Onboard system and control method

Abstract

A first electronic control device (5) is loaded with a first peripheral monitoring application (91) that monitors the periphery of a vehicle while the vehicle is parked and a first OS (81). A second electronic control device (6) is loaded with a second peripheral monitoring application (92) that monitors the periphery of the vehicle while the vehicle is parked and a second OS (82). When a program of the second peripheral monitoring application or the second OS is being rewritten, the first electronic control device operates in a first degraded mode in which peripheral monitoring is performed without data communication with the second electronic control device. When a program of the first peripheral monitoring application or the first OS is being rewritten, the second electronic control device operates in a second degraded mode in which peripheral monitoring is performed without data communication with the first electronic control device.

Description

In-vehicle system and control method CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This international application claims the benefit of Japanese Patent Application No. 2024-105139, filed with the Japan Patent Office on June 28, 2024, the entire disclosure of which is incorporated herein by reference.

[0002] The present disclosure relates to an in-vehicle system and a control method that allows software updates.

[0003] Patent Document 1 describes a software update device that acquires software supplied from outside the vehicle and updates the software for a plurality of electronic control units mounted on the vehicle.

[0004] Japanese Patent Application Laid-Open No. 2021-128362

[0005] Software updates for electronic control devices installed in vehicles are often performed while the vehicle is parked.

[0006] As a result of detailed investigations by the inventors, the following problem was found: In order to update a program of a perimeter monitoring application that monitors the perimeter of a vehicle while the vehicle is parked, it is necessary to stop the operation of the perimeter monitoring application while the vehicle is parked. As a result, a monitoring stop period occurs while the vehicle is parked, during which monitoring of the perimeter of the vehicle is stopped.

[0007] The present disclosure prevents the occurrence of periods during which monitoring is suspended due to software updates.

[0008] One aspect of the present disclosure is an in-vehicle system that is mounted on a vehicle and includes a first periphery monitoring device group, a first electronic control unit, a second periphery monitoring device group, and a second electronic control unit.

[0009] The first periphery monitoring device group includes at least one first monitoring device that monitors the periphery of the vehicle. The first electronic control unit is connected to the first periphery monitoring device group. The second periphery monitoring device group includes at least one second monitoring device that monitors the periphery of the vehicle. The second electronic control unit is connected to the second periphery monitoring device group.

[0010] The at least one first monitoring device is configured to generate first perimeter monitoring information by monitoring the perimeter of the vehicle.

[0011] At least one second monitoring device is configured to generate second perimeter monitoring information by monitoring the perimeter of the vehicle.

[0012] The first electronic control unit is equipped with a first periphery monitoring application that uses first periphery monitoring information to perform first periphery monitoring, which monitors the periphery of the vehicle while the vehicle is parked, and a first operating system that is basic software for operating the first periphery monitoring application.

[0013] The second electronic control unit is equipped with a second periphery monitoring application capable of performing second periphery monitoring, which monitors the periphery of the vehicle while the vehicle is parked, using second periphery monitoring information, and a second operating system, which is basic software for operating the second periphery monitoring application.

[0014] The first electronic control unit and the second electronic control unit are connected to each other so as to be able to communicate data with each other.

[0015] The first electronic control unit is configured to operate in a first degenerate mode in which the first peripheral monitoring is performed without data communication with the second electronic control unit while a second software update is being executed in the second electronic control unit to rewrite the program of the second peripheral monitoring application or the program of the second operating system.

[0016] The second electronic control unit is configured to operate in a second degenerate mode in which the second peripheral monitoring is performed without data communication with the first electronic control unit while the first software update is being executed in the first electronic control unit to rewrite the program of the first peripheral monitoring application or the program of the first operating system.

[0017] In the in-vehicle system of the present disclosure configured as above, when the operation of the first periphery monitoring application is stopped because the first software update is being executed, the second periphery monitoring application operates in the second degenerate mode. Furthermore, when the operation of the second periphery monitoring application is stopped because the second software update is being executed, the first periphery monitoring application operates in the first degenerate mode. Therefore, the in-vehicle system of the present disclosure can prevent a situation in which monitoring of the vehicle periphery is completely stopped due to a software update and can prevent a period of monitoring suspension due to a software update.

[0018] Yet another aspect of the present disclosure is a control method executed in an in-vehicle system installed in a vehicle.

[0019] In the control method disclosed herein, the first electronic control unit operates in a first degenerate mode in which it performs first peripheral monitoring without communicating data with the second electronic control unit while a second software update is being executed in the second electronic control unit to rewrite the program of a second peripheral monitoring application or the program of a second operating system.

[0020] The second electronic control unit operates in a second degenerate mode in which it performs second peripheral monitoring without communicating data with the first electronic control unit while the first software update is being executed in the first electronic control unit to rewrite the program of the first peripheral monitoring application or the program of the first operating system.

[0021] The control method of the present disclosure is a method executed in the in-vehicle system of the present disclosure, and by executing this method, it is possible to obtain the same effects as the in-vehicle system of the present disclosure.

[0022] 1 is a block diagram showing the configuration of a software update system. FIG. 2 is a block diagram showing the configuration of the first and second ECUs. FIG. 3 is a diagram showing the arrangement of a camera and an acceleration sensor. FIG. 4 is a functional block diagram showing the functional configuration of the first and second ECUs of the first to fourth embodiments. FIG. 5 is a flowchart showing an update control process. FIG. 6 is a flowchart showing a first mode switching process of the first embodiment. FIG. 7 is a flowchart showing a second mode switching process of the first embodiment. FIG. 8 is a flowchart showing a first mode switching process of the second embodiment. FIG. 9 is a flowchart showing a second mode switching process of the second embodiment. FIG. 10 is a flowchart showing a first mode switching process of the third embodiment. FIG. 11 is a functional block diagram showing the functional configuration of the first and second ECUs of the fifth and sixth embodiments.

[0023] First Embodiment A first embodiment of the present disclosure will be described below with reference to the drawings.

[0024] As shown in FIG. 1, the software update system 1 of this embodiment includes a vehicle control system 2 and a center 3.

[0025] The vehicle control system 2 is mounted on the vehicle and has a function of performing data communication with the center 3 via a wide area wireless communication network NW.

[0026] The center 3 has a function of performing data communication with the vehicle control system 2 via the wide area wireless communication network NW. The center 3 has a function of distributing updated software to each vehicle.

[0027] The vehicle control system 2 includes a software update device 4, a first electronic control unit 5 (hereinafter referred to as the first ECU 5), a second electronic control unit 6 (hereinafter referred to as the second ECU 6), a third electronic control unit 7 (hereinafter referred to as the third ECU 7), an external communication device 8, and an internal communication network 9. ECU is an abbreviation for Electronic Control Unit.

[0028] The software update device 4 has a function of updating the software of the first, second, and third ECUs 5, 6, and 7 via wireless communication using OTA. OTA stands for Over The Air. That is, the software update device 4 downloads new software distributed from the center 3 and writes it into the first, second, and third ECUs 5, 6, and 7.

[0029] The first ECU 5 controls a main parking monitoring system that monitors the surroundings of the vehicle when the vehicle is parked.

[0030] The second ECU 6 controls a sub parking monitoring system that monitors the periphery of the vehicle when the vehicle is parked.

[0031] The third ECU 7 controls, for example, an advanced driver assistance system (ADAS). ADAS is an abbreviation for Advanced Driver Assistance System.

[0032] The external vehicle communication device 8 performs data communication with the center 3 via the wide area wireless communication network NW.

[0033] The in-vehicle communication network 9 includes, for example, CAN FD and Ethernet. Ethernet is a registered trademark. CAN FD stands for Controller Area Network with Flexible Data Rate. The CAN FD connects the software update device 4 to the first, second, and third ECUs 5, 6, and 7 and the exterior-vehicle communication device 8 via a bus. The Ethernet individually connects the software update device 4 to the first, second, and third ECUs 5, 6, and 7 and the exterior-vehicle communication device 8. Note that the in-vehicle communication network 9 may be any system capable of performing data communication with the in-vehicle communication devices, and is not limited to the above-mentioned CAN FD and Ethernet. Furthermore, the in-vehicle communication network 9 may be configured to be capable of data communication using multiple communication systems, or may be configured to be capable of data communication using a single communication system.

[0034] The software update device 4 is an electronic control device mainly composed of a microcomputer including a CPU 11, a ROM 12, a RAM 13, etc. The various functions of the microcomputer are realized by the CPU 11 executing a program stored in a non-transitory tangible recording medium. In this example, the ROM 12 corresponds to the non-transitory tangible recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 11 may be configured as hardware using one or more ICs, etc. Furthermore, the number of microcomputers constituting the software update device 4 may be one or more.

[0035] The center 3 includes a control unit 21 , a communication unit 22 , and a storage unit 23 .

[0036] The control unit 21 is an electronic control device mainly composed of a microcomputer including a CPU, a ROM, a RAM, and the like.

[0037] The communication unit 22 communicates data with the vehicle control system 2 via the wide area wireless communication network NW. The storage unit 23 is a storage device for storing various data. The storage unit 23 stores software for distribution to each vehicle.

[0038] As shown in FIG. 2 , the first ECU 5 includes a first control unit 31 , a first vehicle interface 32 (hereinafter, referred to as first vehicle I / F 32 ), and a first storage unit 33 .

[0039] The first control unit 31 includes a CPU 41, a ROM 42, and a RAM 43. The various functions of the first control unit 31 are realized by the CPU 41 executing a program stored in a non-transitory physical recording medium. In this example, the ROM 42 corresponds to the non-transitory physical recording medium storing the program. Furthermore, the execution of this program results in the execution of a method corresponding to the program. Note that some or all of the functions executed by the CPU 41 may be configured as hardware using one or more ICs, etc.

[0040] The first vehicle I / F 32 is an input / output circuit for transmitting and receiving signals to and from on-board devices, sensors, etc., mounted on the vehicle. The first vehicle I / F 32 is connected to the first control unit 31.

[0041] The first storage unit 33 is a storage device for storing various data. The first storage unit 33 is connected to the first control unit 31.

[0042] The second ECU 6 includes a second control unit 51 , a second vehicle interface 52 (hereinafter, referred to as the second vehicle I / F 52 ), and a second storage unit 53 .

[0043] The second control unit 51 includes a CPU 61, a ROM 62, and a RAM 63. The various functions of the second control unit 51 are realized by the CPU 61 executing a program stored in a non-transitory physical recording medium. In this example, the ROM 62 corresponds to the non-transitory physical recording medium storing the program. Furthermore, the execution of this program results in the execution of a method corresponding to the program. Note that some or all of the functions executed by the CPU 61 may be configured as hardware using one or more ICs or the like. The second control unit 51 is connected to the first control unit 31 so as to enable data communication between the first control unit 31 and the second control unit 51.

[0044] The second vehicle I / F 52 is an input / output circuit for transmitting and receiving signals to and from on-board devices, sensors, etc., mounted on the vehicle. The second vehicle I / F 52 is connected to the second control unit 51.

[0045] The second storage unit 53 is a storage device for storing various data and is connected to the second control unit 51.

[0046] A first camera 71 , a second camera 72 , a third camera 73 and a first acceleration sensor 77 are connected to the first vehicle I / F 32 .

[0047] A fourth camera 74 , a fifth camera 75 , a sixth camera 76 and a second acceleration sensor 78 are connected to the second vehicle I / F 52 .

[0048] 3, the first camera 71 is installed at the front of the vehicle interior and continuously captures images of the situation in front of the vehicle. The first camera 71 outputs first image data generated by capturing the images.

[0049] The second camera 72 is installed at the rear of the vehicle interior and continuously captures images of the area behind the vehicle. The second camera 72 outputs second image data generated by capturing the images.

[0050] The third camera 73 is installed at the front of the vehicle interior and captures images of the interior and rear of the vehicle continuously. The third camera 73 outputs third image data generated by capturing the images.

[0051] The fourth camera 74 is installed at the front of the vehicle outside the passenger compartment of the vehicle, and continuously captures images of the situation in front of the vehicle. The fourth camera 74 outputs fourth image data generated by capturing the images.

[0052] The fifth camera 75 is installed at the rear of the vehicle outside the passenger compartment of the vehicle, and continuously captures images of the area behind the vehicle. The fifth camera 75 outputs fifth image data generated by capturing the images.

[0053] The sixth camera 76 is installed at the front of the vehicle interior and captures images of the interior of the vehicle and the rear of the vehicle continuously. The sixth camera 76 outputs sixth image data generated by capturing the images.

[0054] The first acceleration sensor 77 detects the acceleration of the vehicle and outputs a first acceleration detection signal indicative of the detection result.

[0055] The second acceleration sensor 78 detects the acceleration of the vehicle and outputs a second acceleration detection signal indicative of the detection result.

[0056] The first acceleration sensor 77 is installed outside the passenger compartment of the vehicle on the front side of the vehicle, and the second acceleration sensor 78 is installed outside the passenger compartment of the vehicle on the rear side of the vehicle.

[0057] 4, the CPU 41 executes a first operating system 81 (hereinafter referred to as the first OS 81). The first OS 81 is basic software installed in the CPU 41 for running various applications.

[0058] The CPU 41 is loaded with a first periphery monitoring application 91. The CPU 41 may be loaded with an application other than the first periphery monitoring application 91.

[0059] The first periphery monitoring application 91 has a camera control function 101 and a sensor control function 102 .

[0060] The camera control function 101 is a function that controls the start and end of shooting by the first camera 71, the second camera 72, and the third camera 73, and controls the recording of image data generated by the first camera 71, the second camera 72, and the third camera 73.

[0061] The sensor control function 102 is a function that detects a vehicle impact (for example, an impact caused by a hit-and-run accident, etc.) based on the first acceleration detection signal obtained from the first acceleration sensor 77, and notifies the driver of the occurrence of a vehicle impact.

[0062] The CPU 61 executes a second operating system 82 (hereinafter referred to as the second OS 82). The second OS 82 is basic software installed in the CPU 61 for running various applications.

[0063] The CPU 61 is loaded with a second periphery monitoring application 92. The CPU 61 may be loaded with an application other than the second periphery monitoring application 92.

[0064] The second periphery monitoring application 92 has a camera control function 111 and a sensor control function 112 .

[0065] The camera control function 111 is a function that controls the start and end of shooting by the fourth camera 74, the fifth camera 75, and the sixth camera 76, and controls the recording of image data generated by the fourth camera 74, the fifth camera 75, and the sixth camera 76.

[0066] The sensor control function 112 is a function that detects vehicle impacts (for example, impacts caused by hit-and-run accidents, etc.) based on the second acceleration detection signal obtained from the second acceleration sensor 78, and notifies the driver of the occurrence of a vehicle impact.

[0067] The first perimeter monitoring application 91 is configured to selectively transition the main parking monitoring system between a main normal mode and a main degenerate mode.

[0068] In the main normal mode, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal, it notifies the sub parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal or receives a notification of the occurrence of a vehicle impact from the sub parking monitoring system, it records the first, second, and third image data.

[0069] In the main degenerate mode, the first periphery monitoring application 91 records the first, second, and third image data when it detects a vehicle impact based on the first acceleration detection signal.

[0070] The second perimeter monitoring application 92 is configured to selectively transition the sub parking monitoring system between a sub normal mode and a sub degenerate mode.

[0071] In the sub-normal mode, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal, it notifies the main parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal or receives notification of the occurrence of a vehicle impact from the main parking monitoring system, it records the fourth, fifth, and sixth image data.

[0072] In the sub-degenerate mode, the second periphery monitoring application 92 records the fourth, fifth, and sixth image data when it detects a vehicle impact based on the second acceleration detection signal.

[0073] Next, a description will be given of the procedure of the update control process executed by the software update device 4. The update control process is a process that is repeatedly executed while the software update device 4 is in operation.

[0074] 5, the CPU 11 determines in S10 whether or not an OTA campaign notification has been received from the center 3. The OTA campaign notification is information transmitted from the center 3 to notify of an OTA software update, and includes information for identifying the ECU that is the target of the software update.

[0075] If an OTA campaign notification has not been received, the CPU 11 ends the update control process. On the other hand, if an OTA campaign notification has been received, the CPU 11 downloads software from the center 3 in S20. Note that there are two patterns: one in which the download starts after obtaining permission from the vehicle occupant, and one in which the download starts without permission from the vehicle occupant.

[0076] When the download is completed in S20, the CPU 11 determines in S30 whether the update by the software downloaded in S20 will stop the application of the main parking monitoring system (i.e., the first periphery monitoring application 91). Specifically, when updating the program of the first OS 81 or the program of the first periphery monitoring application 91, the CPU 11 determines that the update will stop the application of the main parking monitoring system.

[0077] If the update will cause the main parking monitoring system application to be stopped, the CPU 11 determines in S40 whether the update using the software downloaded in S20 will cause the sub parking monitoring system application (i.e., the second periphery monitoring application 92) to be stopped. Specifically, if the update is for the second OS 82 program or the second periphery monitoring application 92 program, the CPU 11 determines that the update will cause the sub parking monitoring system application to be stopped.

[0078] If the update does not stop the application of the sub parking monitoring system, the CPU 11 executes the OTA update of the main parking monitoring system side as the update using the software downloaded in S20 in S50, and ends the update control process. That is, the CPU 11 executes the process of rewriting the program of the first OS 81 or the program of the first perimeter monitoring application 91.

[0079] If the update in S40 is to stop the application of the sub parking monitoring system, the CPU 11 executes OTA on the main parking monitoring system side in S60 in the same manner as in S50.

[0080] Next, in S70, the CPU 11 executes an OTA update of the sub parking monitoring system using the software downloaded in S20, and then ends the update control process. That is, the CPU 11 executes a process of rewriting the program of the second OS 82 or the program of the second perimeter monitoring application 92.

[0081] Also, if in S30 the update does not cause the application of the main parking monitoring system to be stopped, the CPU 11 determines in S80, similar to S40, whether the update by the software downloaded in S20 will cause the application of the sub parking monitoring system to be stopped.

[0082] Here, if the update is to stop the application of the sub parking monitoring system, the CPU 11 executes OTA on the sub parking monitoring system side in S90 in the same manner as in S70, and ends the update control process.

[0083] On the other hand, if the update does not stop the application of the sub parking monitoring system, the CPU 11 executes normal OTA (i.e., update of software other than the programs of the first and second OSs 81 and 82 and the first and second applications 91 and 92) at S100 and terminates the update control process.

[0084] Next, a description will be given of the procedure of the first mode switching process executed by the first control unit 31 of the first ECU 5. The first mode switching process is a process that is repeatedly executed while the first ECU 5 is in operation.

[0085] When the first mode switching process is executed, the CPU 41 determines whether the main parking monitoring system is in the main normal mode at S210, as shown in Fig. 6. If the main parking monitoring system is in the main normal mode, the CPU 41 determines whether communication with the sub parking monitoring system has been interrupted at S220. If communication with the sub parking monitoring system has not been interrupted, the CPU 41 ends the first mode switching process.

[0086] On the other hand, if communication with the sub parking monitoring system has been interrupted, the CPU 41 transitions the main parking monitoring system to the main degenerate mode in S230, and ends the first mode switching process.

[0087] If the main parking monitoring system is not in the main normal mode at S210, the CPU 41 determines that the main parking monitoring system is in the main degenerate mode, and determines whether communication with the sub parking monitoring system has been restored at S240. If communication with the sub parking monitoring system has not been restored, the CPU 41 ends the first mode switching process.

[0088] On the other hand, if communication with the sub parking monitoring system is restored, the CPU 41 transitions the main parking monitoring system to the main normal mode in S250, and ends the first mode switching process.

[0089] Next, a description will be given of the procedure of the second mode switching process executed by the second control unit 51 of the second ECU 6. The second mode switching process is a process that is repeatedly executed while the second ECU 6 is in operation.

[0090] When the second mode switching process is executed, the CPU 61 determines whether the sub parking monitoring system is in the sub normal mode at S310, as shown in Fig. 7. If the sub parking monitoring system is in the sub normal mode, the CPU 61 determines whether communication with the main parking monitoring system has been interrupted at S320. If communication with the main parking monitoring system has not been interrupted, the CPU 61 ends the second mode switching process.

[0091] On the other hand, if communication with the main parking monitoring system has been interrupted, the CPU 61 transitions the sub parking monitoring system to the sub degenerate mode in S330, and ends the second mode switching process.

[0092] If the sub parking monitoring system is not in the sub normal mode at S310, the CPU 61 determines that the sub parking monitoring system is in the sub degenerate mode, and determines whether communication with the main parking monitoring system has been restored at S340. If communication with the main parking monitoring system has not been restored, the CPU 61 ends the second mode switching process.

[0093] On the other hand, if communication with the main parking monitoring system is restored, the CPU 61 transitions the sub parking monitoring system to the sub normal mode in S350, and ends the second mode switching process.

[0094] The vehicle control system 2 configured in this manner includes a first periphery monitoring device group, a first ECU 5 , a second periphery monitoring device group, and a second ECU 6 .

[0095] The first periphery monitoring device group includes a first camera 71, a second camera 72, and a third camera 73 that monitor the periphery of the vehicle. The first ECU 5 is connected to the first periphery monitoring device group. The first ECU 5 may also be directly connected to the first periphery monitoring device group.

[0096] The second periphery monitoring device group includes a fourth camera 74, a fifth camera 75, and a sixth camera 76 that monitor the periphery of the vehicle. The second ECU 6 is connected to the second periphery monitoring device group. The second ECU 6 may also be directly connected to the second periphery monitoring device group.

[0097] The first camera 71, the second camera 72 and the third camera 73 are configured to generate first image data, second image data and third image data, respectively, by monitoring the surroundings of the vehicle.

[0098] The fourth camera 74, the fifth camera 75 and the sixth camera 76 are configured to generate fourth image data, fifth image data and sixth image data, respectively, by monitoring the surroundings of the vehicle.

[0099] The first ECU 5 is equipped with a first periphery monitoring application 91 that performs first periphery monitoring, which monitors the periphery of the vehicle while the vehicle is parked, using the first, second, and third image data, and a first OS 81 that is basic software for operating the first periphery monitoring application 91.

[0100] The second ECU 6 is equipped with a second periphery monitoring application 92 capable of performing second periphery monitoring, which monitors the periphery of the vehicle while the vehicle is parked, using the fourth, fifth, and sixth image data, and a second OS 82, which is basic software for operating the second periphery monitoring application 92.

[0101] The first ECU 5 and the second ECU 6 are connected to each other so as to be able to communicate data with each other. Here, the connection between the first ECU 5 and the second ECU 6 is not limited to a direct connection. For example, the first ECU 5 and the second ECU 6 may be connected to each other so as to be able to communicate data with each other via an ECU other than the first ECU 5 and the second ECU 6.

[0102] The first ECU 5 is configured to operate in a main degenerate mode in which the first peripheral monitoring is performed without performing data communication with the second ECU 6 while the second software update is being executed in the second ECU 6, which rewrites the program of the second peripheral monitoring application 92 or the program of the second OS 82.

[0103] The second ECU 6 is configured to operate in a sub-degenerate mode in which the second peripheral monitoring is performed without performing data communication with the first ECU 5 while the first software update is being executed in the first ECU 5, which rewrites the program of the first peripheral monitoring application 91 or the program of the first OS 81.

[0104] In such a vehicle control system 2, when the operation of the first periphery monitoring application 91 is stopped because the first software update is being executed, the second periphery monitoring application 92 operates in the sub-degenerate mode. Furthermore, when the operation of the second periphery monitoring application 92 is stopped because the second software update is being executed, the first periphery monitoring application 91 operates in the main-degenerate mode. Therefore, the vehicle control system 2 can prevent a situation in which monitoring of the vehicle periphery is completely stopped due to a software update, and can prevent a period in which monitoring is stopped due to a software update.

[0105] Furthermore, the first ECU 5 is configured to operate in the main degenerate mode when data communication with the second ECU 6 is interrupted. The second ECU 6 is configured to operate in the sub degenerate mode when data communication with the first ECU 5 is interrupted. The vehicle control system 2 can transition to the main degenerate mode and the sub degenerate mode without receiving a notification of the first or second software update from outside the first and second ECUs 5 and 6. This reduces the processing load on devices installed outside the first and second ECUs 5 and 6.

[0106] Furthermore, when the first software update has not been performed in the first ECU 5 and the second software update has not been performed in the second ECU 6, the first periphery monitoring application 91 performs the first periphery monitoring using the first, second, and third image data, and the second periphery monitoring application 92 performs the second periphery monitoring using the fourth, fifth, and sixth image data. In such a vehicle control system 2, the first ECU 5 and the second ECU 6 can each independently monitor the periphery of the vehicle.

[0107] In the embodiment described above, the vehicle control system 2 corresponds to an in-vehicle system, the first camera 71, the second camera 72 and the third camera 73 correspond to a first monitoring device, the first ECU 5 corresponds to a first electronic control device, the fourth camera 74, the fifth camera 75 and the sixth camera 76 correspond to a second monitoring device, and the second ECU 6 corresponds to a second electronic control device.

[0108] Furthermore, the first, second, and third image data correspond to the first surrounding monitoring information, the fourth, fifth, and sixth image data correspond to the second surrounding monitoring information, the main degenerate mode corresponds to the first degenerate mode, and the sub degenerate mode corresponds to the second degenerate mode.

[0109] Second Embodiment A second embodiment of the present disclosure will be described below with reference to the drawings. In the second embodiment, differences from the first embodiment will be described. The same reference numerals will be used to designate common components.

[0110] The software update system 1 of the second embodiment differs from the first embodiment in that the first and second mode switching process is changed.

[0111] In addition, the software update device 4 of the second embodiment differs from the first embodiment in that when updating the program of the first OS 81 or the program of the first perimeter monitoring application 91, it is configured to send a main update notification to the second ECU 6 indicating that the software of the main parking monitoring system will be updated.

[0112] In addition, the software update device 4 of the second embodiment differs from the first embodiment in that when updating the program of the second OS 82 or the program of the second perimeter monitoring application 92, it is configured to send a sub-update notification to the first ECU 5 indicating that the software of the sub-parking monitoring system will be updated.

[0113] Next, the procedure of the first mode switching process of the second embodiment will be described.

[0114] As shown in FIG. 8, the first mode switching process of the second embodiment differs from the first embodiment in that the process of S222 is executed instead of S220.

[0115] That is, if the main parking monitoring system is in the main normal mode at S210, the CPU 41 determines at S222 whether or not a sub-update notification has been received from the software update device 4. Here, if a sub-update notification has not been received, the CPU 41 ends the first mode switching process.

[0116] On the other hand, if a sub-update notification has been received, the CPU 41 proceeds to S230.

[0117] Next, the procedure of the second mode switching process of the second embodiment will be described.

[0118] As shown in FIG. 9, the second mode switching process of the second embodiment differs from the first embodiment in that the process of S322 is executed instead of S320.

[0119] That is, if the sub parking monitoring system is in the sub normal mode at S310, the CPU 61 determines at S322 whether or not a main update notification has been received from the software update device 4. Here, if a main update notification has not been received, the CPU 61 ends the second mode switching process.

[0120] On the other hand, if a main update notification has been received, the CPU 61 proceeds to S330.

[0121] In the vehicle control system 2 configured in this manner, the first ECU 5 is configured to operate in the main degenerate mode when it receives a sub-update notification from the software update device 4 indicating that a second software update will be performed. The second ECU 6 is configured to operate in the sub-degenerate mode when it receives a main update notification from the software update device 4 indicating that a first software update will be performed.

[0122] Such a vehicle control system 2 can transition to main degeneration mode or sub degeneration mode by having the first and second ECUs 5 and 6 receive a sub update notification or a main update notification without having the first and second ECUs 5 and 6 perform the process of determining whether a communication interruption has occurred, thereby reducing the processing load on the first and second ECUs 5 and 6.

[0123] In the embodiment described above, the software update device 4 corresponds to an external device to the first and second electronic control units, the main update notification corresponds to the first update notification, and the sub-update notification corresponds to the second update notification.

[0124] Third Embodiment A third embodiment of the present disclosure will be described below with reference to the drawings. In the third embodiment, differences from the first embodiment will be described. The same reference numerals will be used to designate common components.

[0125] The software update system 1 of the third embodiment differs from the first embodiment in that the first and second mode switching process is changed.

[0126] In addition, the first ECU 5 of the third embodiment differs from the first embodiment in that when updating the program of the first OS 81 or the program of the first perimeter monitoring application 91, it is configured to send a main update notification to the second ECU 6 indicating that the software of the main parking monitoring system will be updated.

[0127] In addition, the second ECU 6 of the third embodiment differs from the first embodiment in that when updating the program of the second OS 82 or the program of the second perimeter monitoring application 92, it is configured to send a sub-update notification to the first ECU 5 indicating that the software of the sub-parking monitoring system will be updated.

[0128] Next, the procedure of the first mode switching process of the third embodiment will be described.

[0129] As shown in FIG. 10, the first mode switching process of the third embodiment differs from the first embodiment in that the process of S224 is executed instead of S220.

[0130] That is, if the main parking monitoring system is in the main normal mode at S210, the CPU 41 determines at S224 whether or not a sub-update notification has been received from the second ECU 6. If a sub-update notification has not been received, the CPU 41 ends the first mode switching process.

[0131] On the other hand, if a sub-update notification has been received, the CPU 41 proceeds to S230.

[0132] Next, the procedure of the second mode switching process of the third embodiment will be described.

[0133] As shown in FIG. 11, the second mode switching process of the third embodiment differs from the first embodiment in that the process of S324 is executed instead of S320.

[0134] That is, if the sub parking monitoring system is in the sub normal mode at S310, the CPU 61 determines at S324 whether or not a main update notification has been received from the first ECU 5. If the main update notification has not been received, the CPU 61 ends the second mode switching process.

[0135] On the other hand, if a main update notification has been received, the CPU 61 proceeds to S330.

[0136] In the vehicle control system 2 configured as described above, the first ECU 5 is configured to transmit a main update notification indicating that a first software update will be performed before performing a first software update. The second ECU 6 is configured to transmit a sub update notification indicating that a second software update will be performed before performing a second software update. The first ECU 5 is configured to operate in a main degenerate mode when receiving the sub update notification from the second ECU 6. The second ECU 6 is configured to operate in a sub degenerate mode when receiving the main update notification from the first ECU 5.

[0137] Such a vehicle control system 2 can transition to main degeneration mode or sub degeneration mode by having the first and second ECUs 5 and 6 send and receive sub update notifications or main update notifications without having the first and second ECUs 5 and 6 perform the process of determining whether a communication interruption has occurred, thereby reducing the processing load on the first and second ECUs 5 and 6 and the software update device 4.

[0138] Fourth Embodiment A fourth embodiment of the present disclosure will be described below with reference to the drawings. In the fourth embodiment, differences from the first embodiment will be described. The same reference numerals will be used to designate common components.

[0139] The software update system 1 of the fourth embodiment differs from the first embodiment in that the main normal mode and the sub normal mode are changed.

[0140] That is, in the main normal mode of the fourth embodiment, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal, it notifies the sub parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal or receives notification of the occurrence of a vehicle impact from the sub parking monitoring system, it records the first, second, and third image data, and records the fourth, fifth, and sixth image data transferred from the sub parking monitoring system.

[0141] In the sub-normal mode of the fourth embodiment, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal, it notifies the main parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal or receives a notification of the occurrence of a vehicle impact from the main parking monitoring system, it transfers the fourth, fifth, and sixth image data to the main parking monitoring system.

[0142] In the vehicle control system 2 configured in this manner, when the first software update has not been performed in the first ECU 5 and the second software update has not been performed in the second ECU 6, the second ECU 6 transmits the fourth, fifth, and sixth image data to the first ECU 5, and the first periphery monitoring application 91 of the first ECU 5 performs the first periphery monitoring using the first, second, and third image data and the fourth, fifth, and sixth image data. In such a vehicle control system 2, both the first ECU 5 and the second ECU 6 can monitor the periphery of the vehicle even if the second ECU 6 does not have a memory with a capacity sufficient to store the fourth, fifth, and sixth image data.

[0143] Fifth Embodiment A fifth embodiment of the present disclosure will be described below with reference to the drawings. In the fifth embodiment, differences from the first embodiment will be described. The same reference numerals will be used to designate common components.

[0144] As shown in FIG. 12, the software update system 1 of the fifth embodiment differs from the first embodiment in that the first periphery monitoring application 91 further has an image analysis function 103 .

[0145] The image analysis function 103 is a function that performs image analysis using image data generated by the first camera 71, the second camera 72, and the third camera 73. By analyzing the image data, it is possible to detect, for example, a person present around the vehicle. This allows the first perimeter monitoring application 91 to determine that a person who has been present around the vehicle for a certain period of time or more is a suspicious person.

[0146] The software update system 1 of the fifth embodiment also differs from the first embodiment in that the main normal mode, main degenerate mode, sub normal mode, and sub degenerate mode are changed.

[0147] That is, in the main normal mode of the fifth embodiment, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal, it notifies the sub-parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal or when it receives notification of the occurrence of a vehicle impact from the sub-parking monitoring system, it records the first, second, and third image data and performs image analysis using the first, second, and third image data. Furthermore, the first periphery monitoring application 91 performs image analysis using the fourth, fifth, and sixth image data transferred from the sub-parking monitoring system.

[0148] In the main degenerate mode of the fifth embodiment, when the first surroundings monitoring application 91 detects a vehicle impact based on the first acceleration detection signal, it records the first, second, and third image data and performs image analysis using the first, second, and third image data.

[0149] In the sub-normal mode of the fifth embodiment, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal, it notifies the main parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal or receives notification of the occurrence of a vehicle impact from the main parking monitoring system, it records the fourth, fifth, and sixth image data and transfers the fourth, fifth, and sixth image data to the main parking monitoring system.

[0150] In the sub-degenerate mode of the fifth embodiment, the second periphery monitoring application 92 records the fourth, fifth, and sixth image data when it detects a vehicle impact based on the second acceleration detection signal.

[0151] In the vehicle control system 2 configured in this manner, the first periphery monitoring application 91 of the first ECU 5 has an image analysis function 103 that analyzes image data included in the first, second, and third image data and the fourth, fifth, and sixth image data. Such a vehicle control system 2 not only records image data but also monitors the periphery of the vehicle using the results of analyzing the image data.

[0152] Sixth Embodiment A sixth embodiment of the present disclosure will be described below with reference to the drawings. In the sixth embodiment, differences from the fifth embodiment will be described. The same reference numerals will be used to designate common components.

[0153] The software update system 1 of the sixth embodiment differs from the first embodiment in that the main normal mode and the sub normal mode are changed.

[0154] That is, in the main normal mode of the sixth embodiment, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal, it notifies the sub-parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the first periphery monitoring application 91 detects a vehicle impact based on the first acceleration detection signal or when it receives notification of the occurrence of a vehicle impact from the sub-parking monitoring system, it records the first, second, and third image data and performs image analysis using the first, second, and third image data. Furthermore, the first periphery monitoring application 91 records the fourth, fifth, and sixth image data transferred from the sub-parking monitoring system and performs image analysis using the fourth, fifth, and sixth image data transferred from the sub-parking monitoring system.

[0155] In the sub-normal mode of the sixth embodiment, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal, it notifies the main parking monitoring system of the occurrence of the vehicle impact. Furthermore, when the second periphery monitoring application 92 detects a vehicle impact based on the second acceleration detection signal or receives a notification of the occurrence of a vehicle impact from the main parking monitoring system, it transfers the fourth, fifth, and sixth image data to the main parking monitoring system.

[0156] In the vehicle control system 2 configured in this manner, when the first software update has not been performed in the first ECU 5 and the second software update has not been performed in the second ECU 6, the second ECU 6 transmits the fourth, fifth, and sixth image data to the first ECU 5, and the first periphery monitoring application 91 of the first ECU 5 performs the first periphery monitoring using the first, second, and third image data and the fourth, fifth, and sixth image data. In such a vehicle control system 2, both the first ECU 5 and the second ECU 6 can monitor the periphery of the vehicle even if the second ECU 6 does not have a memory with a capacity sufficient to store the fourth, fifth, and sixth image data.

[0157] The first periphery monitoring application 91 of the first ECU 5 has an image analysis function 103 that analyzes image data included in the first, second, and third image data and the fourth, fifth, and sixth image data. Such a vehicle control system 2 not only records image data but also monitors the periphery of the vehicle using the analysis results of the image data.

[0158] Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modifications.

[0159] [Variation 1] In the above embodiment, the first, second, and third cameras 71, 72, and 73 are directly connected to the first ECU 5, and the fourth, fifth, and sixth cameras 74, 75, and 76 are directly connected to the second ECU 6. However, the first, second, and third cameras 71, 72, and 73 may be directly connected to an ECU other than the first and second ECUs 5 and 6 (hereinafter, "other ECUs"), and the first ECU 5 may be directly connected to the other ECUs, so that the first ECU 5 acquires the first, second, and third image data. Similarly, the fourth, fifth, and sixth cameras 74, 75, and 76 may be directly connected to an ECU other than the first and second ECUs 5 and 6, and the second ECU 6 may be directly connected to the other ECUs, so that the second ECU 6 acquires the fourth, fifth, and sixth image data. In this case, the other ECUs correspond to a group of perimeter monitoring devices that monitor the perimeter of the vehicle.

[0160] The first and second control units 31 and 51 and the method thereof described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to execute one or more functions embodied in a computer program. Alternatively, the first and second control units 31 and 51 and the method thereof described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the first and second control units 31 and 51 and the method thereof described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to execute one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible recording medium. The method for implementing the functions of each unit included in the first and second control units 31 and 51 does not necessarily need to include software; all of the functions may be implemented using one or more hardware.

[0161] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Furthermore, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, part of the configuration of the above embodiments may be omitted. Furthermore, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0162] In addition to the first ECU 5 and second ECU 6 described above, the present disclosure can also be realized in various forms, such as a system having the first ECU 5 and second ECU 6 as components, a program for causing a computer to function as the first ECU 5 and second ECU 6, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a control method.[Technical Ideas Disclosed in the Present Specification] [Item 1] An in-vehicle system (2) mounted on a vehicle, comprising: a first periphery monitoring device group including at least one first monitoring device (71, 72, 73) that monitors the periphery of the vehicle; a first electronic control unit (5) connected to the first periphery monitoring device group; a second periphery monitoring device group including at least one second monitoring device (74, 75, 76) that monitors the periphery of the vehicle; and a second electronic control unit (6) connected to the second periphery monitoring device group, wherein the at least one first monitoring device is configured to generate first periphery monitoring information by monitoring the periphery of the vehicle, and the at least one second monitoring device is configured to generate second periphery monitoring information by monitoring the periphery of the vehicle, and the first electronic control unit is equipped with a first periphery monitoring application (91) that performs first periphery monitoring to monitor the periphery of the vehicle while the vehicle is parked using the first periphery monitoring information, and a first operating system (81) that is basic software for operating the first periphery monitoring application, The second electronic control unit is equipped with a second periphery monitoring application (92) capable of performing second periphery monitoring, which monitors the periphery of the vehicle while the vehicle is parked, using the second periphery monitoring information, and a second operating system (82) which is basic software for operating the second periphery monitoring application; the first electronic control unit and the second electronic control unit are connected to each other so that data communication is possible; the first electronic control unit is configured to operate in a first degenerate mode in which the first periphery monitoring is performed without data communication with the second electronic control unit while a second software update is being executed in the second electronic control unit to rewrite the program of the second periphery monitoring application or the program of the second operating system; and the second electronic control unit is configured to operate in a second degenerate mode in which the second periphery monitoring is performed without data communication with the first electronic control unit while a first software update is being executed in the first electronic control unit to rewrite the program of the first periphery monitoring application or the program of the first operating system.

[0163] [Item 2] The in-vehicle system according to Item 1, wherein the first electronic control unit is configured to operate in the first degenerate mode when data communication with the second electronic control unit is interrupted, and the second electronic control unit is configured to operate in the second degenerate mode when data communication with the first electronic control unit is interrupted.

[0164] [Item 3] The in-vehicle system according to Item 1, wherein the first electronic control unit is configured to operate in the first degenerate mode when a second update notification indicating that the second software update will be performed is received from outside the first electronic control unit, and the second electronic control unit is configured to operate in the second degenerate mode when a first update notification indicating that the first software update will be performed is received from outside the second electronic control unit.

[0165] [Item 4] The in-vehicle system according to Item 1, wherein the first electronic control unit is configured to transmit a first update notification indicating that the first software update will be performed before performing the first software update, the second electronic control unit is configured to transmit a second update notification indicating that the second software update will be performed before performing the second software update, the first electronic control unit is configured to operate in the first degenerate mode when receiving the second update notification from the second electronic control unit, and the second electronic control unit is configured to operate in the second degenerate mode when receiving the first update notification from the first electronic control unit.

[0166] [Item 5] The in-vehicle system according to any one of items 1 to 4, wherein, when the first software update has not been performed in the first electronic control unit and the second software update has not been performed in the second electronic control unit, the first periphery monitoring application performs the first periphery monitoring using the first periphery monitoring information, and the second periphery monitoring application performs the second periphery monitoring using the second periphery monitoring information.

[0167] [Item 6] The in-vehicle system according to any one of Items 1 to 4, wherein, when the first software update has not been performed in the first electronic control unit and the second software update has not been performed in the second electronic control unit, the second electronic control unit transmits the second periphery monitoring information to the first electronic control unit, and the first periphery monitoring application of the first electronic control unit performs the first periphery monitoring using the first periphery monitoring information and the second periphery monitoring information.

[0168] [Item 7] The in-vehicle system according to any one of items 1 to 6, wherein the first periphery monitoring application of the first electronic control unit has an image analysis function that analyzes image data included in the first periphery monitoring information and the second periphery monitoring information.

[0169] [Item 8] A control method executed in an in-vehicle system (2) mounted on a vehicle, the in-vehicle system comprising: a first periphery monitoring device group including at least one first monitoring device (71, 72, 73) that monitors the periphery of the vehicle; a first electronic control unit (5) connected to the first periphery monitoring device group; a second periphery monitoring device group including at least one second monitoring device (74, 75, 76) that monitors the periphery of the vehicle; and a second electronic control unit (6) connected to the second periphery monitoring device group, wherein the at least one first monitoring device is configured to generate first periphery monitoring information by monitoring the periphery of the vehicle, and the at least one second monitoring device is configured to generate second periphery monitoring information by monitoring the periphery of the vehicle, and the first electronic control unit is equipped with a first periphery monitoring application (91) that performs first periphery monitoring that monitors the periphery of the vehicle while the vehicle is parked using the first periphery monitoring information, and a first operating system (81) that is basic software for operating the first periphery monitoring application, The second electronic control unit is equipped with a second periphery monitoring application (92) capable of performing second periphery monitoring that monitors the periphery of the vehicle while the vehicle is parked using the second periphery monitoring information, and a second operating system (82) that is basic software for operating the second periphery monitoring application; the first electronic control unit and the second electronic control unit are connected to each other so that data communication is possible; the first electronic control unit operates in a first degenerate mode that performs the first periphery monitoring without performing data communication with the second electronic control unit while a second software update is being executed in the second electronic control unit to rewrite the program of the second periphery monitoring application or the program of the second operating system; and the second electronic control unit operates in a second degenerate mode that performs the second periphery monitoring without performing data communication with the first electronic control unit while a first software update is being executed in the first electronic control unit to rewrite the program of the first periphery monitoring application or the program of the first operating system.

Claims

1. An in-vehicle system (2) mounted on a vehicle, comprising: a first periphery monitoring device group including at least one first monitoring device (71, 72, 73) that monitors the periphery of the vehicle; a first electronic control unit (5) connected to the first periphery monitoring device group; a second periphery monitoring device group including at least one second monitoring device (74, 75, 76) that monitors the periphery of the vehicle; and a second electronic control unit (6) connected to the second periphery monitoring device group, wherein the at least one first monitoring device is configured to generate first periphery monitoring information by monitoring the periphery of the vehicle, and the at least one second monitoring device is configured to generate second periphery monitoring information by monitoring the periphery of the vehicle, and the first electronic control unit is equipped with a first periphery monitoring application (91) that uses the first periphery monitoring information to perform first periphery monitoring that monitors the periphery of the vehicle while the vehicle is parked, and a first operating system (81) that is basic software for operating the first periphery monitoring application, The second electronic control unit is equipped with a second periphery monitoring application (92) capable of performing second periphery monitoring, which monitors the periphery of the vehicle while the vehicle is parked, using the second periphery monitoring information, and a second operating system (82) which is basic software for operating the second periphery monitoring application; the first electronic control unit and the second electronic control unit are connected to each other so that data communication is possible; the first electronic control unit is configured to operate in a first degenerate mode in which the first periphery monitoring is performed without data communication with the second electronic control unit while a second software update is being executed in the second electronic control unit to rewrite the program of the second periphery monitoring application or the program of the second operating system; and the second electronic control unit is configured to operate in a second degenerate mode in which the second periphery monitoring is performed without data communication with the first electronic control unit while a first software update is being executed in the first electronic control unit to rewrite the program of the first periphery monitoring application or the program of the first operating system.

2. An in-vehicle system as described in claim 1, wherein the first electronic control unit is configured to operate in the first degenerate mode when data communication with the second electronic control unit is interrupted, and the second electronic control unit is configured to operate in the second degenerate mode when data communication with the first electronic control unit is interrupted.

3. An in-vehicle system as described in claim 1, wherein the first electronic control unit is configured to operate in the first degenerate mode when it receives a second update notification from outside the first electronic control unit indicating that the second software update will be performed, and the second electronic control unit is configured to operate in the second degenerate mode when it receives a first update notification from outside the second electronic control unit indicating that the first software update will be performed.

4. An in-vehicle system as described in claim 1, wherein the first electronic control unit is configured to send a first update notification indicating that the first software update will be performed before performing the first software update, the second electronic control unit is configured to send a second update notification indicating that the second software update will be performed before performing the second software update, the first electronic control unit is configured to operate in the first degenerate mode when receiving the second update notification from the second electronic control unit, and the second electronic control unit is configured to operate in the second degenerate mode when receiving the first update notification from the first electronic control unit.

5. An in-vehicle system as set forth in any one of claims 1 to 4, wherein, when the first software update has not been performed in the first electronic control unit and the second software update has not been performed in the second electronic control unit, the first periphery monitoring application performs the first periphery monitoring using the first periphery monitoring information, and the second periphery monitoring application performs the second periphery monitoring using the second periphery monitoring information.

6. An in-vehicle system as set forth in any one of claims 1 to 4, wherein, when the first software update has not been performed in the first electronic control unit and the second software update has not been performed in the second electronic control unit, the second electronic control unit transmits the second periphery monitoring information to the first electronic control unit, and the first periphery monitoring application of the first electronic control unit performs the first periphery monitoring using the first periphery monitoring information and the second periphery monitoring information.

7. An in-vehicle system according to any one of claims 1 to 4, wherein the first periphery monitoring application of the first electronic control unit has an image analysis function for analyzing image data included in the first periphery monitoring information and the second periphery monitoring information.

8. A control method executed by an in-vehicle system (2) mounted on a vehicle, the in-vehicle system comprising: a first periphery monitoring device group including at least one first monitoring device (71, 72, 73) that monitors the periphery of the vehicle; a first electronic control unit (5) connected to the first periphery monitoring device group; a second periphery monitoring device group including at least one second monitoring device (74, 75, 76) that monitors the periphery of the vehicle; and a second electronic control unit (6) connected to the second periphery monitoring device group, wherein the at least one first monitoring device is configured to generate first periphery monitoring information by monitoring the periphery of the vehicle; and the at least one second monitoring device is configured to generate second periphery monitoring information by monitoring the periphery of the vehicle; the first electronic control unit is equipped with a first periphery monitoring application (91) that uses the first periphery monitoring information to perform first periphery monitoring that monitors the periphery of the vehicle while the vehicle is parked, and a first operating system (81) that is basic software for operating the first periphery monitoring application, The second electronic control unit is equipped with a second periphery monitoring application (92) capable of performing second periphery monitoring that monitors the periphery of the vehicle while the vehicle is parked using the second periphery monitoring information, and a second operating system (82) that is basic software for operating the second periphery monitoring application; the first electronic control unit and the second electronic control unit are connected to each other so that data communication is possible; the first electronic control unit operates in a first degenerate mode that performs the first periphery monitoring without performing data communication with the second electronic control unit while a second software update is being executed in the second electronic control unit to rewrite the program of the second periphery monitoring application or the program of the second operating system; and the second electronic control unit operates in a second degenerate mode that performs the second periphery monitoring without performing data communication with the first electronic control unit while a first software update is being executed in the first electronic control unit to rewrite the program of the first periphery monitoring application or the program of the first operating system.

Images