Control device, control method, and control program

Abstract

This control device determines whether the importance of an update of software of a travel control electronic control unit (ECU) controlling the travel of a mobile body is greater than or equal to a predetermined value if a request to update the software is made when the mobile body is travelling in a conventional travel mode by the travel control ECU. If the importance of the software update is greater than or equal to the predetermined value, the control device controls the mobile body to be able to travel in a temporary travel mode in which the mobile body is caused to travel in a manner different from the conventional travel mode by the travel control ECU. Then, the control device updates the software of the travel control ECU while control by the temporary travel mode is being executed.

Description

Control device, control method, and control program

[0001] The present disclosure relates to a control device, a control method, and a control program.

[0002] Japanese Patent Publication No. 2022-018031 discloses that if the software rewrite process is not performed normally, evacuation driving is performed while suppressing driving restrictions.

[0003] In addition, JP 2022-012834 A discloses that when the operation of the target electronic control unit is restricted during the execution of control to install or activate software, the execution of an alternative function that is equivalent to at least part of the function of the target electronic control unit is controlled.

[0004] However, when updating software in an ECU (Electronic Control Unit), the normal operation of the ECU must be temporarily stopped, which creates the problem that the software in the driving control ECU cannot be updated while the driving control ECU is controlling the driving of a vehicle, which is an example of a moving object.

[0005] The present disclosure aims to provide a control device, a control method, and a control program that can instantly update the software of a driving control ECU even while the driving control ECU is controlling the driving of a vehicle.

[0006] A control device according to a first aspect of the present disclosure is a control device that, when a request for updating software of a driving control Electronic Control Unit (ECU) that controls the driving of a moving body is made while the moving body is driving in a normal driving mode by the driving control ECU, determines whether the importance of the software update is equal to or greater than a predetermined value, and if the importance of the software update is equal to or greater than the predetermined value, controls the moving body to be able to drive in a special driving mode that causes the moving body to drive in a manner different from the normal driving mode by the driving control ECU, and updates the software of the driving control ECU while control in the special driving mode is being executed.

[0007] The control method according to the second aspect executes processing including the steps of: when a request is made to update software of a driving control Electronic Control Unit (ECU) that controls the driving of a moving body while the moving body is driving in a normal driving mode by the driving control ECU, determining whether the importance of the software update is equal to or greater than a predetermined value; and, if the importance of the software update is equal to or greater than the predetermined value, controlling the moving body to be able to drive in a special driving mode in which the driving control ECU drives the moving body in a manner different from the normal driving mode; and updating the software of the driving control ECU while control in the special driving mode is being executed.

[0008] The control program according to the third aspect causes at least one processor to execute processing including: when a request is made to update software of a driving control ECU (Electronic Control Unit) that controls the driving of the mobile body while the mobile body is driving in a normal driving mode by the driving control ECU, determining whether the importance of the software update is equal to or greater than a predetermined value; and, if the importance of the software update is equal to or greater than the predetermined value, controlling the mobile body to be able to drive in a special driving mode in which the driving control ECU drives the mobile body in a manner different from the normal driving mode; and updating the software of the driving control ECU while control in the special driving mode is being executed.

[0009] According to the present disclosure, it is possible to instantly update the software of a driving control ECU even while the driving control ECU is controlling the driving of a mobile object.

[0010] 1 is a configuration diagram of a vehicle control system according to a first embodiment; FIG. 2 is a configuration diagram of a vehicle control device according to the first embodiment; FIG. 3 is a configuration diagram showing a hardware configuration of a vehicle driving control ECU according to the first embodiment; FIG. 4 is a flowchart of vehicle control processing according to the first embodiment; FIG. 5 is a configuration diagram of a vehicle control device according to a second embodiment; FIG. 6 is a configuration diagram of a vehicle control device according to a third embodiment; and FIG. 7 is a configuration diagram of a vehicle control device according to a fourth embodiment.

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present disclosure will be described in detail below with reference to the accompanying drawings. In the following embodiments, a moving object to be subjected to driving control is a vehicle.

[0012] First Embodiment

[0013] 1, a vehicle control system 10 of this embodiment includes a server 12 and a vehicle 14. The server 12 and the vehicle 14 are connected via a network 16.

[0014] As shown in FIG. 2 , the vehicle 14 is equipped with a vehicle control device 18 that controls the traveling of the vehicle 14 and a motor 26 that drives the vehicle 14. The vehicle control device 18 also includes a host control ECU (Electronic Control Unit) 20, a vehicle traveling control ECU 22, and an alternative ASIC (Application Specific Integrated Circuit) 24. The vehicle traveling control ECU is an example of a traveling control ECU of the present disclosure. The vehicle is an example of a moving body of the present disclosure. The vehicle control device 18 is an example of a control device of the present disclosure.

[0015] The host control ECU 20 acquires a new software program from the server 12 via the network 16. This new program is a program for updating the operation of the vehicle driving control ECU 22. The vehicle driving control ECU 22 installs or activates the program acquired by the host control ECU 20. Here, installing a program refers to storing the program in a non-volatile memory (not shown) and making it executable. Activating a program refers to enabling a function realized by executing the program.

[0016] The vehicle driving control ECU 22 executes an installed or activated program to control the driving of the motor 26. In the first embodiment, the mode in which the vehicle driving control ECU 22 drives the motor 26 to drive the vehicle 14 is the normal driving mode.

[0017] 3 is a block diagram showing the hardware configuration of the host control ECU 20 and the vehicle driving control ECU 22. As shown in FIG.

[0018] 3, the controller 40 includes a central processing unit (CPU) 40A, a read-only memory (ROM) 40B, a random access memory (RAM) 40C, and an input / output interface (I / O) 40D. The CPU 40A, ROM 40B, RAM 40C, and I / O 40D are connected to each other via a bus 40E. The bus 40E includes a control bus, an address bus, and a data bus. A communication unit 41 and a storage unit 42 are connected to the I / O 40D.

[0019] The communication unit 41 is an interface for performing data communication with external devices such as the server 12 and other ECUs.

[0020] The storage unit 42 is configured by, for example, a non-volatile memory. As shown in Fig. 3, the storage unit 42 stores a vehicle driving control program 42A and the like.

[0021] The CPU 40A is an example of a computer and is a general-purpose processor.

[0022] The vehicle driving control program 42A may be stored in a non-volatile, non-transitory recording medium or distributed via a network and installed in the vehicle driving control ECU 22 as needed.

[0023] Examples of non-volatile non-transient recording media include CD-ROMs (Compact Disc Read Only Memory), magneto-optical disks, HDDs (Hard Disk Drives), DVD-ROMs (Digital Versatile Disc Read Only Memory), flash memories, memory cards, etc.

[0024] The alternative ASIC 24 is an application specific integrated circuit for driving the vehicle 14. The alternative ASIC 24 controls the vehicle 14 to run by executing known PWM (Pulse Width Modulation) control on an inverter (not shown) that drives the vehicle 14. The mode in which the alternative ASIC 24 drives the motor 26 to cause the vehicle 14 to run is called an emergency driving mode. The emergency driving mode is a driving mode in which the vehicle 14 is driven in a manner different from the normal driving mode controlled by the vehicle driving control ECU 22.

[0025] Next, a flowchart of the vehicle control process executed by the host control ECU 20 will be described with reference to Fig. 4. The process of Fig. 4 is repeatedly executed every time a new program is acquired.

[0026] First, while the vehicle 14 is traveling in a normal traveling mode, OTA (Over The Air) is executed between the server 12 and the vehicle control device 18, and the server 12 requests an update of the program of the vehicle traveling control ECU 22. The host control ECU 20 downloads the new program via OTA and temporarily stores it in its own memory unit (not shown).

[0027] Even if the server 12 outputs a control signal requesting an update of the program of the vehicle driving control ECU 22 and the vehicle control device 18 receives the control signal, it is difficult to immediately stop the vehicle driving control ECU 22 while the vehicle 14 is driving in normal driving mode. Therefore, it is difficult to immediately update the program of the vehicle driving control ECU 22. However, if the current program of the vehicle driving control ECU 22 has a serious defect or an urgent change (including, for example, a change in communication standards), it may be necessary to immediately update the program. This is because waiting to update the program until the vehicle 14 is stopped could result in a malfunction in the driving control of the vehicle 14.

[0028] Therefore, when it is determined that a program update is necessary, even if the vehicle 14 is in motion, the vehicle control device 18 of this embodiment switches to driving control by the alternative ASIC 24, which is a means for realizing driving control different from driving control by the vehicle driving control ECU 22, and installs a new program in the vehicle driving control ECU 22. After that, after activation of the new program is successfully completed, the vehicle control device 18 switches from driving control by the alternative ASIC 24 to driving control by the original vehicle driving control ECU 22. This allows the program of the vehicle driving control ECU 22 to be updated immediately, even if the vehicle driving control ECU 22 is currently controlling vehicle driving.

[0029] Therefore, when a request for updating the program of the vehicle driving control ECU 22 is made from the server 12 while the vehicle 14 is driving in the normal driving mode, the host control ECU 20 executes the flowchart shown in FIG.

[0030] In step S100, the host control ECU 20 determines the importance of the update of the downloaded new program. For example, the new program is provided with identification data or metadata indicating the importance of the update, which is predetermined according to the importance of the update. The importance of the program can be determined by referring to the identification data or metadata. Therefore, for example, the host control ECU 20 determines the importance of the update of the new program based on the identification data or metadata attached to the new program. If the importance of the update of the new program is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the update of the new program is less than the predetermined value, the routine ends.

[0031] In step S102, the host control ECU 20 outputs a control signal to the alternative ASIC 14 to instruct the vehicle 14 to travel in the temporary travel mode. Upon receiving the control signal instructing the vehicle 14 to travel in the temporary travel mode, the alternative ASIC 14 controls the vehicle 14 to travel in the temporary travel mode, instead of the vehicle travel control ECU 22. In this case, the alternative ASIC 24 controls the vehicle 14 to travel by executing known PWM (Pulse Width Modulation) control on an inverter (not shown) that drives the vehicle 14. In addition, the vehicle travel control ECU 22 controls the vehicle 14 to end travel in the normal travel mode. This switches the travel mode from travel in the normal travel mode to travel in the temporary travel mode.

[0032] In step S104, the host control ECU 20 outputs a control signal instructing the vehicle driving control ECU 22 to update to the new program. Specifically, when the vehicle driving control ECU 22 has completed switching from the normal driving mode to the temporary driving mode by the alternative ASIC 14, the host control ECU 20 outputs a control signal instructing the vehicle driving control ECU 22 to install and activate the new program.

[0033] In step S106, the host control ECU 20 determines whether the update process of the new program by the vehicle driving control ECU 22 (e.g., installation and activation of the new program in the vehicle driving control ECU 22) has been completed. If the update process of the new program has been completed, the process proceeds to step S108. If the update process of the new program has not been completed, the determination process of step S106 is repeated. In this way, the program update process of the vehicle driving control ECU 22 is executed while vehicle driving control is being executed in the temporary driving mode.

[0034] In step S108, the host control ECU 20 outputs a control signal instructing the vehicle 14 to travel in the normal travel mode to the vehicle travel control ECU 22 and the alternative ASIC 24. Upon receiving the control signal instructing the vehicle 14 to travel in the normal travel mode, the vehicle travel control ECU 22 controls the vehicle 14 to travel in the normal travel mode. Furthermore, upon receiving the control signal instructing the vehicle 14 to travel in the normal travel mode, the alternative ASIC 24 terminates control of the vehicle 14 in the special travel mode. This causes the travel mode to be switched from travel in the special travel mode to travel in the normal travel mode.

[0035] As described above, when a program update request for the vehicle driving control ECU 22 is received while the vehicle 14 is driving in the normal driving mode controlled by the vehicle driving control ECU 22, the vehicle control device 18 of this embodiment determines whether the importance of the program update is equal to or greater than a predetermined value. If the importance of the program update is equal to or greater than the predetermined value, the vehicle control device 18 controls the vehicle 14 to be driven in a special driving mode that drives the vehicle 14 in a manner different from the normal driving mode controlled by the vehicle driving control ECU 22. The vehicle control device 18 then updates the program for the vehicle driving control ECU 22 while control in the special driving mode is being executed. Furthermore, when the program update is complete, the vehicle control device 18 controls the vehicle 14 to be driven in the normal driving mode controlled by the vehicle driving control ECU 22. This allows the program for the vehicle driving control ECU 22 to be updated immediately, even while the vehicle driving control ECU 22 is controlling the vehicle driving. Furthermore, by using an ASIC as a dedicated processor for driving the vehicle in the special driving mode, costs can be reduced.

[0036] Second Embodiment

[0037] A second embodiment will be described below. Note that the same parts of the second embodiment as those of the first embodiment are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0038] 5 shows a vehicle 214 according to the second embodiment. The vehicle 214 according to the second embodiment is a vehicle that can run on either the front wheels or the rear wheels. The normal running mode of the second embodiment is a running mode in which the vehicle runs on both the front wheels and the rear wheels. The special running mode of the second embodiment is a running mode in which the vehicle runs on either the front wheels or the rear wheels.

[0039] The vehicle control device 218 of the second embodiment differs from the first embodiment in that when it receives a request to update the program of either the front wheel control ECU that controls the front wheel motor 226A or the rear wheel control ECU that controls the rear wheel motor 226B, it controls the vehicle 214 to run in a special driving mode in which the vehicle 214 runs using the ECU that is not the target of update, either the front wheel control ECU or the rear wheel control ECU.

[0040] As shown in FIG. 5, the vehicle 214 of the second embodiment includes a vehicle control device 218, a front wheel motor 226A that drives the front wheels of the vehicle 214, and a rear wheel motor 226B that drives the rear wheels of the vehicle 214.

[0041] The vehicle control device 218 of the second embodiment includes a host control ECU 220, a front wheel control ECU 222 that controls the front wheels, and a rear wheel control ECU 224 that controls the rear wheels. The host control ECU 220, the front wheel control ECU 222, and the rear wheel control ECU 224 have the hardware configurations shown in Fig. 3. The processors included in the host control ECU 220, the front wheel control ECU 222, and the rear wheel control ECU 224 include a general-purpose processor (e.g., a CPU) or a dedicated processor (e.g., a GPU (Graphics Processing Unit), ASIC, and FPGA (Field Programmable Gate Array), programmable logic device, etc.).

[0042] In the second embodiment, the normal driving mode is a driving mode in which the vehicle 214 is driven by controlling both the front and rear wheels, and the special driving mode is a driving mode in which the vehicle 214 is driven by controlling either the front or rear wheels.

[0043] Next, a description will be given of a flowchart of the vehicle control process executed by the host control ECU 220. Note that the flow of the vehicle control process executed by the host control ECU 220 is the same as that in the first embodiment, and therefore will be described with reference to FIG.

[0044] While the vehicle 214 is traveling in the normal traveling mode, OTA is executed between the server 12 and the vehicle control device 18, and a request is made to update the program of either the front wheel control ECU 222 or the rear wheel control ECU 224. The host control ECU 220 downloads a new program via OTA and temporarily stores it in its own memory unit (not shown). The new program is a program that updates the current program of either the front wheel control ECU 222 or the rear wheel control ECU 224. The host control ECU 220 then executes the flowchart shown in FIG. 4.

[0045] In step S100, the host control ECU 220 determines the importance of the update of the downloaded new program. If the importance of the update of the new program is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the update of the new program is less than the predetermined value, the process ends.

[0046] In step S102, the host control ECU 220 controls the vehicle 214 to run in a special running mode in which the vehicle 214 is run by the ECU that is not the target of the program update, out of the front wheel control ECU 222 and the rear wheel control ECU 224. Specifically, the host control ECU 220 outputs a control signal instructing the vehicle 214 to run in the special running mode to the front wheel control ECU 222 and the rear wheel control ECU 224, and runs the vehicle 214 in the special running mode in which the vehicle 214 is run by the ECU that is not the target of the program update.

[0047] In step S104, the host control ECU 220 outputs a control signal instructing an update to the new program to the ECU that is the target of the program update, either the front wheel control ECU 222 or the rear wheel control ECU 224. Specifically, when the switch from the normal driving mode to the temporary driving mode is completed, the host control ECU 220 outputs a control signal instructing the installation and activation of the new program to the ECU that is the target of the program update.

[0048] In step S106, the host control ECU 220 determines whether the new program update process (e.g., installation and activation of the new program in the ECU) has been completed for the ECU that is the program update target, either the front wheel control ECU 222 or the rear wheel control ECU 224. If the new program update process has been completed, the process proceeds to step S108. If the new program update process has not been completed, the determination process of step S106 is repeated.

[0049] In step S108, the host control ECU 220 outputs a control signal instructing the vehicle 214 to travel in the normal travel mode to the front wheel control ECU 222 and the rear wheel control ECU 224. Upon receiving the control signal instructing the vehicle 214 to travel in the normal travel mode, the front wheel control ECU 222 and the rear wheel control ECU 224 control the vehicle 214 to travel in the normal travel mode. This causes the travel mode to be switched from travel in the special travel mode to travel in the normal travel mode.

[0050] In this way, when the vehicle control device 218 of the second embodiment receives a request to update the program of either the front wheel control ECU 222 that controls the front wheels or the rear wheel control ECU 224 that controls the rear wheels, it controls the vehicle 214 to run in a temporary running mode in which the vehicle 214 is run by the ECU that is not the target of update, out of the front wheel control ECU 222 and the rear wheel control ECU 224. This makes it possible to immediately update the program of either the front wheel control ECU 222 or the rear wheel control ECU 224 even when both the front wheel control ECU 222 and the rear wheel control ECU 224 are currently controlling the vehicle running.

[0051] Third Embodiment

[0052] A third embodiment will be described below. Note that the same parts of the third embodiment as those of the first or second embodiment are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0053] 6 shows a vehicle 314 according to the third embodiment. The vehicle 314 according to the third embodiment is a hybrid vehicle equipped with a motor 326A and an engine 326B for propelling the vehicle 314.

[0054] The vehicle control device 318 of the third embodiment differs from the first and second embodiments in that, when it receives a request to update the program of either the motor control ECU 322 that controls the motor 326A or the engine control ECU 324 that controls the engine 326B, it controls the vehicle 314 to run in a special running mode in which the vehicle 314 runs using the ECU that is not the target of update, out of the motor control ECU 322 and the engine control ECU 324.

[0055] In the following, an example will be described in which the driving mode in which the motor control ECU 322 controls the driving of the vehicle 314 is the normal driving mode, and the driving mode in which the engine control ECU 324 controls the driving of the vehicle 314 is the special driving mode. Note that the driving mode in which the motor control ECU 322 controls the driving of the vehicle 314 may be the special driving mode, and the driving mode in which the engine control ECU 324 controls the driving of the vehicle 314 may be the normal driving mode.

[0056] The vehicle 314 of the third embodiment includes a vehicle control device 318, a motor 326A, and an engine 326B.

[0057] The vehicle control device 318 of the third embodiment includes a host control ECU 320, a motor control ECU 322 that controls a motor 326A, and an engine control ECU 324 that controls an engine 326B. The host control ECU 320, the motor control ECU 322, and the engine control ECU 324 have the hardware configurations shown in Fig. 3. The processors included in the host control ECU 320, the motor control ECU 322, and the engine control ECU 324 include a general-purpose processor (e.g., a CPU) or a dedicated processor (e.g., a GPU, an ASIC, an FPGA, a programmable logic device, etc.).

[0058] Next, a description will be given of a flowchart of the vehicle control process executed by the host control ECU 320. Note that the flow of the vehicle control process executed by the host control ECU 320 is the same as that in the first embodiment, and therefore will be described with reference to FIG.

[0059] While the vehicle 314 is running in normal running mode under the control of the motor control ECU 322, OTA is executed between the server 12 and the vehicle control device 318, and a program update request is made for the motor control ECU 322. The host control ECU 320 downloads a new program via OTA and temporarily stores it in its own storage unit (not shown). The new program is a program that updates the current program in the motor control ECU 322. The host control ECU 320 then executes the flowchart shown in FIG. 4.

[0060] In step S100, the host control ECU 320 determines the importance of the update of the downloaded new program. If the importance of the update of the new program is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the update of the new program is less than the predetermined value, the process ends.

[0061] In step S102, the host control ECU 320 controls the vehicle 314 to run in a special running mode in which the vehicle 314 is run by the engine control ECU 324. Specifically, the host control ECU 320 outputs a control signal instructing running in the special running mode to the motor control ECU 322 and the engine control ECU 324, and runs the vehicle 314 in the special running mode in which the vehicle 314 is run by the engine control ECU 324 that is not the target of the program update. This switches the running mode from the normal running mode to the special running mode.

[0062] In step S104, the host control ECU 320 outputs a control signal instructing the motor control ECU 322, whose program is to be updated, to update to a new program. Specifically, when the switch from the normal driving mode to the temporary driving mode is completed, the host control ECU 320 outputs a control signal instructing the motor control ECU 322, whose program is to be updated, to install and activate the new program.

[0063] In step S106, the host control ECU 320 determines whether the update process of the new program (e.g., installation and activation of the new program in the ECU) by the motor control ECU 322 has been completed. If the update process of the new program has been completed, the process proceeds to step S108. If the update process of the new program has not been completed, the determination process of step S106 is repeated.

[0064] In step S108, the host control ECU 320 outputs a control signal instructing the vehicle 314 to travel in the normal travel mode to the motor control ECU 322 and the engine control ECU 324. When the motor control ECU 322 receives the control signal instructing the vehicle 314 to travel in the normal travel mode, the motor control ECU 322 controls the vehicle 314 to travel in the normal travel mode. When the engine control ECU 324 receives the control signal instructing the vehicle 314 to travel in the normal travel mode, the engine control ECU 324 controls the vehicle 314 to end traveling in the special travel mode. This causes the travel mode to be switched from traveling in the special travel mode to traveling in the normal travel mode.

[0065] In this way, when the vehicle control device 318 of the third embodiment receives a request to update the program of either the motor control ECU 322 that controls the motor 326A or the engine control ECU 324 that controls the engine 326B, it controls the vehicle 314 to run in a temporary running mode in which the vehicle 314 is run by the ECU that is not the target of update, out of the motor control ECU 322 and the engine control ECU 324. As a result, even if the motor control ECU 322 is controlling the motor 326A to control the vehicle running, the program of the motor control ECU 322 can be updated immediately by driving the engine control ECU 324 instead of the motor control ECU 322.

[0066] Furthermore, as described above, when the driving mode in which the motor control ECU 322 controls the driving of the vehicle 314 is the emergency driving mode and the driving mode in which the engine control ECU 324 controls the driving of the vehicle 314 is the normal driving mode, even if the engine control ECU 324 is in the process of controlling the vehicle driving by controlling the engine 326B, the program of the engine control ECU 324 can be updated immediately by driving the motor control ECU 322 instead of the engine control ECU 324.

[0067] Fourth Embodiment

[0068] A fourth embodiment will be described below. Note that the same parts of the fourth embodiment as those of the first to third embodiments are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0069] 7 shows a vehicle 414 according to the fourth embodiment. The vehicle 414 according to the fourth embodiment is a vehicle equipped with a first motor 426A and a second motor 426B. The second motor 426B is a spare motor.

[0070] The vehicle control device 418 of the fourth embodiment differs from the first to third embodiments in that, when a request to update the program of the first motor control ECU 422 that controls the first motor 426A is received, the vehicle control device 418 controls the vehicle 414 to run in a special running mode in which the vehicle 414 is run by the second motor control ECU 424 that controls the second motor 426B.

[0071] The vehicle 414 of the fourth embodiment includes a vehicle control device 418, a first motor 426A, and a second motor 426B.

[0072] The vehicle control device 418 of the fourth embodiment includes a host control ECU 420, a first motor control ECU 422 that controls a first motor 426A, and a second motor control ECU 424 that controls a second motor 426B. The host control ECU 420, the first motor control ECU 422, and the second motor control ECU 424 have the hardware configuration shown in Fig. 3. The processors included in the host control ECU 420, the first motor control ECU 422, and the second motor control ECU 424 include a general-purpose processor (e.g., a CPU) or a dedicated processor (e.g., a GPU, an ASIC, an FPGA, a programmable logic device, etc.).

[0073] In the fourth embodiment, the normal driving mode is a driving mode in which the first motor control ECU 422 controls the first motor 426A to drive the vehicle 414. The special driving mode is a driving mode in which the second motor control ECU 424 controls the second motor 426B to drive the vehicle 414.

[0074] Next, a description will be given of a flowchart of the vehicle control process executed by the host control ECU 420. Note that the flow of the vehicle control process executed by the host control ECU 420 is the same as that in the first embodiment, and therefore will be described with reference to FIG.

[0075] While the vehicle 414 is running in normal running mode under driving control by the first motor control ECU 422, OTA is executed between the server 12 and the vehicle control device 418, and a program update request is made for the first motor control ECU 422. The host control ECU 420 downloads a new program via OTA and temporarily stores it in its own memory unit (not shown). The new program is a program that updates the current program of the first motor control ECU 422. The host control ECU 420 then executes the flowchart shown in FIG. 4.

[0076] In step S100, the host control ECU 420 determines the importance of the update of the downloaded new program. If the importance of the update of the new program is equal to or greater than a predetermined value, the process proceeds to step S102. On the other hand, if the importance of the update of the new program is less than the predetermined value, the process ends.

[0077] In step S102, the host control ECU 420 controls the second motor control ECU 424, which controls the second motor 426B, to run the vehicle 414 in a special running mode. Specifically, the host control ECU 420 outputs a control signal instructing the second motor control ECU 424 to run in the special running mode, causing the vehicle 414 to run in the special running mode. This switches the running mode from the normal running mode to the special running mode.

[0078] In step S104, the host control ECU 420 outputs a control signal instructing an update to the new program to the first motor control ECU 422. Specifically, when the switch from the normal driving mode to the temporary driving mode is completed, the host control ECU 420 outputs a control signal instructing the installation and activation of the new program to the first motor control ECU 422, which is the target of the program update.

[0079] In step S106, the host control ECU 420 determines whether the update process of the new program (e.g., installation and activation of the new program in the ECU) by the first motor control ECU 422 has been completed. If the update process of the new program has been completed, the process proceeds to step S108. If the update process of the new program has not been completed, the determination process of step S106 is repeated.

[0080] In step S108, the host control ECU 420 outputs a control signal instructing the vehicle 414 to travel in the normal travel mode to the first motor control ECU 422 and the second motor control ECU 424. Upon receiving the control signal instructing the vehicle 414 to travel in the normal travel mode, the first motor control ECU 422 controls the vehicle 414 to travel in the normal travel mode. Upon receiving the control signal instructing the vehicle 414 to travel in the normal travel mode, the second motor control ECU 424 ends the vehicle 414 from traveling in the special travel mode. This switches the travel mode from traveling in the special travel mode to traveling in the normal travel mode.

[0081] In this way, when the vehicle control device 418 of the fourth embodiment receives a request to update the program of the first motor control ECU 422 that controls the first motor 426A, it controls the vehicle 414 to run in a special running mode in which the second motor control ECU 424 that controls the second motor 426B runs the vehicle 414. As a result, even if the first motor control ECU 422 is controlling the first motor 426A to control the vehicle running, the second motor control ECU 424 is driven instead of the first motor control ECU 422, so that the program of the first motor control ECU 422 can be updated immediately.

[0082] Furthermore, the present disclosure is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the gist of the present invention.

[0083] For example, although the above embodiments have been described with reference to examples in which the moving body is a vehicle, the present invention is not limited to this and may be applied to any moving body, such as a mobile robot, a ship, an airplane (e.g., an electric aircraft), or agricultural or construction machinery.

[0084] Furthermore, when installing a new program, the vehicle control device may install a program that indicates differences from a program that is already running, thereby enabling efficient program installation.

[0085] Furthermore, driving in the special driving mode is different from driving in the normal driving mode. Therefore, when the vehicle is driving in the special driving mode, the user may feel uneasy because the ride comfort of the vehicle is different from normal. Therefore, when driving the vehicle in the special driving mode, the vehicle control device may output information indicating that the vehicle is being driven in the special driving mode to an output device in the vehicle (for example, to a display or a speaker).

[0086] In the above embodiments, the new program is provided with identification data or metadata indicating the importance of the update that is predetermined based on the importance of the update, and the host control ECU determines the importance of the update of the new program based on the identification data or metadata attached to the new program. However, the present invention is not limited to this. For example, the host control ECU may determine the importance of the update of the new program based on the type of control signal representing a program update request output from the server 12 or the data attached to the control signal.

[0087] In addition, the configuration of the vehicle control system described in each of the above embodiments is an example, and it goes without saying that unnecessary parts may be deleted or new parts may be added within the scope of the present disclosure.

[0088] Furthermore, the processing flow of the vehicle control program described in the above embodiment (see Figure 4) is also one example, and it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged within the scope of the present disclosure.

[0089] The controller and method described herein may be implemented by a special-purpose computer having a processor programmed to perform one or more functions embodied in a computer program. Alternatively, the apparatus and method described herein may be implemented by a special-purpose computer having a processor configured with dedicated hardware logic circuits. Alternatively, the apparatus and method described herein may be implemented by one or more special-purpose computers configured by a combination of a processor executing a computer program and one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory storage medium.

[0090] <Supplementary Notes> (Supplementary Note 1) A control device (18) comprising: when a request for software update of a cruise control ECU (Electronic Control Unit) (22) that controls the travel of a mobile body (14) is made while the mobile body is traveling in a normal travel mode by the cruise control ECU, determining whether the importance of the software update is equal to or greater than a predetermined value, when the importance of the software update is equal to or greater than the predetermined value, controlling the mobile body to travel in a special travel mode that causes the mobile body to travel in a manner different from the normal travel mode by the cruise control ECU, and updating the software of the cruise control ECU while control in the special travel mode is being executed. (Supplementary Note 2) The control device according to Supplementary Note 1, wherein the mobile body is a vehicle. (Supplementary Note 3) The control device according to Supplementary Note 2, wherein the control device includes the driving control ECU having a CPU (Central Processing Unit) that is a general-purpose processor, and an alternative ASIC (Application Specific Integrated Circuit) (24), and when the vehicle is being driven in the normal driving mode by the driving control ECU and the importance of the software update in the update request is equal to or greater than a predetermined value, the control device controls the vehicle to be driven in the special driving mode in which the vehicle is driven using the alternative ASIC. (Supplementary Note 4) The control device according to Supplementary Note 2, wherein the vehicle is a vehicle (214) that can run using only either front wheels or rear wheels, and when the update request is received for the software of either a front wheel control ECU (222) that controls the front wheels or a rear wheel control ECU (224) that controls the rear wheels, the control device controls the vehicle to run in the temporary running mode in which the vehicle is run using the ECU that is not the target of update, out of the front wheel control ECU and the rear wheel control ECU.(Supplementary Note 5) The control device according to Supplementary Note 2, wherein the vehicle is a hybrid vehicle (314) equipped with a motor (326A) and an engine (326B) that run the vehicle, and when the update request for the software of either a motor control ECU (322) that controls the motor or an engine control ECU (324) that controls the engine is received, the control device controls to run the vehicle in the temporary running mode in which the vehicle is run by the ECU that is not the target of update, of the motor control ECU and the engine control ECU. (Supplementary Note 6) The control device according to Supplementary Note 2, wherein the vehicle is a vehicle (414) equipped with a first motor (426A) and a spare second motor (426B) that run the vehicle, and when the update request for the software of a first motor control ECU (422) that controls the first motor is received, the control device controls to run the vehicle in the temporary running mode in which the vehicle is run by a second motor control ECU (424) that controls the second motor. (Supplementary Note 7) The control device according to Supplementary Note 2, wherein when the software update is completed, the driving control ECU controls the vehicle to be driven in the normal driving mode. (Supplementary Note 8) The control device according to any one of Supplementary Notes 2 to 5, when the vehicle is driven in the special driving mode, information indicating that the vehicle is to be driven in the special driving mode is output to an output device in the vehicle. (Supplementary Note 9) A control method in which at least one processor (40) executes processing including: when a request for software update of a driving control ECU (Electronic Control Unit) that controls driving of the moving body is made while the moving body is driving in a normal driving mode by the driving control ECU, determining whether the importance of the software update is equal to or greater than a predetermined value; when the importance of the software update is equal to or greater than the predetermined value, controlling the moving body to be able to drive in a special driving mode in which the driving control ECU drives the moving body in a manner different from the normal driving mode; and updating the software of the driving control ECU while control in the special driving mode is being executed.(Supplementary Note 10) A control program (42A) that causes at least one processor to execute processing including: when a request for software update of a driving control ECU (Electronic Control Unit) that controls driving of the moving body is made while the moving body is driving in a normal driving mode by the driving control ECU, determining whether the importance of the software update is equal to or greater than a predetermined value; when the importance of the software update is equal to or greater than the predetermined value, controlling the moving body to be able to drive in a special driving mode that causes the moving body to drive in a manner different from the normal driving mode by the driving control ECU; and updating the software of the driving control ECU while control in the special driving mode is being executed.

[0091] The disclosure of Japanese Patent Application No. 2022-175046 is incorporated herein by reference in its entirety, and all documents, patent applications, and technical standards described herein are incorporated herein by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually indicated to be incorporated by reference.

Claims

1. When a request for software update of a driving control ECU (22) for controlling the driving of a vehicle (14) is made while the vehicle is running in a normal driving mode by the driving control ECU, a determination is made as to whether or not the importance of the software update is equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle control ECU includes a central processing unit (CPU) that is a general-purpose processor, and an alternative application specific integrated circuit (ASIC) (24). When the vehicle is being driven in the normal driving mode by the driving control ECU and the importance of the software update of the update request is equal to or greater than a predetermined value, the vehicle is controlled to be driven in the temporary driving mode in which the vehicle is driven using the alternative ASIC. A control device (18).

2. When a request for software update of a driving control ECU (Electronic Control Unit) that controls the driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, determining whether or not the importance of the software update is equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle is a vehicle (214) capable of running on only one of the front wheels and the rear wheels, When the update request for the software of either one of a front wheel control ECU (222) that controls the front wheels and a rear wheel control ECU (224) that controls the rear wheels is received, the vehicle is controlled to run in the temporary running mode in which the ECU that is not the target of the update out of the front wheel control ECU and the rear wheel control ECU is used to run the vehicle. A control device (218).

3. When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, determining whether or not the importance of the software update is equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle is a vehicle (414) equipped with a first motor (426A) for driving the vehicle and a spare second motor (426B), When the update request for the software of a first motor control ECU (422) that controls the first motor is received, a second motor control ECU (424) that controls the second motor is used to control the vehicle to run in the temporary running mode in which the vehicle is run. Control device (418).

4. When the software update is completed, the driving control ECU controls the vehicle to be driven in the normal driving mode. The control device according to any one of claims 1 to 3.

5. When the vehicle is driven in the special driving mode, information representing that the vehicle is driven in the special driving mode is output to an output device in the vehicle. The control device according to any one of claims 1 to 3.

6. At least one processor (40) When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, the importance of the software update is determined to be equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; When the vehicle is running in the normal running mode by the running control ECU having a CPU (Central Processing Unit) which is a general-purpose processor, and the importance of the software update of the update request is equal to or higher than a predetermined value, the vehicle is controlled to run in the special running mode in which the vehicle is run using an alternative ASIC (Application Specific Integrated Circuit); A control method for executing a process including the steps of:

7. At least one processor When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, the importance of the software update is determined to be equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle is capable of running on only one of the front wheels or the rear wheels, When the update request for the software of either one of the front wheel control ECU that controls the front wheels and the rear wheel control ECU that controls the rear wheels is received, the vehicle is controlled to run in the temporary running mode in which the ECU that is not the update target of the front wheel control ECU or the rear wheel control ECU is used to run the vehicle. A control method for executing a process including the steps of:

8. At least one processor When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, the importance of the software update is determined to be equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle includes a first motor for propelling the vehicle and a second motor as a spare, when the update request for the software of a first motor control ECU that controls the first motor is received, control is performed so that the vehicle is driven in the special driving mode in which the vehicle is driven by a second motor control ECU that controls the second motor. A control method for executing a process including the steps of:

9. At least one processor, When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, the importance of the software update is determined to be equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; When the vehicle is running in the normal running mode by the running control ECU having a CPU (Central Processing Unit) which is a general-purpose processor, and the importance of the software update of the update request is equal to or higher than a predetermined value, the vehicle is controlled to run in the special running mode in which the vehicle is run using an alternative ASIC (Application Specific Integrated Circuit); A control program (42A) for executing a process including the steps of:

10. At least one processor, When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, the importance of the software update is determined to be equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle is capable of running on only one of the front wheels or the rear wheels, When the update request for the software of either one of the front wheel control ECU that controls the front wheels and the rear wheel control ECU that controls the rear wheels is received, the vehicle is controlled to run in the temporary running mode in which the ECU that is not the update target of the front wheel control ECU or the rear wheel control ECU is used to run the vehicle. A control program that causes the device to execute a process including the above.

11. At least one processor, When a request for updating software of a driving control ECU (Electronic Control Unit) that controls driving of the vehicle is made while the vehicle is running in a normal driving mode by the driving control ECU, the importance of the software update is determined to be equal to or greater than a predetermined value; When the importance of the software update is equal to or greater than a predetermined value, the vehicle is controlled to travel in a special travel mode in which the travel control ECU drives the vehicle in a manner different from the normal travel mode, updating software of the driving control ECU while control in the temporary driving mode is being executed; The vehicle includes a first motor for propelling the vehicle and a second motor as a spare, when the update request for the software of a first motor control ECU that controls the first motor is received, control is performed so that the vehicle is driven in the special driving mode in which the vehicle is driven by a second motor control ECU that controls the second motor. A control program that causes the device to execute a process including the above.