Control device, control method, and control program

Abstract

This control device determines whether the importance of an update of software of a travel control electronic control unit (ECU) controlling the travel of a mobile body is greater than or equal to a predetermined value if a request to update the software is made when the mobile body is travelling in a conventional travel mode by the travel control ECU. If the importance of the software update is greater than or equal to the predetermined value, the control device controls the mobile body to be able to travel in a temporary travel mode in which the mobile body is caused to travel in a manner different from the conventional travel mode by the travel control ECU. Then, the control device updates the software of the travel control ECU while control by the temporary travel mode is being executed.

Description

Technical Field

[0001] The present disclosure relates to a control device, a control method, and a control program.

Background Art

[0002] Japanese Patent Application Laid-Open No. 2022-018031 discloses performing a retreat travel while suppressing driving restrictions when a software rewrite process is not normally performed.

[0003] Also, Japanese Patent Application Laid-Open No. 2022-012834 discloses controlling the execution of an alternative function that is at least equivalent to at least a part of the functions of a target electronic control unit when the operation of the target electronic control unit is restricted when executing control to install or activate software.

Summary of the Invention

Problems to be Solved by the Invention

[0004] By the way, when updating the software of an ECU (Electronic Control Unit), it is necessary to temporarily stop the normal operation of the ECU. For this reason, there is a problem that the software of the driving control ECU cannot be updated while the driving control ECU is controlling the driving of a vehicle, which is an example of a moving body.

[0005] An object of the present disclosure is to provide a control device, a control method, and a control program that can immediately update the software of a driving control ECU even while the driving control ECU is controlling the driving of a vehicle.

Means for Solving the Problems

[0006] The control device according to the first aspect of this disclosure is a control device that, when a request for a software update for the driving control ECU (Electronic Control Unit) is made while the mobile body is traveling in a normal driving mode controlled by the driving control ECU that controls the movement of the mobile body, determines whether the importance of the software update is greater than or equal to a predetermined value, and if the importance of the software update is greater than or equal to a predetermined value, controls the mobile body to be able to travel in a temporary driving mode that drives the mobile body in a manner different from the normal driving mode controlled by the driving control ECU, and updates the software of the driving control ECU while the control in the temporary driving mode is being executed.

[0007] The control method according to the second embodiment includes the following steps: when a request for a software update for the driving control ECU (Electronic Control Unit) is made while the mobile body is traveling in a normal driving mode controlled by the driving control ECU, the processor determines whether the importance of the software update is greater than or equal to a predetermined value, and if the importance of the software update is greater than or equal to a predetermined value, the processor controls the mobile body to be able to travel in a temporary driving mode that drives the mobile body in a manner different from the normal driving mode controlled by the driving control ECU, and updates the software of the driving control ECU while the control in the temporary driving mode is being executed.

[0008] The control program according to the third embodiment causes at least one processor to execute a process that includes determining whether the importance of the software update is greater than or equal to a predetermined value when a request for a software update for the driving control ECU (Electronic Control Unit) is made while the mobile body is traveling in a normal driving mode controlled by the driving control ECU, and if the importance of the software update is greater than or equal to a predetermined value, controlling the mobile body to be able to travel in a temporary driving mode that drives the mobile body in a manner different from the normal driving mode controlled by the driving control ECU, and updating the software of the driving control ECU while the control in the temporary driving mode is being executed. [Effects of the Invention]

[0009] According to this disclosure, the software of the driving control ECU can be updated immediately, even while the driving control ECU is controlling the movement of a moving object. [Brief explanation of the drawing]

[0010] [Figure 1] This is a diagram showing the configuration of the vehicle control system according to the first embodiment. [Figure 2] This is a configuration diagram of the vehicle control device according to the first embodiment. [Figure 3] This is a configuration diagram showing the hardware configuration of the vehicle driving control ECU according to the first embodiment. [Figure 4] This is a flowchart of the vehicle control process according to the first embodiment. [Figure 5] This is a configuration diagram of the vehicle control device according to the second embodiment. [Figure 6] This is a configuration diagram of the vehicle control device according to the third embodiment. [Figure 7] This is a configuration diagram of the vehicle control device according to the fourth embodiment. [Modes for carrying out the invention]

[0011] Hereinafter, embodiments for implementing this disclosure will be described in detail with reference to the drawings. In each of the following embodiments, the case in which the moving object to be controlled is a vehicle will be described as an example.

[0012] <First Embodiment>

[0013] As shown in Figure 1, the vehicle control system 10 of this embodiment includes a server 12 and a vehicle 14. The server 12 and the vehicle 14 are connected via a network 16.

[0014] As shown in Figure 2, the vehicle 14 is equipped with a vehicle control device 18 that controls the movement of the vehicle 14 and a motor 26 that drives the vehicle 14. The vehicle control device 18 also includes a higher-level control ECU (Electronic Control Unit) 20, a vehicle driving control ECU 22, and an alternative ASIC (Application Specific Integrated Circuit) 24. The vehicle driving control ECU is an example of a driving control ECU of this disclosure. The vehicle is an example of a mobile body of this disclosure. The vehicle control device 18 is an example of a control device of this disclosure.

[0015] The higher-level control ECU 20 obtains a new software program from the server 12 via the network 16. This new program is for updating the operation of the vehicle driving control ECU 22. The vehicle driving control ECU 22 then installs or activates the program obtained by the higher-level control ECU 20. Here, program installation means storing the program in non-volatile memory (not shown) and making it executable. Program activation means enabling the functions realized by the execution of the program.

[0016] The vehicle driving control ECU 22 controls the driving of the motor 26 by executing an installed or activated program. In the first embodiment, the mode in which the vehicle driving control ECU 22 drives the motor 26 to drive the vehicle 14 is the normal driving mode.

[0017] Figure 3 is a block diagram showing the hardware configuration of the upper control ECU 20 and the vehicle driving control ECU 22. As shown in Figure 3, the vehicle driving control ECU 22 includes a controller 40.

[0018] As shown in Figure 3, the controller 40 includes a CPU (Central Processing Unit) 40A, a ROM (Read Only Memory) 40B, a RAM (Random Access Memory) 40C, and an input / output interface (I / O) 40D. The CPU 40A, the ROM 40B, the RAM 40C, and the I / O 40D are respectively connected via a bus 40E. The bus 40E includes a control bus, an address bus, and a data bus. A communication unit 41 and a storage unit 42 are connected to the I / O 40D.

[0019] The communication unit 41 is an interface for performing data communication with external devices such as the server 12 and other ECUs.

[0020] The storage unit 42 is composed of, for example, a non-volatile memory. As shown in Figure 3, the storage unit 42 stores a vehicle driving control program 42A and the like.

[0021] The CPU 40A is an example of a computer and is a general-purpose processor.

[0022] Note that the vehicle driving control program 42A may be stored in a non-volatile non-transitory recording medium or distributed via a network and appropriately installed in the vehicle driving control ECU 22.

[0023] Examples of non-volatile, non-transitional recording media include CD-ROMs (Compact Disc Read Only Memory), magneto-optical disks, HDDs (Hard Disk Drives), DVD-ROMs (Digital Versatile Disc Read Only Memory), flash memory, and memory cards.

[0024] The replacement ASIC24 is an application-specific integrated circuit, specifically designed for driving the vehicle 14. The replacement ASIC24 controls the vehicle 14 to move by executing known PWM (Pulse Width Modulation) control on the inverter (not shown) that drives the vehicle 14. The mode in which the replacement ASIC24 drives the motor 26 to drive the vehicle 14 is called the temporary driving mode. The temporary driving mode is a driving mode in which the vehicle 14 is driven in a manner different from the normal driving mode controlled by the vehicle driving control ECU22.

[0025] Next, with reference to Figure 4, we will explain the flowchart of the vehicle control processing performed by the higher-level control ECU 20. Note that the processing in Figure 4 is executed repeatedly each time a new program is acquired.

[0026] First, while the vehicle 14 is running in normal driving mode, an OTA (Over The Air) update is performed between the server 12 and the vehicle control device 18, and the server 12 requests an update to the program of the vehicle driving control ECU 22. The higher-level control ECU 20 downloads the new program via OTA and temporarily stores it in its own memory unit (not shown).

[0027] Even if server 12 outputs a control signal indicating a request to update the program of vehicle driving control ECU 22, and vehicle control device 18 receives that control signal, it is difficult to immediately stop vehicle driving control ECU 22 while vehicle 14 is driving in normal driving mode. Therefore, it is difficult to immediately update the program of vehicle driving control ECU 22. However, if the current program of vehicle driving control ECU 22 has a serious defect or an urgent change (including, for example, a change in communication standards), it may be necessary to update the program immediately. This is because waiting for vehicle 14 to come to a stop to update the program could cause malfunctions in the vehicle driving control of vehicle 14.

[0028] Therefore, in this embodiment, when the vehicle control device 18 determines that a program update is necessary even while the vehicle 14 is in motion, it switches to driving control by the alternative ASIC 24, which is a means of implementing driving control different from that by the vehicle driving control ECU 22, and installs a new program in the vehicle driving control ECU 22. After the activation of the new program is successfully completed, it switches from driving control by the alternative ASIC 24 to driving control by the original vehicle driving control ECU 22. This makes it possible to update the program of the vehicle driving control ECU 22 immediately, even while the vehicle driving control ECU 22 is in the process of controlling the vehicle's movement.

[0029] Therefore, if a request to update the program of the vehicle driving control ECU 22 is made from the server 12 while the vehicle 14 is driving in normal driving mode, the higher-level control ECU 20 executes the flowchart shown in Figure 4.

[0030] In step S100, the higher-level control ECU 20 determines the importance of the downloaded new program update. For example, the new program is accompanied by identification data or metadata representing the importance of the update, which is predetermined according to the importance of the update. By referring to this identification data or metadata, the importance of the program can be determined. Therefore, for example, the higher-level control ECU 20 determines the importance of the new program update based on the identification data or metadata attached to the new program. If the importance of the new program update is greater than or equal to a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the new program update is less than a predetermined value, this routine terminates.

[0031] In step S102, the higher-level control ECU 20 outputs a control signal to the substitute ASIC 14 instructing it to drive in the temporary driving mode. Upon receiving the control signal instructing the vehicle to drive in the temporary driving mode, the substitute ASIC 14 controls the vehicle to drive in the temporary driving mode, taking over from the vehicle driving control ECU 22. In this case, the substitute ASIC 24 controls the vehicle to drive by executing a known PWM (Pulse Width Modulation) control on the inverter (not shown) that drives the vehicle 14. The vehicle driving control ECU 22 also controls the vehicle to end driving in the normal driving mode. This switches the driving mode from normal driving mode to temporary driving mode.

[0032] In step S104, the higher-level control ECU 20 outputs a control signal to the vehicle driving control ECU 22 instructing it to update to a new program. Specifically, once the vehicle driving control ECU 22 has finished switching from the normal driving mode to the temporary driving mode by the alternative ASIC 14, the higher-level control ECU 20 outputs a control signal to the vehicle driving control ECU 22 instructing it to install and activate the new program.

[0033] In step S106, the higher-level control ECU 20 determines whether the new program update process by the vehicle driving control ECU 22 (for example, installation and activation of the new program on the vehicle driving control ECU 22) has been completed. If the new program update process has been completed, the process proceeds to step S108. If the new program update process has not been completed, the determination process in step S106 is repeated. In this way, the program update process of the vehicle driving control ECU 22 is executed while the vehicle driving control is being performed in temporary driving mode.

[0034] In step S108, the higher-level control ECU 20 outputs a control signal to the vehicle driving control ECU 22 and the alternative ASIC 24 instructing them to drive in the normal driving mode. When the vehicle driving control ECU 22 receives the control signal instructing them to drive in the normal driving mode, it controls the vehicle 14 to drive in the normal driving mode. When the alternative ASIC 24 receives the control signal instructing them to drive in the normal driving mode, it terminates the control of the vehicle 14 in the temporary driving mode. This switches the driving mode from the temporary driving mode to the normal driving mode.

[0035] As described above, in this embodiment, when a request for a program update for the vehicle driving control ECU 22 is made while the vehicle 14 is driving in the normal driving mode controlled by the vehicle driving control ECU 22, the vehicle control device 18 determines whether the importance of the program update is above a predetermined value. If the importance of the program update is above a predetermined value, the vehicle control device 18 controls the vehicle 14 to be drivable in a temporary driving mode that drives the vehicle 14 in a manner different from the normal driving mode controlled by the vehicle driving control ECU 22. The vehicle control device 18 then updates the program of the vehicle driving control ECU 22 while the control in the temporary driving mode is being executed. After the program update is completed, the vehicle control device 18 controls the vehicle 14 to be drivable in the normal driving mode controlled by the vehicle driving control ECU 22. This makes it possible to update the program of the vehicle driving control ECU 22 immediately, even while the vehicle driving control ECU 22 is performing control of the vehicle driving. Furthermore, by using an ASIC as the dedicated processor for driving the vehicle in temporary driving mode, costs can be reduced.

[0036] <Second Embodiment>

[0037] A second embodiment will now be described. Note that parts of the second embodiment that are identical to those of the first embodiment are denoted by the same reference numerals, and detailed descriptions are omitted.

[0038] Figure 5 shows a vehicle 214 according to the second embodiment. The vehicle 214 according to the second embodiment is a vehicle that can run using only either the front wheels or the rear wheels. The normal driving mode of the second embodiment is a driving mode in which the vehicle runs using both the front wheels and the rear wheels. The temporary driving mode of the second embodiment is a driving mode in which the vehicle runs using only either the front wheels or the rear wheels.

[0039] The vehicle control device 218 of the second embodiment differs from the first embodiment in that, when it receives a request to update the program of either the front wheel control ECU that controls the front wheel motor 226A or the rear wheel control ECU that controls the rear wheel motor 226B, it controls the vehicle 214 to run in a temporary driving mode, which is controlled by the ECU that is not subject to the update.

[0040] As shown in Figure 5, the vehicle 214 of the second embodiment includes a vehicle control device 218, a front wheel motor 226A that drives the front wheels of the vehicle 214, and a rear wheel motor 226B that drives the rear wheels of the vehicle 214.

[0041] The vehicle control device 218 of the second embodiment includes a higher-level control ECU 220, a front-wheel control ECU 222 for controlling the front wheels, and a rear-wheel control ECU 224 for controlling the rear wheels. The higher-level control ECU 220, front-wheel control ECU 222, and rear-wheel control ECU 224 have the hardware configuration shown in Figure 3. The processors included in the higher-level control ECU 220, front-wheel control ECU 222, and rear-wheel control ECU 224 include general-purpose processors (e.g., CPUs) or dedicated processors (e.g., GPUs: Graphics Processing Units, ASICs, and FPGAs: Field Programmable Gate Arrays, programmable logic devices, etc.).

[0042] In the second embodiment, the normal driving mode is one in which the vehicle 214 is driven by controlling both the front and rear wheels. The temporary driving mode is one in which the vehicle 214 is driven by controlling either the front or rear wheels.

[0043] Next, we will describe the flowchart of the vehicle control processing performed by the higher-level control ECU 220. Since the flow of the vehicle control processing performed by the higher-level control ECU 220 is the same as in the first embodiment, we will explain it with reference to Figure 4.

[0044] While vehicle 214 is driving in normal driving mode, an OTA (Over-the-Air) update is performed between server 12 and vehicle control device 18, and a request is made to update the program of either the front wheel control ECU 222 or the rear wheel control ECU 224. The higher-level control ECU 220 downloads the new program via OTA and temporarily stores it in its own memory (not shown). The new program is a program that updates the current program of either the front wheel control ECU 222 or the rear wheel control ECU 224. The higher-level control ECU 220 then executes the flowchart shown in Figure 4.

[0045] In step S100, the higher-level control ECU 220 determines the importance of the downloaded new program update. If the importance of the new program update is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the new program update is less than a predetermined value, this routine terminates.

[0046] In step S102, the higher-level control ECU 220 controls the vehicle 214 to run in a temporary driving mode, whichever of the front wheel control ECU 222 and rear wheel control ECU 224 is not subject to program update. Specifically, the higher-level control ECU 220 outputs a control signal to the front wheel control ECU 222 and rear wheel control ECU 224 to instruct them to run in temporary driving mode, causing the vehicle 214 to run in a temporary driving mode, which is controlled by the ECU that is not subject to program update.

[0047] In step S104, the higher-level control ECU 220 outputs a control signal to the ECU that is the target of the program update, either the front wheel control ECU 222 or the rear wheel control ECU 224. Specifically, once the switch from normal driving mode to temporary driving mode is complete, the higher-level control ECU 220 outputs a control signal to the ECU that is the target of the program update, instructing it to install and activate the new program.

[0048] In step S106, the higher-level control ECU 220 determines whether the program update process (for example, installation and activation of the new program on the ECU) has been completed by the ECU that is the target of the program update, either the front wheel control ECU 222 or the rear wheel control ECU 224. If the program update process has been completed, the process proceeds to step S108. If the program update process has not been completed, the determination process in step S106 is repeated.

[0049] In step S108, the higher-level control ECU 220 outputs a control signal to the front wheel control ECU 222 and the rear wheel control ECU 224 instructing them to drive in the normal driving mode. Upon receiving the control signal instructing the front wheel control ECU 222 and the rear wheel control ECU 224, they control the vehicle 214 to drive in the normal driving mode. This switches the driving mode from the temporary driving mode to the normal driving mode.

[0050] Thus, when the vehicle control device 218 of the second embodiment receives a request to update the program of either the front wheel control ECU 222, which controls the front wheels, or the rear wheel control ECU 224, which controls the rear wheels, it controls the vehicle 214 to run in a temporary driving mode, which is controlled by the ECU that is not subject to the update. This makes it possible to immediately update the program of either the front wheel control ECU 222 or the rear wheel control ECU 224, even if both of them are currently performing vehicle driving control.

[0051] <Third Embodiment>

[0052] A third embodiment will now be described. Note that parts of the third embodiment that are identical to those of the first or second embodiment are denoted by the same reference numerals, and detailed descriptions are omitted.

[0053] Figure 6 shows a vehicle 314 according to the third embodiment. The vehicle 314 according to the third embodiment is a hybrid vehicle equipped with a motor 326A and an engine 326B for driving the vehicle 314.

[0054] The vehicle control device 318 of the third embodiment differs from the first and second embodiments in that, when it receives a request to update the program of either the motor control ECU 322 that controls the motor 326A or the engine control ECU 324 that controls the engine 326B, it controls the vehicle 314 to run in a temporary driving mode, which is controlled by the ECU that is not subject to the update.

[0055] In the following explanation, we will use the example where the driving mode controlled by the motor control ECU 322 is the normal driving mode, and the driving mode controlled by the engine control ECU 324 is the temporary driving mode. However, it is also possible that the driving mode controlled by the motor control ECU 322 is the temporary driving mode, and the driving mode controlled by the engine control ECU 324 is the normal driving mode.

[0056] The vehicle 314 of the third embodiment includes a vehicle control device 318, a motor 326A, and an engine 326B.

[0057] The vehicle control device 318 of the third embodiment includes a higher-level control ECU 320, a motor control ECU 322 for controlling the motor 326A, and an engine control ECU 324 for controlling the engine 326B. The higher-level control ECU 320, motor control ECU 322, and engine control ECU 324 have the hardware configuration shown in Figure 3. The processors included in the higher-level control ECU 320, motor control ECU 322, and engine control ECU 324 include a general-purpose processor (e.g., a CPU) or a dedicated processor (e.g., a GPU, ASIC, FPGA, and programmable logic device, etc.).

[0058] Next, we will describe the flowchart of the vehicle control processing performed by the higher-level control ECU 320. Note that the flow of the vehicle control processing performed by the higher-level control ECU 320 is as described in the first embodiment. Since it is similar to the previous example, please refer to Figure 4 for explanation.

[0059] While the vehicle 314 is running in normal driving mode controlled by the motor control ECU 322, an OTA (Over-the-Air) update is performed between the server 12 and the vehicle control device 318, requesting a program update for the motor control ECU 322. The higher-level control ECU 320 downloads the new program via OTA and temporarily stores it in its own memory (not shown). The new program is an update to the current program of the motor control ECU 322. The higher-level control ECU 320 then executes the flowchart shown in Figure 4.

[0060] In step S100, the higher-level control ECU 320 determines the importance of the downloaded new program update. If the importance of the new program update is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the new program update is less than a predetermined value, this routine terminates.

[0061] In step S102, the higher-level control ECU 320 controls the vehicle 314 to run in a temporary driving mode controlled by the engine control ECU 324. Specifically, the higher-level control ECU 320 outputs control signals to the motor control ECU 322 and the engine control ECU 324 to instruct them to run in the temporary driving mode, and the engine control ECU 324, which is not subject to program update, drives the vehicle 314 in the temporary driving mode. As a result, the driving mode switches from the normal driving mode to the temporary driving mode.

[0062] In step S104, the higher-level control ECU 320 outputs a control signal to the motor control ECU 322 that is the target of the program update, instructing it to update to a new program. Specifically, once the switch from normal driving mode to temporary driving mode is complete, the higher-level control ECU 320 outputs a control signal to the motor control ECU 322 that is the target of the program update, instructing it to install and activate the new program.

[0063] In step S106, the higher-level control ECU 320 determines whether the motor control ECU 322 has completed the new program update process (for example, installation and activation of the new program on the ECU). If the new program update process is completed, the process proceeds to step S108. If the new program update process is not completed, the determination process in step S106 is repeated.

[0064] In step S108, the higher-level control ECU 320 outputs a control signal to the motor control ECU 322 and the engine control ECU 324 instructing them to drive in the normal driving mode. When the motor control ECU 322 receives the control signal instructing them to drive in the normal driving mode, it controls the vehicle 314 to drive in the normal driving mode. When the engine control ECU 324 receives the control signal instructing them to drive in the normal driving mode, it controls the vehicle 314 to end its operation in the temporary driving mode. This switches the driving mode from the temporary driving mode to the normal driving mode.

[0065] Thus, when the vehicle control device 318 of the third embodiment receives a request to update the program of either the motor control ECU 322, which controls the motor 326A, or the engine control ECU 324, which controls the engine 326B, it controls the vehicle 314 to run in a temporary driving mode, whichever of the two ECUs is not subject to the update. As a result, even if the motor control ECU 322 is in the process of controlling the vehicle by controlling the motor 326A, the program of the motor control ECU 322 can be updated immediately by driving the engine control ECU 324 instead of the motor control ECU 322.

[0066] Furthermore, as described above, if the driving mode in which the motor control ECU 322 controls the movement of the vehicle 314 is the temporary driving mode, and the driving mode in which the engine control ECU 324 controls the movement of the vehicle 314 is the normal driving mode, then even if the engine control ECU 324 is in the process of controlling the vehicle's movement by controlling the engine 326B, the program of the engine control ECU 324 can be updated immediately by driving the motor control ECU 322 instead of the engine control ECU 324.

[0067] <Fourth Embodiment>

[0068] The fourth embodiment will now be described. Note that the same reference numerals are used for parts of the fourth embodiment that are identical to those of the first to third embodiments, and detailed descriptions will be omitted.

[0069] Figure 7 shows a vehicle 414 according to the fourth embodiment. The vehicle 414 according to the fourth embodiment is equipped with a first motor 426A and a second motor 426B. The second motor 426B is a spare motor.

[0070] The fourth embodiment differs from the first to third embodiments in that, when the vehicle control device 418 receives a program update request for the first motor control ECU 422 which controls the first motor 426A, it controls the vehicle 414 to run in a temporary driving mode, which is controlled by the second motor control ECU 424 which controls the second motor 426B.

[0071] The vehicle 414 of the fourth embodiment includes a vehicle control device 418, a first motor 426A, and a second motor 426B.

[0072] The vehicle control device 418 of the fourth embodiment includes a higher-level control ECU 420, a first motor control ECU 422 for controlling the first motor 426A, and a second motor control ECU 424 for controlling the second motor 426B. The higher-level control ECU 420, the first motor control ECU 422, and the second motor control ECU 424 have the hardware configuration shown in Figure 3. The processors included in the higher-level control ECU 420, the first motor control ECU 422, and the second motor control ECU 424 include a general-purpose processor (e.g., a CPU) or a dedicated processor (e.g., a GPU, ASIC, FPGA, and programmable logic device, etc.).

[0073] In the fourth embodiment, the normal driving mode is when the first motor control ECU 422 controls the first motor 426A to drive the vehicle 414. The temporary driving mode is when the second motor control ECU 424 controls the second motor 426B to drive the vehicle 414.

[0074] Next, we will explain the flowchart of the vehicle control processing performed by the higher-level control ECU 420. Since the flow of the vehicle control processing performed by the higher-level control ECU 420 is the same as in the first embodiment, we will explain it with reference to Figure 4.

[0075] While the vehicle 414 is running in normal driving mode under the driving control of the first motor control ECU 422, an OTA (Over-the-Air) update is performed between the server 12 and the vehicle control device 418, and a request for a program update for the first motor control ECU 422 is made. The higher-level control ECU 420 downloads the new program via OTA and temporarily stores it in its own memory (not shown). The new program is a program that updates the current program of the first motor control ECU 422. Then, the higher-level control ECU 420 executes the flowchart shown in Figure 4.

[0076] In step S100, the higher-level control ECU 420 determines the importance of the downloaded new program update. If the importance of the new program update is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the new program update is less than a predetermined value, this routine terminates.

[0077] In step S102, the higher-level control ECU 420 controls the vehicle 414 to run in a temporary driving mode, which is controlled by the second motor control ECU 424 that controls the second motor 426B. Specifically, the higher-level control ECU 420 outputs a control signal to the second motor control ECU 424 instructing it to run in temporary driving mode, thereby causing the vehicle 414 to run in temporary driving mode. As a result, the driving mode switches from normal driving mode to temporary driving mode.

[0078] In step S104, the higher-level control ECU 420 outputs a control signal to the first motor control ECU 422 instructing it to update to a new program. Specifically, once the switch from normal driving mode to temporary driving mode is complete, the higher-level control ECU 420 outputs a control signal to the first motor control ECU 422, which is the target of the program update, instructing it to install and activate the new program.

[0079] In step S106, the higher-level control ECU 420 determines whether the new program update process by the first motor control ECU 422 (for example, installation and activation of the new program on the ECU) has been completed. If the new program update process has been completed, the process proceeds to step S108. If the new program update process has not been completed, the determination process in step S106 is repeated.

[0080] In step S108, the higher-level control ECU 420 outputs control signals to the first motor control ECU 422 and the second motor control ECU 424 instructing them to drive in the normal driving mode. Upon receiving the control signal instructing the first motor control ECU 422 to drive the vehicle 414 in the normal driving mode, it controls the vehicle 414 to drive in the normal driving mode. Upon receiving the control signal instructing the second motor control ECU 424 to drive in the normal driving mode, it terminates the vehicle 414's operation in the temporary driving mode. This switches the driving mode from the temporary driving mode to the normal driving mode.

[0081] Thus, when the vehicle control device 418 of the fourth embodiment receives a request to update the program of the first motor control ECU 422 which controls the first motor 426A, it controls the vehicle 414 to run in a temporary driving mode, which is driven by the second motor control ECU 424 which controls the second motor 426B. As a result, even if the first motor control ECU 422 is in the process of controlling the vehicle by controlling the first motor 426A, the program of the first motor control ECU 422 can be updated immediately by driving the second motor control ECU 424 instead of the first motor control ECU 422.

[0082] Furthermore, this disclosure is not limited to the embodiments described above, and various modifications and applications are possible without departing from the spirit of this invention.

[0083] For example, although the above embodiments were described using the case where the moving body is a vehicle, the invention is not limited to this. The moving body can be anything, and the above embodiments may be applied to, for example, a mobile robot, a ship, an airplane (e.g., an electric aircraft), or agricultural construction machinery.

[0084] Furthermore, when installing a new program, the vehicle control system may install a program that represents the differences between the new program and the already running program. This allows for more efficient program installation.

[0085] Furthermore, driving in temporary driving mode differs from driving in normal driving mode. Therefore, when a vehicle is running in temporary driving mode, users may feel uneasy because the ride is different from usual. For this reason, when the vehicle is running in temporary driving mode, the vehicle control system may output information indicating that the vehicle is running in temporary driving mode to an output device inside the vehicle (for example, to a display or speaker).

[0086] Furthermore, in each of the above embodiments, the new program is accompanied by identification data or metadata representing the importance of the update, which is predetermined according to the importance of the update. The higher-level control ECU determines the importance of the new program update based on the identification data or metadata attached to the new program, but the invention is not limited to this. For example, the higher-level control ECU may determine the importance of the new program update according to the type of control signal representing the program update request output from the server 12 or the data attached to the control signal.

[0087] Furthermore, the configurations of the vehicle control systems described in each of the above embodiments are merely examples, and it goes without saying that unnecessary parts may be deleted or new parts added without departing from the spirit of this disclosure.

[0088] Furthermore, the processing flow of the vehicle control program described in the above embodiment (see Figure 4) is just one example, and it goes without saying that unnecessary steps may be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the spirit of this disclosure.

[0089] The control unit and method described herein may be implemented by a dedicated computer comprising a processor programmed to perform one or more functions embodied by a computer program. Alternatively, the apparatus and method described herein may be implemented by a dedicated computer comprising a processor composed of dedicated hardware logic circuits. Alternatively, the apparatus and method described herein may be implemented by one or more dedicated computers comprising a combination of a processor that executes a computer program and one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by the computer on a computer-readable non-transitional tangible recording medium.

[0090] <Note> (Note 1) When a request for a software update for the driving control ECU (Electronic Control Unit) (22), which controls the movement of the mobile body (14), is made while the mobile body is moving in normal driving mode, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the mobile body is controlled to be drivable by a temporary driving mode, which drives the mobile body in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. A control device (18) equipped with the following. (Note 2) The aforementioned moving object is a vehicle. The control device described in Appendix 1. (Note 3) The control device comprises a driving control ECU equipped with a general-purpose processor, which is a CPU (Central Processing Unit), and an alternative ASIC (Application Specific Integrated Circuit) (24). When the vehicle is running in the normal driving mode controlled by the driving control ECU, and the importance of the software update in the update request is greater than or equal to a predetermined value, the system controls the vehicle to run in the temporary driving mode using the alternative ASIC. The control device described in Appendix 2. (Note 4) The aforementioned vehicle is a vehicle (214) that can run on either the front wheels or the rear wheels alone. When an update request is received for the software of either the front wheel control ECU (222) that controls the front wheel or the rear wheel control ECU (224) that controls the rear wheel, the vehicle is controlled to run in the temporary driving mode, which is controlled by the ECU that is not subject to the update. The control device described in Appendix 2. (Note 5) The vehicle is a hybrid vehicle (314) equipped with a motor (326A) and an engine (326B) for driving the vehicle. When an update request is received for the software of either the motor control ECU (322) that controls the motor or the engine control ECU (324) that controls the engine, the vehicle is controlled to run in the temporary driving mode, which is controlled by the ECU that is not subject to the update. The control device described in Appendix 2. (Note 6) The vehicle is a vehicle (414) equipped with a first motor (426A) for driving the vehicle and a spare second motor (426B), When the software update request for the first motor control ECU (422) that controls the first motor is received, the second motor control ECU (424) that controls the second motor controls the vehicle to run in the temporary running mode. The control device described in Appendix 2. (Note 7) When the software update is completed, the vehicle is controlled to be drivable by the normal driving mode using the driving control ECU. The control device described in Appendix 2. (Note 8) When the vehicle is driven in the aforementioned temporary driving mode, information indicating that the vehicle is being driven in the aforementioned temporary driving mode is output to an output device within the vehicle. A control device as described in any one of the items in Appendix 2 to Appendix 5. (Note 9) At least one processor (40) If a request for a software update for the ECU (Electronic Control Unit) is made while the mobile body is traveling in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the mobile body is controlled to be drivable by a temporary driving mode, which drives the mobile body in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. A control method for executing a process that includes the following. (Note 10) At least one processor, If a request for a software update for the ECU (Electronic Control Unit) is made while the mobile body is traveling in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the mobile body is controlled to be drivable by a temporary driving mode, which drives the mobile body in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. A control program (42A) that causes the program to execute a process that includes the following.

[0091] Furthermore, the disclosure of Japanese Patent Application No. 2022-175046 is incorporated herein by reference in its entirety. In addition, all documents, patent applications, and technical standards described herein are incorporated herein by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

Claims

1. When a request for a software update for the driving control ECU (Electronic Control Unit) (22) is made while the vehicle (14) is running in a normal driving mode controlled by the driving control ECU (Electronic Control Unit) (22) that controls the driving of the vehicle (14), it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The vehicle includes a driving control ECU equipped with a general-purpose processor, a CPU (Central Processing Unit), and an alternative ASIC (Application Specific Integrated Circuit) (24), When the vehicle is running in the normal driving mode controlled by the driving control ECU, and the importance of the software update in the update request is greater than or equal to a predetermined value, the system controls the vehicle to run in the temporary driving mode using the alternative ASIC. Control device (18).

2. When a request for a software update for the driving control ECU (Electronic Control Unit) is made while the vehicle is driving in normal driving mode controlled by the driving control ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The aforementioned vehicle is a vehicle (214) that can run on either the front wheels or the rear wheels alone. When an update request is received for the software of either the front wheel control ECU (222) that controls the front wheels or the rear wheel control ECU (224) that controls the rear wheels, the vehicle is controlled to run in the temporary driving mode, which is controlled by the ECU of the front wheel control ECU or the rear wheel control ECU that is not subject to the update. Control device (218).

3. When a request for a software update for the driving control ECU (Electronic Control Unit) is made while the vehicle is running in normal driving mode controlled by the driving control ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The vehicle is a vehicle (414) equipped with a first motor (426A) for driving the vehicle and a spare second motor (426B), When the software update request for the first motor control ECU (422) that controls the first motor is received, the second motor control ECU (424) that controls the second motor controls the vehicle to run in the temporary running mode. Control device (418).

4. When the software update is completed, the vehicle is controlled to be drivable by the normal driving mode using the driving control ECU. A control device according to any one of claims 1 to 3.

5. When the vehicle is driven in the aforementioned temporary driving mode, information indicating that the vehicle is being driven in the aforementioned temporary driving mode is output to an output device within the vehicle. A control device according to any one of claims 1 to 3.

6. At least one processor (40) When a request for a software update for the Electronic Control Unit (ECU) is made while the vehicle is running in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. When the vehicle is running in the normal driving mode controlled by the driving control ECU equipped with a general-purpose processor (CPU, or Central Processing Unit), and the importance of the software update in the update request is greater than or equal to a predetermined value, the vehicle is controlled to run in the temporary driving mode using an alternative ASIC (Application Specific Integrated Circuit). A control method for executing a process that includes the following.

7. At least one processor, When a request for a software update for the Electronic Control Unit (ECU) is made while the vehicle is running in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The aforementioned vehicle is a vehicle that can run on either the front wheels or the rear wheels alone. When an update request is received for the software of either the front wheel control ECU that controls the front wheels or the rear wheel control ECU that controls the rear wheels, the vehicle is controlled to run in the temporary driving mode, which is controlled by the ECU that is not subject to the update. A control method for executing a process that includes the following.

8. At least one processor, When a request for a software update for the Electronic Control Unit (ECU) is made while the vehicle is running in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The vehicle is equipped with a first motor for propelling the vehicle and a backup second motor. When the software update request for the first motor control ECU that controls the first motor is received, the second motor control ECU that controls the second motor controls the vehicle to run in the temporary driving mode. A control method for executing a process that includes the following.

9. At least one processor, When a request for a software update for the Electronic Control Unit (ECU) is made while the vehicle is running in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. When the vehicle is running in the normal driving mode controlled by the driving control ECU equipped with a general-purpose processor (CPU, or Central Processing Unit), and the importance of the software update in the update request is greater than or equal to a predetermined value, the vehicle is controlled to run in the temporary driving mode using an alternative ASIC (Application Specific Integrated Circuit). A control program (42A) that causes the program to execute a process that includes the following.

10. At least one processor, When a request for a software update for the Electronic Control Unit (ECU) is made while the vehicle is running in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The aforementioned vehicle is a vehicle that can run on either the front wheels or the rear wheels alone. When an update request is received for the software of either the front wheel control ECU that controls the front wheels or the rear wheel control ECU that controls the rear wheels, the vehicle is controlled to run in the temporary driving mode, which is controlled by the ECU that is not subject to the update. A control program that executes a process that includes the following.

11. At least one processor, When a request for a software update for the Electronic Control Unit (ECU) is made while the vehicle is running in normal driving mode controlled by the ECU, it is determined whether the importance of the software update is equal to or greater than a predetermined value. If the importance of the software update is greater than a predetermined value, the vehicle is controlled to be drivable by a temporary driving mode that drives the vehicle in a manner different from the normal driving mode by the driving control ECU. While the control using the aforementioned temporary driving mode is being executed, the software of the driving control ECU is updated. The vehicle is equipped with a first motor for propelling the vehicle and a backup second motor. When the software update request for the first motor control ECU that controls the first motor is received, the second motor control ECU that controls the second motor controls the vehicle to run in the temporary driving mode. A control program that executes a process that includes the following.

Images