JP7587909B2 - Control Systems and Control Devices - Google Patents

Description

This disclosure relates to a control system and a control device.

Recently, the technology for autonomous driving of vehicles has been developing, and a technology for switching between autonomous driving and manual driving by a driver is known. Furthermore, during autonomous driving, the amount of processing by the CPU (Central Processing Unit) of the ECU (Electronic Control Unit) generally increases. Furthermore, in order to update software processed by the ECU, a technology for wirelessly rewriting software using OTA (Over the Air) technology has been developed. As a technology for updating software installed in such a vehicle's ECU, a technology has been disclosed in which, when software related to an autonomous driving function or a driving assistance function needs to be updated, the operation of the autonomous driving function or the driving assistance function is restricted, and the software update is prioritized (for example, Patent Document 1).

Patent No. 6569771

You may want to prioritize continued use of autonomous driving or driver assistance features over software updates.

The purpose of this disclosure is to provide a control system and a control device that enable autonomous driving without restricting functionality.

The control system according to the present disclosure includes a detection unit, a rewrite management unit, a suppression request unit, and an operation control unit. The detection unit detects a first switching command that instructs switching to automatic operation. The rewrite management unit controls a software update process. When the detection unit detects the first switching command, the suppression request unit sends an update suppression request for suppressing the software update to the rewrite management unit that controls the software update process. In response to the update suppression request, when the suppression request unit receives a first response from the rewrite management unit indicating that the software update has been suppressed, the operation control unit requests at least one execution unit that executes automatic operation control to start automatic operation. When the rewrite management unit receives the update suppression request, if the software is being updated, it sends an update control command to at least one execution unit to interrupt the software update, and when it receives a third response from the at least one execution unit indicating that the interruption has been completed, it sends the first response to the suppression request unit.

The control system and control device disclosed herein enable autonomous driving without restricting functionality.

FIG. 1 is a diagram showing an example of an overall configuration of a vehicle according to a first embodiment. FIG. 2 is a diagram illustrating an example of a hardware configuration of the vehicle control device according to the first embodiment. FIG. 3 is a diagram illustrating an example of a functional block configuration of the vehicle control device according to the first embodiment. FIG. 4 is a diagram illustrating another example of the configuration of functional blocks of the vehicle control device according to the first embodiment. FIG. 5 is a flowchart showing an example of an operation flow of the control request unit of the vehicle control device according to the first embodiment when switching from manual driving to automatic driving. FIG. 6 is a flowchart showing an example of an operation flow of the control request unit of the vehicle control device according to the first embodiment when switching from automatic driving to manual driving. FIG. 7 is a flowchart illustrating an example of an operation flow of the rewrite management unit of the vehicle control device according to the first embodiment when switching from manual driving to automatic driving. FIG. 8 is a flowchart showing an example of the flow of operations of the rewrite management unit of the vehicle control device according to the first embodiment when switching from automatic driving to manual driving. FIG. 9 is a flowchart showing an example of a flow of a software update operation of the execution unit of the vehicle control device according to the first embodiment. FIG. 10 is a flowchart showing an example of a flow of the automatic/manual switching operation of the execution unit of the vehicle control device according to the first embodiment. FIG. 11 is a diagram illustrating an example of a functional block configuration of a vehicle control device according to the second embodiment. FIG. 12 is a flowchart showing an example of the flow of operations of the rewrite management unit of the vehicle control device according to the second embodiment when switching from manual driving to automatic driving. FIG. 13 is a flowchart showing an example of the flow of operations of the rewrite management unit of the vehicle control device according to the second embodiment when switching from automatic driving to manual driving. FIG. 14 is a flowchart showing an example of the flow of operations of the control request unit of the vehicle control device according to the third embodiment when switching from manual driving to automatic driving. FIG. 15 is a flowchart showing an example of the flow of operations of the rewrite management unit of the vehicle control device according to the third embodiment when switching from manual driving to automatic driving.

Below, we will explain embodiments of the control system and control device according to the present disclosure with reference to the drawings.

[First embodiment]
(Overall vehicle configuration)
Fig. 1 is a diagram showing an example of the overall configuration of a vehicle according to the first embodiment. The overall configuration of a vehicle 1 according to the present embodiment will be described with reference to Fig. 1 .

As shown in FIG. 1, the vehicle 1 includes a body 2, wheels 3F, and wheels 3R. The wheels 3F are a pair of front wheels that are installed on the front side of the body 2 and contact the road surface. The wheels 3R are a pair of rear wheels that are installed on the rear side of the body 2 and contact the road surface. The vehicle 1 can travel using a pair of wheels 3F and a pair of wheels 3R that are arranged along a predetermined direction. In this case, the predetermined direction in which the wheels 3F and wheels 3R are arranged becomes the direction of movement of the vehicle 1, and the vehicle can move forward or backward by switching gears, etc. Note that when referring to any of the wheels 3F and wheels 3R, or when referring to them collectively, they will simply be referred to as "wheels 3".

As shown in FIG. 1, the vehicle 1 also includes a seat 4, a vehicle drive unit 5, imaging units 6a and 6b, door mirrors 7L and 7R, a rear seat 8, a rearview mirror 9, an engine switch 10a, an automatic driving changeover switch 10b, a steering wheel 11, a shift lever 12, a parking brake 13, a door lock device 14, a display device 15, a speaker 19, a vehicle control device 20, and a temperature sensor 21.

Seat 4 is provided in the vehicle cabin of vehicle 1 and serves as a driver's seat for the driver of vehicle 1. While seated in seat 4, the driver can steer vehicle 1 by operating steering wheel 11 and an accelerator pedal and a brake pedal (not shown).

The vehicle drive unit 5 is a drive device mounted on the vehicle 1. The vehicle drive unit 5 is, for example, an engine, a motor, a drive unit for the wheels 3, etc.

The imaging unit 6a is a camera provided in the front part of the vehicle 1 and captures images of the area in front of the vehicle 1. The imaging unit 6b is a camera provided in the rear part of the vehicle 1 and captures images of the area behind the vehicle 1. As described below, the imaging units 6a and 6b are monocular cameras or stereo cameras that can detect the position, distance, speed, etc. of other vehicles. The imaging units 6a and 6b are used, for example, to grasp the surrounding situation when the vehicle 1 performs autonomous driving. Note that when referring to any imaging unit among the imaging units 6a and 6b, or when referring to them collectively, they will simply be referred to as "imaging unit 6".

The door mirror 7L is an exterior rear-view mirror attached to the front of the left door of the vehicle body 2, for viewing the area to the left rear. The rear-view mirror 7R is an exterior rear-view mirror attached to the front of the right door of the vehicle body 2, for viewing the area to the right rear. Note that when referring to any of the door mirrors 7L and 7R, or when referring to them collectively, they will be referred to simply as "door mirror 7." Door mirrors may also be referred to as side mirrors, etc. Also, instead of the door mirror 7, a fender mirror attached to the front end of the hood of the vehicle body 2 may be installed.

The rear seat 8 is provided at the rear of the vehicle interior and is a seat for passengers other than the driver of the vehicle 1.

The room mirror 9 is an interior rear-view mirror that is installed on the ceiling above the windshield and allows the driver to see behind and to the sides of the vehicle. The room mirror is also called a back mirror.

The engine switch 10a is a switch that the driver operates when starting the engine of the vehicle 1. The engine switch 10a is also called an ignition switch. When the driver operates the engine switch 10a, the vehicle 1 enters an engine start or engine stop state. In addition, the operation of the engine switch 10a controls the power supply to electronic devices installed in the vehicle 1.

The automatic driving changeover switch 10b is a switch for switching the driving state of the vehicle 1 between automatic driving and manual driving. The automatic driving changeover switch 10b is an example of an "operation unit."

The steering wheel 11 is a steering wheel for steering the vehicle 1 and is installed on the dashboard in front of the seat 4.

The shift lever 12 is a lever that the driver operates when changing the shift position. The movable range of the shift lever 12 includes, for example, a parking position, a reverse position, a neutral position, and a drive position. When the shift lever 12 is in the parking position, the vehicle 1 is in a so-called parked state in which the power of the engine is not transmitted to the wheels 3. When the shift lever 12 is in the reverse position, the vehicle 1 is in a state in which it can move backward. When the shift lever 12 is in the drive position, the vehicle 1 is in a state in which it can move forward.

The parking brake 13 is one of the brake mechanisms of the vehicle 1. The parking brake 13 is a manual braking mechanism that allows the driver to manually stop the movement of the vehicle 1. When the parking brake 13 is applied, the movement of the vehicle 1 is stopped and the vehicle is in a parked state. When the parking brake 13 is released, the vehicle 1 is able to move. The parking brake is also called a side brake.

The door lock device 14 is a device that switches the doors of the vehicle 1 between a locked state and an unlocked state. For example, the doors of the vehicle 1 can be switched between a locked state and an unlocked state from outside the vehicle 1 using a key for the vehicle 1 or the like.

The display device 15 is a display device such as an LCD (Liquid Crystal Display) or an OELD (Organic Electro-Luminescent Display) that is installed on the dashboard in front of the seat 4. The display device 15 displays various information such as road guidance, weather forecasts, driving assistance displays, and displays indicating that the vehicle has switched to automatic or manual driving. The display device 15 may have an image display function as well as an audio output function and an input function.

The audio output function of the display device 15 may be realized by the speaker 19. The display device 15 may also be configured as a touch panel having an input function for accepting operational input by the user. The display device 15 may also include a navigation device having a location information acquisition function and a route search function using map information.

The speaker 19 is a device that outputs audio. For example, the speaker 19 outputs audio indicating that the driving mode has switched to automatic or manual driving, audio of driving instructions for driving assistance, etc.

The vehicle control device 20 is an ECU (Electronic Control Unit) or an OBU (On Board Unit) that controls various operations of the vehicle 1. The vehicle control device 20 is a device that not only controls the driving control function and driving assistance function, for example, but also controls operations based on various functions provided in the vehicle 1 as a whole.

The temperature sensor 21 is a sensor that detects the internal temperature or the ambient temperature of the vehicle control device 20. The temperature sensor 21 is installed, for example, inside or near the vehicle control device 20. The temperature sensor 21 corresponds to a "temperature detection unit." Note that, if the CPU 101 described below is a SoC, the temperature sensor 21 may be built into the SoC.

(Hardware configuration of the vehicle control device)
2 is a diagram showing an example of a hardware configuration of the vehicle control device according to the first embodiment. The hardware configuration of the vehicle control device 20 according to the present embodiment will be described with reference to FIG.

As shown in FIG. 2, the vehicle control device 20 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, a ROM (Read Only Memory) 103, an imaging I/F 104, a display I/F 105, a GPS (Global Positioning System) I/F 106, a vehicle speed I/F 107, a communication I/F 108, an audio I/F 109, an input I/F 110, and a sensor I/F 111. The CPU 101, RAM 102, ROM 103, imaging I/F 104, display I/F 105, GPS I/F 106, vehicle speed I/F 107, communication I/F 108, audio I/F 109, input I/F 110, and sensor I/F 111 are connected to one another so as to enable data communication via a bus 112. Note that the bus 112 is not limited to a form in which all components are connected as shown in FIG. 2, and each component may be connected to the CPU 101 via a bus, for example.

The CPU 101 is a calculation device that controls the entire vehicle control device 20. The RAM 102 is a volatile storage device that serves as a work area for processing by the CPU 101. The ROM 103 is a non-volatile storage device that stores the control program and various data of the vehicle control device 20.

The concept of CPU101 includes a micro processing unit (MPU), a micro controller unit (MCU), and a system on a chip (SoC). CPU101 may include two or more of an MPU, an MCU, and a SoC.

The imaging I/F 104 is an interface for receiving images captured by the imaging units 6a and 6b. The imaging I/F 104 continuously receives the images captured by the imaging units 6a and 6b as frame images, thereby acquiring them as a moving image.

The display I/F 105 is an interface for transmitting various display data to the display device 15.

The GPS I/F 106 is an interface for receiving position information received by a GPS sensor 16 installed in the vehicle 1. The position information received by the GPS sensor 16 is, for example, a GPS signal. The vehicle speed I/F 107 is an interface for receiving speed information from a vehicle speed sensor 17 that detects the vehicle speed of the vehicle 1. The vehicle speed sensor 17 is installed, for example, near the wheels 3, and generates a vehicle speed pulse that indicates the rotational speed or number of rotations of the wheels 3.

The communication I/F 108 is an interface for transmitting and receiving data to and from a communication device 18 installed in the vehicle 1. The communication device 18 performs data communication with an external device such as a server via wireless communication. This allows the communication I/F 108 to perform data communication with the external device via the communication device 18.

The audio I/F 109 is an interface for outputting audio data to a speaker 19 installed in the vehicle 1.

The input I/F 110 is an interface for inputting input data and operation signals from various input devices to the vehicle control device 20. For example, the automatic driving changeover switch 10b is connected to the input I/F 110, and the input I/F 110 is an interface for receiving a command to switch to automatic driving or manual driving from the automatic driving changeover switch 10b.

The sensor I/F 111 is an interface for inputting detection signals or detection data from various sensors arranged in the vehicle 1 to the vehicle control device 20. For example, a temperature sensor 21 is connected to the sensor I/F 111, and the sensor I/F 111 inputs the internal temperature or ambient temperature of the vehicle control device 20 detected by the temperature sensor 21 to the vehicle control device 20.

Note that the hardware configuration of the vehicle control device 20 shown in FIG. 2 is an example, and it is not necessary to include all of the components shown in FIG. 2, or it may include other components.

(Configuration and operation of functional blocks of vehicle control device)
Fig. 3 is a diagram showing an example of the configuration of functional blocks of the vehicle control device according to the first embodiment. Fig. 4 is a diagram showing another example of the configuration of functional blocks of the vehicle control device according to the first embodiment. The configuration and operation of the functional blocks of the vehicle control device 20 according to this embodiment will be described with reference to Figs. 3 and 4.

As shown in FIG. 3, the vehicle control device 20 has a switch detection unit 201, a control request unit 202, a rewrite management unit 203, an execution unit 204, and an output control unit 205.

The switch detection unit 201 is a functional unit that detects a command to switch from manual operation to automatic operation, or a command to switch from automatic operation to manual operation, from the automatic operation changeover switch 10b. The switch detection unit 201 corresponds to a "detection unit." The switch detection unit 201 is realized, for example, by the input I/F 110 and the CPU 101 shown in FIG. 2 executing a program.

The command to switch to automatic or manual driving detected by the switch detection unit 201 is not limited to being detected from the automatic driving changeover switch 10b, and may be detected, for example, based on the occurrence of a specified event. The switch detection unit 201 may detect the switch command when, for example, a malfunction occurs in the operation of the vehicle control device 20 or a fault occurs in the driving operation of the vehicle 1. The switch detection unit 201 may detect the switch command when, for example, an event occurs that requires risk avoidance without manual driving, or when the driver is dozing or an abnormality is detected.

The control request unit 202 is a functional unit that performs suppression control of software updates and control of the start and end of autonomous driving based on the switching command detected by the switch detection unit 201. The software is, for example, a program and data for realizing an autonomous driving function, a driving assistance function, and functions other than these functions, and is installed in the ROM 103. As shown in FIG. 3, the control request unit 202 has a suppression request unit 2021, an autonomous driving control request unit 2022, and a notification control unit 2023. The control request unit 202 is realized, for example, by the CPU 101 shown in FIG. 2 executing a program.

The suppression request unit 2021 is a functional unit that sends an update suppression request to the rewrite management unit 203 to suppress software updates when the switch detection unit 201 detects a command to switch from manual operation to automatic operation.

The automatic driving control request unit 2022 is a functional unit that sends an automatic driving start request to the execution unit 204 to request the start of automatic driving when the suppression request unit 2021 receives a response from the rewrite management unit 203 in response to the update suppression request indicating that the software update has been suppressed. The response indicating that the software update has been suppressed is, for example, a response that the rewrite management unit 203 will not start the software update and that the execution unit 204 has interrupted the software update when the execution unit 204 is updating the software. Also, the response indicating that the software update has been suppressed is, for example, a response that the rewrite management unit 203 will not start the software update when the execution unit 204 is not updating the software. The automatic driving control request unit 2022 corresponds to a "driving control unit".

The notification control unit 2023 is a functional unit that notifies the output control unit 205 that autonomous driving has started when the autonomous driving control request unit 2022 receives a response from the execution unit 204 in response to an autonomous driving start request that autonomous driving has started.

The rewrite management unit 203 is a functional unit that controls the update process of the software in the execution unit 204 when a module for software update is received from an external server via the communication device 18. Furthermore, when the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021, it sends an update control command to the execution unit 204 to interrupt a software update if one is in progress. The rewrite management unit 203 is realized, for example, by the communication I/F 108 shown in FIG. 2 and a program executed by the CPU 101.

The execution unit 204 is a functional unit that starts automatic driving and executes automatic driving control in response to an automatic driving start request from the automatic driving control request unit 2022. The execution unit 204 also writes a module for software update to the ROM 103 under the control of the rewrite management unit 203. When the execution unit 204 receives an update control command from the rewrite management unit 203 to interrupt the update while the software is being updated, the execution unit 204 interrupts the writing process to the ROM 103 while the software is being updated, and the rewrite management unit 203 controls its own state so as not to start the update. When the software is not being updated, the rewrite management unit 203 controls its own state so as not to start the software update. The execution unit 204 is realized, for example, by the CPU 101 shown in FIG. 2 executing a program. Note that, although one execution unit 204 is shown in FIG. 3, this is not limited thereto, and multiple execution units 204 may be provided. In this case, at least one of the multiple execution units 204 starts autonomous driving and executes autonomous driving control in response to an autonomous driving start request from the autonomous driving control request unit 2022.

When the output control unit 205 receives a notification from the notification control unit 2023 that autonomous driving has started, the output control unit 205 at least one of the following: displays the notification on the display device 15, and outputs the notification as audio from the speaker 19. The output control unit 205 is realized, for example, by the CPU 101 shown in FIG. 2 executing a program. The display device 15 and the speaker 19 are examples of an "output device".

Of the two, display of the notification by the display device 15 and audio output of the notification by the speaker 19, it is desirable that at least the notification be displayed by the display device 15. There is a possibility that the driver may miss the audio output by the speaker 19, but the display by the display device 15 can continuously inform the driver that autonomous driving has started.

Furthermore, each functional unit of the vehicle control device 20 shown in FIG. 3 is a conceptual representation of the function, and is not limited to this configuration. For example, multiple functional units illustrated as independent functional units in the vehicle control device 20 shown in FIG. 3 may be configured as a single functional unit. On the other hand, the function of a single functional unit in the vehicle control device 20 shown in FIG. 3 may be divided into multiple functions and configured as multiple functional units.

In addition, FIG. 3 shows a block configuration in which the vehicle control device 20 is configured by one ECU, but is not limited to this, and the functions of the vehicle control device 20 may be realized by multiple ECUs. For example, as shown in FIG. 4, the vehicle control devices 20a to 20c, which are three ECUs, may realize functions equivalent to those of the vehicle control device 20. In the example shown in FIG. 4, the vehicle control devices 20a, 20b, and 20c organically cooperate to configure one control system. In the example shown in FIG. 4, the vehicle control device 20a includes a switch detection unit 201, a control request unit 202, and an output control unit 205, the vehicle control device 20b includes a rewrite management unit 203, and the vehicle control device 20c includes an execution unit 204. The vehicle control devices 20a to 20c transmit and receive data and signals to each other, for example, by CAN (Controller Area Network) communication or the like. Note that the control system is not limited to being a system that includes multiple vehicle control devices, and the concept of a control system also includes each of the vehicle control devices 20a to 20c shown in FIG. 4, as well as a single vehicle control device 20 as shown in FIG. 3.

(Operation flow of the control request unit)
Fig. 5 is a flowchart showing an example of an operation flow when switching from manual driving to automatic driving of the control request unit of the vehicle control device according to the first embodiment. Fig. 6 is a flowchart showing an example of an operation flow when switching from automatic driving to manual driving of the control request unit of the vehicle control device according to the first embodiment. First, with reference to Fig. 5, an operation of the control request unit 202 of the vehicle control device 20 when switching from manual driving to automatic driving will be described.

<Step S11>
If the switch detection unit 201 detects a command to switch from manual operation to automatic operation from the automatic operation changeover switch 10b (step S11: Yes), the process proceeds to step S12, and if not (step S11: No), the process waits until a switch command is detected. The command to switch from manual operation to automatic operation corresponds to a "first switch command."

<Step S12>
The suppression request unit 2021 of the control request unit 202 sends an update suppression request for suppressing software updates to the rewrite management unit 203. Then, the process proceeds to step S13.

<Step S13>
When the suppression request unit 2021 receives a positive response to the update suppression request from the rewrite management unit 203 indicating that the software update has been suppressed (step S13: Yes), the suppression request unit 2021 proceeds to step S14, and when the positive response has not been received (step S13: No), the suppression request unit 2021 waits until the positive response is received. The positive response to the update suppression request corresponds to a "first response." The first response includes at least one of a response that the rewrite management unit 203 will not start the software update and a response that at least one execution unit 204 has interrupted the software update.

<Step S14>
The autonomous driving control request unit 2022 of the vehicle control device 20 sends an autonomous driving start request to the execution unit 204 to request the start of autonomous driving. Then, the process proceeds to step S15.

<Step S15>
When the autonomous driving control request unit 2022 receives an affirmative response from the execution unit 204 in response to the autonomous driving start request, indicating that autonomous driving has started (step S15: Yes), the autonomous driving control request unit 2022 proceeds to step S16, and when an affirmative response has not been received (step S15: No), the autonomous driving control request unit 2022 waits until an affirmative response is received. The affirmative response from the execution unit 204 indicating that autonomous driving has started corresponds to a "second response."

<Step S16>
The notification control unit 2023 of the vehicle control device 20 notifies the output control unit 205 that the autonomous driving has started. Then, the processing of the control request unit 202 ends.

The above steps S11 to S16 are the flow of operations performed by the control request unit 202 when switching from manual operation to automatic operation.

Next, with reference to FIG. 6, the operation of the control request unit 202 of the vehicle control device 20 when switching from automatic driving to manual driving will be described.

<Step S21>
If the switch detection unit 201 detects a command to switch from automatic operation to manual operation from the automatic operation changeover switch 10b (step S21: Yes), the process proceeds to step S22, and if not (step S21: No), the process waits until a switch command is detected. The command to switch from automatic operation to manual operation corresponds to a "second switch command."

<Step S22>
The autonomous driving control request unit 2022 sends an autonomous driving end request to the execution unit 204 to request the end of autonomous driving. Then, the process proceeds to step S23.

<Step S23>
When the autonomous driving control request unit 2022 receives an affirmative response from the execution unit 204 to the autonomous driving end request indicating that autonomous driving has been ended (step S23: Yes), the autonomous driving control request unit 2022 proceeds to step S24, and when an affirmative response has not been received (step S23: No), the autonomous driving control request unit 2022 waits until an affirmative response is received. The affirmative response from the execution unit 204 indicating that autonomous driving has been ended corresponds to a "fourth response".

<Step S24>
The notification control unit 2023 notifies the output control unit 205 that the autonomous driving has ended. Then, the process proceeds to step S25.

<Step S25>
The suppression request unit 2021 sends an update suppression release request for releasing the suppression of software updates to the rewrite management unit 203. Then, the process proceeds to step S26.

<Step S26>
If the suppression request unit 2021 receives a positive response to the update suppression cancellation request from the rewrite management unit 203 indicating to the execution unit 204 that the software update has been suspended or that the suppression of starting the update has been cancelled (step S26: Yes), the suppression request unit 2021 terminates the processing, and if a positive response has not been received (step S26: No), the suppression request unit 2021 waits until a positive response is received.

The above steps S21 to S26 are the flow of operations performed by the control request unit 202 when switching from automatic operation to manual operation.

(Operation flow of the rewrite management unit)
Fig. 7 is a flowchart showing an example of an operation flow when switching from manual driving to autonomous driving of the rewrite management unit of the vehicle control device according to the first embodiment. Fig. 8 is a flowchart showing an example of an operation flow when switching from autonomous driving to manual driving of the rewrite management unit of the vehicle control device according to the first embodiment. First, with reference to Fig. 7, the operation of the rewrite management unit 203 of the vehicle control device 20 when switching from manual driving to autonomous driving will be described.

<Step S31>
If the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021 (step S31: Yes), the rewrite management unit 203 proceeds to step S32, and if the update suppression request has not been received (step S31: No), the rewrite management unit 203 waits until an update suppression request is received.

<Step S32>
If the rewrite management unit 203 confirms that the software is being updated in the execution unit 204 (step S32: Yes), the process proceeds to step S33, and if the rewrite management unit 203 confirms that the software is not being updated (step S32: No), the process proceeds to step S35.

<Step S33>
The rewrite management unit 203 sends an update control command to the execution unit 204 to interrupt the software update, and then the process proceeds to step S34.

<Step S34>
If the rewrite management unit 203 receives an affirmative response from the execution unit 204 indicating that the software update has been interrupted (step S34: Yes), the rewrite management unit 203 proceeds to step S35, and if an affirmative response has not been received (step S34: No), the rewrite management unit 203 waits until an affirmative response is received. The affirmative response from the execution unit 204 indicating that the software update has been interrupted corresponds to the "third response."

<Step S35>
The rewrite management unit 203 sets an update flag for internally controlling software updates to the execution unit 204 to "not allowed," and then the process proceeds to step S36.

<Step S36>
The rewrite management unit 203 sends an affirmative response to the update suppression request, indicating that the software update has been suppressed, to the suppression request unit 2021. Then, the processing of the rewrite management unit 203 ends.

The above steps S31 to S36 are the flow of operations performed by the rewrite management unit 203 when switching from manual operation to automatic operation.

Next, with reference to FIG. 8, the operation of the rewrite management unit 203 of the vehicle control device 20 when switching from automatic driving to manual driving will be described.

<Step S41>
If the rewrite management unit 203 receives an update suppression release request from the suppression request unit 2021 (step S41: Yes), it proceeds to step S42, and if the update suppression release request has not been received (step S41: No), it waits until it receives an update suppression release request.

<Step S42>
The rewrite management unit 203 sets an update flag for internally controlling software updates to the execution unit 204 to "OK". Since the load of the software update process in the execution unit 204 is large, the temperature of the CPU 101 is expected to rise during the software update process. For example, even if the rewrite management unit 203 receives an update suppression release request, if the internal temperature or the ambient temperature of the vehicle control device 20 acquired from the temperature sensor 21 via the sensor I/F 111 is higher than a predetermined threshold, the rewrite management unit 203 may not start or resume the software update by setting the update flag to "NO". Alternatively, even if the rewrite management unit 203 sets the update flag to "OK", if the internal temperature or the ambient temperature is higher than a predetermined threshold. This makes it possible to suppress the occurrence of malfunctions such as frequency restrictions of the CPU 101 due to the temperature rise caused by the update process of the CPU 101. Specifically, the frequency restrictions are as follows. The CPU 101 may suppress heat generation due to an increase in the amount of processing by lowering the processing frequency. At this time, a decrease in the processing frequency may lead to a decrease in the processing speed of the CPU 101. Then, the process proceeds to step S43.

<Step S43>
The rewrite management unit 203 sends an affirmative response to the update suppression release request, indicating that the software update has been suppressed, to the suppression request unit 2021. Then, the processing of the rewrite management unit 203 ends.

The above steps S41 to S43 are followed by the rewrite management unit 203 to perform the operation when switching from automatic to manual operation.

(Flow of operations of the execution unit)
Fig. 9 is a flowchart showing an example of a flow of a software update operation of the execution unit of the vehicle control device according to the first embodiment. Fig. 10 is a flowchart showing an example of a flow of an automatic/manual switching operation of the execution unit of the vehicle control device according to the first embodiment. First, the software update operation in the execution unit 204 of the vehicle control device 20 will be described with reference to Fig. 9.

<Step S51>
If the execution unit 204 is currently updating software (step S51: Yes), the process proceeds to step S52, and if the execution unit 204 is not currently updating software (step S51: No), the process proceeds to step S57.

<Step S52>
If the execution unit 204 receives an autonomous driving start request from the autonomous driving control request unit 2022 (step S52: Yes), it proceeds to step S53, and if the execution unit 204 has not received an autonomous driving start request (step S52: No), it proceeds to step S54.

<Step S53>
Since the software is being updated, the execution unit 204 sends a negative response to the autonomous driving start request, indicating that autonomous driving cannot be started, to the autonomous driving control request unit 2022. Then, the process proceeds to step S54.

<Step S54>
If the execution unit 204 receives an update control command from the rewrite management unit 203 to interrupt the software update (step S54: Yes), it proceeds to step S55, and if it has not received an update control command (step S54: No), it returns to step S52.

<Step S55>
In response to the update control command, the execution unit 204 suspends the process of writing the software to be updated into the ROM 103. Then, the process proceeds to step S56.

<Step S56>
The execution unit 204 sends an affirmative response to the update control command, indicating that the software update has been interrupted, to the rewrite management unit 203. Then, the processing of the execution unit 204 ends.

<Step S57>
If the execution unit 204 is executing an automatic driving process or has received an automatic driving start request or an automatic driving end request from the automatic driving control request unit 2022 (step S57: Yes), the software update process cannot be started or resumed, and the process is terminated. On the other hand, if the execution unit 204 is not executing an automatic driving process and has not received an automatic driving start request or an automatic driving end request from the automatic driving control request unit 2022 (step S57: No), the process proceeds to step S58.

<Step S58>
If the execution unit 204 receives an update control command from the rewrite management unit 203 to start or resume a software update (step S58: Yes), it proceeds to step S59, and if it has not received an update control command (step S58: No), it returns to step S57.

<Step S59>
In response to the update control command, the execution unit 204 starts or resumes the process of writing the software to be updated into the ROM 103. Then, the process proceeds to step S60.

<Step S60>
The execution unit 204 sends an affirmative response to the update control command, which indicates that the software update has been started or resumed, to the rewrite management unit 203. Then, the processing of the execution unit 204 ends.

The above steps S51 to S60 are used to start, resume, and suspend software updates in the execution unit 204.

Next, the automatic/manual switching operation in the execution unit 204 of the vehicle control device 20 will be described with reference to FIG. 10.

<Step S71>
If the automatic driving process is not being executed in the execution unit 204 (step S71: No), the process proceeds to step S72. If the automatic driving process is being executed (step S71: Yes), the process proceeds to step S76.

<Step S72>
If the execution unit 204 is updating software or has received an update control command from the rewrite management unit 203 to start or resume the software update (step S72: Yes), the automatic driving process cannot be started until the software update is interrupted, so the process of the execution unit 204 is terminated. On the other hand, if the execution unit 204 is not updating software and has not received an update control command from the rewrite management unit 203 to start or resume the software update (step S72: No), the process proceeds to step S73.

<Step S73>
If the execution unit 204 receives an autonomous driving start request from the autonomous driving control request unit 2022 (step S73: Yes), it proceeds to step S74, and if the execution unit 204 has not received an autonomous driving start request (step S73: No), it returns to step S72.

<Step S74>
The execution unit 204 starts the automatic driving process, and then the process proceeds to step S75.

<Step S75>
The execution unit 204 sends an affirmative response to the autonomous driving start request, indicating that the autonomous driving process has started, to the autonomous driving control request unit 2022. Then, the process ends.

<Step S76>
If the execution unit 204 receives an update control command from the rewrite management unit 203 to start or resume a software update while the autonomous driving process is being executed (step S76: Yes), the execution unit 204 proceeds to step S77; if the execution unit 204 has not received an update control command (step S76: No), the execution unit 204 proceeds to step S78.

<Step S77>
The execution unit 204 determines that software updating will not be performed during execution of the autonomous driving process, and sends a negative response to the update control command for starting or resuming software updating to the rewrite management unit 203. Then, the process proceeds to step S78.

<Step S78>
If the execution unit 204 receives a request to end autonomous driving from the autonomous driving control request unit 2022 (step S78: Yes), it proceeds to step S79, and if the execution unit 204 has not received a request to end autonomous driving (step S78: No), it proceeds to step S76.

<Step S79>
The execution unit 204 ends the automatic driving process, and then proceeds to step S80.

<Step S80>
The execution unit 204 sends an affirmative response to the autonomous driving end request, indicating that the autonomous driving process has ended, to the autonomous driving control request unit 2022. Then, the process ends.

The above steps S71 to S80 are followed by the execution unit 204 to switch between automatic and manual operation.

As described above, in the vehicle control device 20 according to this embodiment, when a switching command is detected by the switch detection unit 201, the suppression request unit 2021 sends an update suppression request to the rewrite management unit 203 to suppress the software update. When the suppression request unit 2021 receives a response from the rewrite management unit 203 indicating that the software update has been suppressed in response to the update suppression request, the automatic driving control request unit 2022 sends an automatic driving start request to the execution unit 204. As a result, when the driving state of the vehicle 1 is switched to automatic driving, the update of the software installed in the vehicle control device 20 is interrupted, making it possible to perform automatic driving in the vehicle 1 without restricting the function of the current software. In addition, when designing a system, it is no longer necessary to consider that the software writing process, which is generally infrequent, the processing of the CPU 101 during automatic driving, and the access processing of the RAM 102 and ROM 103 are performed simultaneously. Therefore, the degree of freedom in system design is improved.

Second Embodiment
The vehicle control device according to the second embodiment will be described, focusing on the differences from the vehicle control device 20 according to the first embodiment. In the first embodiment, an operation was described in which software updates are suspended or updates are not started in the vehicle control device when the driving state of the vehicle 1 is switched to autonomous driving for all software executed in the execution unit 204. In this embodiment, an operation is described in which the processing of the vehicle control device is made different depending on whether the software executed in the execution unit is related to autonomous driving operation.

(Configuration and operation of functional blocks of vehicle control device)
Fig. 11 is a diagram showing an example of the configuration of functional blocks of a vehicle control device according to the second embodiment. The configuration and operation of the functional blocks of the control system according to the present embodiment will be described with reference to Fig. 11 .

In this embodiment, as shown in FIG. 11, vehicle control devices 20a to 20d constitute a control system. Vehicle control device 20a has a switch detection unit 201, a control request unit 202, and an output control unit 205. Vehicle control device 20b has a rewrite management unit 203. Vehicle control device 20c has an execution unit 204a. Vehicle control device 20d has an execution unit 204b. Note that the operation of switch detection unit 201, control request unit 202, and output control unit 205 is similar to that described in the first embodiment. In addition, when referring to any vehicle control device among vehicle control devices 20a to 20d, or when referring to them collectively, they will simply be referred to as "vehicle control device 20."

The rewrite management unit 203 is a functional unit that controls the update process of the software in the execution unit 204a and the execution unit 204b when a module for software update is received from an external server via the communication device 18. In addition, when the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021, the rewrite management unit 203 sends an update control command to the execution unit 204a that executes the function of the automatic driving operation to interrupt the update if the software is being updated. In addition, when the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021, the rewrite management unit 203 prioritizes software update for the execution unit 204b that executes functions other than the automatic driving operation. In other words, the rewrite management unit 203 does not cause the execution unit 204b to interrupt the update if the execution unit 204b is updating software, and does not cause the execution unit 204b to prohibit the update if the software is not being updated. The rewrite management unit 203 is realized, for example, by the communication I/F 108 and the CPU 101 shown in FIG. 2 executing a program.

The execution unit 204a is a functional unit that is the target of the automatic driving operation, and is a functional unit that starts automatic driving and executes automatic driving control in response to an automatic driving start request from the automatic driving control request unit 2022. The execution unit 204a also writes a module for software update to the ROM 103 under the control of the rewrite management unit 203. When the execution unit 204a receives an update control command from the rewrite management unit 203 to suspend the update while the software is being updated, the execution unit 204a suspends the writing process to the ROM 103 while the software is being updated, and the rewrite management unit 203 controls its own state so as not to start the update. When the software is not being updated, the rewrite management unit 203 controls its own state so as not to start the software update. That is, the CPU 101 corresponding to the execution unit 204a is a suppression target CPU that is the target of suppression of software update. The execution unit 204a is realized, for example, by the CPU 101 shown in FIG. 2 of the vehicle control device 20c executing a program. The execution unit 204a corresponds to the "first execution unit". In addition, although one execution unit 204a is shown in FIG. 11, this is not limiting, and multiple execution units 204a may be provided. In this case, at least one of the multiple execution units 204a starts automatic driving and executes automatic driving control in response to an automatic driving start request from the automatic driving control request unit 2022.

The execution unit 204b is a functional unit that is not subject to the automatic driving operation and executes processing other than the automatic driving processing. The execution unit 204b is a functional unit that realizes, for example, RSE (Rear Seat Entertainment). The execution unit 204b also writes a module for software update to the ROM 103 under the control of the rewrite management unit 203. The execution unit 204b also continues the write process to the ROM 103 when the software is being updated, even if the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021. That is, the CPU 101 corresponding to the execution unit 204b is a non-suppression target CPU that is not subject to the suppression of software updates. The execution unit 204b is realized, for example, by the CPU 101 shown in FIG. 2 of the vehicle control device 20d executing a program. The execution unit 204b corresponds to a "second execution unit". Note that, although one execution unit 204b is shown in FIG. 11, this is not limited thereto, and multiple execution units 204b may be provided.

Note that when referring to any of the execution units 204a and 204b, or when referring to them collectively, they will simply be referred to as "execution unit 204."

In addition, in FIG. 11, execution unit 204a is shown as the execution unit 204 corresponding to the CPU to be inhibited, and execution unit 204b is shown as the execution unit 204 corresponding to the CPU not to be inhibited, but multiple execution units 204 may each correspond to the CPU to be inhibited and the CPU not to be inhibited.

Furthermore, the functional units of the vehicle control devices 20a to 20d shown in FIG. 11 are conceptual representations of functions, and are not limited to such configurations. For example, the multiple functional units illustrated as vehicle control devices 20a to 20d may be configured as a single functional unit. On the other hand, the functions of a single functional unit in each of the functional units illustrated as vehicle control devices 20a to 20d may be divided into multiple functions and configured as multiple functional units.

The control system configuration shown in FIG. 11 is composed of vehicle control devices 20a to 20d, but is not limited to this and may be composed of one vehicle control device or any other number of vehicle control devices.

(Operation flow of the rewrite management unit)
Fig. 12 is a flowchart showing an example of an operation flow when switching from manual driving to automatic driving of the rewrite management unit of the vehicle control device according to the second embodiment. Fig. 13 is a flowchart showing an example of an operation flow when switching from automatic driving to manual driving of the rewrite management unit of the vehicle control device according to the second embodiment. First, with reference to Fig. 12, an operation of the rewrite management unit 203 of the vehicle control device 20b when switching from manual driving to automatic driving will be described.

<Step S31a>
If the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021 (step S31a: Yes), it proceeds to step S32a, and if the update suppression request has not been received (step S31a: No), it waits until it receives an update suppression request.

<Step S32a>
If the rewrite management unit 203 confirms that the software is being updated and that there is an execution unit 204 corresponding to the CPU to be suppressed (step S32a: Yes), the process proceeds to step S33a. If it confirms that there is no execution unit 204 in the process of updating the software, or that the execution unit 204 corresponds to a CPU that is not to be suppressed even if the software is being updated (step S32a: No), the process proceeds to step S35a.

<Step S33a>
The rewrite management unit 203 sends an update control command for interrupting the software update to the execution unit 204 corresponding to the suppression target CPU during the software update, and then proceeds to step S34a.

<Step S34a>
When the rewrite management unit 203 receives an affirmative response indicating that the software update has been interrupted from the execution unit 204 corresponding to the suppression target CPU (step S34a: Yes), the rewrite management unit 203 proceeds to step S35a, and when the affirmative response has not been received (step S34a: No), the rewrite management unit 203 waits until it receives an affirmative response. The affirmative response indicating that the software update has been interrupted from the execution unit 204 corresponding to the suppression target CPU corresponds to the "third response."

<Step S35a>
The rewrite management unit 203 sets an update flag for internally controlling software updates to the execution unit 204 corresponding to the suppression target CPU to "not allowed," and then the process proceeds to step S36a.

<Step S36a>
The rewrite management unit 203 sends an affirmative response to the update suppression request, indicating that the software update has been suppressed, to the suppression request unit 2021. Then, the process proceeds to step S37a.

<Step S37a>
If the rewrite management unit 203 confirms that there is an execution unit 204 corresponding to a non-restricted CPU awaiting a software update (step S37a: Yes), it proceeds to step S38a, and if there is no execution unit 204 corresponding to a non-restricted CPU awaiting a software update (step S37a: No), it terminates the processing of the rewrite management unit 203.

<Step S38a>
The rewrite management unit 203 controls the software update process in the execution unit 204 corresponding to the non-restriction target CPU, and then the process returns to step S37a.

The above steps S31a to S38a are the flow of operations performed by the rewrite management unit 203 when switching from manual operation to automatic operation.

Next, with reference to FIG. 13, the operation of the rewrite management unit 203 of the vehicle control device 20b when switching from automatic driving to manual driving will be described.

<Step S41a>
If the rewrite management unit 203 receives an update suppression release request from the suppression request unit 2021 (step S41a: Yes), it proceeds to step S42a, and if the update suppression release request has not been received (step S41a: No), it waits until it receives an update suppression release request.

<Step S42a>
The rewrite management unit 203 sets an update flag for internally controlling software update to the execution unit 204 corresponding to the suppression target CPU to "OK". As described above, the software update process in the execution unit 204 corresponding to the suppression target CPU has a large load, so that the temperature of the CPU 101 is expected to rise during the software update process. For example, even if the rewrite management unit 203 receives an update suppression release request, if the internal temperature or the ambient temperature of the vehicle control device 20 corresponding to the suppression target CPU acquired from the temperature sensor 21 via the sensor I/F 111 is higher than a predetermined threshold, the rewrite management unit 203 may not start or resume the software update by setting the update flag to "NO". Alternatively, even if the rewrite management unit 203 sets the update flag to "OK", if the internal temperature or the ambient temperature is higher than a predetermined threshold. This makes it possible to suppress the occurrence of malfunctions such as frequency restrictions of the CPU 101 due to the temperature rise caused by the update process of the CPU 101. Then, the process proceeds to step S43a.

<Step S43a>
The rewrite management unit 203 sends an affirmative response to the update suppression release request, indicating that the suspension of the software update or the suspension of the start of the update has been lifted for the execution unit 204 corresponding to the suppression target CPU, to the suppression request unit 2021. Then, the processing of the rewrite management unit 203 ends.

The above steps S41a to S43a are followed by the rewrite management unit 203 to perform the operation when switching from automatic to manual operation.

As described above, in the control system according to this embodiment, when the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021, it sends an update control command to the execution unit 204a, which is the target of software update suppression, and does not send an update control command to the execution unit 204b, which is not the target of software update suppression. That is, even if the update suppression request is generated by the suppression request unit 2021, the software update process for the execution unit 204b continues without interruption. In the execution unit 204a that executes the automatic driving control, if automatic driving and software update are performed simultaneously, the processing load of the execution unit 204a may increase. Therefore, by interrupting the update for the execution unit 204a, automatic driving can be started without increasing the processing load. In addition, in the execution unit 204b that executes procedures other than the automatic driving operation, the processing load does not change whether software update is performed simultaneously with automatic driving or when software update is performed when automatic driving is not performed. Therefore, by not interrupting the update for the execution unit 204b, it is possible to perform a function improvement resulting from the software update without increasing the processing load in the control system.

[Third embodiment]
The vehicle control device according to the third embodiment will be described, focusing on the differences from the vehicle control device 20 according to the first embodiment. In the first embodiment, an operation was described in which software updates are suspended or not started in the vehicle control device for all software executed by the execution unit 204 when the driving state of the vehicle 1 is switched to autonomous driving. In this embodiment, an operation is described in which the processing of the vehicle control device is made different according to the priority order of the software to be updated. Note that the configuration of the functional blocks of the vehicle control device 20 according to this embodiment is assumed to be the same as the configuration of the functional blocks of the vehicle control device 20 according to the first embodiment.

(Operation flow of the control request unit)
14 is a flowchart showing an example of an operation flow when switching from manual driving to automatic driving of the control request unit of the vehicle control device according to the third embodiment. With reference to FIG. 14, the operation of the control request unit 202 of the vehicle control device 20 when switching from manual driving to automatic driving will be described.

<Step S11b>
If the switch detection unit 201 detects a command to switch from manual operation to automatic operation from the automatic operation changeover switch 10b (step S11b: Yes), the process proceeds to step S12a, and if not (step S11b: No), the process waits until a switch command is detected. The command to switch from manual operation to automatic operation corresponds to a "first switch command."

<Step S12b>
The suppression request unit 2021 of the control request unit 202 sends an update suppression request for suppressing software updates to the rewrite management unit 203. Then, the process proceeds to step S13b.

<Step S13b>
If the suppression request unit 2021 receives a response to the update suppression request from the rewrite management unit 203 (step S13b: Yes), the suppression request unit 2021 proceeds to step S14b, and if a response has not been received (step S13b: No), the suppression request unit 2021 waits until a response is received. A positive response to the update suppression request corresponds to a "first response." The first response includes at least one of a response that the rewrite management unit 203 will not start the software update and a response that at least one execution unit 204 has interrupted the software update.

<Step S14b>
If the response that the suppression request unit 2021 receives from the rewrite management unit 203 is a positive response indicating that the software update has been suppressed (step S14b: Yes), the suppression request unit 2021 proceeds to step S15b, and if the response is a negative response (step S14b: No), the suppression request unit 2021 proceeds to step S18b.

<Step S15b>
The autonomous driving control request unit 2022 of the vehicle control device 20 sends an autonomous driving start request to the execution unit 204 to request the start of autonomous driving. Then, the process proceeds to step S16b.

<Step S16b>
When the autonomous driving control request unit 2022 receives an affirmative response from the execution unit 204 in response to the autonomous driving start request, indicating that autonomous driving has started (step S16b: Yes), the autonomous driving control request unit 2022 proceeds to step S17b, and when an affirmative response has not been received (step S16b: No), the autonomous driving control request unit 2022 waits until an affirmative response is received. The affirmative response from the execution unit 204 indicating that autonomous driving has started corresponds to a "second response."

<Step S17b>
The notification control unit 2023 of the vehicle control device 20 notifies the output control unit 205 that the autonomous driving has started. Then, the processing of the control request unit 202 ends.

<Step S18b>
The notification control unit 2023 of the vehicle control device 20 notifies the output control unit 205 that it is not possible to start autonomous driving. Then, the processing of the control request unit 202 ends.

The operation of the control request unit 202 when switching from automatic operation to manual operation is the same as in the first embodiment.

(Operation flow of the rewrite management unit)
15 is a flowchart showing an example of an operation flow of the rewrite management unit 203 of the vehicle control device 20 when switching from manual driving to automatic driving according to the third embodiment. With reference to FIG. 15, the operation of the rewrite management unit 203 of the vehicle control device 20 when switching from manual driving to automatic driving will be described.

<Step S31b>
If the rewrite management unit 203 receives an update suppression request from the suppression request unit 2021 (step S31b: Yes), it proceeds to step S32b, and if the update suppression request has not been received (step S31b: No), it waits until it receives an update suppression request.

<Step S32b>
If the rewrite management unit 203 determines that the software is being updated in the execution unit 204 (step S32b: Yes), the process proceeds to step S33b, and if the rewrite management unit 203 determines that the software is not being updated (step S32b: No), the process proceeds to step S36b. The rewrite management unit 203 determines that the software is being updated in the execution unit 204 when, for example, communication for software update is being performed between the rewrite management unit 203 and the execution unit 204.

<Step S33b>
When the execution unit 204 determines that software is being updated, the rewrite management unit 203 determines whether the priority of the software being updated is low. For example, when the priority is low (step S33b: Yes), the rewrite management unit 203 proceeds to step S34b, and when the priority is high (step S33b: No), the rewrite management unit 203 proceeds to step S38b. Here, high-priority software is software that needs to be updated urgently, for example, to correct a defect. Low-priority software is software that needs to be updated to improve or add functions, for example.

<Step S34b>
The rewrite management unit 203 sends an update control command to the execution unit 204 to interrupt the software update, and then the process proceeds to step S35b.

<Step S35b>
If the rewrite management unit 203 receives an affirmative response from the execution unit 204 indicating that the software update has been interrupted (step S35b: Yes), the rewrite management unit 203 proceeds to step S36b, and if an affirmative response has not been received (step S35b: No), the rewrite management unit 203 waits until an affirmative response is received. The affirmative response from the execution unit 204 indicating that the software update has been interrupted corresponds to the "third response."

<Step S36b>
The rewrite management unit 203 sets an update flag for internally controlling software updates to the execution unit 204 to "not allowed," and then the process proceeds to step S37b.

<Step S37b>
The rewrite management unit 203 sends an affirmative response to the update suppression request, indicating that the software update has been suppressed, to the suppression request unit 2021. Then, the processing of the rewrite management unit 203 ends.

<Step S38b>
If the priority of the software being updated is high, the rewrite management unit 203 sends a negative response to the update suppression request to the suppression request unit 2021, which disables the execution unit 204 from interrupting the software update or preventing the update from starting. Then, the processing of the rewrite management unit 203 ends.

As described above, in the vehicle control device 20 according to this embodiment, if the priority of the software to be updated is low, the rewrite management unit 203 sends an update control command to the execution unit 204, and if the priority of the software to be updated is high, the rewrite management unit 203 does not send an update control command to the execution unit 204. By interrupting the update of software with low priority, the vehicle control device 20 can start autonomous driving without increasing the processing load on the execution unit 204. Furthermore, for software with high priority, the vehicle control device 20 can improve functionality resulting from software updates by prioritizing the update process.

The programs executed by the vehicle control device 20 according to each of the above-mentioned embodiments are provided in a state where they are pre-installed in a ROM or the like. The programs executed by the vehicle control device 20 may be provided by recording them in an installable or executable format on a computer-readable storage medium such as a CD-ROM, a flexible disk (FD), a CD-R, or a DVD (Digital Versatile Disk). The above-mentioned programs may be provided to the vehicle control device 20 via a network such as the Internet. The programs to be executed by the vehicle control device 20 according to each of the above-mentioned embodiments are modularized to include the above-mentioned functional units, and the actual hardware is, for example, such that the CPU 101 reads and executes the programs from the ROM 103, whereby each of the above-mentioned functional units is loaded onto the RAM 102, which is a main storage device, and each of the above-mentioned functional units is generated on the RAM 102.

Although each embodiment of the present disclosure has been described, these are presented as examples and are not intended to limit the technical scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, modifications, and combinations can be made without departing from the gist of the invention. These embodiments are within the scope and gist of the invention, as well as the scope of equivalents of the invention described in the claims.

REFERENCE SIGNS LIST 1 vehicle 2 vehicle body 3, 3F, 3R wheels 4 seats 5 vehicle drive unit 6, 6a, 6b imaging unit 7, 7L, 7R door mirrors 8 rear seats 9 rearview mirror 10a engine switch 10b automatic driving changeover switch 11 steering wheel 12 shift lever 13 parking brake 14 door lock device 15 display device 16 GPS sensor 17 vehicle speed sensor 18 communication device 19 speaker 20, 20a to 20d vehicle control device 21 temperature sensor 101 CPU
102 RAM
103 ROM
104 Imaging I/F
105 Display I/F
106 GPS I/F
107 Vehicle speed I/F
108 Communication I/F
109 Audio I/F
110 Input I/F
111 Sensor I/F
112 Bus 201 Switch detection unit 202 Control request unit 203 Rewrite management unit 204, 204a, 204b Execution unit 205 Output control unit 2021 Suppression request unit 2022 Automatic driving control request unit 2023 Notification control unit

Claims (10)

A detection unit that detects a first switching command that instructs switching to automatic driving;
A rewrite management unit that controls software update processing;
a suppression request unit that transmits an update suppression request for suppressing the update of the software to the rewrite management unit when the first switching command is detected by the detection unit;
an operation control unit that requests at least one execution unit that executes automatic driving control to start automatic driving when the suppression request unit receives a first response indicating that the software update has been suppressed from the rewrite management unit in response to the update suppression request;
Equipped with
A control system in which, when the rewrite management unit receives the update suppression request, if the software is being updated, it sends an update control command to the at least one execution unit to interrupt the update of the software, and when it receives a third response from the at least one execution unit indicating that the interruption has been completed, it sends the first response to the suppression request unit . The control system of claim 1, wherein the first response includes at least one of a response from the rewrite management unit to the effect that the software update will not be started and a response from the at least one execution unit to the effect that the software update has been interrupted. The control system according to claim 1 or 2, further comprising an output control unit that, when the driving control unit receives a second response from the at least one execution unit indicating that autonomous driving has started, causes an output device to output information indicating that autonomous driving has started. the output device is a display device,
The control system according to claim 3 , wherein when the driving control unit receives the second response, the output control unit causes the output device to display a notification that automatic driving has started. The control system according to any one of claims 1 to 4, wherein the detection unit detects the first switching command from an operation unit for switching the operating state. the at least one execution unit includes a first execution unit that executes software that is a target of suppression of updating, and a second execution unit that executes software that is not a target of suppression of updating;
A control system as described in any one of claims 1 to 5, wherein when the rewrite management unit receives the update suppression request, if the software to be suppressed from updating is currently being updated, the rewrite management unit sends the update control command to the first execution unit, and does not send the update control command to the second execution unit. A control system as described in any one of claims 1 to 6, wherein when the update suppression request is received, the rewrite management unit sends the update control command to the execution unit if the priority of the software to be updated is low, and does not send the update control command to the execution unit if the priority is high . The detection unit detects a second switching command instructing switching to manual operation,
When the second switching command is detected by the detection unit, the driving control unit requests the at least one execution unit to end the automatic driving;
when receiving a fourth response from the at least one execution unit indicating that the autonomous driving has been terminated, the suppression request unit sends an update suppression release request to the rewrite management unit to release the suppression of the software update;
The control system according to any one of claims 1 to 7 , wherein the rewrite management unit enables the at least one execution unit to start or resume a software update on condition that the rewrite management unit receives the update suppression release request. The control system of claim 8, wherein when the rewrite management unit receives a request to cancel the update suppression, the rewrite management unit does not cause the execution unit to start or resume the software update if the ambient temperature detected by a temperature detection unit that detects the ambient temperature is higher than a predetermined threshold value. A detection unit that detects a first switching command that instructs switching to automatic driving;
A rewrite management unit that controls software update processing;
a suppression request unit that transmits an update suppression request for suppressing the update of the software to the rewrite management unit when the first switching command is detected by the detection unit;
an operation control unit that requests at least one execution unit that executes automatic driving control to start automatic driving when the suppression request unit receives a first response indicating that the software update has been suppressed from the rewrite management unit in response to the update suppression request;
Equipped with
A control device in which, when the rewrite management unit receives the update suppression request, if the software is being updated, it sends an update control command to the at least one execution unit to interrupt the update of the software, and when it receives a third response from the at least one execution unit indicating that the interruption has been completed, it sends the first response to the suppression request unit .

Images