Mobility control system, method, and program

Abstract

To provide a mobility control system which can appropriately control a mobility unit in accordance with a state of software used for controlling the mobility unit.SOLUTION: A mobility control system 80 is mounted on a mobility unit to be controlled and performs control in accordance with a state of the mobility unit. A software state detection unit 81 detects a state of software controlling the mobility unit. A control unit 82 performs control to restrict operation functions of the mobility unit on the basis of the state of software. In addition, the software state detection unit 81 detects version information or an update state of the software as the state of software, and the control unit 82 determines the functions to be restricted on the basis of the state of software.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a mobility control system, a mobility control method, and a mobility control program that perform control according to the situation of a mobility equipped with software. [Background technology]

[0002] In recent years, mobility, such as vehicles, has been equipped with communication functions, thereby improving comfort and safety. In addition, by connecting to the Internet, it is possible to enjoy various information services from outside in addition to being able to be realized only within the network within the mobility. In this specification, mobility is defined as a means of transportation (for example, a vehicle such as a car).

[0003] A large amount of software is used to control mobility. For example, various processes such as processes for implementing the above-mentioned communication functions, processes for controlling various mobility functions, and processes for detecting abnormalities are realized using software.

[0004] For example, Patent Document 1 describes a system that takes action when an abnormality occurs in communication data within an in-vehicle system. When an abnormality occurs in communication data within the in-vehicle system, the system described in Patent Document 1 collects information for determining the state from each information processing device within the in-vehicle system, and identifies the presence or absence of a security abnormality and a safety abnormality. The system then determines the action to be taken in response to the abnormality and notifies each information processing device.

[0005] Furthermore, Patent Document 2 describes a system that transmits diagnosis target data to a center device and diagnoses vehicle abnormalities in real time. In the system described in Patent Document 2, when the diagnosis vehicle device transmits the detected diagnosis target data to the center device, the center device judges whether or not the event is rare, determines whether or not the diagnosis vehicle is abnormal based on the judgment result, and transmits the diagnosis result to the diagnosis vehicle device. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2019-73102 A [Patent Document 2] JP 2013-120143 A Summary of the Invention [Problem to be solved by the invention]

[0007] On the other hand, the systems described in Patent Documents 1 and 2 are based on the premise that software for performing various processes is always available. In other words, the systems described in Patent Documents 1 and 2 do not take into consideration cases where the state of the software itself changes. Therefore, when mobility is controlled using software, it is desirable to perform appropriate control according to the state of the software.

[0008] Therefore, an object of the present invention is to provide a mobility control system, a mobility control method, and a mobility control program that can appropriately control mobility depending on the state of software used to control the mobility. [Means for solving the problem]

[0009] The mobility control system according to the present invention includes a software status detection unit that detects an update status of software that controls mobility, and a mobility control unit that detects an update status of the software. If the software status detection unit detects that the software that controls autonomous driving is being updated, the system controls to restrict the autonomous driving functions of the mobility vehicle and controls to allow manual driving. and a control unit.

[0010] The mobility control method according to the present invention detects an update status of software that controls mobility, and updates the mobility-related software. If it is detected that the software controlling autonomous driving is being updated, the system will restrict the autonomous driving functions of the mobility vehicle and will control the vehicle to operate manually. It is characterized by:

[0011] The mobility control program according to the present invention includes a software status detection process for detecting an update status of software that controls mobility, and a mobility control program for detecting an update status of the software. When the software status detection process detects that the software that controls autonomous driving is being updated, the system controls to restrict the autonomous driving functions of the mobility vehicle and controls to allow manual driving. The present invention is characterized by executing control processing. Effect of the Invention

[0012] According to the present invention, mobility can be appropriately controlled depending on the state of the software used to control that mobility. [Brief description of the drawings]

[0013] [Figure 1] 1 is a block diagram showing a configuration example of an embodiment of a mobility control system according to the present invention. [Diagram 2] 1 is a flowchart showing an example of the operation of the mobility control system. [Diagram 3] 1 is a block diagram showing an overview of a mobility control system according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0015] 1 is a block diagram showing an example of the configuration of an embodiment of a mobility control system according to the present invention. The mobility control system 100 of this embodiment includes a communication device 10, a unit 20, a software state detection unit 30, a control unit 40, and an input / output device 50.

[0016] The mobility control system 100 is a system that is installed in the mobility 300 to be controlled and takes measures according to the state of the mobility 300. A specific example of the mobility 300 is a connected car. In this embodiment, an autonomous vehicle using a communication function is assumed, and software used in the communication device 10 and the unit 20 can be updated by OTA (Over the Air). In addition, in this embodiment, various functions of the autonomous vehicle using a Global Positioning System (GPS), road equipment, the Internet, etc. are described as specific examples. However, the mobility 300 is not limited to a vehicle, and may be, for example, a train or an airplane.

[0017] The mobility control system 100 communicates with a security center server 210 in an external security center 200 via the communication device 10. The security center server 210 transmits to the mobility control system 100 information required for mobility control and information related to software.

[0018] Specifically, the communication device 10 is a device that communicates with the security center server 210 or an arbitrary external server (not shown). The communication device 10 may take any form, and may be realized, for example, by a communication device equipped with a dedicated vehicle-mounted module. The communication device 10 may notify the software state detection unit 30 (described later) of the communication status and information on software notified from an external device.

[0019] The unit 20 is a unit that detects various states of the mobility and performs control, and is realized by, for example, various electronic control units. Although only one unit 20 is illustrated in FIG. 1, the number of units 20 is not limited to one, and may be two or more. The mobility control system 100 includes multiple units 20 according to the control objects. For example, in the case of a vehicle, the control objects include the engine, brakes, meters, car navigation, airbags, etc.

[0020] Furthermore, the unit 20 of the present embodiment may be realized by a computer processor (for example, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit)) that operates according to software for performing various types of mobility control.

[0021] Examples of types of software include software that controls telematics, software that controls driving, and software that controls autonomous driving. Examples of controlled objects related to driving include the engine, brakes, and steering wheel. Also, examples of controlled objects related to autonomous driving include cameras, vehicle distance sensors, and GPS. Note that the above-mentioned classifications of software types are merely examples, and classifications may be defined individually depending on the software.

[0022] When the vehicle is traveling, the software that controls the telematics described above is usually permitted to be updated during manual driving or limited automated driving (for example, automated driving to the extent that communication functions are not used). Also, software that controls driving is usually not permitted to be updated while the vehicle is traveling. Also, software that controls automated driving is permitted to be updated if the vehicle is traveling manually.

[0023] The software state detection unit 30 detects the state of software that controls mobility. Specifically, the software state detection unit 30 detects the state of software used in the communication device 10 and the unit 20 that controls various states of mobility. The software state detection unit 30 may detect the state of the software by periodically inquiring about the state of the unit 20, or may detect the state of the software based on a situation notified from the unit 20. Furthermore, the software state detection unit 30 may detect the state of the software when it receives a notification of information related to the software (e.g., update information) from an external device (e.g., security center server 210).

[0024] The software status detection unit 30 detects, as the software status, version information of the software or an update status within the mobility control system 100. Examples of the software update status include a status in which an update is currently in progress, an update is pending, an update has failed, and the like.

[0025] The software state detection unit 30 detects whether the target software is the latest version or not, based on the version information of the software. If the software is not the latest version (is an old version), the software state detection unit 30 may further detect whether the software has vulnerabilities.

[0026] The software state detection unit 30 may periodically inquire of an external device (e.g., the security center server 210) about update information and information indicating the presence or absence of vulnerabilities of the software used by the mobility control system 100 via the communication device 10, or may irregularly receive update information from the software manufacturer. The software state detection unit 30 may then detect the state of the software currently being used based on the software update information or information indicating the presence or absence of vulnerabilities obtained from the external device.

[0027] The control unit 40 performs control to restrict the operating functions of the mobility 300 based on the state of the software detected by the software state detection unit 30. Specifically, the control unit 40 determines the functions to be restricted based on the state of the software, and performs various controls on the determined functions.

[0028] If it is detected that the software is not the latest version, the control unit 40 notifies the user of the recommendation to update to the latest version. Furthermore, if the software has a vulnerability, the control unit 40 may notify the user to more strongly recommend updating to the latest version, and may further perform control to restrict functions according to the location of the vulnerability. In this way, by restricting functions according to the location of the vulnerability, it is possible to restrict only the target functions while suppressing the impact on other functions operated by software having a vulnerability in some functions.

[0029] In this case, the control unit 40 may impose restrictions on functions corresponding to the vulnerable locations similar to those imposed during software updates. For example, the control unit 40 may control the input / output device 50 (described later) to output a message indicating that a software update is required.

[0030] When it is detected that software is being updated, the control unit 40 controls to restrict functions according to the part to be updated. For example, the software that controls telematics performs processing to transmit and receive various information required for driving using a communication function. Therefore, when the software that controls telematics is being updated, the control unit 40 may control to restrict the functions of the communication device.

[0031] Also, for example, it is dangerous to operate the vehicle while updating the software that controls driving. Therefore, when the software that controls driving is being updated, the control unit 40 may perform control to restrict various functions so that driving is not possible. In this case, the control unit 40 may perform control to prevent software update from being performed until the vehicle is stopped.

[0032] In addition, for example, it is dangerous to perform automatic driving when the software that controls automatic driving is being updated. Therefore, when the software that controls automatic driving is being updated, the control unit 40 may perform control to restrict the function for performing automatic driving and perform control to perform manual driving.

[0033] When a situation in which software is waiting to be updated is detected, the control unit 40 performs control to notify the user that the update will change the mobility's operating functions (driving mode), and also performs control according to the presence or absence of vulnerabilities in the software to be updated. Specifically, when it is found that the software waiting to be updated has vulnerabilities, the control unit 40 performs control to restrict functions according to the location of the vulnerabilities.

[0034] Furthermore, if a software update failure is detected, the control unit 40 performs control to notify the user of the update failure and to prompt the user to update again, and performs control similar to that during update standby. That is, the control unit 40 performs the above notification and control according to the presence or absence of vulnerabilities in the software to be updated.

[0035] Note that, when an update is pending or when an update has failed, the control unit 40 may notify the user to confirm whether or not to automatically start the update.

[0036] The input / output device 50 is a device that performs input / output processing between the operator of the mobility 300 and the mobility control system 100. The input / output device 50 is realized, for example, by an IVI (in-vehicle infotainment). The input / output device 50 may output the software update status and the control contents by the control unit 40 in response to an instruction from the control unit 40.

[0037] The software state detection unit 30 and the control unit 40 are realized by a processor (for example, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit)) of a computer that operates according to a program (mobility control program).

[0038] For example, the program may be stored in a storage unit (not shown) included in the mobility control system 100, and the processor may read the program and operate as the software state detection unit 30 and the control unit 40 in accordance with the program. Furthermore, the functions of the mobility control system 100 may be provided in a SaaS (Software as a Service) format.

[0039] The software state detection unit 30 and the control unit 40 may each be realized by dedicated hardware. Also, some or all of the components of each device may be realized by general-purpose or dedicated circuits, processors, etc., or a combination of these. These may be configured by a single chip, or may be configured by multiple chips connected via a bus. Some or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and programs.

[0040] Furthermore, when some or all of the components of the mobility control system 100 are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be arranged in a centralized or distributed manner.

[0041] Next, an operation example of this embodiment will be described. Fig. 2 is a flowchart showing an operation example of the mobility control system 100 of this embodiment. The software state detection unit 30 detects the version information or update status of the software as the software state (step S31). The control unit 40 performs control to limit the operating functions of the mobility based on the detected software state (step S32).

[0042] As described above, in this embodiment, the software status detection unit 30 detects the version information or update status of the software as the software status, and the control unit 40 performs control to limit the operation function of the mobility based on the software status. Therefore, the mobility can be appropriately controlled according to the status of the software used to control the mobility.

[0043] Next, an overview of the present invention will be described. Fig. 3 is a block diagram showing an overview of a mobility control system according to the present invention. A mobility control system 80 according to the present invention is a mobility control system (e.g., mobility control system 100) that is mounted on a mobility to be controlled (e.g., mobility 300) and performs control according to the state of the mobility, and includes a software state detection unit 81 (e.g., software state detection unit 30) that detects the state of software that controls the mobility, and a control unit 82 (e.g., control unit 40) that performs control to limit the operating functions of the mobility based on the state of the software.

[0044] A software state detection unit 81 detects the version information or update status of the software as the state of the software, and a control unit 82 determines the functions to be restricted based on the state of the software.

[0045] Such a configuration allows mobility to be appropriately controlled depending on the state of the software used to control that mobility.

[0046] Furthermore, the software status detection unit 81 may detect the software update status as the software status, and the control unit 82 may perform control to restrict functions according to the update location when the software status detection unit 81 detects a status in which an update is in progress. With such a configuration, it becomes possible to suppress in advance changes in functions that are affected by updates.

[0047] Furthermore, the software state detection unit 81 may detect the presence or absence of software vulnerabilities as the software state, and the control unit 82 may perform control to restrict functions according to the location of the vulnerabilities. With such a configuration, it becomes possible to prevent unexpected operations based on functions having vulnerabilities.

[0048] Furthermore, the software status detection unit 81 may detect that the software status is awaiting a software update or that the software update has failed, and the control unit 82 may perform control to restrict functions according to the location of vulnerabilities contained in the software awaiting an update or the software that has failed to update. With such a configuration, it is possible to suppress unexpected operations based on functions having vulnerabilities that may occur until an update is performed.

[0049] The mobility may be a connected car that performs automatic driving. In this case, the software state detection unit 81 may detect the state of the currently used software based on software update information or information indicating the presence or absence of vulnerability obtained from an external device.

[0050] In this case, the software state detection unit 81 may detect the software update status as the software state, and the control unit 82 may perform control to restrict the function for performing autonomous driving when the software state detection unit 81 detects a state in which an update is being performed. With such a configuration, it becomes possible to suppress unexpected operations that affect autonomous driving.

[0051] Although the present invention has been described above with reference to the embodiments and examples, the present invention is not limited to the above-mentioned embodiments and examples. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Explanation of symbols]

[0052] 10. Communications Equipment 20 units 30 Software status detection unit 40 Control section 50 I / O Devices 100 Mobility Control System 200 Security Center 210 Security Center Server 300 Mobility

Claims

1. a software status detection unit that detects an update status of software that controls mobility; and a control unit that performs control to limit a function for performing automatic driving of the mobility and control to perform manual driving when the software state detection unit detects a situation in which the software for controlling automatic driving of the mobility is being updated. A mobility control system comprising:

2. When the software state detection unit detects a situation in which software that controls the autonomous driving of the mobility among the software is waiting to be updated, the control unit notifies a user that the driving mode of the mobility will change from autonomous driving to manual driving due to the update. The mobility control system of claim 1 .

3. When the software state detection unit detects a situation in which software that controls the running of the mobility among the software is being updated, the control unit performs control to restrict updating of the software that controls the running of the mobility so that the software cannot be updated until the mobility is stopped. The mobility control system according to claim 1 or 2.

4. When the software state detection unit detects a situation in which software that controls driving of the mobility is being updated, the control unit performs control to restrict functions so that the mobility cannot be driven. A mobility control system according to any one of claims 1 to 3.

5. The control unit notifies a user to confirm whether or not to automatically start an update when the software state detection unit detects a state in which the software is waiting to be updated or an update has failed. A mobility control system according to any one of claims 1 to 4.

6. A control device is installed in the mobility to be controlled. A mobility control system according to any one of claims 1 to 5.

7. Detects the update status of the software that controls mobility, When a situation is detected in which the software controlling the automatic driving of the mobility is being updated, control is performed to restrict the function for performing the automatic driving of the mobility, and control is performed to perform manual driving. A control method comprising:

8. When a situation is detected in which the software controlling the autonomous driving of the mobility is waiting to be updated, a user is notified that the driving mode of the mobility will change from autonomous driving to manual driving due to the update. The mobility control method according to claim 7.

9. On the computer, A software status detection process for detecting an update status of software that controls mobility; and A control process for performing control to limit a function for performing automatic driving of the mobility and control for performing manual driving when a situation in which software for controlling automatic driving of the mobility is being updated is detected in the software state detection process. A mobility control program for executing the above.

10. A computer comprising: In the control process, when the software state detection process detects a state in which software that controls the autonomous driving of the mobility among the software is waiting to be updated, a user is notified that the update will change the driving mode of the mobility from autonomous driving to manual driving. The mobility control program according to claim 9.

Images