Control device, control method, and control program

Abstract

This control device has a processor installed in a moving body, and the processor downloads software from a server while in a first mode in which the server and the moving body communicate. In addition, when in a second mode in which a communication device and the moving body communicate, software downloaded to the communication device from the server is downloaded by the processor from the communication device.

Description

Control device, control method, and control program

[0001] The present disclosure relates to a control device, a control method, and a control program.

[0002] Japanese Patent Application Laid-Open Publication No. 2022-016517 discloses that a server updates the autonomous driving control software of an information processing device over the air (OTA) in response to a request from a service provider.

[0003] As disclosed in the above-mentioned Japanese Patent Application Laid-Open No. 2022-016517, when OTA is performed only between a server and a vehicle, which is an example of a moving body, the vehicle's ECU (Electronic Control Unit) must access the server during OTA. In this case, for example, if the communication environment between the server and the vehicle is poor, OTA cannot be performed, and a situation may arise in which software running in the vehicle cannot be updated.

[0004] On the other hand, if the communication environment between the server and the vehicle is always good and new software is installed in the vehicle successively via OTA, vehicles such as taxis or shared cars cannot be operated while the new software is being installed in the vehicle, which could result in lost business opportunities and losses.

[0005] For this reason, it is desirable to not only perform OTA by accessing a server from the vehicle's ECU, but also to perform OTA in a more flexible manner.

[0006] The present disclosure aims to provide a control device, a control method, and a control program that enable a mobile object to download new software via another communication device without the mobile object having to directly access a server.

[0007] A control device according to a first aspect of the present disclosure has a processor mounted on a mobile body, and in a first mode in which a server and the mobile body communicate with each other, the processor downloads software from the server, and in a second mode in which the mobile body communicates with a communication device different from the server, the processor downloads the software downloaded from the server to the communication device from the communication device.

[0008] The control method of the second aspect performs processing in which at least one processor mounted on a mobile body downloads software from a server in a first mode in which the mobile body communicates with a server, and downloads the software downloaded from the server to the communication device from the communication device in a second mode in which the mobile body communicates with a communication device different from the server.

[0009] The control program of the third aspect causes at least one processor mounted on a mobile body to execute processing including downloading software from a server in a first mode in which the mobile body communicates with a server, and downloading the software downloaded from the server to the communication device from the communication device in a second mode in which the mobile body communicates with a communication device different from the server.

[0010] The present disclosure has an advantage that new software can be downloaded to a mobile object via another communication device without the mobile object having to directly access a server.

[0011] 1 is a configuration diagram of a vehicle control system according to a first embodiment; FIG. 2 is a diagram for explaining the first embodiment; FIG. 3 is a configuration diagram showing the hardware configuration of each ECU according to the first embodiment; FIG. 4 is a flowchart of a first control process according to the first embodiment; FIG. 5 is a flowchart of a second control process according to the first embodiment; and FIG. 6 is a flowchart of a third control process according to a third embodiment.

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In the following embodiments, a moving body is a vehicle.

[0013] 1, a vehicle control system 10 according to a first embodiment includes a server 12 and a plurality of vehicles 14X, 14A, 14B, and 14C. Each of the plurality of vehicles 14X, 14A, 14B, and 14C includes an ECU.

[0014] The server 12 and the plurality of vehicles 14X, 14A, 14B, and 14C are communicatively connected via a network 16. However, the communication environment between the server 12 and the plurality of vehicles 14X, 14A, 14B, and 14C may be poor, and each of the plurality of vehicles 14X, 14A, 14B, and 14C may be unable to communicate with the server 12. Note that, hereinafter, any one of the plurality of vehicles 14X, 14A, 14B, and 14C may also be simply referred to as "vehicle 14."

[0015] In the first embodiment, when the communication environment between the server 12 and the vehicle 14 is poor and it is difficult to perform OTA, the vehicle 14 acquires new software, which is a program, via another communication device (e.g., an ECU of another vehicle, a mobile terminal, or a personal computer) different from the server 12. Examples of a poor communication environment between the server 12 and the vehicle 14 include when communication between the server 12 and the vehicle 14 is impossible or when communication takes an extremely long time.

[0016] As shown in FIG. 1, when the communication environment between the vehicle 14 and the server 12 that performs OTA is good (hereinafter also referred to simply as the “first mode”), the vehicle 14 performs OTA with the server 12 and downloads a new program.

[0017] On the other hand, as shown in Figure 2, when the communication environment between vehicles 14A, 14B, and 14C and the server 12 that performs OTA is poor and it is difficult to perform OTA (hereinafter simply referred to as the "second mode"), a new program is downloaded from another communication device (for example, ECU 18X of vehicle 14X that has already downloaded a program from server 12).

[0018] This allows the vehicle 14 to download and install new programs to the vehicle via other communication devices even if the communication environment between the vehicle 14 and the server 12 is poor and it is difficult to perform OTA.

[0019] The first mode is a mode in which communication between the server 12 and the vehicle 14 is possible, and the second mode is a mode in which communication between the server 12 and the vehicle 14 is restricted.

[0020] In the following, an example will be described in which the other communication device is an ECU mounted on a vehicle, but the communication device is not limited to an ECU of the vehicle and may be any unit that has a communication function and a storage medium. For example, the other communication device may be a mobile terminal, a personal computer, or the like.

[0021] The ECU of the vehicle 14 installs or activates a new program within itself. Here, installing a program means storing the program in a non-volatile memory (not shown) and making it executable. Activating a program means enabling the functions realized by executing the program.

[0022] 3 is a block diagram showing the hardware configuration of the ECU provided in each of the plurality of vehicles 14X, 14A, 14B, and 14C. As shown in FIG. 3, the ECU of each of the vehicles 14X, 14A, 14B, and 14C includes a controller 40.

[0023] 3, the controller 40 includes a central processing unit (CPU) 40A, a read-only memory (ROM) 40B, a random access memory (RAM) 40C, and an input / output interface (I / O) 40D. The CPU 40A, ROM 40B, RAM 40C, and I / O 40D are connected to each other via a bus 40E. The bus 40E includes a control bus, an address bus, and a data bus. A communication unit 41 and a storage unit 42 are connected to the I / O 40D.

[0024] The communication unit 41 is an interface for performing data communication with external devices such as the server 12 and other ECUs.

[0025] The storage unit 42 is configured by, for example, a nonvolatile memory. As shown in Fig. 3, the storage unit 42 stores a control program 42A and the like.

[0026] The CPU 40A is an example of a computer. The term "computer" as used here refers to a processor in a broad sense, and includes a general-purpose processor (e.g., a CPU) or a dedicated processor (e.g., a GPU: Graphics Processing Unit, an ASIC: Application Specific Integrated Circuit, an FPGA: Field Programmable Gate Array, a programmable logic device, etc.).

[0027] The control program 42A may be stored in a non-volatile, non-transitory recording medium or distributed via a network and installed in the ECU as needed.

[0028] Examples of non-volatile non-transient recording media include CD-ROMs (Compact Disc Read Only Memory), magneto-optical disks, HDDs (Hard Disk Drives), DVD-ROMs (Digital Versatile Disc Read Only Memory), flash memories, memory cards, etc.

[0029] The server 12 also has a hardware configuration similar to that shown in FIG.

[0030] Next, a flowchart of the first control process executed by the ECU of the vehicle 14 will be described with reference to Figure 4. In the first mode, which indicates that the ECU of the vehicle 14 and the server 12 are in an environment where they can communicate with each other, OTA is executed between the server 12 and the ECU of the vehicle 14. Figure 4 is a flowchart of the first control process executed by each vehicle in the first mode. Note that the following description will be given taking as an example a case where the ECU 18X of the vehicle 14X executes the first control process of Figure 4.

[0031] In step S100, the ECU 18X of the vehicle 14X downloads a new program via OTA and temporarily stores it in its own storage unit (not shown).

[0032] In step S102, the ECU 18X of the vehicle 14X verifies the program downloaded in step S100. The program verification involves verifying whether the program is intended for the ECU 18X, whether the program operates properly, and whether the program is virus-free. The ECU 18X of the vehicle 14X then installs the verified program into itself.

[0033] In step S104, the ECU 18X of the vehicle 14X activates the new program.

[0034] The first control process shown in FIG. 4 can be executed by each of the plurality of vehicles 14X, 14A, 14B, and 14C.

[0035] Next, in the second mode, which indicates that communication between the ECU of the vehicle 14 and the server 12 is restricted, the flowchart of the second control process shown in Figure 5 is executed between the server 12 and the ECU of the vehicle 14.

[0036] In the following, an example will be described in which the vehicle 14X has already executed the flowchart of FIG. 4 and the vehicle 14A is in the second mode.

[0037] First, the ECU 18X of the vehicle 14X transmits a trigger signal indicating a program update trigger to the ECU 18A of the vehicle 14A. Note that the ECU 18X of the vehicle 14X and the ECU 18A of the vehicle 14A transmit and receive data via vehicle-to-vehicle communication.

[0038] In step S200, the ECU 18A of the vehicle 14A receives a trigger signal transmitted from the ECU 18X of the vehicle 14X. The trigger signal includes version information of the new program and a group ID representing the group of vehicles into which the program should be installed. The group of vehicles refers to, for example, a group representing the type of vehicle or a group representing that the vehicles are managed by the same management entity (for example, the same management company).

[0039] In step S202, the ECU 18A of the vehicle 14A determines whether the group to which the vehicle 14X belongs corresponds to the group to which the vehicle 14A belongs. For example, the ECU 18A of the vehicle 14A determines whether the group ID included in the trigger signal is the same as the group ID of the group to which the vehicle 14A belongs. If the group ID of the vehicle 14A and the group ID of the vehicle 14X are the same, the process proceeds to step S204. On the other hand, if the group ID of the vehicle 14A and the group ID of the vehicle 14X are not the same, the control process ends. In this way, the new program is installed only if the new program is intended for the vehicle.

[0040] In step S204, the ECU 18A of the vehicle 14A compares the version information of the new program included in the trigger signal with the version information of the program currently running on the vehicle 14A, and determines whether the program to be installed is a newer version than the current program. If the program to be installed is a newer version than the current program, the process proceeds to step S206. On the other hand, if the program to be installed is not a newer version than the current program, the second control process ends. Therefore, the new program is installed only if the program to be installed is a newer version than the current program.

[0041] In step S206, the ECU 18A of the vehicle 14A transmits a request signal to the ECU 18X of the vehicle 14X, requesting provision of a new program.

[0042] In step S208, the ECU 18A of the vehicle 14A downloads the new program from the vehicle 14X via vehicle-to-vehicle communication and installs the program in the ECU 18A without verifying the program, because the program has already been verified in the vehicle 14X.

[0043] The vehicle control system 10 of the first embodiment can be used, for example, when updating the program of a vehicle that is driven in a mine or mountainous area where the communication environment is poor.

[0044] For example, assume that each of multiple vehicles 14X, 14A, 14B, and 14C (e.g., vehicles used in a mine or the like) is placed in an environment (e.g., a mine or the like) where it cannot communicate with the server 12. In this situation, one of the multiple vehicles, vehicle 14X, moves to a location where it can communicate with the server 12, and downloads, verifies, installs, and activates a new program via OTA.

[0045] After the vehicle 14X downloads the new program in a communication-enabled environment, the vehicle 14X moves to a location where the multiple vehicles 14A, 14B, and 14C are located, in other words, to a location where the vehicle 14X can communicate with each of the vehicles 14A, 14B, and 14C. The ECU 18X of the vehicle 14X then outputs a trigger signal to each of the ECUs of the multiple vehicles 14A, 14B, and 14C to notify them that the new program has been downloaded. Each of the multiple vehicles 14A, 14B, and 14C downloads the new program via the ECU 18X of the vehicle 14X.

[0046] This allows the vehicle to acquire new programs via other communication devices even when the communication environment between the vehicle and the server is poor and it is difficult to perform OTA.

[0047] In the above, an example was described in which vehicle 14X provides a new program to vehicles 14A, 14B, and 14C, but instead of vehicle 14X, a mobile terminal, which is a mobile communication device, may download the new program and provide the program to vehicles 14A, 14B, and 14C via the mobile terminal.

[0048] As described above, the vehicle ECU of the vehicle control system of the first embodiment includes a processor mounted on the vehicle, which is an example of a mobile body. In a first mode in which the server and the vehicle communicate with each other, the processor downloads a program from a storage unit (not shown) of the server. In a second mode in which the vehicle communicates with another vehicle (or a mobile terminal, personal computer, etc.), which is an example of a mobile communication device, the processor of the vehicle ECU downloads a program from the other vehicle that has been previously downloaded from the server to the other vehicle. This allows the vehicle to download a new program to the vehicle via another communication device without directly accessing the server. Furthermore, even if the communication environment between the vehicle and the server is poor and it is difficult to perform OTA, the vehicle can obtain a new program via the other communication device.

[0049] Furthermore, when a vehicle's ECU downloads a new program from another vehicle's ECU via vehicle-to-vehicle communication and verification of the new software has already been performed, the software verification can be omitted, allowing for efficient installation.

[0050] Furthermore, the program can be updated appropriately by downloading the program after the vehicle's ECU has confirmed that the program version is new.

[0051] Second Embodiment Next, a second embodiment will be described. The same components of the second embodiment as those of the first embodiment are designated by the same reference numerals, and detailed descriptions thereof will be omitted. The vehicle control system of the second embodiment is similar to that of the first embodiment, and detailed descriptions thereof will be omitted. The second embodiment differs from the first embodiment in that the quality of the communication environment is not taken into consideration.

[0052] In the second embodiment, each of the vehicles belonging to the same group acquires the new program via other vehicles that have already downloaded the new program, thereby reducing simultaneous access by the vehicles to the server. Note that a group may refer to a group or vehicle type that is managed by the same management entity (e.g., a taxi company or a car sharing company).

[0053] For example, after at least one vehicle 14X (or a communication device such as a mobile terminal or personal computer) among the vehicles belonging to the same group performs OTA with the server 12 to download a new program, the other vehicles 14A, 14B, and 14C belonging to the same group obtain the new program via the vehicle 14X. This prevents multiple vehicles from accessing the server simultaneously, thereby reducing the processing load on the server. Note that the communication device that downloads the program is not limited to other vehicles, and may be any unit that has communication functions and a storage medium.

[0054] For example, assume that a taxi company manages vehicles 14X, 14A, 14B, and 14C. In this case, the ECU 18X of the vehicle 14X executes the control process shown in FIG. 4 to download, verify, install, and activate a new program via OTA with the server 12.

[0055] 5 and downloads the new program via the ECU 18X of the vehicle 14X. This prevents the vehicles 14X, 14A, 14B, and 14C from accessing the server 12 simultaneously, thereby reducing the processing load on the server 12.

[0056] As described above, the vehicle ECU of the vehicle control system of the second embodiment has a processor mounted on the vehicle, which is an example of a mobile body. In a first mode in which the server and the vehicle communicate with each other, the processor downloads a program from a memory unit (not shown) of the server. In a second mode in which the vehicle communicates with another vehicle (or a communication device such as a mobile terminal or personal computer), which is an example of a mobile communication device, the processor of the vehicle ECU downloads a program from the other vehicle that has been previously downloaded to the other vehicle from the server. This allows a new program to be downloaded to the vehicle via another communication device without the vehicle directly accessing the server. Furthermore, the download and installation of new programs for vehicles belonging to the same group can be appropriately managed.

[0057] The second embodiment is also preferable from the viewpoint of managing the download and installation of new programs to vehicles belonging to the same group. When managing the download and installation of new programs to vehicles belonging to the same group, it may be preferable to update the programs of all vehicles at the same time as much as possible. Therefore, according to the second embodiment, it is possible to appropriately manage the download and installation of new programs to vehicles belonging to the same group.

[0058] Furthermore, while an OTA is being performed, a vehicle (e.g., a taxi or a shared car) cannot be used, which may result in a loss of business opportunities. For this reason, for example, the timing of downloading a new program via OTA and the timing of installing the program may be separated. This can reduce losses due to missed business opportunities.

[0059] In addition, according to the vehicle control system of the second embodiment, programs are provided between vehicles belonging to the same group, so that new programs can be downloaded to the vehicle's ECU without performing OTA with the server.

[0060] Third Embodiment Next, a third embodiment will be described. The same components of the third embodiment as those of the first and second embodiments are designated by the same reference numerals, and detailed descriptions thereof will be omitted. The configuration of the vehicle control system of the third embodiment is similar to that of the first embodiment, and detailed descriptions thereof will be omitted.

[0061] The third embodiment differs from the first and second embodiments in that the ECU of the vehicle 14 searches for target devices (e.g., a server, an ECU installed in the vehicle, a mobile terminal, a personal computer, etc.) that store a new program to be downloaded and acquires the new program from the searched target devices. The target devices include, for example, the server 12 and other communication devices (e.g., an ECU installed in the vehicle, a mobile terminal, a personal computer, etc.). The target devices may be any units that have communication functions and a storage medium.

[0062] Next, a flowchart of the third control process executed by the ECU 18A of the vehicle 14A will be described with reference to FIG.

[0063] In step S300, the ECU 18A of the vehicle 14A searches for a target device with which it can communicate within a predetermined range around the vehicle 14A.

[0064] In step S302, the ECU 18A of the vehicle 14A determines whether or not there is a communicable target device within a predetermined range around the vehicle 14A. If there is a communicable target device, the process proceeds to step S304. On the other hand, if there is no communicable target device, the third control process ends.

[0065] In step S304, the ECU 18A of the vehicle 14A determines whether the communicable target device holds a program of the same group as the vehicle 14A. If the communicable target device holds a program of the same group as the vehicle 14A, the process proceeds to step S306. If the communicable communication device does not hold a program of the same group as the vehicle 14A, the third control process is terminated.

[0066] In step S306, the ECU 18A of the vehicle 14A determines whether the searched target device holds a new program for the vehicle 14A. If the target device holds a new program for the vehicle 14A, the process proceeds to step S308. On the other hand, if the target device does not hold a new program for the vehicle 14A, the third control process ends.

[0067] In step S308, if there are multiple target devices and all of them hold new programs for the vehicle 14A, the ECU 18A of the vehicle 14A selects one target device from the multiple target devices.

[0068] In step S310, the ECU 18A of the vehicle 14A transmits a request signal to the target device selected in step S308, requesting provision of a new program.

[0069] In step S312, the ECU 18A of the vehicle 14A downloads the new program through communication processing with the target device selected in step S308.

[0070] In this case, if the server 12 is included in the searched target devices, the ECU 18A of the vehicle 14A downloads a new program from the server 12 in the first mode. On the other hand, if the server 12 is not included in the searched target devices and the searched target devices are other communication devices, the ECU 18A of the vehicle 14A downloads a new program from the other communication device in the second mode.

[0071] In step S314, when installing a new program, the ECU 18A of the vehicle 14A outputs information inquiring whether or not to perform the installation immediately. Specifically, the ECU 18A of the vehicle 14A presents information inquiring whether or not to perform the installation immediately to the user of the vehicle 14A. For example, the ECU 18A of the vehicle 14A controls a display unit (not shown) or an audio output device (not shown) within the vehicle 14A to output the information inquiring whether or not to perform the installation immediately. Alternatively, the ECU 18A of the vehicle 14A may control a mobile terminal operated by the user to output the information inquiring whether or not to perform the installation immediately.

[0072] In step S316, the ECU 18A of the vehicle 14A receives an instruction signal input by the user and determines whether the instruction signal is an installation instruction. If the instruction signal input by the user indicates an installation instruction, the process proceeds to step S318. On the other hand, if the instruction signal input by the user does not indicate an installation instruction, the third control process ends. For example, the user performs an operation to instruct installation or an operation to instruct not to install in response to inquiry information displayed on a touch panel, which is an example of a display unit (not shown) in the vehicle 14A.

[0073] If it is determined in step S316 that the new program will not be installed, the downloaded new program will be installed after a predetermined time has elapsed or in response to a user instruction.

[0074] In step S318, the ECU 18A of the vehicle 14A installs the new program received in step S312.

[0075] In this way, the vehicle ECU of the vehicle control system of the third embodiment searches for target devices that can communicate with the vehicle from the server and multiple other communication devices. If the searched target devices include the server, the vehicle ECU downloads a program from the server in a first mode. If the searched target devices do not include the server but are other communication devices, the vehicle ECU downloads a program from the other communication devices in a second mode. This allows a new program to be downloaded to the vehicle via other communication devices without the vehicle directly accessing the server. Furthermore, even if the communication environment between the vehicle and the server is poor and OTA is difficult to implement, the vehicle can obtain a new program via other communication devices.

[0076] Furthermore, according to the vehicle ECU of the vehicle control system of the third embodiment, when a new program is acquired from a mobile target device (e.g., the vehicle ECU, a mobile terminal, or a personal computer), the program is not installed immediately, but is installed only with permission (or instruction) from the user. This prevents a situation in which the vehicle becomes immediately unusable due to the acquisition of a new program. Specifically, the system searches for a communication device that has the new program and downloads the new program from that communication device, but installs the program only with permission from the user. This prevents taxis or shared cars that belong to the same group from becoming immediately unusable when a new program is acquired, thereby reducing the risk of business opportunities being lost and losses occurring.

[0077] Furthermore, the present disclosure is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the gist of the present invention.

[0078] For example, in the above embodiments, the moving body is a vehicle, but the present invention is not limited to this. Any moving body may be used, and the above embodiments may be applied to, for example, a mobile robot.

[0079] Furthermore, when installing a new program, the vehicle ECU may install a program that indicates the differences from the program that is already running, thereby enabling efficient program installation.

[0080] Furthermore, after downloading a new program, the vehicle ECU may cause an output device to output the time required for installation when installing the new program. For example, the vehicle ECU may control an in-vehicle display device (not shown) or an audio output device (not shown), which are examples of output devices, to output the time required for installation. Alternatively, the vehicle ECU may control a user-operated mobile terminal, which is also an example of an output device, to output the time required for installation. This allows the user to instruct the ECU whether or not to install the new program depending on the time required for installation.

[0081] The vehicle's ECU may also be configured to assign a group ID to the vehicle. For example, the vehicle's ECU may acquire information representing a group ID entered by a user operating an in-vehicle device (not shown) or a mobile terminal (not shown), and assign the group ID to the vehicle. By allowing users to assign IDs to vehicles themselves, for example, a car sharing company or taxi company can assign the same or corresponding group IDs to multiple vehicles that they manage. This makes it easier to manage multiple vehicles. For example, as in the second embodiment, it is possible to manage multiple vehicles to which new programs are downloaded and installed.

[0082] Furthermore, when installing a new program, the vehicle's ECU may acquire information about the vehicle's operation plan and determine whether to start installation based on the information about the vehicle's operation plan. For example, if the target vehicle is scheduled to operate from 9:00 to 17:00 Monday through Friday, the ECU of the target vehicle may install the new program avoiding those hours. For example, if the target vehicle is a taxi or a shared car, avoiding installation during the hours the target vehicle is operating can prevent lost business opportunities and losses. In this case, the vehicle's ECU does not immediately install the new program when it is downloaded, but determines whether to start installation based on the information about the vehicle's operation plan.

[0083] In addition, the configuration of the vehicle control system described in each of the above embodiments is an example, and it goes without saying that unnecessary parts may be deleted or new parts may be added within the scope of the present disclosure.

[0084] Furthermore, the processing flow of the control program described in the above embodiment (see Figures 4, 5, and 6) is also an example, and it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be changed within the scope of the present disclosure.

[0085] The controller and method described herein may be implemented by a special-purpose computer having a processor programmed to perform one or more functions embodied in a computer program. Alternatively, the apparatus and method described herein may be implemented by a special-purpose computer having a processor configured with dedicated hardware logic circuits. Alternatively, the apparatus and method described herein may be implemented by one or more special-purpose computers configured by a combination of a processor executing a computer program and one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory storage medium.

[0086] <Supplementary Notes> (Supplementary Note 1) A control device (18A) having a processor (40) mounted on a mobile body (14A), the processor downloading software from a server (12) in a first mode in which the mobile body communicates with the server, and downloading the software downloaded from the server to the communication device from the communication device in a second mode in which the mobile body communicates with a communication device different from the server. (Supplementary Note 2) The control device according to Supplementary Note 1, wherein the processor searches the server and a plurality of the communication devices for target devices that can communicate with the mobile body, and if the server is included in the searched target devices, downloads the software from the server in the first mode, and if the server is not included in the searched target devices and the searched target device is the communication device, downloads the software from the communication device in the second mode. (Supplementary Note 3) The control device according to Supplementary Note 1 or Supplementary Note 2, wherein the first mode is a mode in which communication between the server and the mobile body is possible, and the second mode is a mode in which communication between the server and the mobile body is restricted. (Supplementary Note 4) The control device according to Supplementary Note 2, wherein the processor: determines whether the searched target device retains new software for the mobile body, transmits a request signal to the target device determined to retain the new software for the mobile body, requesting provision of the new software, and downloads the software from the target device. (Supplementary Note 5) The control device according to any one of Supplementary Notes 1 to 4, wherein the processor: when downloading new software, if an instruction signal instructing installation is received, installs the new software, and when downloading the new software, if an instruction signal instructing not to install is received, stores the new software in its own storage unit without installing the new software.(Supplementary Note 6) The control device according to any one of Supplementary Notes 1 to 5, wherein the processor installs the software into the mobile object without performing the predetermined verification of the software if the communication device has performed a predetermined verification of the software. (Supplementary Note 7) The control device according to any one of Supplementary Notes 1 to 6, wherein the processor downloads the software if an ID representing a group of the mobile object of the control device corresponds to an ID representing a group of the mobile object attached to the software. (Supplementary Note 8) The control device according to any one of Supplementary Notes 1 to 7, wherein the processor downloads the software if the version of the software to be installed is newer than the version of the software running in an ECU (Electronic Control Unit) mounted on the mobile object. (Supplementary Note 9) The control device according to any one of Supplementary Notes 1 to 8, wherein the communication device different from the server is an ECU or a mobile terminal mounted on another mobile object. (Supplementary Note 10) The control device according to any one of Supplementary Notes 1 to 9, wherein the processor, after downloading new software, when installing the new software, causes an output device to output a time required for installation. (Supplementary Note 11) The control device according to any one of Supplementary Notes 1 to 10, wherein the processor, when installing new software, causes an output device to output information inquiring whether or not to perform installation immediately. (Supplementary Note 12) The control device according to any one of Supplementary Notes 1 to 11, wherein the processor acquires information representing a group ID input by a user operating a device in the mobile object or a mobile terminal, and assigns the group ID to the mobile object. (Supplementary Note 13) The control device according to any one of Supplementary Notes 1 to 12, wherein, when installing new software, the processor determines whether or not to start installation in accordance with an operation plan of the mobile object.(Supplementary Note 14) A control method in which at least one processor mounted on a mobile body executes processing including: downloading software from a server in a first mode in which a server and the mobile body communicate with the mobile body, and downloading, from the communication device, the software downloaded from the server to the communication device in a second mode in which the mobile body communicates with a communication device different from the server. (Supplementary Note 15) A control program (42A) in which at least one processor mounted on a mobile body executes processing including: downloading software from the server in a first mode in which a server and the mobile body communicate with the mobile body, and downloading, from the communication device, the software downloaded from the server to the communication device in a second mode in which the mobile body communicates with a communication device different from the server.

[0087] The disclosure of Japanese Patent Application No. 2022-177569 is incorporated herein by reference in its entirety, and all documents, patent applications, and technical standards described herein are incorporated herein by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually indicated to be incorporated by reference.

Claims

1. A processor (40) mounted on a moving body (14A), the processor comprising: downloading software from a server (12) in a first mode in which the server and the mobile unit communicate with each other; In a second mode in which the mobile object communicates with a communication device different from the server, the software downloaded from the server to the communication device is downloaded from the communication device; If the communication device executes a predetermined verification of the software, the software is installed in the mobile object without executing the predetermined verification of the software. Control device (18A).

2. The processor, searching the server and the plurality of communication devices for a target device capable of communicating with the mobile object; downloading the software from the server in the first mode if the server is included in the searched target devices; downloading the software from the communication device in the second mode when the server is not included in the searched target devices and the searched target devices are the communication devices; The control device according to claim 1 .

3. the first mode is a mode in which communication between the server and the mobile object is possible; The second mode is a mode in which communication between the server and the mobile object is restricted. The control device according to claim 1 or 2.

4. The processor, determining whether the discovered target device has new software for the mobile unit; transmitting a request signal to the target device determined to have new software for the mobile object, requesting provision of the new software; downloading said software from said target device; The control device according to claim 2.

5. The processor, When new software is downloaded, if an instruction signal instructing installation is received, the new software is installed; When the new software is downloaded, if an instruction signal instructing not to install the new software is received, the new software is stored in its own storage unit without being installed. The control device according to claim 1 or 2.

6. The processor, downloading the software when the ID representing the group of the mobile object of the mobile object corresponds to the ID representing the group of the mobile object added to the software; The control device according to claim 1 or 2.

7. The processor, downloading the software when the version of the software to be installed is newer than the version of the software running in an ECU (Electronic Control Unit) mounted on the vehicle; The control device according to claim 1 or 2.

8. The communication device other than the server is an ECU or a mobile terminal mounted on another moving object. The control device according to claim 1 or 2.

9. The processor, After downloading new software, when installing the new software, a time required for installation is output from an output device. The control device according to claim 1 or 2.

10. The processor, When installing new software, information inquiring whether or not to install immediately is output from an output device. The control device according to claim 1 or 2.

11. The processor, acquiring information representing a group ID input by a user operating a device in the mobile object or a mobile terminal, and assigning the group ID to the mobile object; The control device according to claim 1 or 2.

12. The processor, When installing new software, it is determined whether or not to start the installation in accordance with an operation plan of the mobile object. The control device according to claim 1 or 2.

13. At least one processor mounted on the mobile unit, downloading software from the server in a first mode in which the server and the mobile unit communicate with each other; In a second mode in which the mobile object communicates with a communication device different from the server, the software downloaded from the server to the communication device is downloaded from the communication device; If the communication device executes a predetermined verification of the software, the software is installed in the mobile object without executing the predetermined verification of the software. A control method for executing a process including the steps of:

14. At least one processor mounted on the mobile object, downloading software from the server in a first mode in which the server and the mobile unit communicate with each other; In a second mode in which the mobile object communicates with a communication device different from the server, the software downloaded from the server to the communication device is downloaded from the communication device; If the communication device executes a predetermined verification of the software, the software is installed in the mobile object without executing the predetermined verification of the software. A control program (42A) for executing a process including the steps of: