Vehicle Control Systems

Abstract

To achieve both maintenance of control and reduction of storage area, concerning a control system capable of rewriting a program while driving a vehicle.SOLUTION: A control system 10 for controlling a vehicle includes a first storage unit 13 and a second α-storage unit 23. A first program PG1 for executing a first function A is stored in the first storage unit 13. The second α-storage unit 23 stores an alternative function A' that substitutes for all of the first function A and a second program PG2 that causes the second function B to be executed. The control system 10 controls the vehicle with a first function A and a second function B. The control system 10 controls the vehicle with an alternative function A' and a second function B when the first function A cannot be executed. When the control system 10 rewrites and updates the first program PG1 while the vehicle is running, rewrites the first program PG1 while maintaining the control of the vehicle by the alternative function A' and the second function B.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a vehicle control system. [Background technology]

[0002] Patent Document 1 discloses a control device that can rewrite and update a program for controlling a vehicle while the vehicle is being driven. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-204227 A Summary of the Invention [Problem to be solved by the invention]

[0004] During program rewriting, functions that can be realized by the CPU executing the program are stopped. As disclosed in Patent Document 1, in a control device in which a program may be rewritten while the vehicle is being driven, it is required to maintain control of the vehicle even when functions are stopped due to program rewriting. For this reason, the control device may be equipped with an alternative storage unit that has the same program as the program to be rewritten. In such a control device, when functions are stopped due to program rewriting in the storage unit, control of the vehicle is maintained by the CPU executing the program in the alternative storage unit.

[0005] In the case where multiple storage units each have a different program, in order to maintain control even when any of the programs is rewritten, the control device must be provided with an alternative storage unit corresponding to each storage unit. In such a case, there is a problem that an alternative storage unit is required for each storage unit installed in the control device. [Means for solving the problem]

[0006] A vehicle control system for solving the above problem is a vehicle control system that controls a vehicle, and includes a first memory unit that stores a first program that executes a first function, and a second memory unit that stores an alternative function that replaces all of the first function, and a second program that executes a second function.When the first function can be executed, the vehicle is controlled by the first function and the second function, while when the first function cannot be executed, the vehicle is controlled by the alternative function and the second function.The first program stored in the first memory unit can be rewritten and updated, and when the first program is rewritten while the vehicle is being driven, the first program is rewritten while maintaining control of the vehicle by the alternative function and the second function.

[0007] In the above configuration, the vehicle is controlled by a first function realized by executing the first program and a second function realized by executing the second program. Even during rewriting of the first program, the control of the vehicle can be maintained by the alternative function and the second function.

[0008] Furthermore, in the above configuration, the alternative function is realized by executing a second program. The second program is a program that realizes a second function for controlling the vehicle together with the first function. That is, the control system can maintain control of the vehicle while the first program is being rewritten, without providing a separate storage unit that stores a program solely for replacing the first function that is stopped when the first program is rewritten. [Brief description of the drawings]

[0009] [Figure 1] 1 is a block diagram illustrating an embodiment of a control system for a vehicle. [Diagram 2] FIG. 2 is a schematic diagram showing a storage area of ​​a storage unit in the control system. [Diagram 3] FIG. 2 is a schematic diagram showing a storage area of ​​a storage unit in the control system. [Figure 4] 4 is a flowchart showing a process flow executed by the control system when rewriting a program. [Diagram 5] FIG. 11 is a block diagram showing a modified example of the control system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of a vehicle control system will be described with reference to FIGS. FIG. 1 shows a vehicle 80, a control system 10, and a server 91. The control system 10 is a vehicle control system mounted on the vehicle 80. Information can be transmitted and received between the control system 10 and the server 91 by wireless communication via a network 92. The server 91 can supply the control system 10 with a program for updating the functions of the control system 10. The control system 10 can rewrite and update its own program using the program received from the server 91. That is, the control system 10 supports program updates by OTA (Over The Air). In the following, a new program received from the server 91 is referred to as an update program. The update program may be the new program itself, or may be the difference between the old program and the new program.

[0011] <vehicle> 1, a vehicle 80 includes a communication device 81. The communication device 81 is connected to a control system 10. The communication device 81 can be connected to a network 92. Information can be transmitted and received between the control system 10 and a server 91 via the communication device 81.

[0012] The vehicle 80 may be equipped with a notification device 82. The notification device 82 can provide a notification to the driver of the vehicle 80. The notification device 82 is, for example, a display device capable of displaying characters, figures, and the like. The notification device 82 may be an indicator light that can be turned on or off. The notification device 82 may be a speaker device that can output sound.

[0013] The vehicle 80 is equipped with a braking device 70. One example of the braking device 70 is a hydraulic friction braking device. The braking device 70 has a braking mechanism provided for each wheel of the vehicle 80. The braking mechanism has a wheel cylinder. The braking mechanism can apply a friction braking force to the wheel according to the WC pressure, which is the hydraulic pressure in the wheel cylinder.

[0014] The braking device 70 may include a hydraulic pressure generating device 71 and a brake actuator 72. The vehicle 80 includes a brake operating member 83 that can be operated by the driver. The hydraulic pressure generating device 71 can generate hydraulic pressure according to the operation of the brake operating member 83. The brake actuator 72 can individually adjust the WC pressure in each braking mechanism.

[0015] The vehicle 80 is equipped with various sensors. Detection signals from the various sensors are input, for example, to the control system 10. Fig. 1 illustrates a brake sensor 84 capable of detecting the amount of operation of a brake operating member 83 as an example of the various sensors.

[0016] The vehicle 80 is equipped with a drive unit and a steering unit. The drive unit is a power source that outputs drive force to drive wheels among the wheels equipped on the vehicle 80. An example of the drive unit is an internal combustion engine. A motor generator can also be used as the drive unit. The steering unit can change the angle of the steered wheels among the wheels.

[0017] A manual driving mode and an automatic driving mode are prepared for the vehicle 80. The manual driving mode is a driving mode in which the vehicle 80 is driven based on the operation by the driver of the vehicle 80. The automatic driving mode is a driving mode in which the vehicle 80 is driven automatically.

[0018] Control System Configuration As shown in FIG. 1, the control system 10 includes a plurality of control units. In the control system 10, the control units are connected to each other so that they can communicate with each other. The control system 10 includes a first control unit 11. The control system 10 includes a second control unit 21. The control system 10 may include a third control unit 31. The first control unit 11, the second control unit 21, and the third control unit 31 constitute a braking control unit that controls the braking device 70. As shown in FIG. 2, the first control unit 11 constitutes an upstream control system 10U. The second control unit 21 constitutes a downstream control system 10D. Here, the downstream control system 10D has higher functionality than the upstream control system 10U. The downstream control system 10D can replace the functions of the upstream control system 10U. On the other hand, the upstream control system 10U can only replace a part of the functions of the downstream control system 10D.

[0019] The configuration of each control unit will be described. As shown in Fig. 1, the first control unit 11 includes a first calculation unit 12 and a first storage unit 13. The second control unit 21 includes a second calculation unit 22, a second α storage unit 23, and a second β storage unit 24. The third control unit 31 includes a third calculation unit 32 and a third storage unit 33.

[0020] Each of the storage units 13, 23, 24, and 33 includes a volatile memory such as a DRAM or an SRAM. Each of the storage units 13, 23, 24, and 33 includes a rewritable non-volatile memory such as a flash memory or an EEPROM. The non-volatile memory stores a program that realizes the function of controlling the vehicle 80.

[0021] Each of the calculation units 12, 22, and 32 can execute a program stored in a memory. For example, the first calculation unit 12 can read and execute a program stored in the nonvolatile memory of the first storage unit 13. The second calculation unit 22 can read and execute a program stored in the nonvolatile memory of the second α storage unit 23 and the second β storage unit 24. The third calculation unit 32 can read and execute a program stored in the nonvolatile memory of the third storage unit 33. An example of the first calculation unit 12, the second calculation unit 22, and the third calculation unit 32 is a CPU. A GPU or the like can also be adopted as the first calculation unit 12, the second calculation unit 22, and the third calculation unit 32. Each of the calculation units 12, 22, and 32 may be configured by a plurality of processor cores. Each of the calculation units 12, 22, and 32 may be configured by one processor core.

[0022] The control system 10 may include an integrated control unit 40. The integrated control unit 40 can execute a program that controls the first control unit 11 and the second control unit 21 to control the vehicle 80. The integrated control unit 40 can execute a program that rewrites and updates the programs stored in each of the first control unit 11 and the second control unit 21. The integrated control unit 40 can also execute a program that controls the third control unit 31 to control the vehicle 80. The integrated control unit 40 can also execute a program that rewrites and updates the programs stored in the third control unit 31. The function of the integrated control unit 40 may be provided in at least one of the multiple control units. In this case, the integrated control unit 40 can be omitted. For example, the integrated control unit 40 includes a ROM and a RAM. For example, the integrated control unit 40 includes a CPU that can execute the programs stored in the ROM.

[0023] The control system 10 may include other control units. Examples of the other control units include a drive control unit that controls the drive device, a steering control unit that controls the steering device, and an automatic driving control unit that executes the automatic driving mode. The drive control unit, the steering control unit, and the automatic driving control unit may be provided in a control system separate from the control system 10. In the automatic driving mode, the automatic driving control unit controls each control unit to cause the vehicle 80 to travel automatically.

[0024] Control Program The programs stored in each of the storage units 13, 23, 24 will be described with reference to FIG. 2. FIG. 2 shows a schematic representation of a storage area of ​​a non-volatile memory in the storage unit. The first storage unit 13 stores a first program PG1. The second α storage unit 23 stores a second program PG2. The second β storage unit 24 stores a second program PG2 similar to the program stored in the second α storage unit 23. Alternatively, one of the second program PG2 stored in the second α storage unit 23 and the second program PG2 stored in the second β storage unit 24 may be the latest version, and the other program may be the previous version.

[0025] When the first program PG1 stored in the first storage unit 13 is executed, a first function A is realized. The first function A is a function of operating the hydraulic pressure generating device 71 in response to the operation of the brake operating member 83. In other words, the first function A is a function related to braking of the vehicle 80.

[0026] When the second program PG2 stored in the second α storage unit 23 is executed, the alternative function A′ and the second function B are realized. The alternative function A′ is a function that can operate the hydraulic pressure generating device 71 in place of the first function A. An example of the alternative function A′ is the same function as the first function A. The alternative function A′ does not necessarily have to be the same as the first function A as long as it can replace all of the first function A. The second function B is a function that operates the brake actuator 72. The second function B includes a function that operates the brake actuator 72 to automatically brake the vehicle 80 when the automatic driving mode is executed. That is, the alternative function A′ and the second function B are functions related to braking of the vehicle 80. The second function B includes many functions compared to the first function A or the alternative function A′. In addition, the alternative function A′ and the second function B can also be realized by executing the second program PG2 stored in the second β storage unit 24.

[0027] The second program PG2 is a larger program than the first program PG1, and occupies a larger storage area in the storage unit than the first program PG1.

[0028] In the control system 10, the second α storage unit 23 corresponds to a "second storage unit that stores an alternative function that substitutes for all of the first function, and a second program that executes the second function." The second β storage unit 24 is also one of the "second storage units that stores an alternative function that substitutes for all of the first function, and a second program that executes the second function."

[0029] Brake system control The control of the braking device 70 by the control system 10 will be described with reference to Fig. 2. The control system 10 can control the braking device 70 by a redundant configuration. The control system 10 can control the braking device 70 by a first function A executed by an upstream control system 10U and a second function B executed by a downstream control system 10D.

[0030] In the example shown in Fig. 2, a first program PG1 is being executed in a first control unit 11 constituting an upstream control system 10U. This causes a first function A to be executed. Furthermore, a second program PG2 is being executed in a second control unit 21 constituting a downstream control system 10D. This causes a second function B to be executed.

[0031] Here, a case will be described where an abnormality occurs in the upstream control system 10U and the first function A cannot be executed. In the control system 10, when an abnormality occurs in the upstream control system 10U, the second control unit 21 in the downstream control system 10D can execute the alternative function A' to substitute for the first function A.

[0032] In this way, when the control system 10 can execute the first function A, it controls the braking device 70 of the vehicle 80 by the first function A and the second function B. On the other hand, when the control system 10 cannot execute the first function A, it controls the braking device 70 of the vehicle 80 by the alternative function A' and the second function B. Maintaining control of the braking device 70 by the alternative function A' and the second function B when the first function A cannot be executed is referred to as alternative control by the downstream control system 10D.

[0033] FIG. 2 shows an example in which the second program PG2 stored in the second α storage unit 23 is read and executed. On the other hand, the second program PG2 stored in the second β storage unit 24 is not read, and the second β storage unit 24 is on standby. That is, the second control unit 21 does not execute the second program PG2 stored in the second β storage unit 24. In contrast to the example shown in FIG. 2, the control system 10 can execute the second program PG2 stored in the second β storage unit 24 and put the second α storage unit 23 on standby. For example, when the second program PG2 stored in the second β storage unit 24 is the latest version of the program, the second program PG2 may be executed.

[0034] A case where an abnormality occurs in the downstream control system 10D will be described. In the control system 10, when an abnormality occurs in a control unit that is executing the second program PG2 among the control units constituting the downstream control system 10D, the first function A executed by the upstream control system 10U can be used as necessary. This makes it possible to ensure the safety of the vehicle 80.

[0035] Notification Processing The control system 10 may have a function of controlling the notification device 82 shown in Fig. 1. Notification to the driver of the vehicle 80 or the like by controlling the notification device 82 is referred to as notification processing. For example, a program for performing the notification processing can be executed by the integrated control unit 40. The program for performing the notification processing may be executed by the first control unit 11, the second control unit 21, or the third control unit 31.

[0036] An example of the notification process is an abnormality notification process that notifies that an abnormality has occurred in a control unit. For example, when the first function A cannot be executed, it is possible to notify that an abnormality has occurred in the first control unit 11 constituting the upstream control system 10U. For example, when the second function B cannot be executed, it is possible to notify that an abnormality has occurred in the second control unit 21 constituting the downstream control system 10D. Also, for example, it is possible to perform an abnormality notification that does not include information that can identify which control unit is the control unit in which the abnormality has occurred.

[0037] In the abnormality notification process, for example, an indicator light indicating the abnormality is turned on, or information indicating the abnormality is displayed on a display device, or a notification sound indicating the abnormality is output from a speaker device.

[0038] An example of the notification process is an update notification process that notifies that the program of the control unit is being rewritten. For example, it is possible to notify that the first program PG1 or the second program PG2 is being rewritten. Also, for example, it is possible to perform an update notification that does not include information that can identify the program being rewritten.

[0039] In the update notification process, for example, an indicator light indicating that the program is being rewritten is turned on to notify the user of the update. Alternatively, for example, information indicating that the program is being rewritten is displayed on a display device to notify the user of the update. Alternatively, for example, a notification sound indicating that the program is being rewritten is output from a speaker device to notify the user of the update.

[0040] As another notification process, a process of notifying that an update program has been received from the server 91 may be performed. Also, a process of notifying that a program update has been completed may be performed. Also, as a notification process during program rewriting, a process of notifying of functions that will be stopped due to rewriting may be performed.

[0041] Program Updates 3 and 4, a process for rewriting and updating a control program will be described. Here, an example will be described in which the first program PG1 stored in the first storage unit 13 is rewritten while the vehicle 80 is being driven. When a program is rewritten, the function realized by the execution of the program is stopped. That is, when the first program PG1 is rewritten, the first function A is stopped.

[0042] In the control system 10, when the first program PG1 in the upstream control system 10U is rewritten, the alternative function A' and the second function B are performed by one control unit constituting the downstream control system 10D, as shown in Fig. 3. In the example shown in Fig. 3, the second program PG2 stored in the secondα storage unit 23 is being executed by the second control unit 21. That is, the alternative function A' and the second function B are performed by executing the second program PG2 stored in the secondα storage unit 23.

[0043] In this way, when the control system 10 rewrites the first program PG1 while the vehicle 80 is being driven, the control system 10 can rewrite the first program PG1 while maintaining control of the vehicle 80 by the alternative function A' and the second function B.

[0044] In addition, in the control system 10, when the second program PG2 in the downstream control system 10D is rewritten, the second α storage unit 23 or the second β storage unit 24, whichever storage unit has not been read by the second calculation unit 22, is the target of rewriting. As a specific example, when the latest version of the second program PG2 is stored in the second α storage unit 23 and the second calculation unit 22 reads and executes the second program PG2, the second β storage unit 24 is the target of rewriting. That is, when the second program PG2 in the second α storage unit 23 is being executed, the second β storage unit 24, which is on standby, is the target of rewriting. In this way, in the control system 10, the second control unit 21 has two storage units that store the second program PG2, so that the second program PG2 can be rewritten while maintaining control of the vehicle 80.

[0045] Fig. 4 shows a process flow when rewriting and updating a control program. This process routine is repeatedly executed at a predetermined cycle. A rewrite program, which is a program for executing the process shown in Fig. 4, is stored, for example, in the ROM of the integrated control unit 40. The process shown in Fig. 4 can be realized by the CPU of the integrated control unit 40 executing the rewrite program stored in the ROM.

[0046] When this processing routine is started, first, in step S101, the control system 10 determines whether or not an update program has been received from the server 91. If an update program has not been received (S101: NO), the control system 10 temporarily ends this processing routine. On the other hand, if an update program has been received (S101: YES), the control system 10 shifts the processing to step S102.

[0047] In step S102, the control system 10 determines whether or not the program of the upstream control system 10U is to be rewritten. If the update program received from the server 91 is a new first program PG1, the program of the upstream control system 10U is to be rewritten. On the other hand, if the update program is a new second program PG2, the program of the upstream control system 10U is not to be rewritten, but the program of the downstream control system 10D is to be rewritten. If the program of the upstream control system 10U is to be rewritten (S102: YES), the control system 10 transitions the process to step S103.

[0048] In step S103, the control system 10 determines whether the driving mode of the vehicle 80 is the manual driving mode. If the driving mode is not the manual driving mode, that is, if the driving mode is the automatic driving mode (S103: NO), the control system 10 temporarily ends this processing routine.

[0049] On the other hand, if the driving mode is the manual driving mode, that is, if the driving mode is not the automatic driving mode (S103: YES), the control system 10 transitions the process to step S104.

[0050] In step S104, the control system 10 prohibits rewriting of the program in the downstream control system 10D. As a result, even if a new second program PG2 is received from the server 91, the program in the downstream control system 10D will not be rewritten. When prohibiting rewriting of the program in the downstream control system 10D, the control system 10 transitions the process to step S105.

[0051] In step S105, the control system 10 transfers the control of the braking device 70 to alternative control by the downstream control system 10D. Specifically, the control system 10 stops the first function A. Furthermore, the control system 10 causes the second control unit 21 constituting the downstream control system 10D to execute the alternative function A' and the second function B. Thereafter, the control system 10 transfers the process to step S106.

[0052] In step S106, the control system 10 prohibits the driving mode of the vehicle 80 from being switched from the manual driving mode to the automatic driving mode. That is, the manual driving mode is continued. After that, the control system 10 transitions the process to step S107.

[0053] In step S107, the control system 10 optimizes the notification process. For example, the control system 10 prohibits the abnormality notification process and performs the update notification process. The control system 10 may only prohibit the abnormality notification process. After that, the control system 10 shifts the process to step S108.

[0054] In step S108, the control system 10 executes rewriting of the program in the upstream control system 10U. That is, the control system 10 rewrites the first program PG1 in the first control unit 11. After that, the control system 10 ends this processing routine.

[0055] When the rewriting of the first program PG1 is completed, the first control unit 11 is in a standby state until the control system 10 is restarted. The alternative control by the downstream control system 10D continues until the control system 10 is restarted. After the control system 10 is restarted, the update of the first program PG1 is completed and a new first program PG1 is executed. Accordingly, the control system 10 ends the alternative control. That is, the braking device 70 is controlled by the first function A and the second function B. Furthermore, after the control system 10 is restarted, the control system 10 releases the inhibition of rewriting the program in the downstream control system 10D. Furthermore, the control system 10 releases the inhibition of switching to the automatic driving mode. Furthermore, the control system 10 releases the inhibition of the abnormality notification process. Furthermore, the control system 10 ends the update notification process.

[0056] In the process of step S102, if the program of the downstream control system 10D is to be rewritten (S102: NO), the control system 10 shifts the process to step S109.

[0057] In step S109, the control system 10 executes rewriting of the program in the downstream control system 10D. That is, the control system 10 rewrites the second program PG2 in the storage unit that is on standby, either the second α storage unit 23 or the second β storage unit 24. After that, the control system 10 ends this processing routine. When the rewriting of the second program PG2 is completed, the storage unit that is the target of the rewriting is placed in a standby state until the control system 10 is restarted. After the control system 10 is restarted, the update of the second program PG2 is completed and the new second program PG2 is executed. Accordingly, the control system 10 places the storage unit that has the old second program PG2, either the second α storage unit 23 or the second β storage unit 24, on standby.

[0058] <Action and Effects> The operation and effects of this embodiment will be described. In the control system 10, the vehicle 80 is controlled by a first function A that is realized by executing a first program PG1 and a second function B that is realized by executing a second program PG2. Even during rewriting of the first program PG1, the control of the vehicle 80 can be maintained by the alternative function A' and the second function B.

[0059] Furthermore, in the control system 10, the alternative function A' is realized by executing the second program PG2. The second program PG2 is a program that realizes a second function B for controlling the braking device 70 of the vehicle 80 together with the first function A. That is, in the control system 10, it is possible to maintain control of the vehicle 80 during rewriting of the first program PG1 without separately providing a storage unit that stores a program solely for replacing the first function A that is stopped in association with the rewriting of the first program PG1.

[0060] In a vehicle that has an automatic driving mode, such as the vehicle 80, the functions for controlling the vehicle are multiplexed. With the multiplexing of functions, many storage units in which programs are stored may be installed. According to the control system 10, it is possible to maintain control of the vehicle 80 during program rewriting, even if it is not necessary to provide storage units in which programs are stored only for replacing the functions of all storage units. In the control system 10, it is possible to reduce the number of storage units, compared to a case in which storage units in which programs are stored only for replacing the functions of all storage units are provided.

[0061] In a configuration in which control is performed by the upstream control system 10U and the downstream control system 10D, as in the control system 10, redundancy is reduced during execution of alternative control by the downstream control system 10D. Here, if the driving mode of the vehicle 80 during execution of alternative control is a manual driving mode, redundancy can be ensured by operation by the driver. On the other hand, when the vehicle 80 is controlled in an automatic driving mode, operation by the driver cannot be expected. For this reason, if alternative control is executed when the vehicle 80 is controlled in an automatic driving mode, redundancy cannot be ensured.

[0062] In this regard, according to the control system 10, when the vehicle 80 is controlled in the autonomous driving mode, the processing routine shown in FIG. 4 is terminated (S103: NO). That is, rewriting of the first program PG1 is prohibited. Furthermore, in the control system 10, switching from the manual driving mode to the autonomous driving mode is prohibited while the first program PG1 is being rewritten in the first storage unit 13 (S106). That is, when the driving mode of the vehicle 80 is the autonomous driving mode, the first program PG1 is not rewritten, and alternative control associated with the rewriting is not performed. This makes it possible to avoid a decrease in redundancy.

[0063] In the control system 10, the first function A is, for example, a function of activating the hydraulic pressure generating device 71 in response to the operation of the brake operating member 83. The second function B is, for example, a function of activating the brake actuator 72 so as to individually adjust the braking force generated on each wheel in response to the running state of the vehicle 80. The first function A is less complicated than the second function B. This makes it possible to reduce the increase in size of the second program PG2 that can realize the alternative function A' that can substitute for the first function A.

[0064] While a program is being rewritten, the functions realized by executing the program are stopped. In this case, the stop is not due to the occurrence of an abnormality, so it is not preferable to notify an abnormality accompanying the program rewriting. Therefore, in the control system 10, while the first program PG1 in the first storage unit 13 is being rewritten, notification of an abnormality is prohibited (S107). This makes it possible to prevent erroneous notification of an abnormality from being made.

[0065] According to the control system 10, while the first program PG1 is being rewritten in the first storage unit 13, the notification device 82 can be controlled to notify that the first program PG1 is being rewritten (S107).

[0066] In the control system 10, the downstream control system 10D is configured by the second control unit 21 including the second α storage unit 23 and the second β storage unit 24. Therefore, even if the second program PG2 in one of the second α storage unit 23 and the second β storage unit 24 is being rewritten, the second calculation unit 22 executes the second program PG2 stored in the other storage unit, thereby making it possible to continue control of the vehicle 80.

[0067] (Example of change) This embodiment can be modified as follows: This embodiment and the following modifications can be combined with each other to the extent that they are not technically inconsistent.

[0068] In the process of step S103 shown in FIG. 4, if the driving mode of the vehicle 80 is the automatic driving mode (S103: NO), a request to switch from the automatic driving mode to the manual driving mode may be made, and the processing routine may then be terminated. If the driving mode is switched to the manual driving mode by the request in this process, the process proceeds to step S104 and subsequent steps if the process of step S103 is executed again. As a result, it becomes possible to rewrite the upstream control system 10U. That is, it becomes possible to rewrite the first program PG1.

[0069] According to the above processing, when a request is made to rewrite the first program PG1 in the first memory unit 13 while the vehicle 80 is being controlled in the autonomous driving mode, the autonomous driving mode is switched to the manual driving mode, and then the first program PG1 can be rewritten.

[0070] Each control unit in the control system 10 may transmit a signal indicating its own status to the other control units. An example of a signal indicating a status is a signal indicating that a program in the control unit is being rewritten. An example of a signal indicating a status is a signal indicating that the control unit is executing a program. An example of a signal indicating a status is a signal indicating that the control unit is on standby. An example of a signal indicating a status is a signal indicating that the control unit is operating normally. If the signal is not transmitted, it can be determined that an abnormality has occurred in the control unit. An example of a signal indicating a status may be a signal indicating that an abnormality has occurred in the control unit.

[0071] Each control unit in the control system 10 may switch the state of the control system at the discretion of each control unit based on a signal that each control unit transmits to the other control units, rather than being controlled by the integrated control unit 40. For example, when the second control unit 21 is informed that an abnormality has occurred in the first control unit 11, alternative control may be performed by the downstream control system 10D.

[0072] In the above embodiment, the second control unit 21 is provided with two storage units for storing the second program PG2 so that the function of the downstream control system 10D can be maintained even during the rewriting of the second program PG2 in the downstream control system 10D. As a control system, the second control unit 21 may have one storage unit. Even if the control system is configured in this way, the control of the vehicle 80 can be maintained by the alternative control during the rewriting of the first program PG1, as in the above embodiment. However, in the case where the second control unit 21 has only one storage unit as in the above configuration, when the second program PG2 of the second control unit 21 is rewritten, the function of the downstream control system 10D cannot be maintained. That is, the alternative function A' cannot be executed. For this reason, in a situation where the alternative control is necessary, it is desirable to prohibit the rewriting of the second program PG2 in the second control unit 21. For example, when the first function A of the upstream control system 10U is stopped due to the rewriting of the first program PG1 in the first control unit 11, it is advisable to prohibit the rewriting of the second program PG2.

[0073] In the above embodiment, an example was shown in which the alternative function A' is executed by the second control unit 21 constituting the downstream control system 10D. For example, if the second program PG2 capable of realizing the alternative function A' is also stored in the third storage unit 33, the downstream control system 10D can also be configured by the second control unit 21 and the third control unit 31. In this configuration, the second control unit 21 may have only one storage unit. In this configuration, the alternative function A' is executed in the downstream control system 10D as follows. For example, when the first function A of the upstream control system 10U is stopped by rewriting the first program PG1 in the first control unit 11, one of the second control unit 21 and the third control unit 31 can execute the second program PG2. For example, when a program is being rewritten in one of the second control unit 21 and the third control unit 31 constituting the downstream control system 10D, that is, when the alternative function A' cannot be executed in one of the control units, the other control unit executes the alternative function A'.

[0074] In the above embodiment, an example has been shown in which the first control unit 11 includes the first storage unit 13, and the second control unit 21 includes the second α storage unit 23 and the second β storage unit 24. However, the control system is not limited to this, and may have a configuration shown in FIG.

[0075] The control system 110 shown in Fig. 5 includes a control unit 111 having a first storage unit 113, a second storage unit 123, and a third storage unit 133. The control unit 111 further includes a calculation unit 112. The first storage unit 113 stores a first program PG1. The second storage unit 123 and the third storage unit 133 store a second program PG2.

[0076] The calculation unit 112 can execute the first program PG1 and the second program PG2. When the first function A can be executed, the calculation unit 112 controls the vehicle by the first function A and the second function B, while when the first function A cannot be executed, the calculation unit 112 can control the vehicle by the alternative function A' and the second function B. The calculation unit 112 can rewrite and update the first program PG1 stored in the first storage unit 113. The calculation unit 112 can rewrite and update the second program PG2 stored in the second storage unit 123 and the third storage unit 133. When the calculation unit 112 rewrites the first program PG1 while the vehicle is being driven, the calculation unit 112 can rewrite the first program PG1 while maintaining control of the vehicle by the alternative function A' and the second function B.

[0077] In the control system 110, the second storage unit 123 corresponds to a "second storage unit that stores an alternative function that substitutes for all of the first function, and a second program that causes the second function to be executed." The third storage unit 133 also corresponds to a "second storage unit that stores an alternative function that substitutes for all of the first function, and a second program that causes the second function to be executed."

[0078] In the control system 110, similarly to the control system 10 in the above embodiment, the control of the vehicle 80 can be maintained by alternative control while the first program PG1 is being rewritten. Even when the second program PG2 in one of the second storage unit 123 and the third storage unit 133 is being rewritten, the control of the vehicle can be continued by executing the second program PG2 stored in the other storage unit.

[0079] The configuration of the control system in the above embodiment is an example. The configuration can be changed as long as the control system allows the program to be rewritten while the vehicle 80 is being driven. For example, each control unit having a storage unit and a calculation unit may be configured with one or more hardware circuits. An example of a hardware circuit is an FPGA (Field Programmable Gate Array). Each control unit may also include a processor that executes some of the various processes according to a computer program, and a hardware circuit that executes the remaining processes.

[0080] The calculation unit may further include a dedicated memory in addition to a processor core. In the above embodiment, the control of the braking device 70 by the control system 10 is illustrated, but this is not limiting. The first function A and the second function B may be functions that control the vehicle 80, and may not be functions related to braking of the vehicle 80.

[0081] In the above embodiment, an example has been described in which the program is rewritten while the vehicle 80 is being driven. In the control system 10, it is also possible to rewrite the program when the start switch of the vehicle 80 is turned off. [Explanation of symbols]

[0082] 10…Control system 10U…Upstream control system 10D…Downstream control system 11...First control section 12...1st calculation section 13...1st storage section 21...Second control section 22…Second calculation section 23…Second α memory section 24…Second β storage section 31…Third control section 32...Third calculation section 33...Third memory section 70...braking device 71...Liquid pressure generating device 72...Braking actuator 80…Vehicle 82…Notification device 91...Server 92…Network

Claims

1. A vehicle control system for controlling a vehicle, comprising: a first storage unit that stores a first program for executing a first function, and a second storage unit that stores an alternative function that substitutes for the entire first function, and a second program for executing a second function; When the first function can be executed, the vehicle is controlled by the first function and the second function, and when the first function cannot be executed, the vehicle is controlled by the alternative function and the second function, The first program stored in the first storage unit can be rewritten and updated, when the first program is rewritten while the vehicle is being driven, the first program is rewritten while maintaining control of the vehicle by the alternative function and the second function, The vehicle is provided with a manual driving mode in which the vehicle is driven based on an operation by a driver of the vehicle, and an automatic driving mode in which the vehicle is driven automatically, When the vehicle is controlled in the automatic driving mode, rewriting of the first program is prohibited. Vehicle control system.

2. Switching from the manual driving mode to the automatic driving mode is prohibited during rewriting of the first program in the first storage unit. The vehicle control system according to claim 1 .

3. When a request is made to rewrite the first program in the first storage unit during control of the vehicle in the automatic driving mode, the automatic driving mode is switched to the manual driving mode, and the first program is then rewritten.

3. A vehicle control system according to claim 1 or 2.

4. During the rewriting of the first program in the first storage section, rewriting of the second program in the second storage section is prohibited. The vehicle control system according to any one of claims 1 to 3.

5. The first function and the second function are functions related to braking of the vehicle. The vehicle control system according to any one of claims 1 to 4.

6. A notification device of the vehicle can be controlled; When the first function or the second function cannot be executed, the notification device is controlled to notify the abnormality, The notification of the abnormality is prohibited during rewriting of the first program in the first storage unit. A vehicle control system according to any one of claims 1 to 5.

7. A notification device of the vehicle can be controlled; During the rewriting of the first program in the first storage unit, the notification device is controlled to notify that the first program is being rewritten. A vehicle control system according to any one of claims 1 to 6.

Images