Mobile body control device, mobile body control method, and program

Abstract

To avoid actuation of apparatuses provided in a movable body from being interrupted by processing of updating software of a controller.SOLUTION: A movable body controller 1 comprises: a software update unit 22 that executes processing of updating software of apparatus control units 51a-51c provided in a movable body 100; an apparatus actuation state recognition unit 23 that recognizes the actuation state of actuation apparatuses 71-73 controlled by the apparatus control units 51a-51c; and a software update restriction unit 24 that, while the apparatus actuation state recognition unit 23 recognizes that the actuation apparatuses 71-73 are being actuated, executes software update inhibition processing of inhibiting the software update unit 22 from executing the processing of updating the software of the apparatus control units 51a-51c.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a mobile object control device, a mobile object control method, and a program. [Background technology]

[0002] Conventionally, technologies for supporting software updates for in-vehicle devices have been proposed. For example, Patent Document 1 discloses a technology for controlling the vehicle doors to be in an unlocked state before executing a software update process in order to avoid a situation in which vehicle functions are restricted and the door unlock operation becomes impossible during a software update for an in-vehicle device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2022-40990 Summary of the Invention [Problem to be solved by the invention]

[0004] However, mobile objects such as vehicles are equipped with various devices that operate in response to user operations, and if a software update process for a control device is executed while these devices are operating, the operation of the devices may be interrupted, which may cause discomfort or anxiety to the user. Therefore, an object of the present application is to prevent the operation of devices equipped in a mobile object from being interrupted by a software update process for a control device. The present application aims to improve safety in order to solve the above-mentioned problems, and by extension, to further improve traffic safety and contribute to the development of a sustainable transportation system. [Means for solving the problem]

[0005] As a first aspect for achieving the above object, a software update unit that executes a software update process for a device control unit provided in a mobile object, a device operation state recognition unit that recognizes the operation state of an operating device controlled by the device control unit, and a software update restriction unit that executes a software update prohibition process that prohibits the software update unit from executing the software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation. an integrated control unit connected to a plurality of device control units that individually control a plurality of the operating devices provided in the moving body; Equipped with The software update unit executes software update processing for the plurality of device control units via the integrated control unit, the device operation state recognition unit recognizes the operation states of the plurality of operating devices via the integrated control unit, and the software update restriction unit executes the software update prohibition processing for the plurality of device control units via the integrated control unit. Examples include mobile control devices.

[0006] In the above-mentioned mobile body control device, the software update unit may be configured to disable the failure detection functions of the multiple equipment control units by sending failure detection disable instruction information to the multiple equipment control units via the integrated control unit when performing a software update process for at least one of the multiple equipment control units. In the mobile control device, the software update unit may be configured to enable the fault detection functions of the multiple equipment control units by sending fault detection enable instruction information to the multiple equipment control units via the integrated control unit when the software update process of the equipment control unit is completed.

[0007] The above-mentioned mobile body control device may be configured to include a surrounding presence recognition unit that recognizes presences around the mobile body, and the software update restriction unit may be configured to terminate the software update prohibition process and enable the software update unit to execute the software update process for the equipment control unit when the equipment operation status recognition unit recognizes that the operation of the operating equipment has ended and the surrounding presence recognition unit no longer recognizes the presences during the execution of the software update prohibition process.

[0008] the above As a second aspect for achieving the object, a software update unit that executes a software update process for a device control unit provided in a mobile object, a device operation state recognition unit that recognizes the operation state of an operating device controlled by the device control unit, and a software update restriction unit that executes a software update prohibition process that prohibits the software update unit from executing the software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation. A communication control unit that communicates with a user terminal used by a user of the mobile body and,the device control unit starts operation of the operating device when the communication control unit receives operation instruction information for the operating device transmitted from the user terminal, and the software update restriction unit, after the device control unit starts operation of the operating device in response to receiving the operation instruction information and starts the software update prohibition process in response to recognition by the device operation state recognition unit that the operating device is in operation, transmits software update confirmation information to the user terminal by the communication control unit, inquiring about whether or not to execute software update processing for the device control unit, when the device operation state recognition unit recognizes that the operation of the operating device has been completed, and terminates the software update prohibition process when the communication control unit receives software update instruction information transmitted from the user terminal that instructs execution of software update processing for the device control unit, and enables execution of software update processing for the device control unit by the software update unit. Mobile control devices include .

[0009] the above As a third aspect for achieving the object, a software update unit that executes a software update process for a device control unit provided in a mobile body, a device operation state recognition unit that recognizes the operation state of an operating device controlled by the device control unit, a software update restriction unit that executes a software update prohibition process that prohibits the software update unit from executing a software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation, and a communication control unit that communicates with a user terminal used by a user of the mobile body; and the device control unit starts the operation of the operating device when the communication control unit receives operation instruction information for the operating device transmitted from the user terminal, and the software update restriction unit starts the software update prohibition process when the device control unit starts the operation of the operating device in response to receiving the operation instruction information and the device operation status recognition unit recognizes that the operating device is in operation, and then when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the device control unit starts the software update prohibition process when the communication control unit receives operation instruction information for the operating device transmitted from the user terminal, and the software update restriction unit User terminal and receiving detection information from an acceleration sensor provided in the device control unit, determining whether the user terminal is stopped based on the detection information, and when determining that the user terminal is stopped, terminating the software update prohibition process and enabling the software update unit to execute the software update process for the device control unit. Mobile control devices include .

[0010] the above As a fourth aspect for achieving the object, a mobile object includes a software update unit that executes a software update process for a device control unit provided in the mobile object, a device operation state recognition unit that recognizes the operation state of an operating device controlled by the device control unit, and a software update restriction unit that executes a software update prohibition process that prohibits the software update unit from executing the software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation,The operating device is any one of a door opening / closing device for the mobile body, a door locking device for the mobile body, a charge lid for the mobile body, a fuel lid for the mobile body, an electric sliding seat for the mobile body, a trunk opening / closing device for the mobile body, a tailgate opening / closing device for the mobile body, an air suspension extension / retraction device for the mobile body, a power window opening / closing device for the mobile body, a sunroof opening / closing device for the mobile body, a sunshade opening / closing device for the mobile body, a steering wheel tilt and telescopic adjustment device for the mobile body, and a movable rear monitor camera for the mobile body. Mobile control devices include .

[0011] the above The second to fourth aspects In the mobile object control device, The mobile object includes an integrated control unit connected to a plurality of device control units that individually control the plurality of operating devices, wherein the software update unit executes software update processing for the plurality of device control units via the integrated control unit, the device operation state recognition unit recognizes the operation states of the plurality of operating devices via the integrated control unit, and the software update restriction unit executes the software update prohibition processing for the plurality of device control units via the integrated control unit. The configuration may be such that:

[0013] To achieve the above objectives, 5 As an aspect, a mobile object control method executed by a computer includes: a software update step of executing a software update process for an equipment control unit provided in a mobile object; an equipment operation state recognition step of recognizing an operation state of an operating equipment controlled by the equipment control unit; and a software update restriction step of executing a software update prohibition process for prohibiting execution of a software update process for the equipment control unit by the software update step while it is recognized by the equipment operation state recognition step that the operating equipment is in operation. The software update step executes software update processing for the plurality of device control units via an integrated control unit provided in the mobile body and connected to the plurality of device control units that individually control the plurality of operating devices, the device operation state recognition step recognizes the operation states of the plurality of operating devices via the integrated control unit, and the software update restriction step executes the software update prohibition processing for the plurality of device control units via the integrated control unit. A mobile object control method is also included.

[0014] To achieve the above objectives, 6 As an aspect, a computer is caused to function as a software update unit that executes software update processing for a device control unit provided in a mobile object, a device operation state recognition unit that recognizes the operation state of an operating device controlled by the device control unit, and a software update restriction unit that executes software update prohibition processing to prohibit the software update unit from executing software update processing for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation. The software update unit executes software update processing for the plurality of device control units via an integrated control unit provided in the mobile object and connected to the plurality of device control units that individually control the plurality of operating devices, the device operation state recognition unit recognizes the operation states of the plurality of operating devices via the integrated control unit, and the software update restriction unit executes the software update prohibition processing for the plurality of device control units via the integrated control unit. Programs include: [Effects of the Invention]

[0015] According to the above mobile object control device, mobile object control method, and program, it is possible to prevent the operation of the equipment provided in the mobile object from being interrupted by the software update process of the control device. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a configuration diagram of a mobile object control device. [Figure 2] FIG. 2 is a first flowchart of the software update process for the local ECU. [Figure 3] FIG. 3 is a second flowchart of the software update process for the local ECU. DETAILED DESCRIPTION OF THE INVENTION

[0017] [1. Configuration of mobile control device] The configuration of a mobile body control device 1 of this embodiment will be described with reference to Fig. 1. The mobile body control device 1 is mounted on a mobile body 100 (corresponding to the target mobile body of the present disclosure) and controls the operation of the mobile body 100. The mobile body 100 is a vehicle, an aircraft, a ship, etc. The mobile body 100 is equipped with an SS (start / stop) switch 2 that instructs starting and stopping (power ON and power OFF) of the mobile body 100, a communication unit 3, an external monitor camera 4, and a display 5.

[0018] The communication unit 3 communicates with the mobile object management server 210 and a user terminal 90 used by a user U of the mobile object via the communication network 200, and also performs short-range wireless communication with the user terminal 90 using Bluetooth (registered trademark), Wifi (registered trademark), etc. The external monitor camera 4 captures images of the surroundings of the mobile object 100.

[0019] The mobile object control device 1 includes a central ECU (Electronic Control Unit) 10, gateway ECUs 50a and 50b, and local ECUs 51a to 51f. The central ECU 10 is connected to the gateway ECU 50a by a communication line 40a, and is also connected to the gateway ECU 50b by a communication line 40b.

[0020] The gateway ECU 50a is connected to a plurality of local ECUs 51a to 51c via a communication line 41a, and the gateway ECU 50b is connected to a plurality of local ECUs 51a to 51c via a communication line 41b. d The local ECUs 51a to 51f are connected to the local ECUs 51a to 51c. The local ECUs 51a to 51c control the operation of operating devices 71 to 73 provided in the vehicle 100. The operating devices 71 to 73 include, for example, a door opening / closing device for the vehicle 100, a door locking device for the vehicle 100, a charge lid for the vehicle 100, a fuel lid for the vehicle 100, an electric sliding seat for the vehicle 100, a trunk opening / closing device for the vehicle 100, a tailgate opening / closing device for the vehicle 100, an air suspension extension / retraction device for the vehicle 100, a power window opening / closing device for the vehicle 100, a sunroof opening / closing device for the vehicle 100, a sunshade opening / closing device for the vehicle 100, a steering wheel tilt and telescopic adjustment device for the vehicle 100, and a movable rear monitor camera for the vehicle 100. Furthermore, the local ECU 51 d controls the operation of the communication unit 3 , the local ECU 51 e controls the operation of the external monitor camera 4 , and the local ECU 51 f controls the operation of the display 5 .

[0021] Hereinafter, the gateway ECU 50a and the gateway ECU 50b will be collectively referred to as the gateway ECU 50, and the local ECUs 51a to 51f will be collectively referred to as the local ECU 51. The central ECU 10, the gateway ECU 50, and the local ECU 51 are control units equipped with a processor, a memory, an interface circuit, etc. The gateway ECU 50 corresponds to the integrated control unit in the present disclosure, and the local ECU 51 corresponds to the device control unit in the present disclosure.

[0022] The multiple local ECUs 51 connected to the gateway ECU 50 are grouped according to the functions and locations of the objects controlled by the local ECUs 51. Although two gateway ECUs 50a and 50b are illustrated in Fig. 1, three or more gateway ECUs 50 may be provided. Furthermore, the number of objects controlled connected by the local ECUs 51 may be two or more.

[0023] The central ECU 10 manages the mobile object 100 by OTA (Over The Air), and in this embodiment, the process in which the central ECU 10 downloads a new version of software (update software) for the local ECU 51 from the mobile object management server 210 and updates the software of the local ECU 51 is described.

[0024] The central ECU 10 includes a processor 20, a memory 30, etc., and the memory 30 stores a program 31 for controlling the central ECU 10. The processor 20 corresponds to the computer of the present disclosure. By reading and executing the program 31, the processor 20 functions as a communication control unit 21, a software update unit 22, an equipment operation state recognition unit 23, a software update restriction unit 24, and a surrounding presence recognition unit 25.

[0025] The process executed by the software update unit 22 corresponds to the software update step in the mobile object control method of the present disclosure, the process executed by the equipment operation state recognition unit 23 corresponds to the equipment operation state recognition step in the mobile object control method of the present disclosure, and the process executed by the software update restriction unit 24 corresponds to the software update restriction step in the mobile object control method of the present disclosure.

[0026] The communication control unit 21 controls communication with the mobile object management server 210 and the user terminal 90 via the communication unit 3. The software update unit 22 downloads and acquires a new version of software for the local ECU 51 from the mobile object management server 210, and executes a software update process to update the software of the local ECU 51 from the old version to the new version. The new version of software may also be received and acquired from a maintenance terminal 300 connected to the mobile object control device 1.

[0027] The device operation state recognition unit 23 recognizes the operation state of the operating device by receiving operation state information of the operating device controlled by the local ECU 51 via the gateway ECU 50. The software update restriction unit 24 executes software update restriction processing that prohibits the software update unit 22 from updating the software of the local ECU 51 while the device operation state recognition unit 23 recognizes that the operating device is in operation.

[0028] The surrounding person recognition unit 25 recognizes surrounding people around the moving object 100 from the images captured by the external monitor camera 4. It is also possible to recognize surrounding people carrying terminal devices from the reception strength of radio waves from the communication unit 3.

[0029] [2. Software update process] The procedure of the software update process of the local ECU 51 executed by the mobile object control device 1 will be described with reference to the flowcharts shown in Figures 2 and 3. The mobile object control device 1 executes the process according to the flowcharts shown in Figures 2 and 3 when the mobile object 100 is in a standby state (a state in which the SS switch 2 is stopped and the power of the mobile object 100 is turned off). The central ECU 10 updates the software of the local ECU 51 by communicating with the local ECU 51 via the gateway ECU 50.

[0030] 2, the software update unit 22 downloads a new version of software for the local ECU 51 from the mobile object management server 210 via the communication control unit 21. In the following step S2, the software update unit 22 transfers the new version of software to the gateway ECU 50. In step S20, the gateway ECU 50 transmits the new version of software received from the central ECU 10 to the local ECU 51 and installs it in the local ECU 51.

[0031] The local ECU 51 has a dual-layer memory, and the new version of the software is stored on a different layer from the layer on which the old version of the software currently in use is stored. Then, through activation processing (described later), the software used by the local ECU 51 is switched from the old version to the new version, thereby completing the software update of the local ECU 51.

[0032] In step S3, the software update unit 22 transmits a valid instruction signal for the re-power-on prohibition request to the gateway ECU 50, thereby instructing the prohibition of re-power-on by the start operation of the SS switch 2. In step S21, the gateway ECU 50 transmits a valid instruction signal for the re-power-on prohibition request to the local ECU 51, thereby putting the local ECU 51 into a re-power-on prohibition state.

[0033] In step S4, the device operation state recognition unit 23 transmits to the gateway ECU 50 an operation state request signal requesting transmission of operation state information indicating the states of the operating devices controlled by the local ECU 51. When the gateway ECU 50 receives the operation state request signal in step S22, the process proceeds to step S23, where the gateway ECU 50 receives the operation state information from the local ECU 51 through communication with the local ECU 51. In the following step S24, the gateway ECU 50 transmits the operation state information to the central ECU 10. In the next step S25, the gateway ECU 50 determines whether or not an operating state request signal has been received, and if an operating state request signal has been received, the gateway ECU 50 proceeds to step S23, and if an operating state request signal has not been received, the gateway ECU 50 proceeds to step S26.

[0034] In step S5, when the device operation state recognition unit 23 receives operation state information from the gateway ECU 50, the process proceeds to step S6. In step S6, the device operation state recognition unit 23 recognizes whether or not an operating device controlled by the local ECU 51 is operating. In the following step S7, the software update restriction unit 24 proceeds to step S4 if the device operation state recognition unit 23 recognizes that the operating device is in an operating state, and proceeds to step S8 if the device operation state recognition unit 23 recognizes that the operating device is in a stopped state.

[0035] The process of step S7 (software update prohibition process) prohibits the execution of activation processes from step S8 onwards until it is recognized that the operating devices controlled by the local ECU 51 are stopped. This prevents the operation of the operating devices from being interrupted. In step S8, the software update unit 22 starts the activation process. instructions The signal is sent to the gateway ECU 50. In step S26, Gateway ECU50 starts activation first finger When the indication signal is received, the process proceeds from step S26 to step S27 in FIG.

[0036] 3, the gateway ECU 50 disables the failure detection function of the local ECU 51 through communication with the local ECU 51. This prevents a failure from being detected due to the control process by the local ECU 51 being interrupted during activation of the local ECU 51, and prevents failure detection information from being output from the local ECU 51, thereby eliminating the need for processing by the central ECU 10 in response to the reception of the failure detection information.

[0037] In the following step S28, the gateway ECU 50 instructs the local ECU 51 to execute activation through communication with the local ECU 51, thereby executing activation of the local ECU 51. In the next step S29, when the gateway ECU 50 recognizes through communication with the local ECU 51 that activation of the local ECU 51 has been completed, the gateway ECU 50 transmits an activation completion notification signal to the central ECU 10.

[0038] In step S9, the software update unit 22 completes activation. notification When the signal is received, the process proceeds to step S10, where the gateway ECU 50 transmits an instruction signal to disable the re-power-on prohibition request to the gateway ECU 50. In step S31, the gateway ECU 50 disables the re-power-on prohibition request of the local ECU 51, thereby enabling the local ECU 51 to be powered on again. The next time the SS switch 2 is started, the software update unit 22 displays a screen on the display 5 notifying that the software has been updated.

[0039] [ 3 Other embodiments 2 that the activated device has completed its activation, the software update restriction unit 24 immediately proceeds to step S8 and transmits an activation start instruction signal to the gateway ECU 50. In another embodiment, when it is recognized in step S7 that the activated device has completed its activation, the software update restriction unit 24 may execute at least one of the following first to third determination processes before transmitting an activation start instruction signal to the gateway ECU 50.

[0040] First determination process: When the software update restriction unit 24 recognizes in step S7 that the operating device has completed its operation, the surrounding presence recognition unit 25 determines whether or not a surrounding presence has been confirmed near the moving object 100, and if a surrounding presence has been confirmed, the software update restriction unit 24 waits until the surrounding presence is no longer recognized, and then proceeds to step S8. Note that if the first determination process is not performed, there is no need to provide the surrounding presence recognition unit 25.

[0041] Second determination process: If the operating equipment starts operating in response to the mobile object control device 1 receiving operation instruction information transmitted from the user terminal 90 in response to operation of the user terminal 90 by the user U, when the operating equipment completes operation in step S7, the software update restriction unit 24 transmits software update confirmation information to the user terminal 90 inquiring about whether or not a software update is possible, and displays a software update confirmation screen on the display unit of the user terminal 90. Then, when the software update restriction unit 24 receives software update instruction information transmitted from the user terminal 90 instructing a software update, it proceeds to step S8.

[0042] Third determination process: When the software update restriction unit 24 recognizes in step S7 that the operation of the operating device has been completed, it receives detection information from the acceleration sensor provided in the user terminal 90 from the user terminal and determines whether the user terminal is stopped. Then, when the software update unit 22 recognizes that the user terminal 90 is stopped, it proceeds to step S8 and sends an activation start instruction signal to the gateway ECU 50.

[0043] In the above embodiment, the software update unit 22 updates the gateway ECU 50 in step S27 of FIG. via The failure detection function of the local ECU 51 is disabled, and in step S30, the failure detection function of the local ECU 51 is enabled via the gateway ECU 50. As another embodiment, a configuration may be adopted in which the process of switching between disabling and enabling the failure detection functions of the multiple local ECUs 51 via the gateway ECU 50 is not performed.

[0044] 1 is a schematic diagram showing the configuration of the mobile object control device 1 divided by main processing content to facilitate understanding of the present invention, but the mobile object control device 1 may also be divided into other categories. Furthermore, the processing of each component may be executed by one hardware unit or by multiple hardware units. Furthermore, the processing of each component shown in FIGS. 2 and 3 may be executed by one program or by multiple programs.

[0045] 4. Configurations supported by the above embodiments The above embodiment is a specific example of the following configuration.

[0046] (Configuration 1) A mobile body control device comprising: a software update unit that executes a software update process for an equipment control unit provided in a mobile body; an equipment operation state recognition unit that recognizes the operation state of an operating equipment controlled by the equipment control unit; and a software update restriction unit that executes a software update prohibition process that prohibits the software update unit from executing a software update process for the equipment control unit while the equipment operation state recognition unit recognizes that the operating equipment is in operation. According to the mobile object control device of configuration 1, the software update process for the device control unit is executed while the operating device is in operation, and it is possible to avoid interrupting the operation of the operating device.

[0047] (Configuration 2) A mobile body control device as described in Configuration 1, which includes an integrated control unit connected to a plurality of device control units that individually control a plurality of operating devices provided on the mobile body, wherein the software update unit executes software update processing for the plurality of device control units via the integrated control unit, the device operating status recognition unit recognizes the operating status of the plurality of operating devices via the integrated control unit, and the software update restriction unit executes the software update prohibition processing for the plurality of device control units via the integrated control unit. According to the mobile control device of configuration 2, by controlling multiple device control units via an integrated control unit, information can be efficiently transmitted between the software update unit, device operation status recognition unit, and software update restriction unit and the multiple device control units.

[0048] (Configuration 3) A mobile body control device as described in Configuration 1 or Configuration 2, which is provided with a surrounding presence recognition unit that recognizes presences around the mobile body, and when the equipment operation state recognition unit recognizes that the operation of the operating equipment has ended during the execution of the software update prohibition process and the surrounding presence recognition unit no longer recognizes the presences, the software update restriction unit terminates the software update prohibition process and enables the software update unit to execute the software update process of the equipment control unit. According to the mobile body control device of configuration 3, when surrounding people such as users of the mobile body are recognized, the software update of the equipment control unit is continued to be prohibited, thereby maintaining a state in which the operating equipment can be used.

[0049] (Configuration 4) A mobile body control device described in any one of configurations 1 to 3, which includes a communication control unit that communicates with a user terminal used by a user of the mobile body, and wherein the equipment control unit starts operation of the operating equipment when the communication control unit receives operation instruction information for the operating equipment sent from the user terminal, and the software update restriction unit starts operation of the operating equipment in response to receiving the operation instruction information, and starts the software update prohibition process in response to the equipment operation status recognition unit recognizing that the operating equipment is in operation, and then, when the equipment operation status recognition unit recognizes that the operation of the operating equipment has been completed, sends software update confirmation information to the user terminal by the communication control unit inquiring about whether or not to execute software update processing for the equipment control unit, and when the communication control unit receives software update instruction information sent from the user terminal instructing the execution of software update processing for the equipment control unit, the software update prohibition process is terminated and the software update unit is allowed to execute software update processing for the equipment control unit. According to the mobile body control device of configuration 4, when a user operates an operating device of a mobile body using a user terminal, the user terminal inquires whether or not a software update is possible, thereby preventing the user from being unable to use the operating device against his or her will due to the execution of a software update in the device control unit.

[0050] (Configuration 5) A communication control unit that communicates with a user terminal used by a user of the mobile body, wherein the device control unit starts operation of the operating device when the communication control unit receives operation instruction information for the operating device transmitted from the user terminal, and the software update restriction unit starts the software update prohibition process when the device control unit starts operation of the operating device in response to receiving the operation instruction information and the device operation status recognition unit recognizes that the operating device is in operation, and then when the device operation status recognition unit recognizes that the operation of the operating device has been completed, ... software update restriction process when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the software update restriction process when the device control unit starts operation of the operating device in response to receiving the operation instruction information and the software update prohibition process when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the software update restriction process when the device control unit starts operation of the operating device in response to receiving the operation instruction information and the software update prohibition process when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the software update restriction process when the device control unit starts operation of the operating device in response to receiving the operation instruction information and the software update prohibition process when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the software update restriction process when the device control unit starts operation of the operating device in response to receiving the operation instruction information and the software update restriction process when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the software update restriction process when the device control unit starts operation of the operating device in response to receiving the operation instruction information and the software update prohibition process when the device operation status recognition unit recognizes that the operation of the operating device has been completed, the software update restriction User terminala communication control unit that receives detection information from an acceleration sensor provided in the user terminal, recognizes whether the user terminal is stopped based on the detection information, and when it recognizes that the user terminal is stopped, terminates the software update prohibition process and enables the software update unit to execute the software update process of the equipment control unit. According to the mobile control device of configuration 5, when it is estimated that the user has finished using the operating equipment because the user terminal is stopped, the software update process for the equipment control unit can be performed.

[0051] (Configuration 6) A mobile body control device according to any one of configurations 1 to 5, wherein the operating device is any one of a door opening / closing device for the mobile body, a door locking device for the mobile body, a charge lid for the mobile body, a fuel lid for the mobile body, an electric sliding seat for the mobile body, a trunk opening / closing device for the mobile body, a tailgate opening / closing device for the mobile body, an air suspension extension / retraction device for the mobile body, a power window opening / closing device for the mobile body, a sunroof opening / closing device for the mobile body, a sunshade opening / closing device for the mobile body, a steering wheel tilt and telescopic adjustment device for the mobile body, and a movable rear monitor camera for the mobile body. According to the mobile body control device of configuration 6, it is possible to avoid inconvenience to the user caused by the operation of the mobile body door opening / closing device, the mobile body door locking device, the mobile body charge lid, the mobile body fuel lid, the mobile body electric sliding seat, the mobile body trunk opening / closing device, the mobile body tailgate opening / closing device, the mobile body air suspension extension / retraction device, the mobile body power window opening / closing device, the mobile body sunroof opening / closing device, the mobile body sunshade opening / closing device, the mobile body steering wheel tilt and telescopic adjustment device, and the mobile body movable rear monitor camera stopping midway.

[0052] (Configuration 7) A mobile body control device described in any one of configurations 1 to 6, wherein the software update unit disables the failure detection functions of the multiple equipment control units by sending failure detection disable instruction information to the multiple equipment control units via the integrated control unit when performing a software update process for at least one of the multiple equipment control units. According to the mobile control device of configuration 7, when the software update process of the equipment control unit is executed, a state that differs from normal conditions is judged to be a fault, and it is possible to avoid the output of fault detection information from the equipment control unit.

[0053] (Configuration 8) A mobile control device as described in Configuration 7, wherein the software update unit enables the failure detection functions possessed by the multiple equipment control units by sending failure detection enable instruction information to the multiple equipment control units via the integrated control unit when the software update process of the equipment control unit is completed. According to the mobile object control device of configuration 8, the failure detection function of the device control unit can be enabled at the timing when the software update of the device control unit is completed.

[0054] (Structure 9) A mobile body control method executed by a computer, comprising: a software update step of executing a software update process of an equipment control unit provided in a mobile body; an equipment operation state recognition step of recognizing the operation state of an operating equipment controlled by the equipment control unit; and a software update restriction step of executing a software update prohibition process of prohibiting the execution of a software update process of the equipment control unit by the software update step while the equipment operation state recognition step recognizes that the operating equipment is in operation. By executing the mobile object control method of configuration 9 by a computer, the same effects as those of the mobile object control device of configuration 1 can be obtained.

[0055] (Configuration 10) A program that causes a computer to function as a software update unit that executes software update processing for an equipment control unit provided in a mobile object, an equipment operation state recognition unit that recognizes the operation state of an operating equipment controlled by the equipment control unit, and a software update restriction unit that executes software update prohibition processing that prohibits the software update unit from executing software update processing for the equipment control unit while the equipment operation state recognition unit recognizes that the operating equipment is in operation. By executing the program of configuration 10 by a computer, the configuration of the mobile object control device of configuration 1 can be realized. [Explanation of symbols]

[0056] 1...mobile body control device, 2...SS switch, 3...communication unit, 4...external monitor camera, 5...display, 10...central ECU, 20...processor, 21...communication control unit, 22...software update unit, 23...equipment operation status recognition unit, 24...software update restriction unit, 25...surrounding presence recognition unit, 30...memory, 31...program, 50 (50a, 50b)...gateway ECU (integrated control unit), 51 (51a to 51f)...local ECU (equipment control unit), 71 to 73...operating equipment, 90...user terminal, 100...mobile body, 200...communication network, 210...mobile body management server, 300...maintenance terminal, U...user

Claims

1. a software update unit that executes a software update process for a device control unit provided in the mobile object; an appliance operation state recognition unit that recognizes the operation state of an operating appliance controlled by the appliance control unit; a software update restriction unit that executes a software update prohibition process to prohibit the software update unit from executing a software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation; an integrated control unit connected to a plurality of device control units that individually control a plurality of the operating devices provided in the moving body; Equipped with the software update unit executes software update processing for the plurality of device control units via the integrated control unit; the appliance operation state recognition unit recognizes the operation states of the plurality of operating appliances via the integrated control unit, The software update restriction unit executes the software update prohibition process for the plurality of device control units via the integrated control unit. Mobile control device.

2. When executing a software update process for at least one of the plurality of device control units, the software update unit disables the failure detection functions of the plurality of device control units by transmitting failure detection disable instruction information to the plurality of device control units via the integrated control unit. The mobile object control device according to claim 1 .

3. When the software update process of the device control unit is completed, the software update unit transmits failure detection enable instruction information to the device control units via the integrated control unit, thereby enabling the failure detection functions of the device control units. The mobile object control device according to claim 2 .

4. a surrounding presence recognition unit that recognizes people around the moving body, When the device operation state recognition unit recognizes that the operation of the operating device has ended and the surrounding person recognition unit recognizes no surrounding person during the execution of the software update prohibition process, the software update restriction unit ends the software update prohibition process and enables the software update unit to execute the software update process for the device control unit. The mobile object control device according to any one of claims 1 to 3.

5. a software update unit that executes a software update process for a device control unit provided in the mobile object; an appliance operation state recognition unit that recognizes the operation state of an operating appliance controlled by the appliance control unit; a software update restriction unit that executes a software update prohibition process to prohibit the software update unit from executing a software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation; a communication control unit that communicates with a user terminal used by a user of the mobile body; Equipped with the device control unit starts operation of the operating device when the communication control unit receives operation instruction information for the operating device transmitted from the user terminal; The software update restriction unit, after the device control unit starts operation of the operating device in response to reception of the operation instruction information and starts the software update prohibition process in response to recognition by the device operation state recognition unit that the operating device is in operation, transmits, to the user terminal by the communication control unit, software update confirmation information inquiring about whether or not to execute software update processing of the device control unit when the device operation state recognition unit recognizes that operation of the operating device has been completed, and terminates the software update prohibition process and enables the software update unit to execute software update processing of the device control unit when the communication control unit receives software update instruction information transmitted from the user terminal. Mobile control device.

6. a software update unit that executes a software update process for a device control unit provided in the mobile object; an appliance operation state recognition unit that recognizes the operation state of an operating appliance controlled by the appliance control unit; a software update restriction unit that executes a software update prohibition process to prohibit the software update unit from executing a software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation; a communication control unit that communicates with a user terminal used by a user of the mobile body; Equipped with the device control unit starts operation of the operating device when the communication control unit receives operation instruction information for the operating device transmitted from the user terminal; The software update restriction unit, after the device control unit starts operation of the operating device in response to receiving the operation instruction information and starts the software update prohibition process in response to recognition by the device operation state recognition unit that the operating device is in operation, receives detection information from an acceleration sensor provided in the user terminal transmitted from the user terminal when the device operation state recognition unit recognizes that the operation of the operating device has been completed, by the communication control unit, recognizes whether the user terminal is stopped based on the detection information, and when it recognizes that the user terminal is stopped, terminates the software update prohibition process and enables the software update unit to execute the software update process of the device control unit. Mobile control device.

7. a software update unit that executes a software update process for a device control unit provided in the mobile object; an appliance operation state recognition unit that recognizes the operation state of an operating appliance controlled by the appliance control unit; a software update restriction unit that executes a software update prohibition process to prohibit the software update unit from executing a software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation; Equipped with The operating device is any one of a door opening / closing device for the mobile body, a door locking device for the mobile body, a charge lid for the mobile body, a fuel lid for the mobile body, an electric sliding seat for the mobile body, a trunk opening / closing device for the mobile body, a tailgate opening / closing device for the mobile body, an air suspension extension / retraction device for the mobile body, a power window opening / closing device for the mobile body, a sunroof opening / closing device for the mobile body, a sunshade opening / closing device for the mobile body, a steering wheel tilt and telescopic adjustment device for the mobile body, and a movable rear monitor camera for the mobile body. Mobile control device.

8. an integrated control unit connected to a plurality of device control units that individually control the plurality of operating devices provided in the moving body; the software update unit executes software update processing for the plurality of device control units via the integrated control unit; the appliance operation state recognition unit recognizes the operation states of the plurality of operating appliances via the integrated control unit, The software update restriction unit executes the software update prohibition process for the plurality of device control units via the integrated control unit. The mobile object control device according to any one of claims 5 to 7.

9. A computer-implemented mobile object control method, a software update step of executing a software update process for a device control unit provided in the mobile object; an appliance operation state recognition step of recognizing an operation state of an operating appliance controlled by the appliance control unit; a software update restriction step of executing a software update prohibition process for prohibiting execution of a software update process of the device control unit by the software update step while it is recognized by the device operation state recognition step that the operating device is in operation; Including, the software update step includes performing a software update process for the plurality of device control units via an integrated control unit provided in the mobile object and connected to the plurality of device control units that individually control the plurality of operating devices; the appliance operation state recognition step recognizes the operation states of the plurality of operating appliances via the integrated control unit, The software update restriction step executes the software update prohibition process for the plurality of device control units via the integrated control unit. A mobile object control method.

10. Computer, a software update unit that executes a software update process for a device control unit provided in the mobile object; an appliance operation state recognition unit that recognizes the operation state of an operating appliance controlled by the appliance control unit; a software update restriction unit that executes a software update prohibition process to prohibit the software update unit from executing a software update process for the device control unit while the device operation state recognition unit recognizes that the operating device is in operation; and make it work, the software update unit executes a software update process for the plurality of device control units via an integrated control unit provided in the mobile object and connected to the plurality of device control units that individually control the plurality of operating devices; the appliance operation state recognition unit recognizes the operation states of the plurality of operating appliances via the integrated control unit, The software update restriction unit executes the software update prohibition process for the plurality of device control units via the integrated control unit. program.

Images