds to step S52.

[0032] 2, when the first ECU 10 receives an open completion signal from the second ECU 20 in step S7 and recognizes that communication between the first ECU 10 and the second ECU 20 via the first CAN 70 has been established, the first ECU 10 proceeds to step S8. In steps S8 and S31, the first ECU 10 determines whether or not the first ECU 10 has received a session switching request signal for the terminal connection mode transmitted from the terminal device 50 in step S8 while monitoring the timeout in step S31.

[0033] In step S8, when the first ECU 10 receives a session switching request signal to switch to the terminal connection mode from the terminal device 50, the first ECU 10 proceeds to step S9 to execute processing for switching the session to the terminal connection mode that enables reception of an operation instruction from the terminal device 50. In the following step S10, the first ECU 10 transmits a session switching completion signal to switch to the terminal connection mode to the terminal device 50.

[0034] 3, the first ECU 10 determines whether or not an authentication code for security access has been received from the terminal device 50 in step S11 while monitoring a timeout in step S32. When the first ECU 10 receives from the terminal device 50 an authentication code that matches an authentication code for maintenance connection previously stored in the first memory 12, the first ECU 10 proceeds to the process in step S12 and performs security deactivation to permit the terminal device 50 to perform maintenance operations on the mobile object 100. In the next step S13, the first ECU 10 transmits a security deactivation completion signal to the terminal device 50.

[0035] Here, when the communication between the first ECU 10 and the second ECU 20 is cut off due to the timeout monitoring in step S32, the establishment of communication between the first ECU 10 and the second ECU 20 to connect the terminal device 50 by a long press of the SS switch 40 may be prohibited until a third predetermined time (e.g., several tens of minutes to several hours) has elapsed.

[0036] In the following steps S14 and S33, while monitoring the timeout in step S33, the first ECU 10 determines in step S14 whether or not a session switching request signal to switch to the maintenance mode has been received from the terminal device 50. Then, when the first ECU 10 receives a session switching request signal from the terminal device 50, the process proceeds to step S14, where the first ECU 10 switches the session to the maintenance mode.

[0037] In the following step S16, the first ECU 10 transmits a session switching completion signal to switch to the maintenance mode to the terminal device 50. In the next steps S17 and S34, the first ECU 10 determines whether or not a forced IG-on request signal has been received from the terminal device 50 in step S17 while monitoring a timeout in step S34.

[0038] Then, when the first ECU 10 receives a forced IG on request signal from the terminal device 50, the process proceeds to step S18, where the first ECU 10 performs a forced IG on process to put the vehicle 100 into a power on state (IG on state). In the next steps S19 and S35, the first ECU 10 determines whether or not the vehicle 100 has entered the IG on state due to the forced IG on in step S19, while monitoring a timeout in step S35.

[0039] Before it is recognized in step S19 that the vehicle 100 has entered the IG ON state, the first ECU 10 cuts off communication between the first ECU 10 and the second ECU 20 when the time currently measured by the timer unit 13 exceeds a first predetermined time as a result of monitoring the timeout in step S35. Note that in the flowcharts of Figs. 2 and 3, the timeout is monitored in each determination process of steps S7 and S8 in Fig. 2 and steps S11, S14, S17, and S19 in Fig. 3, but the timeout may be monitored only in step S19 which finally determines that the vehicle 100 has entered the IG ON state, and the process of establishing communication between the first ECU 10 and the second ECU 20 may be stopped when the time currently measured by the timer unit 13 exceeds the first predetermined time.

[0040] When the vehicle 100 is in the IG ON state in step S19, the first ECU 10 advances the process to step S20. In step S20, the first ECU 10 transmits a forced IG ON completion signal to the terminal device 50. This allows the worker W to operate the terminal device 50 to perform various maintenance processes on the vehicle 100 that is in the power ON state. For example, the worker W can operate the terminal device 50 to register key identification information to the vehicle 100.

[0041] Here, when the first ECU 10 successfully authenticates the user using the key identification information stored in the third memory 32 while the vehicle 100 is in a power-off state, the process of turning the vehicle 100 on in response to the operation of the SS switch 40 corresponds to the normal operation response step in the mobile object control method of the present disclosure and the normal operation response processing in the program of the present disclosure. In addition, when the first ECU 10 recognizes a long press of the SS switch 40 while the vehicle 100 is in a power-off state and no key identification information is stored in the third memory 32, it starts timing the first predetermined time using the timing unit 13 and starts a process to establish communication between the first ECU 10 and the second ECU 20, thereby establishing communication between the first ECU 10 and the second ECU 20 and enabling the terminal device 50 connected to the second ECU 20 to operate the first ECU 10 via the second ECU 20. This process corresponds to a maintenance response step in the mobile object control method of the present disclosure and a maintenance response process in the program of the present disclosure.

[0042] 3. Other embodiments In the above embodiment, vehicles (including various types of vehicles such as four-wheeled vehicles, two-wheeled vehicles, vehicles powered by internal combustion engines, and electric vehicles) are used as examples of moving bodies, but the moving body control device and moving body control method disclosed herein can also be applied to other types of moving bodies such as aircraft and ships.

[0043] In the above embodiment, a long press operation in which the SS switch 40 (the power switch of the present disclosure) is continuously operated for a predetermined period of time or more has been exemplified as the predetermined operation of the SS switch 40. However, the predetermined operation may be other operation modes, such as the SS switch 40 being operated multiple times within a predetermined period of time.

[0044] 1 is a schematic diagram showing the configuration of the mobile object control device 1 divided according to main processing contents in order to facilitate understanding of the present invention, and the mobile object control device 1 may be divided in other ways. Furthermore, the processing of each component may be executed by one hardware unit or by multiple hardware units. Furthermore, the processing of each component shown in FIGS. 2 to 4 may be executed by one program or by multiple programs.

[0045] [4. Configuration supported by the above embodiment] The above embodiment is a specific example of the following configuration.

[0046] (Configuration 1) A mobile body control device comprising: a memory unit in which identification information used to authenticate a user of a mobile body is stored; a timing unit which measures a first predetermined time; a first ECU to which a power switch for instructing powering on the mobile body is connected, and which turns the mobile body into a power-on state in response to operation of the power switch if authentication of the user using the identification information stored in the memory unit is successful when the mobile body is in a power-off state; and a second ECU to which a terminal device can be connected and which communicates with the first ECU, wherein when the first ECU recognizes a predetermined operation of the power switch while the identification information is not stored in the memory unit when the mobile body is in a power-off state, the first ECU starts measuring the first predetermined time using the timing unit and starts a process of establishing communication between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU. According to the mobile object control device of configuration 1, the process of establishing communication between the first ECU and the second ECU is started by a simple process of a predetermined operation of a power switch, and the progress of the process of establishing communication can be recognized by the time measured by the timer. Therefore, in a state where the identification information used for authenticating a user is not stored in the mobile object, the cost-saving configuration can improve security performance and enable the power supply of the mobile object to be started.

[0047] (Configuration 2) A mobile body control device as described in Configuration 1, wherein when the mobile body is in a power-off state, even if the terminal device is connected, the second ECU does not accept operation instructions from the terminal device to the second ECU unless communication between the first ECU and the second ECU is established by the first ECU. According to the mobile body control device of configuration 2, unless communication between the first ECU and the second ECU is established in response to a specified operation of the power switch, even if the terminal device is connected to the second ECU, the first ECU cannot be operated by the terminal device, thereby improving security against unauthorized operation of the mobile body device by the terminal device.

[0048] (Configuration 3) A mobile body control device as described in configuration 1 or configuration 2, in which the specified operation is the power switch being operated for a second specified time, and when the first ECU recognizes that the power switch has been operated for the second specified time when the mobile body is in a power-off state and the identification information is not stored in the memory unit, it starts a process of establishing communication between the first ECU and the second ECU. According to the mobile body control device of configuration 3, by executing a process to establish communication between the first ECU and the second ECU, on the condition that the power switch is continuously operated, it is possible to improve reliability when performing maintenance using a terminal device.

[0049] (Configuration 4) The mobile object control device according to any one of configurations 1 to 3, in which a direct communication connection between the first ECU and the terminal device is not possible. According to the mobile object control device of configuration 4, by eliminating the configuration in which the first ECU and the terminal device are directly connected, it is possible to reduce costs and prevent unauthorized connection of the terminal device to the first ECU.

[0050] (Configuration 5) A mobile body control device described in any one of configurations 1 to 4, in which, if communication between the first ECU and the second ECU is established before the timing unit finishes timing the first predetermined time, but authentication of the terminal device based on information transmitted from the terminal device fails, the first ECU cuts off communication between the first ECU and the second ECU, and then prohibits acceptance of the establishment of communication between the first ECU and the second ECU in response to the predetermined operation of the power switch until a third predetermined time has elapsed. According to the mobile object control device of configuration 5, it is possible to prevent a terminal device other than a terminal device preregistered in the vehicle control device from being illegally connected to the vehicle control device.

[0051] (Configuration 6) A mobile body control device described in any one of configurations 1 to 5, wherein the first ECU cancels the process of establishing communication between the first ECU and the second ECU if the first ECU is unable to establish communication between the first ECU and the second ECU and turn the mobile body on in response to receiving a forced power-on signal transmitted from the terminal device before the timing unit finishes timing the first predetermined time. According to the mobile body control device of configuration 6, when the mobile body cannot be turned on by operating the terminal device, the process of establishing communication between the first ECU and the second ECU is stopped, thereby preventing unauthorized operation of the mobile body.

[0052] (Configuration 7) A mobile body control device described in any one of configurations 1 to 6, wherein when the first ECU recognizes an operation on an operation unit provided on the mobile body while the identification information is not stored in the memory unit, the first ECU displays an alarm image on a display unit provided on the mobile body indicating that the identification information is not stored in the memory unit. According to the mobile body control device of configuration 7, a worker performing maintenance on a mobile body can easily recognize that the mobile body has no identification information stored in the memory unit, thereby supporting the worker in carrying out maintenance work.

[0053] (Configuration 8) A mobile body control device described in any one of configurations 1 to 7, wherein, when the first ECU recognizes the specified operation of the power switch and starts the process of establishing communication between the first ECU and the second ECU, a notification image indicating that the process of establishing communication between the first ECU and the second ECU has started is displayed on a display unit provided in the mobile body. According to the mobile body control device of configuration 8, a worker performing maintenance on a mobile body can easily recognize that an instruction to establish communication between the first ECU and the second ECU has been accepted, thereby supporting the worker in carrying out the maintenance work.

[0054] (Configuration 9) A mobile body control method executed by a mobile body control device having a memory unit in which identification information used to authenticate a user of a mobile body is stored, a timing unit that times a first predetermined time, a first ECU connected to a power switch for instructing powering on of the mobile body, and a second ECU to which a terminal device can be connected and that communicates with the first ECU, the mobile body control method including: a normal operation response step in which, when the mobile body is in a power-off state, the first ECU turns the mobile body into a power-on state in response to operation of the power switch if authentication of the user using the identification information stored in the memory unit is successful; and a maintenance response step in which, when the mobile body is in a power-off state and the first ECU recognizes a predetermined operation of the power switch in a state in which the identification information is not stored in the memory unit, the first ECU starts timing of the first predetermined time by the timing unit and starts a communication establishment process between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling operation of the first ECU via the second ECU by the terminal device connected to the second ECU. By executing the moving body control method of configuration 9 by the first ECU, it is possible to obtain the same effects as those of the moving body control device of configuration 1.

[0055] (Configuration 10) In a mobile body control device having a memory unit in which identification information used to authenticate a user of a mobile body is stored, a timing unit that measures a first predetermined time, a first ECU connected to a power switch for instructing powering on of the mobile body, and a second ECU to which a terminal device can be connected and which communicates with the first ECU, a program executed by the first ECU, the program causing the first ECU to execute a normal operation response process in which, when the mobile body is in a power-off state, authentication of the user using the identification information stored in the memory unit is successful, the first ECU turns the mobile body into a power-on state in response to operation of the power switch, and a maintenance response process in which, when the mobile body is in a power-off state and the identification information is not stored in the memory unit, a predetermined operation of the power switch is recognized, the program starts measuring the first predetermined time by the timing unit and starts a communication establishment process between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU, and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU. By executing the program of configuration 10 by the first ECU, the configuration of the mobile object control device of configuration 1 can be realized. [Explanation of symbols]

[0056] 1...mobile object control device, 10...first ECU, 11...first processor, 12...first memory, 20...second ECU, 21...second processor, 22...second memory, 30...third ECU, 31...third processor, 32...third memory, 40...SS switch (power switch), 41...door switch, 42...IG unit, 43...display unit, 50...terminal device, 60...portable terminal, 61...portable key, 100...vehicle (mobile object), W...operator.

Claims

1. a storage unit for storing identification information used to authenticate a user of the mobile object; A timing unit that measures a first predetermined time; a first ECU which is connected to a power switch for instructing to power on the mobile body, and which turns on the power of the mobile body in response to an operation of the power switch if authentication of the user using the identification information stored in the storage unit is successful when the mobile body is in a power-off state; A second ECU to which a terminal device can be connected and which communicates with the first ECU; A mobile object control device comprising: When the first ECU recognizes a predetermined operation of a power switch while the mobile body is in a power-off state and the identification information is not stored in the storage unit, the first ECU starts measuring the first predetermined time by the timer unit and starts a process of establishing communication between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU. Mobile control device.

2. Even if the terminal device is connected when the mobile object is in a power-off state, the second ECU does not accept an operation instruction to the second ECU from the terminal device unless communication between the first ECU and the second ECU is established by the first ECU. The mobile object control device according to claim 1 .

3. the predetermined operation is that the power switch is operated for a second predetermined time, When the first ECU recognizes that the power switch has been operated for the second predetermined time while the identification information is not stored in the storage unit and the moving body is in a power-off state, the first ECU starts a process of establishing communication between the first ECU and the second ECU. The mobile object control device according to claim 1 .

4. The first ECU and the terminal device are configured to be unable to communicate directly with each other. The mobile object control device according to claim 1 .

5. When communication between the first ECU and the second ECU is established before the end of the measurement of the first predetermined time by the timer, but authentication of the terminal device based on information transmitted from the terminal device fails, the first ECU cuts off communication between the first ECU and the second ECU, and thereafter prohibits acceptance of establishment of communication between the first ECU and the second ECU in response to the predetermined operation of the power switch until a third predetermined time has elapsed. The mobile object control device according to any one of claims 1 to 4.

6. When the first ECU is unable to establish communication between the first ECU and the second ECU and to turn the mobile body into a power-on state in response to receiving a forced power-on signal transmitted from the terminal device before the timing of the first predetermined time by the timing unit ends, the first ECU halts the process of establishing communication between the first ECU and the second ECU. The mobile object control device according to any one of claims 1 to 4.

7. When the first ECU recognizes an operation on an operation unit provided on the moving body in a state in which the identification information is not stored in the storage unit, the first ECU displays, on a display unit provided on the moving body, a notification image indicating that the identification information is not stored in the storage unit. The mobile object control device according to any one of claims 1 to 4.

8. When the first ECU recognizes the predetermined operation of the power switch and starts a process of establishing communication between the first ECU and the second ECU, a notification image indicating that the process of establishing communication between the first ECU and the second ECU has started is displayed on a display unit provided in the moving body. The mobile object control device according to any one of claims 1 to 4.

9. A mobile object control method executed by a mobile object control device having a storage unit for storing identification information used for authenticating a user of a mobile object, a timer unit for timing a first predetermined time, a first ECU connected to a power switch for instructing power-on of the mobile object, and a second ECU capable of being connected to a terminal device and communicating with the first ECU, a normal operation response step of, when the first ECU has successfully authenticated the user using the identification information stored in the storage unit while the mobile object is in a power-off state, turning on the mobile object in response to an operation of the power switch; a maintenance response step in which, when the first ECU recognizes a predetermined operation of a power switch while the mobile body is in a power-off state and the identification information is not stored in the memory unit, the first ECU starts measuring the first predetermined time by the timer unit and starts a process of establishing communication between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU; A mobile object control method comprising:

10. A mobile object control device having a storage unit for storing identification information used for authenticating a user of a mobile object, a timer unit for timing a first predetermined time, a first ECU connected to a power switch for instructing to turn on a power source of the mobile object, and a second ECU capable of being connected to a terminal device and communicating with the first ECU, comprising: a program executed by the first ECU, The first ECU, a normal operation response process for turning on the power of the mobile body in response to an operation of the power switch when authentication of the user based on the identification information stored in the storage unit is successful while the mobile body is in a power-off state; a maintenance response process for, when a predetermined operation of a power switch is recognized while the mobile body is in a power-off state and the identification information is not stored in the storage unit, starting the measurement of the first predetermined time by the timer unit and starting a process of establishing communication between the first ECU and the second ECU, thereby establishing communication between the first ECU and the second ECU and enabling the terminal device connected to the second ECU to operate the first ECU via the second ECU; A program that executes the following.

Images