Control device and control method

Abstract

To provide a control device and control method that can make control of a connection device redundant during the automatic operation.SOLUTION: A control device according to an embodiment includes multiple controllers. The multiple controllers control a connection device by executing a control program. The connection device can connect and disconnect a first system which supplies the power of a first power supply to a first load, and a second system which supplies the power of a second power supply to a second load. If the control program is updated while a vehicle capable of performing the automatic operation is traveling, partial controllers prohibit the automatic operation of the vehicle, stop the operation of the other controllers, and update the control program executed by the other controllers.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The disclosed embodiments relate to a control device and a control method.

Background Art

[0002] A vehicle capable of autonomous driving includes a redundant power supply system. The redundant power supply system includes a first system that supplies power of a first power source to a first load and a second system that supplies power of a second power source to a second load. During the autonomous driving of the vehicle, when a power failure occurs in either the first system or the second system, the redundant power supply system needs to surely cut off between the systems.

[0003] Therefore, there is a technique in which both a main microcomputer and a sub-microcomputer execute the same control program to control a connection device that can connect and disconnect the first system and the second system (see, for example, Patent Document 1). According to such a technique, the control of the connection device can be made redundant.

[0004] When it is necessary to modify such a control program, it is necessary to update the control program. As a technique for updating the control program, an OTA (Over The Air) technique that wirelessly transmits the control program from a server to a vehicle for updating is known.

[0005] In that case, when the control device that updates the control program updates the control program executed by the main microcomputer and the control program executed by the sub-microcomputer by the OTA technique while the vehicle is running, the following problems may occur.

[0006] For example, the control device may interrupt the control of the vehicle or cause an undesirable behavior in the vehicle. Therefore, it is not desirable to update both the control programs of the main microcomputer and the sub-microcomputer while the vehicle is running.

[0007] On the other hand, it is also conceivable to temporarily store a new control program received via OTA technology while the vehicle is in motion, and then sequentially update the control programs of the main microcontroller and sub-microcontroller when the vehicle is not running and the ignition (IG) is turned off.

[0008] In that case, since the control programs of both the main microcontroller and the sub-microcontroller need to be updated, the time required for the control program update will be longer. This will not only increase the dark current, but also increase the likelihood that the ignition (IG) will be turned on and the vehicle will start up during the control program update. If the IG is turned on during a program update, the microcontroller that was being updated will not be able to operate correctly.

[0009] Therefore, if the control unit obtains a new control program while the vehicle is running, it is desirable for one microcontroller to continue executing the previous control program. Then, the control unit should stop the operation of the other microcontroller and update the control program executed by the other microcontroller.

[0010] This allows the control unit to update the control program executed by the other microcontroller without interrupting vehicle control while the vehicle is running. The control unit then updates the control program executed by the other microcontroller during periods when the vehicle is not running. This reduces the time required for the control unit to update the control program while the vehicle is not running, and after the vehicle is started up again, both microcontrollers can execute the updated control program. [Prior art documents] [Patent Documents]

[0011] [Patent Document 1] Japanese Patent Publication No. 2021-57982 [Overview of the project] [Problems that the invention aims to solve]

[0012] However, if the control unit continues control by one microcontroller while the other microcontroller is stopped and its control program is updated during autonomous driving, it will no longer be able to provide redundancy for the control of the connected devices.

[0013] The embodiment was made in view of the above, and aims to provide a control device and control method that can make the control of the connected device redundant during autonomous driving. [Means for solving the problem]

[0014] The control device according to the embodiment comprises a plurality of controllers. The plurality of controllers control a connection device by executing a control program. The connection device can connect and disconnect a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load. When some of the controllers update the control program while a vehicle capable of autonomous driving is in motion, they prohibit the autonomous driving of the vehicle, stop the operation of the other controllers, and update the control program executed by the other controllers. [Effects of the Invention]

[0015] According to one embodiment of the control device and control method, the control of the connected device can be made redundant during automatic driving. [Brief explanation of the drawing]

[0016] [Figure 1] Figure 1 is an explanatory diagram showing an example of the configuration of a power supply control device according to an embodiment. [Figure 2] Figure 2 is an explanatory diagram showing an example of the configuration and normal operation of the control device according to the embodiment. [Figure 3] Figure 3 is an explanatory diagram showing the reproduction operation of the control device according to the embodiment. [Figure 4] Figure 4 is an explanatory diagram showing the reproduction operation of the control device according to the embodiment. [Figure 5]FIG. 5 is a flowchart showing an example of the processing executed by the control device according to the embodiment. [Figure 6] FIG. 6 is a flowchart showing a modified example of the processing executed by the control device according to the embodiment. MODE FOR CARRYING OUT THE INVENTION

[0017] Hereinafter, embodiments of the control device and the control method will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited by the embodiments shown below.

[0018] The power control device according to the embodiment is mounted on a vehicle having an automatic driving function. The vehicle having the automatic driving function may be, for example, an electric vehicle, a hybrid vehicle, or an engine vehicle that runs by an internal combustion engine.

[0019] [1. Configuration of Power Control Device] FIG. 1 is an explanatory diagram showing a configuration example of a power control device 1 including a control device according to the embodiment. As shown in FIG. 1, the power control device 1 according to the embodiment is connected to a first power source 10, an automatic driving control device 71, and a notification device 72. Further, the power control device 1 is connected to a program providing device 201 via a communication network 200.

[0020] Furthermore, the power control device 1 is connected to a first general load 101, a fail operation load (hereinafter referred to as "FOP load") 102, a second general load 103, a third general load 104, and a fourth general load 105.

[0021] The first general load 101, the FOP load 102, and the third general load 104 are examples of a first load to which power is supplied from the first power source 10. The FOP load 102, the second general load 103, and the fourth general load 105 are examples of a second load to which power is supplied from a second power source 20 described later.

[0022] Furthermore, the power control device 1 includes a first system 110 and a second system 120. The first system 110 supplies power from the first power supply 10 to the first general load 101, the FOP load 102, and the third general load 104. The second system 120 supplies power from the second power supply 20, which will be described later, to the FOP load 102, the second general load 103, and the fourth general load 105.

[0023] The first general load 101, the second general load 103, the third general load 104, and the fourth general load 105 include loads that are not directly involved in autonomous driving. The first general load 101, the second general load 103, the third general load 104, and the fourth general load 105 include, for example, displays, air conditioners, audio, and video. Furthermore, the first general load 101, the second general load 103, the third general load 104, and the fourth general load 105 also include, for example, various lights, drive recorders, security devices, communication devices, and various sensors.

[0024] The FOP load 102 is a device for autonomous driving. For example, the FOP load 102 includes a steering motor, electric brake system, onboard camera, and radar, which operate during autonomous driving.

[0025] The automated driving control device 71 is equipped with a GPS (Global Positioning System). The automated driving control device 71 is a device that operates the FOP load 102 to control the vehicle's automated driving. The automated driving control device 71 may obtain GPS vehicle position information, map information, and road traffic information from a navigation device (not shown).

[0026] The first power supply 10 includes a generator 12 and a lead-acid battery (hereinafter referred to as "PbB11") when the power control device 1 is mounted on an engine-powered vehicle. The battery of the first power supply 10 may be any secondary battery other than PbB11.

[0027] The generator 12 is, for example, an alternator that generates electricity by converting the kinetic energy of a moving vehicle into electricity. The generator 12 charges the PbB 11 and the second power source 20, which will be described later, with the electricity it generates. The generator 12 also supplies power to the first general load 101, the FOP load 102, the second general load 103, the third general load 104, and the fourth general load 105.

[0028] The first power supply 10 includes a DC / DC converter (hereinafter referred to as "DC-DC converter") and a PbB 11 when the power control device 1 is installed in an electric vehicle or a hybrid vehicle. In this case, the DC-DC converter is connected to a generator and a high-voltage battery with a voltage higher than that of the PbB 11, and steps down the voltages of the generator and the high-voltage battery to output to the first system 110. In this case, the generator is, for example, an alternator that generates electricity by converting the kinetic energy of a moving vehicle. The high-voltage battery is, for example, a vehicle drive battery installed in an electric vehicle or a hybrid vehicle.

[0029] Furthermore, the power control device 1 comprises a second power supply 20, a control device 3, a central ECU (Electronic Control Unit) 6, and a plurality of connection devices. Specifically, the power control device 1 comprises a first connection device 41, a second connection device 42, a third connection device 43, a fourth connection device 44, a fifth connection device 45, a sixth connection device 46, a seventh connection device 47, and an eighth connection device 48.

[0030] The first connection device 41 is a switch capable of connecting and disconnecting the first system 110 and the second system 120. The first connection device 41 may also be a DC-DC converter. In this case, the DC-DC converter connects the first system 110 and the second system 120 when it operates and disconnects the connection when it stops operating.

[0031] The second connection device 42 is a switch that can connect and disconnect the second system 120 and the FOP load 102. The third connection device 43 is a switch that can connect and disconnect the second system 120 and the second general load 103. The fourth connection device 44 is a switch that can connect and disconnect the second system 120 and the fourth general load 105. The fifth connection device 45 is a switch that can connect and disconnect the second power supply 20 and the second system 120.

[0032] The sixth connection device 46 is a switch that can connect and disconnect the first system 110 and the first general load 101. The seventh connection device 47 is a switch that can connect and disconnect the first system 110 and the FOP load 102. The eighth connection device 48 is a switch that can connect and disconnect the first system 110 and the third general load 104.

[0033] The second power supply 20 is a backup power supply for when the first power supply 10 is unable to supply power. The second power supply 20 is equipped with a lithium-ion battery (hereinafter referred to as "LiB21"). However, the battery of the second power supply 20 may be any secondary battery other than LiB21.

[0034] Furthermore, the power control device 1 includes a first voltage sensor 51 and a second voltage sensor 52. The first voltage sensor 51 is provided in the first system 110. The first voltage sensor 51 detects the voltage of the first system 110. The first voltage sensor 51 then outputs the detection result to the control device 3. The second voltage sensor 52 is provided in the second system 120. The second voltage sensor 52 detects the voltage of the second system 120. The second voltage sensor 52 then outputs the detection result to the control device 3.

[0035] The control device 3 includes a microcomputer (hereinafter referred to as "microcontroller") having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), and various circuits.

[0036] Furthermore, the control device 3 may be composed of hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), either in whole or in part.

[0037] The control device 3 controls the operation of the first to eighth connection devices 41 to 48 by having the CPU execute a program stored in ROM, using RAM as a working area. The control device 3 is also connected to the notification device 72.

[0038] The notification device 72 may include a display and a speaker. The notification device 72 notifies the user of information input from the control device 3 by display and at least one of the following: display and sound. The notification device 72 may also include a user interface that accepts instructions from the user by voice or operation.

[0039] Furthermore, the control device 3 is connected to the central ECU 6. The central ECU 6 is connected to, for example, the program supply device 201 via the communication network 200. The communication network 200 may be, for example, the Internet. The program supply device 201 provides the vehicle with various control programs for rewriting related to vehicle control, for example, by OTA (Over The Air) technology.

[0040] The central ECU 6 receives various control programs from the program provider 201 via the communication network 200. The central ECU 6 outputs the received control programs to the control device 3.

[0041] [2. Example of Power Control Device Operation] Next, we will describe an example of the operation of the power control device 1.

[0042] [2.1. Normal operation] When the vehicle's ignition switch (hereinafter referred to as "IG") is turned ON and no ground faults have occurred in the first system 110 and the second system 120, the control device 3 supplies power from the first power supply 10 to all loads during normal stopping, manual operation, or automatic operation.

[0043] At this time, the control device 3 turns on the first to fourth connection devices 41 to 44 and the sixth to eighth connection devices 46 to 48, and turns off the fifth connection device 45. As a result, the power control device 1 can supply power from the first power supply 10 to the first to fourth general loads 101, 103 to 105 and the FOP load 102 while suppressing the normal discharge of the LiB 21.

[0044] [2.2. Operation of the power control device in the event of a ground fault] In the power control device 1, for example, if a ground fault occurs in the first system 110, an overcurrent flows toward the ground fault point, causing the voltage detected by the first voltage sensor 51 to fall below the ground fault threshold.

[0045] Therefore, the control device 3 detects a ground fault in the first system 110 when the voltage detected by the first voltage sensor 51 remains below the ground fault threshold for a predetermined period of time. When the control device 3 detects a ground fault in the first system 110, it first turns off the first connection device 41, turns on the fifth connection device 45, and turns off the sixth to eighth connection devices 46 to 48.

[0046] As a result, even if a ground fault occurs in the first system 110, the power control device 1 can supply power from the second power supply 20 to the FOP load 102, the second general load 103, and the fourth general load 105 to perform FOP control.

[0047] Subsequently, the control device 3 notifies the automatic driving control device 71 that a ground fault has occurred in the first system 110 and that the system has switched to FOP control. As a result, the automatic driving control device 71 operates the FOP load 102 using power supplied from the second power supply 20, allowing the vehicle to move to a safe location and come to a stop.

[0048] However, if the power control device 1 cannot reliably turn off, or interrupt, the first connection device 41 in the event of a ground fault in the first system 110, the LiB 21 of the second power supply 20 will discharge, making FOP control impossible. For this reason, the power control device 1 is configured to reliably turn off the first connection device 41 when necessary by making the control of the first connection device 41 redundant.

[0049] [3. Configuration of the control device] Next, the configuration of the control device 3 according to the embodiment will be described with reference to Figure 2. Figure 2 is an explanatory diagram showing an example of the configuration of the control device 3 according to the embodiment. Hereinafter, the program executed by the control device 3 to control the first connection device 41 will be referred to as the ISO (isolator) control program. Also, hereafter, updating the ISO control program may be referred to as reprogramming.

[0050] [3.1. Control device configuration and normal operation] The control device 3 comprises multiple controllers. For example, as shown in Figure 2, the control device 3 comprises a first controller 31 and a second controller 32. The first controller 31 and the second controller 32 are, for example, core processors.

[0051] Furthermore, the control device 3 includes a first bank 33, a second bank 34, a first input / output (hereinafter referred to as "I / O") port 35, and a second I / O port 36. The first bank 33 and the second bank 34 are memory devices. The first bank 33 and the second bank 34 are, for example, RAM.

[0052] The first bank 33 stores the program executed by the first controller 31. The first bank 33 stores the repro program 37 and the ISO control program 38. The second bank 34 stores the ISO control program 38.

[0053] The repro program 37 and ISO control program 38 stored in the first bank 33 are programs executed by the first controller 31. The ISO control program 38 stored in the second bank 34 is a program executed by the second controller 32.

[0054] Thus, the control device 3 includes a storage unit provided for each of the multiple controllers. The storage unit stores the control program executed by each controller.

[0055] The first controller 31 executes the ISO control program 38 stored in the first bank 33. Then, the first controller 31 outputs a control signal to the first connection device 41 via the first I / O port 35.

[0056] The first controller 31 outputs a control signal to conduct to the first connection device 41 during normal operation of the power control device 1. The first controller 31 outputs a control signal to shut off the first connection device 41 when, for example, a ground fault is detected in the first system 110.

[0057] The second controller 32 executes the ISO control program 38 stored in the second bank 34. The second controller 32 then outputs a control signal to the first connection device 41 via the second I / O port 36.

[0058] The second controller 32 outputs a control signal to conduct to the first connection device 41 during normal operation of the power control device 1. The second controller 32 outputs a control signal to shut off the first connection device 41 when, for example, a ground fault is detected in the first system 110.

[0059] In this way, the control device 3 can provide redundancy for the control of the first connection device 41 by having the first controller 31 and the second controller 32 independently execute the same ISO control program 38.

[0060] As a result, the control device 3 can reliably shut off the first connection device 41 by the other controller even if either the first controller 31 or the second controller 32 fails when it detects a ground fault in the first system 110.

[0061] Furthermore, when the control device 3 detects a ground fault in the first system 110, even if either the first bank 33 or the second bank 34 fails, the ISO control program 38 stored in the other bank is executed, thereby reliably shutting off the first connection device 41.

[0062] The ISO control program 38 may have new functions added to it. In this case, the program provider 201 provides the power control device 1 with the new ISO control program 39 (see Figure 3) which includes the new functions.

[0063] The first controller 31 reprograms the ISO control programs 38 stored in the first bank 33 and the second bank 34 into a new ISO control program 39 by executing the reprogramming program 37.

[0064] [3.2. Reprogramming operation of the control device] Next, the reprogramming operation of the control device 3 according to the embodiment will be described with reference to Figures 3 and 4. Figures 3 and 4 are explanatory diagrams showing the reprogramming operation of the control device 3 according to the embodiment.

[0065] When the ISO new control program 39 is made public, the program provider 201 transmits the ISO new control program 39 to the power control device 1 (see Figure 1). For example, as shown in Figure 3, the program provider 201 transmits the ISO new control program 39 to the central ECU 6 via the communication network 200 (step S1).

[0066] The central ECU 6 is equipped with RAM 61. The central ECU 6 temporarily stores the ISO new control program 39 received from the program provider 201 via the communication network 200 in the RAM 61 (step S2).

[0067] Subsequently, the central ECU 6 sends a reprogramming request to the first controller 31 (step S3). The reprogramming request includes information indicating the amount of data for the ISO new control program 39. When the first controller 31 receives the reprogramming request while the vehicle is in motion, it sends an automatic driving prohibition notice to the automatic driving control device 71 if it is not in automatic driving mode (step S4).

[0068] Subsequently, the first controller 31 obtains the ISO new control program 39 from the RAM 61 of the central ECU 6 (step S5). Then, the first controller 31 stops the operation of the second controller 32 (step S6).

[0069] Subsequently, the first controller 31 reprograms the ISO control program 38 of the second bank 34 into the new ISO control program 39 (step S7). At this time, the first controller 31 may reprogram only a part of the new ISO control program 39. Alternatively, the first controller 31 may update the entire new ISO control program 39.

[0070] Furthermore, if the first controller 31 receives a reprogramming request, it will not perform reprogramming if the vehicle is in autonomous driving mode. In this case, the first controller 31 will perform reprogramming during the period when the vehicle's ignition is turned off.

[0071] Thus, some controllers in the control device 3 (in this case, the first controller 31) will disable the vehicle's autonomous driving function when updating the control program while the vehicle is in operation. Furthermore, some controllers will stop the operation of other controllers (in this case, the second controller 32) and update the control program executed by the other controllers.

[0072] In other words, the control device 3 continues to operate all controllers (in this case, the first controller 31 and the second controller 32) during periods when automatic driving is not prohibited. This allows the control device 3 to provide redundant control of connected devices during automatic driving.

[0073] Furthermore, some controllers in the control unit 3 update the control programs executed by other controllers when they receive a new control program from the program provider 201 while the vehicle is running. Some controllers also update the control programs executed by other controllers during periods when the vehicle is not running. This allows the control unit 3 to immediately update its control programs upon receiving a new control program.

[0074] Furthermore, some controllers in the control device 3 update the control program executed by other controllers when the vehicle is not in autonomous driving mode. Other controllers, however, do not update the control program executed by other controllers when the vehicle is in autonomous driving mode, but instead update the control program executed by other controllers during periods when the vehicle is not running. As a result, the control device 3 does not stop the second controller 32 when a reprogramming request is received during autonomous driving, and redundancy in the control of the first connection device 41 is possible.

[0075] Furthermore, when the first controller 31 starts reprogramming, it notifies the user of information regarding the reprogramming via the notification device 72 (step S8). For example, the first controller 31 notifies the user via the notification device 72 of the message, "We will now start reprogramming. To start automatic operation, you need to turn the IG off once and then turn the IG on."

[0076] In this way, some of the controllers in the control unit 3 notify the user that the control program needs to be updated and that the vehicle needs to be restarted in order to start autonomous driving. This allows the control unit 3 to make the user aware that autonomous driving will be unavailable until the next time the vehicle is started up, in order to update the control program.

[0077] Furthermore, when the first controller 31 starts reprogramming, it calculates the time required for reprogramming based on the amount of data in the ISO new control program 39. The first controller 31 then notifies the user via the notification device 72 of a message such as, "There are T minutes left until reprogramming is complete. Do not turn off the IG until reprogramming is complete." In addition to notifying the user of the time required for reprogramming, the first controller may also display a progress bar on the notification device 72 to show the progress of the reprogramming.

[0078] In this way, some of the controllers provided by the control device 3 inform the user of the time required to update the control program and that the vehicle will continue to run until the update of the control program is complete.

[0079] This allows the control device 3 to clearly inform the user that reprogramming is currently underway and how long it will take. Furthermore, the control device 3 can reliably complete the reprogramming while the vehicle is in motion.

[0080] Subsequently, when the reprogramming of the second bank 34 is completed and the IG is turned off, the first controller 31 copies the ISO new control program 39 stored in the second bank 34 and stores it in the first bank 33, as shown in Figure 4 (step S9).

[0081] Furthermore, if the IG is turned off before the reprogramming of the second bank 34 is completed, the first controller 31 completes the remaining reprogramming of the second bank 34, and then copies the ISO new control program 39 stored in the second bank 34 and stores it in the first bank 33.

[0082] As a result, the first controller 31 can control the first connection device 41 by executing the ISO new control program 39 stored in the first bank 33 after the next time the IG is turned on. At the same time, the second controller 32 can control the first connection device 41 by executing the ISO new control program 39 stored in the second bank 34.

[0083] Here, we have described a case in which the first controller 31 forcibly starts reprogramming when the control device 3 receives the ISO new control program 39 from the program supply device 201, but this is just one example.

[0084] When the first controller 31 receives the ISO new control program 39, it may request the user to grant permission to update the reprogram. In this case, the first controller 31 notifies the user via the notification device 72 of a message such as, "Do you want to download the new software? The download will take T minutes. Automatic operation is not possible until the vehicle is stopped and the ignition is turned on. If you wish to allow the download, please press the permission button."

[0085] Furthermore, the first controller 31 may, for example, notify the user via the notification device 72 of a message such as, "A new control program is available. Do you wish to start updating the control program?"

[0086] The user, for example, uses the user interface of the notification device 72 to input a response to the update permission request to the control device 3 by voice or operation. Then, if the user grants permission for the repro update, the first controller 31 updates the ISO control program 38 in the second bank 34 to the new ISO control program 39.

[0087] Thus, if some controllers in the control unit 3 receive a new control program while the vehicle is running, they request permission from the user to update the control program. If permission is granted, some controllers then update the control program executed by the other controllers.

[0088] This allows the user to refuse to update the control program if they intend to start autonomous driving. Therefore, the control device 3 can update the control program while reflecting the user's wishes.

[0089] Furthermore, if the user does not permit reprogramming, the first controller 31 updates the ISO control program 38 of the second bank 34, which is executed by the second controller 32 after the IG is turned off, to the new ISO control program 39.

[0090] In this way, some controllers in the control device 3 update the control program, which is run by other controllers, during periods when the vehicle is in a non-starting state with the ignition turned off, if updating the control program is not permitted. This ensures that the control device 3 can reliably update the control program while the vehicle is stopped, even if the user refuses to update it while the vehicle is in motion.

[0091] Furthermore, some controllers in the control device 3 notify the user of the time required for updating the control program. This allows the user to refuse the update if they intend to disembark within the time limit for updating the control program. Alternatively, the user can see the time required for the update notified by the control device 3 and decide whether or not to allow the update.

[0092] [4. Processes executed by the control unit] Next, an example of the process performed by the control device 3 will be described with reference to Figure 5. Figure 5 is a flowchart showing an example of the process performed by the control device according to this embodiment. When the vehicle's IG is turned on, the control device 3 starts the process shown in Figure 5.

[0093] As shown in Figure 5, for example, when the IG is turned on, the first controller 31 of the control device 3 first determines whether the update completion flag F1 for the first bank 33 and the update completion flag F2 for the second bank 34 are set (step S101).

[0094] The update completion flags F1 and F2 are set in steps S108, S112, and S113 described later, and indicate that the updates of the first bank 33 and the second bank 34 have been completed in response to the reprogramming request to the new ISO control program 39 during the previous IG-on operation.

[0095] Therefore, step S101 can also be described as the first controller 31 determining whether the ISO control programs 38 of the first bank 33 and the second bank 34 have been updated to the new ISO control program 39 in response to the reprogramming request during the previous ignition on. Here, "during ignition on" refers, for example, to the vehicle being driven.

[0096] If the first controller 31 determines that both update completion flags F1 and F2 are set (step S101, Yes), it sends an automatic driving prohibition release notification to the automatic driving control device 71 (step S102).

[0097] In other words, if the ISO control programs 38 of the first bank 33 and the second bank 34 have been updated to the new ISO control program 39 in response to the reprogramming request during the previous IG-on, the first controller 31 sends an automatic driving prohibition release notification to the automatic driving control device 71. At this time, the first controller 31 clears the update completion flags F1 and F2. Then, the first controller 31 moves the process to step S103.

[0098] If the first controller 31 determines that neither update completion flags F1 nor F2 are set (step S101, No), it determines whether or not there is a reprogramming request from the central ECU 6 during the current run (step S103). In other words, if there was no reprogramming request for the ISO new control program 39 during the previous run, the first controller 31 determines whether or not there is a reprogramming request from the central ECU 6 during the current run.

[0099] If the first controller 31 determines that there is no reprogramming request (step S103, No), it moves the process to step S109. If the first controller 31 determines that there is a reprogramming request (step S103, Yes), it determines whether or not the vehicle is in automatic operation mode (step S104). If the first controller 31 determines that the vehicle is not in automatic operation mode (step S104, No), it notifies the user of information regarding the reprogramming (step S105).

[0100] For example, the first controller 31 notifies the user via the notification device 72 with a message such as, "We will now begin reprogramming. To start autonomous driving, you need to turn the IG off once and then turn the IG on again." The first controller 31 also notifies the user via the notification device 72 with a message such as, "There are T minutes left until reprogramming is complete. Do not turn off the IG until reprogramming is complete."

[0101] Next, the first controller 31 sends an automatic driving prohibition notification to the automatic driving control device 71 (step S106). Then, the first controller 31 stops the operation of the second controller 32 (step S107). After that, the first controller 31 performs reprogramming of the second bank 34 (step S108).

[0102] Specifically, the first controller 31 receives the new ISO control program 39 from the central ECU 6. The first controller 31 then updates the ISO control program 38 of the second bank 34 with the new ISO control program 39 and sets the update completion flag F2 for the second bank 34.

[0103] On the other hand, if the first controller 31 determines in step S104 that automatic operation is in progress (step S104, Yes), it moves the process to step S109. As a result, if a reprogramming request is received during automatic operation, the first controller 31 does not perform the processing in steps S105 to S108, so the second controller 32 is not stopped, and redundancy in the control of the first connection device 41 is possible during automatic operation.

[0104] Subsequently, the first controller 31 determines whether or not the IG has been turned off (step S109). If the first controller 31 determines that the IG has not been turned off (step S109, No), it proceeds to step S103.

[0105] If the first controller 31 determines that the IG has been turned off (step S109, Yes), it determines whether or not there is a new control program (step S110). At this time, the first controller 31 communicates with the central ECU 6. The first controller 31 then checks whether or not the central ECU 6 has the ISO new control program 39 stored in it.

[0106] The first controller determines that there is no new control program (step S110, No) if the central ECU 6 does not store the ISO new control program 39, and terminates processing. The first controller 31 determines that there is a new control program (step S110, Yes) if the central ECU 6 does store the ISO new control program 39.

[0107] Then, the first controller 31 determines whether the second bank 34 has been reprogrammed or not based on whether the update completion flag F2 for the second bank 34 is set (step S111). If the ISO control program 38 of the second bank 34 has not been updated to the new ISO control program 39, that is, if the update completion flag F2 is not set, it is determined that the second bank 34 has not been reprogrammed (step S111, No).

[0108] If the first controller 31 determines "Yes" in step S104, that is, if there is a reprogramming request during autonomous driving, it will determine that the second bank 34 has not been reprogrammed.

[0109] Then, the first controller 31 performs a reprogramming of the second bank 34 (step S112) and sets the update completion flag F2. In this way, when the first controller 31 receives a reprogramming request during autonomous driving, it performs a reprogramming of the second bank 34 at this timing, that is, when the vehicle is not running with the IG turned off.

[0110] Specifically, the first controller 31 receives the new ISO control program 39 from the central ECU 6. Then, the first controller 31 updates the ISO control program 38 of the second bank 34 with the new ISO control program 39.

[0111] The first controller 31 determines that the second bank 34 has been reprogrammed if the ISO control program 38 in the second bank 34 has been updated to the new ISO control program 39, that is, if the update completion flag F2 is set (step S111, Yes). Then, the first controller 31 copies the new ISO control program 39 from the second bank 34 to the first bank 33 (step S113) and sets the update completion flag F1. In other words, the first controller 31 updates the ISO control program 38 in the first bank 33 to the new ISO control program 39. After that, the first controller 31 terminates processing.

[0112] [5. Variations of processes executed by the control device] Next, a modified example of the process performed by the control device 3 will be described with reference to Figure 6. Figure 6 is a flowchart showing a modified example of the process performed by the control device according to the embodiment.

[0113] When the control device 3 performs the process related to the modified example, it starts the process shown in Figure 6 when the vehicle's ignition is turned on. As shown in Figure 6, for example, when the ignition is turned on, the first controller 31 of the control device 3 first determines whether the update completion flag F1 for the first bank 33 and the update completion flag F2 for the second bank 34 are set (step S201). The first controller 31 then determines whether the ISO control programs 38 for the first bank 33 and the second bank 34 have been updated to the new ISO control program 39.

[0114] The update completion flags F1 and F2 are set in steps S209, S213, and S214 described later, and indicate that the updates of the first bank 33 and the second bank 34 have been completed in response to the reprogramming request to the new ISO control program 39 during the previous IG-on operation.

[0115] Therefore, step S201 can also be described as the first controller 31 determining whether the ISO control programs 38 of the first bank 33 and the second bank 34 have been updated to the new ISO control program 39 in response to the reprogramming request during the previous ignition on. Here, "during ignition on" refers, for example, to the vehicle being driven.

[0116] If the first controller 31 determines that both update completion flags F1 and F2 are set (step S201, Yes), it sends an automatic driving prohibition release notification to the automatic driving control device 71 (step S202).

[0117] In other words, if the ISO control programs 38 of the first bank 33 and the second bank 34 have been updated to the new ISO control program 39 in response to the reprogramming request during the previous IG-on, the first controller 31 sends an automatic driving prohibition release notification to the automatic driving control device 71. At this time, the first controller 31 clears the update completion flags F1 and F2. Then, the first controller 31 moves the process to step S203.

[0118] If the first controller 31 determines that neither update completion flags F1 nor F2 are set (step S201, No), it determines whether or not there is a reprogramming request from the central ECU 6 during the current run (step S203). In other words, if there was no reprogramming request for the ISO new control program 39 during the previous run, the first controller 31 determines whether or not there is a reprogramming request from the central ECU 6 during the current run.

[0119] If the first controller 31 determines that there is no reprogramming request (step S203, No), it moves the process to step S210. If the first controller 31 determines that there is a reprogramming request (step S203, Yes), it determines whether or not the vehicle is in automatic operation mode (step S204). If the first controller 31 determines that the vehicle is not in automatic operation mode (step S204, No), it notifies the user of information regarding the reprogramming (step S205).

[0120] For example, the first controller 31 notifies the user via the notification device 72 with the message, "Do you want to download the new software? The download will take T minutes. Autonomous driving is not possible until the vehicle is stopped and the ignition is turned on. If you wish to allow the download, please press the allow button."

[0121] Furthermore, the first controller 31 may notify the user via the notification device 72 of a message such as, "A new control program is available. Do you wish to start updating the control program?" In other words, the first controller 31 requests permission from the user to reprogram.

[0122] Next, the first controller 31 determines whether the reprogramming is OK or not (step S206). Specifically, if the user rejects the reprogramming, the first controller 31 determines that the reprogramming is NG (step S206, No). In this case, the first controller 31 moves the process to step S210.

[0123] The first controller 31 determines that reprogramming is OK if the user has given permission for it (step S206, Yes). In this case, the first controller 31 sends an automatic driving prohibition notification to the automatic driving control device 71 (step S207).

[0124] Then, the first controller 31 stops the operation of the second controller 32 (step S208). After that, the first controller 31 performs reprogramming of the second bank 34 (step S209).

[0125] Specifically, the first controller 31 receives the new ISO control program 39 from the central ECU 6. The first controller 31 then updates the ISO control program 38 of the second bank 34 with the new ISO control program 39 and sets the update completion flag F2 for the second bank 34.

[0126] On the other hand, if the first controller 31 determines in step S204 that automatic operation is in progress (step S204, Yes), it moves the process to step S210. As a result, if a reprogramming request is received during automatic operation, the first controller 31 does not perform the processing in steps S205 to S209, so the second controller 32 is not stopped, and redundancy in the control of the first connection device 41 is possible during automatic operation.

[0127] Subsequently, the first controller 31 determines whether or not the IG has been turned off (step S210). If the first controller 31 determines that the IG has not been turned off (step S210, No), it moves the process to step S203.

[0128] If the first controller 31 determines that the IG has been turned off (step S210, Yes), it determines whether or not there is a new control program (step S211). At this time, the first controller 31 communicates with the central ECU 6. The first controller 31 then checks whether or not the central ECU 6 has the ISO new control program 39 stored in it.

[0129] The first controller determines that there is no new control program (step S211, No) if the central ECU 6 does not store the ISO new control program 39, and terminates processing. The first controller 31 determines that there is a new control program (step S211, Yes) if the central ECU 6 does store the ISO new control program 39.

[0130] Then, the first controller 31 determines whether the second bank 34 has been reprogrammed based on whether the update completion flag F2 for the second bank 34 is set (step S212). If the ISO control program 38 of the second bank 34 has not been updated to the new ISO control program 39, that is, if the update completion flag F2 is not set, it is determined that the second bank 34 has not been reprogrammed (step S212, No).

[0131] If the first controller 31 determines "Yes" in step 204 above, that is, if there is a reprogramming request during autonomous driving, it will determine that the second bank 34 has not been reprogrammed.

[0132] Then, the first controller 31 performs a reprogramming of the second bank 34 (step S213) and sets the update completion flag F2. In this way, when the first controller 31 receives a reprogramming request during autonomous driving, it performs a reprogramming of the second bank 34 at this timing, that is, when the vehicle is not running with the IG turned off.

[0133] Specifically, the first controller 31 receives the new ISO control program 39 from the central ECU 6. Then, the first controller 31 updates the ISO control program 38 of the second bank 34 with the new ISO control program 39.

[0134] The first controller 31 determines that the second bank 34 has been reprogrammed if the ISO control program 38 of the second bank 34 has been updated to the new ISO control program 39, that is, if the update completion flag F2 is set (step S212, Yes).

[0135] Then, the first controller 31 copies the ISO new control program 39 from the second bank 34 to the first bank 33 (step S214) and sets the update completion flag F1. In other words, the first controller 31 updates the ISO control program 38 in the first bank 33 with the ISO new control program 39. After that, the first controller 31 terminates the process.

[0136] In the embodiment described above, the case in which the first controller 31 receives a reprogramming request while driving and the second controller 32 stops operating to reprogram the second bank 34 was explained, but this is just one example. The control device 3 may, for example, stop the operation of the first controller 31 and reprogram the first bank 33 when the second controller 32 receives a reprogramming request while driving.

[0137] Furthermore, the control device 3 may include a central ECU 6. In this case, when the central ECU 6 receives the ISO new control program 39, it stops the operation of either the first controller 31 or the second controller 32 and continues the operation of the other. The central ECU 6 then updates the control program executed by the controller whose operation has been stopped.

[0138] Furthermore, the central ECU 6 may stop the operation of either the first controller 31 or the second controller 32 if the user permits reprogramming. The central ECU 6 may then update the control program executed by the controller whose operation has been stopped.

[0139] [6. Addendum] As an addendum, the features of the present invention are as follows. (1) The system includes a connection device capable of connecting and disconnecting a first system that supplies power from a first power source to a first load, and a second system that supplies power from a second power source to a second load, and is controlled by multiple controllers that execute a control program. When some of the controllers update the control program while a vehicle capable of autonomous driving is in motion, they prohibit the vehicle from operating autonomously, stop the operation of other controllers, and update the control program executed by the other controllers. Control device. (2) If one of the controllers receives a new control program while the vehicle is running, it updates the control program executed by the other controllers, and updates the control program executed by the other controllers during periods when the vehicle is not running. The control device described in (1) above. (3) Some of the aforementioned controllers update the control program executed by other controllers when the vehicle is not in autonomous driving mode, do not update the control program executed by other controllers when the vehicle is in autonomous driving mode, and update the control program executed by other controllers during periods when the vehicle is not running. (2) The control device described above. (4) Some of the controllers notify the user that the control program needs to be updated and that the vehicle needs to be restarted in order to start the vehicle's autonomous driving. The control device described in (2) or (3) above. (5) Some of the controllers notify the user of the time required to update the control program and that the vehicle will remain running until the update of the control program is complete. The control device described in any one of (2) to (4) above. (6) If one of the controllers receives a new control program while the vehicle is running, it requests the user permission to update the control program, and if permission is granted, it updates the control program executed by the other controller. The control device described in (1) above. (7) If the update is not permitted, the aforementioned controller updates the control program that is run by the other controller during the period when the vehicle is not running. The control device described in (6) above. (8) Some of the aforementioned controllers notify the user of the time required to update the control program. The control device described in (6) or (7) above. (9) Each of the aforementioned plurality of controllers is provided with a storage unit that stores the control program executed by each controller, The control device described in any one of (1) to (8) above. (10) Among a plurality of controllers that control a connection device capable of connecting and disconnecting a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load by executing a control program, some of the controllers are: When updating the control program while a vehicle capable of autonomous driving is in operation, the autonomous driving of the vehicle is prohibited, the operation of other controllers is stopped, and the control program executed by the other controllers is updated. Control method.

[0140] Further effects and modifications can be readily derived by those skilled in the art. Therefore, broader aspects of the present invention are not limited to the specific details and representative embodiments expressed and described above. Accordingly, various modifications are possible without departing from the spirit or scope of the overall concept of the invention as defined by the appended claims and their equivalents. [Explanation of symbols]

[0141] 1 Power supply control device 3. Control device 10 1st power supply 12 Generators 20 2nd power supply 31. First Controller 32. Second Controller 33 Bank 1 34 Bank 2 35. First I / O port 36. Second I / O port 37 Reproductive Program 38 ISO control programs 39 ISO New Control Program 41. First connection device 42 Second connection device 43 Third Connection Device 44. Fourth connection device 45 Fifth Connection Device 46. ​​Sixth connection device 47. Seventh connection device 48. Eighth connection device 51. First voltage sensor 52 Second Voltage Sensor 6. Central ECU 61 RAM 71 Automatic Driving Control System 72 Notification device 101 1st general load 102 FOP load 103 2nd general load 104 3rd general load 105 4th general load 110 1st system 120 2nd system 200 Communication Networks 201 Program Provisioning Device

Claims

1. The system includes a connection device capable of connecting and disconnecting a first system that supplies power from a first power source to a first load, and a second system that supplies power from a second power source to a second load, and is controlled by multiple controllers that execute a control program. When some of the controllers update the control program while a vehicle capable of autonomous driving is in motion, they prohibit the vehicle from operating autonomously, stop the operation of other controllers, and update the control program executed by the other controllers. Control device.

2. If one of the controllers receives a new control program while the vehicle is running, it updates the control program executed by the other controllers, and updates the control program executed by the other controllers during periods when the vehicle is not running. The control device according to claim 1.

3. Some of the aforementioned controllers update the control program executed by other controllers when the vehicle is not in autonomous driving mode, do not update the control program executed by other controllers when the vehicle is in autonomous driving mode, and update the control program executed by other controllers during periods when the vehicle is not running. The control device according to claim 2.

4. Some of the controllers notify the user that the control program needs to be updated and that the vehicle needs to be restarted in order to start the vehicle's autonomous driving. The control device according to claim 2.

5. Some of the controllers notify the user of the time required to update the control program and that the vehicle will remain running until the update of the control program is complete. The control device according to claim 2.

6. If one of the controllers receives a new control program while the vehicle is running, it requests the user permission to update the control program, and if permission is granted, it updates the control program executed by the other controller. The control device according to claim 1.

7. If the update is not permitted, the aforementioned controller updates the control program that is run by the other controller during the period when the vehicle is not running. The control device according to claim 6.

8. Some of the aforementioned controllers notify the user of the time required to update the control program. The control device according to claim 6.

9. The control device according to claim 1, further comprising a storage unit provided for each of the plurality of controllers, which stores the control program executed by each of the controllers.

10. A connection device capable of connecting and disconnecting a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load, is controlled by a plurality of controllers that execute a control program, and some of the controllers are such that When updating the control program while a vehicle capable of autonomous driving is in operation, the autonomous driving of the vehicle is prohibited, the operation of other controllers is stopped, and the control program executed by the other controllers is updated. Control method.

Images