Center, update management method, and non-transitory storage medium

Abstract

The present application relates to a center, an update management method, and a non-transitory storage medium. The center is configured to communicate with an OTA manager configured to control software update of an electronic control unit mounted on a vehicle, the center including: a communication unit configured to receive a notification from the OTA manager indicating a progress status of a software update process of the electronic control unit; and a control unit configured to manage an update status indicating a processing status of the software update process in the vehicle based on the notification received by the communication unit, and in a case where the communication unit receives a third notification different from a second notification scheduled to be received immediately after a first notification immediately after the first notification, the update status is set based on the third notification.

Description

Technical Field

[0001] This disclosure relates to the center, update management methods, and non-transitory storage media. Background Technology

[0002] The vehicle is equipped with multiple electronic control units (ECUs) for controlling the vehicle's movements. Each ECU has a processor, temporary storage such as RAM, and non-volatile storage such as flash ROM (non-volatile memory). The processor executes software stored in the non-volatile memory to implement the ECU's control functions. The software stored in each ECU can be rewritten; by updating to a newer version of the software, the functionality of each ECU can be improved, and new vehicle control functions can be added.

[0003] As a technology for updating the software of electronic control units (ECUs), OTA (Over-The-Air) technology is known as follows: An in-vehicle communication device connected to the vehicle network is wirelessly connected to a communication network such as the Internet. A device responsible for updating the vehicle's software downloads software from a central hub with server functionality via wireless communication. The downloaded software is then installed on the ECU to update or add software to the ECU. For example, see Japanese Patent Application Laid-Open No. 2004-326689.

[0004] In the software update process using this OTA technology, at specified times (start, completion, etc.), the device responsible for the software update process, namely the OTA manager, notifies the center of the progress of the software update process, so that the center can manage the status of the process being implemented on the vehicle.

[0005] If, for some reason, the center is unable to receive notifications from the OTA manager indicating the progress of the software update process, there is a possibility that, although the software update process is proceeding normally in the vehicle, the center may mistakenly determine that the software update process has encountered an anomaly. If such a determination is made, a discrepancy will arise between the update status managed by the vehicle and the update status managed by the center, potentially affecting the next software update process. Summary of the Invention

[0006] This disclosure provides a central control, update management method, and non-transitory storage medium that can suppress the judgment that the software update process has malfunctioned when the notification indicating the progress of the software update process cannot be received normally from the OTA manager.

[0007] The first aspect of the present invention involves a central configuration that communicates with an OTA manager, which is configured to control software updates of an electronic control unit (ECU) installed in a vehicle. The central configuration includes: a communication unit configured to receive notifications from the OTA manager indicating the progress of the software update process for the ECU; and a control unit configured to manage an update status indicating the processing status of the software update process in the vehicle based on the notifications received by the communication unit, and to set the update status based on the third notification if the communication unit receives a third notification immediately following the first notification, which is different from a second notification that is scheduled to be received immediately following the first notification.

[0008] The update management method according to the second aspect of the present invention is executed by a central computer, which has a processor and a memory and is configured to communicate with an OTA manager, which is configured to control software updates of an electronic control unit installed in a vehicle. The update management method includes: receiving from the OTA manager a notification indicating the progress of the software update process for the electronic control unit; and managing an update state indicating the processing status of the software update process in the vehicle based on the notification. Managing the update state includes setting the update state based on the third notification if a third notification, different from a second notification that is scheduled to be received immediately after the first notification, is received immediately after the first notification.

[0009] The third aspect of the present invention involves a non-transitory storage medium storing an update management program that can be executed by a central computer. This computer performs the following functions: the central computer has a processor and a memory and is configured to communicate with an OTA (Over-The-Air) manager that controls software updates of an electronic control unit (ECU) installed in a vehicle. These functions include: receiving a notification from the OTA manager indicating the progress of the software update process for the ECU; and managing an update status indicating the processing status of the software update process in the vehicle based on the notification. Managing the update status includes setting the update status based on the third notification if a third notification, different from a second notification intended to be received immediately following the first notification, is received immediately after the first notification.

[0010] Based on the central idea, update management method, and non-transitory storage medium of this disclosure, in cases where notifications indicating the progress of software update processing cannot be received normally from the OTA manager, it is possible to suppress the mistaken judgment that the software update processing has malfunctioned. Attached Figure Description

[0011] Hereinafter, the features, advantages, technical and industrial importance of exemplary embodiments of the present invention will be described with reference to the accompanying drawings, in which the same reference numerals denote the same constituent elements, wherein:

[0012] Figure 1 It is a block diagram representing the overall structure of a network system including a central component involved in one implementation.

[0013] Figure 2 It is a block diagram representing the simplified structure of the center.

[0014] Figure 3 This is the central functional block diagram.

[0015] Figure 4 This is a block diagram representing a simplified structure of the OTA manager.

[0016] Figure 5 This is a functional block diagram of the OTA Manager.

[0017] Figure 6A This is a flowchart of the update status management process executed at the center.

[0018] Figure 6B This is a flowchart of the update status management process executed at the center.

[0019] Figure 7 This is a diagram representing an example of OTA-related results reported by the center to the OEM. Detailed Implementation

[0020] The central feature of this disclosure is that, during software update processing, when notifications indicating the progress of the software update process can be received from the OTA manager in the correct order, the update status is advanced sequentially in a prescribed order. When notifications indicating the progress of the software update process cannot be received from the OTA manager in the correct order, the update status is set based on the most recently received notification from the OTA manager. This prevents the possibility of mistakenly identifying an anomaly in the software update process. Hereinafter, one embodiment of this disclosure will be described in detail with reference to the accompanying drawings.

[0021] <Implementation Method>

[0022] [structure]

[0023] Figure 1 This is a block diagram illustrating the overall structure of a network system including a central component as described in one embodiment of this disclosure. Figure 1 The network system shown is used to update the software of multiple electronic control units 40a to 40d installed in the vehicle, and has a center 10 located outside the vehicle and an in-vehicle network 20 built inside the vehicle.

[0024] (1) Center

[0025] The center 10 can communicate with the OTA manager 30 (described later) of the vehicle network 20 via the network 70, and can manage the software updates of multiple electronic control units 40a to 40d connected to the OTA manager 30 by sending update data of the electronic control units and receiving notifications indicating the progress of software update processing. The center 10 has the function of a so-called server.

[0026] Figure 2 It means Figure 1 A simplified block diagram of the structure of center 10. (See diagram below.) Figure 2 As shown, the center 10 includes a CPU (Central Processing Unit) 11, RAM (Random Access Memory) 12, a storage device 13, and a communication device 14. The storage device 13 is a device equipped with a read / write storage medium such as a hard disk drive (HDD) or a solid-state drive (SSD), storing programs used for software update management, information used for software update management, update data from various electronic control units, etc. In the center 10, the CPU 11 executes programs read from the storage device 13 using the RAM 12 as its working area to perform the prescribed processing related to software updates. The number of CPUs 11 is not limited to one. The communication device 14 is a device for communicating with the OTA manager 30 via the network 70.

[0027] Figure 3 yes Figure 2 The functional block diagram of center 10 is shown. Figure 3 The center 10 shown includes a storage unit 16, a communication unit 17, and a control unit 18. The storage unit 16 communicates with... Figure 2 The storage device 13 shown is used for implementation. The communication unit 17 and the control unit 18 are implemented via... Figure 2 The CPU 11 shown uses RAM 12 to execute programs stored in storage device 13.

[0028] Storage unit 16 stores information related to software update processing for one or more electronic control units installed in the vehicle. As information related to software update processing, storage unit 16 stores update management information obtained by associating information representing the software usable by the electronic control unit with each vehicle identification information (vehicle ID) of the vehicle, and update data of the electronic control unit's software. Information representing the software usable by the electronic control unit can, for example, be a combination of the latest version information of the software for multiple electronic control units. Additionally, as information related to software update processing, storage unit 16 stores update status indicating the status of software update processing implemented in the vehicle.

[0029] The communication unit 17 can receive software update confirmation requests from the OTA manager 30. An update confirmation request, for example, is information sent from the OTA manager 30 to the center 10 when the vehicle's power or ignition system (IGN) is turned on. This information is used to request confirmation from the center 10, based on the vehicle configuration information described later, that there is update data for the electronic control unit. Additionally, the communication unit 17 can receive requests to send (download) distribution data packets from the OTA manager 30. If a download request for a distribution data packet is received, the communication unit 17 sends a distribution data packet containing update data for the electronic control unit software generated by the control unit 18, described later, to the OTA manager 30.

[0030] If the communication unit 17 receives an update confirmation request from the OTA manager 30, the control unit 18 determines, based on the update management information stored in the storage unit 16, whether there is software update data for the electronic control unit (ECU) installed in the vehicle whose ID is determined by the vehicle included in the update confirmation request. If it is determined that there is software update data for the ECU, and a download request for a release data packet is received from the OTA manager 30, the control unit 18 generates a release data packet including the corresponding update data stored in the storage unit 16.

[0031] (2) In-vehicle network

[0032] The vehicle network 20 includes an OTA manager 30, multiple electronic control units 40a-40d, and a communication module 50. The OTA manager 30 and the communication module 50 are connected via bus 60a. The OTA manager 30 is connected to electronic control units 40a and 40b via bus 60b. The OTA manager 30 is connected to electronic control units 40c and 40d via bus 60c.

[0033] The OTA manager 30 can wirelessly communicate with the center 10 via bus 60a and communication module 50 and network 70. Additionally, the OTA manager 30 can wiredly communicate with electronic control units 40a-40d via buses 60b-60c. This OTA manager 30 manages OTA status and is a device that controls the software update sequence to implement software updates for the electronic control units (hereinafter referred to as "target electronic control units") that are to be updated, controlling the software updates of the target electronic control units among electronic control units 40a-40d based on update data obtained from the center 10. The OTA manager 30 may also be referred to as a central gateway (CGW).

[0034] Figure 4 It means Figure 1 A simplified block diagram of the OTA Manager 30 in the system. (See diagram below.) Figure 4As shown, the OTA manager 30 includes a CPU 31, RAM 32, ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, RAM 32, ROM 33, and storage device 34 constitute a microcomputer 35. In the OTA manager 30, the CPU 31 uses RAM 32 as its working area to execute programs read from ROM 33 to perform processing related to software updates. The communication device 36 is used for... Figure 1 The device shown is a communication device that communicates with the communication module 50 and the electronic control units 40a-40d via buses 60a-60c.

[0035] Figure 5 yes Figure 4 The diagram shown is a functional block diagram of OTA Manager 30. Figure 5 The OTA manager 30 shown includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37... Figure 4 The storage device 34 shown is used for implementation. The communication unit 38 and the control unit 39 are implemented through... Figure 4 The CPU 31 shown uses RAM 32 to execute programs stored in ROM 33.

[0036] The storage unit 37 stores information (type information) related to the types of non-volatile memory installed in the multiple electronic control units 40a to 40d. This type information can be pre-created based on the specifications of the multiple electronic control units 40a to 40d constituting the vehicle network 20 and stored in the storage unit 37 during vehicle manufacturing. Alternatively, it can be obtained from the target electronic control unit by the communication unit 38 (described later) through communication within the vehicle network 20 during software update processing.

[0037] The communication unit 38 sends a software update confirmation request to the center 10, for example, when the vehicle's power supply or ignition system (IGN) is turned on. Additionally, the communication unit 38 receives a notification from the center 10 indicating the presence or absence of update data as a response to the update confirmation request. If update data for the electronic control unit's software exists, the communication unit 38 sends a download request for a release data packet to the center 10 and receives the release data packet from the center 10. Furthermore, the communication unit 38 can obtain information about the type of non-volatile memory from the target electronic control unit via communication during software update processing.

[0038] The control unit 39 determines whether there is software update data for the electronic control unit based on the response to the update confirmation request received by the communication unit 38. Furthermore, if software update data is available, the control unit 39 verifies the authenticity of the data packet received by the communication unit 38 from the center 10, and forwards one or more update data entries downloaded and stored in the storage unit 37 to the target electronic control unit. The control unit 39 then installs the update data into the target electronic control unit and provides an instruction after installation to ensure the installed updated software is effective.

[0039] Multiple electronic control units (ECUs) 40a-40d are devices used to control the actions of various parts of the vehicle. Figure 1 The example shows four electronic control units 40a to 40d, but the number of electronic control units is not particularly limited. For example, a display device (HMI) for various displays, such as displaying updated data during software update processing of electronic control units 40a to 40d, displaying an agreement request screen to the vehicle user or administrator requesting consent for the software update, and displaying the results of the software update, can be connected to the OTA manager 30. As a display device, a car navigation system can be used. Furthermore, the number of buses connecting the electronic control units to the OTA manager 30 is not particularly limited. For example, the aforementioned display device can be connected to the OTA manager 30 via a bus other than buses 60a to 60c.

[0040] The communication module 50 is a unit that controls the communication between the center 10 and the vehicle, and is a communication device used to connect the vehicle network 20 to the center 10. The communication module 50 is wirelessly connected to the center 10 via the network 70, and the OTA manager 30 uses the communication module 50 to perform vehicle authentication, download update data, etc. Furthermore, the communication module 50 can be configured to be included within the OTA manager 30.

[0041] [Summary of Software Update Processing]

[0042] The OTA manager 30 sends a software update confirmation request to the center 10, for example, when the vehicle's power or ignition is turned on. The update confirmation request includes information related to the status (system configuration) of the electronic control units (ECUs), such as the vehicle ID used to identify the vehicle and the hardware and software versions of the ECUs 40a-40d connected to the vehicle network 20; that is, vehicle configuration information. The vehicle configuration information is created by obtaining the ECU identification number (ECU_ID) and the ECU software version identification number (ECU_Software_ID) from the ECUs 40a-40d connected to the vehicle network 20. The vehicle ID and the software version of the ECUs 40a-40d are used to determine whether software update data for the ECUs exists by comparing it with the latest software version maintained by the center 10 for each vehicle ID. Additionally, the OTA manager 30 receives a notification from the center 10 indicating the presence or absence of update data as a response to the update confirmation request. When there is software update data for the electronic control unit, the OTA manager 30 sends a download request for the release data packet to the center 10 and receives the release data packet sent from the center 10. The release data packet may include, in addition to the update data, verification data for checking the authenticity of the update data, the quantity of update data, the installation order, and various control information used during the software update.

[0043] The OTA manager 30 determines whether software update data for the electronic control unit (ECU) exists based on the response from the center 10 to the received update confirmation request. Additionally, the OTA manager 30 verifies the authenticity of the release data packets received from the center 10 and stored in the storage device 13. Furthermore, the OTA manager 30 forwards one or more update data packets downloaded via the release data packets to the target ECU, installing the update data onto the target ECU. After installation, the OTA manager 30 instructs the target ECU to activate the installed updated software.

[0044] In the consent request processing, the OTA manager 30 causes the output device to output a notification that consent is required for a software update, or a notification urging consent to the software update. The output device can be a display device that provides the notification based on display, or a sound output device that provides the notification based on sound. For example, when using a display device as the output device in the consent request processing, the OTA manager 30 can display a consent request screen for requesting consent to the software update, or, if the user or administrator consents, display a notification urging the user to press the consent button or perform a specific input operation. Furthermore, in the consent request processing, the OTA manager 30 can display statements, icons, etc., notifying the display device of software update data for the electronic control unit, or displaying restrictions in the execution of the software update process. If the user or administrator receives the consent input, the OTA manager 30 performs the aforementioned installation and activation control processing, updating the software of the target electronic control unit.

[0045] The software update process consists of the following stages: the stage where the OTA manager 30 downloads the update data from the center 10 (download stage); the stage where the OTA manager 30 transfers the downloaded update data to the target electronic control unit and installs the update data in the storage area of ​​the target electronic control unit (installation stage); and the stage where the target electronic control unit activates the installed updated software (activation stage).

[0046] The download process involves the OTA manager 30 receiving update data for updating the electronic control unit software sent from the center 10 via a data packet and storing it in the storage device 34. The download phase includes not only the execution of the download but also the control of a series of download-related processes, such as determining whether the download can be executed and verifying the update data.

[0047] The update data sent from center 10 to OTA manager 30 may include any of the following: updated software for the electronic control unit (ECU), compressed data obtained by compressing the updated software, or split data obtained by splitting the updated software or compressed data. Additionally, the update data may include the ECU_ID (or serial number) of the target ECU and the ECU_Software_ID of the ECU before the update. The update data is downloaded as a release data package, which includes update data for one or more ECUs.

[0048] The installation process involves the OTA Manager 30 writing updated software (an updated version of the program) to the target electronic control unit based on the update data downloaded from the center 10. The installation phase includes not only the execution of the installation but also the control of a series of installation-related processes, such as determining whether the installation can be executed, transferring the update data, and verifying the update software.

[0049] When the update data includes the update software itself, the OTA manager 30 transfers the update data (update software) to the target electronic control unit (ECU) during the installation phase. Alternatively, when the update data includes compressed, differential, or segmented data of the update software, the OTA manager 30 can transfer the update data to the target ECU, and the target ECU can generate the update software based on the update data. Or, the OTA manager 30 can generate the update software based on the update data and then transfer the update software to the target ECU. Here, the generation of the update software can be achieved through decompression of compressed data, or a combination of differential or segmented data.

[0050] The installation of the updated software can be performed by the target electronic control unit based on an installation request from the OTA manager 30. Alternatively, the target electronic control unit can perform the installation autonomously upon receiving the update data without receiving explicit instructions from the OTA manager 30.

[0051] Activation is the process by which the target electronic control unit (ECU) makes the installed updated software effective (activated). The activation phase includes not only the execution of the activation process but also a series of controls related to activation, such as determining whether the activation is feasible and verifying the execution results.

[0052] The activation of the updated software can be performed by the target electronic control unit based on an activation request from the OTA manager 30. Alternatively, the target electronic control unit, upon receiving the update data, can activate itself after installation without explicit instructions from the OTA manager 30.

[0053] Furthermore, software updates can be performed continuously or in parallel for multiple electronic control units.

[0054] In addition, the "software update process" in this manual includes not only the entire process of continuous downloading, installation and activation, but also the process of only a part of the downloading, installation and activation.

[0055] [deal with]

[0056] Next, refer to Figure 6A as well as Figure 6B The processing performed in the network system of this embodiment will be described. Figure 6A as well as Figure 6B This is a flowchart illustrating the steps of the update status management process performed by Center 10. Figure 6A processing and Figure 6B The processing is done through the connectors X, Y, and Z.

[0057] Should Figure 6A as well as Figure 6B The update status management process shown begins when there is an activity to update the software of the electronic control unit.

[0058] (Step S601)

[0059] Center 10 determines whether it has received a notification from OTA Manager 30. Examples of notifications received by Center 10 from OTA Manager 30 when an activity exists include: (a) consent results for activities, downloads, installations, and activations based on user instructions; (b) pre-execution confirmations for downloads, installations, and activations; (c) start reports for downloads, installations, and activations; (d) progress reports for downloads, installations, and activations; (e) completion reports for downloads, installations, and activations; and (f) software update completion reports. These notifications are not limited; some may be omitted, and other notifications may be added. The notification received in step S601 refers to the initial notification, i.e., the acceptance result of the activity, or the receipt of a new notification after an update status has been set based on a certain notification. If Center 10 receives a notification from OTA Manager 30 (step S601, Yes), the process proceeds to step S602; if Center 10 does not receive a notification from OTA Manager 30 (step S601, No), the process proceeds to step S606.

[0060] (Step S602)

[0061] Center 10 determines whether the notification received from OTA Manager 30 is a "software update completion report". If a software update completion report is received, Center 10 can determine that the software update process has been completed normally on the vehicle side. If the notification received from OTA Manager 30 is a software update completion report (step S602, yes), the process proceeds to step S609; if the notification received from OTA Manager 30 is not a software update completion report (step S602, no), the process proceeds to step S603.

[0062] (Step S603)

[0063] Center 10 determines whether the notification received from OTA Manager 30, i.e., the current notification (the second or third notification), is a notification that is scheduled to be received immediately following the previous notification received from OTA Manager 30, i.e., the previous notification (the first notification). Whether the current notification is a notification that is scheduled to be received immediately following the previous notification can be determined according to the processing order predetermined in the software update process. As an example, the determination is that the notification scheduled to be received immediately following the "Download Complete Report" notification becomes the "Installation Agreement Result" notification. If the current notification from OTA Manager 30 is a notification that is scheduled to be received immediately following the previous notification (if the current notification is the second notification) (step S603, Yes), the process proceeds to step S604; if the current notification from OTA Manager 30 is not a notification that is scheduled to be received immediately following the previous notification (if the current notification is the third notification) (step S603, No), the process proceeds to step S605.

[0064] (Step S604)

[0065] Center 10 sets its managed update status to an update status that advances the process by one step. The development order of update statuses can be predetermined. As an example, if the current update status is "Installation Start Preparation", as long as the notification of the predetermined "Installation Start Report" to be received next can be accurately received, the update status is set to the previous process of "Installation Start Preparation", namely "Installation in progress". If the update status is set, the process proceeds to step S601.

[0066] (Step S605)

[0067] Center 10 sets its managed update status to be based on the update status of the current notification received from OTA Manager 30. That is, it assumes that Center 10 has received all notifications from the last notification to the current notification, and sets (changes) the update status based on the content of the current notification. For example, if the current update status is "Installation Start Preparation," and a notification that is not the scheduled "Installation Completion Report" is received, the update status is set to "Installation Complete" based on that notification. Once the update status is set, the process proceeds to step S601.

[0068] (Step S606)

[0069] Center 10 determines whether vehicle configuration information has been obtained from OTA Manager 30. Vehicle configuration information is obtained by sending a software update confirmation request from OTA Manager 30 when the vehicle's power or ignition is turned on. If vehicle configuration information has been obtained from OTA Manager 30 (step S606, Yes), the process proceeds to step S607; if vehicle configuration information has not been obtained from OTA Manager 30 (step S606, No), the process proceeds to step S601.

[0070] (Step S607)

[0071] Center 10 determines, based on vehicle configuration information obtained from OTA manager 30, whether the software update process has been successfully completed if no "software update completion report" notification was received from OTA manager 30. This determination is made by checking whether the software version displayed by the target electronic control unit matches the software version of the target electronic control unit shown in the vehicle configuration information, assuming the software update process was successfully completed. If the software update process can be determined to have been successfully completed (step S607, Yes), the process proceeds to step S609; otherwise, if the software update process cannot be determined to have been successfully completed (step S607, No), the process proceeds to step S608.

[0072] (Step S608)

[0073] Center 10 sets the update status it manages to "Update Processing Incomplete," indicating that the software update process is incomplete. Once the update status is set, the update status management process ends.

[0074] (Step S609)

[0075] Center 10 sets its own managed update status to "Update Processing Complete," indicating that the software update process is finished. Once the update status is set, the update status management process ends.

[0076] Center 10 can also report OTA-related results to vehicle manufacturers, i.e., OEMs (Original Equipment Manufacturers), based on the update status of "update processing completed" and "update processing not completed" set in steps S608 and S609 above.

[0077] Figure 7 This is an example of an OTA-related result (display screen) reported by Center 10 to the OEM. Figure 7In the example, the top chart shows the ratio of vehicles eligible for OTA updates (OTA effective) to those not eligible for OTA updates (OTA ineffective) out of all vehicles in the market that are subject to updates (total vehicles subject to updates). The bottom chart shows the implementation ratio of software update processing for vehicles eligible for OTA updates (OTA effective vehicles). Vehicles with an update status of "Update Processing Completed" are included in "Update Completed," and vehicles with an update status of "Update Processing Incomplete" are included in "Not Updated."

[0078] <Function / Effect>

[0079] As described above, in one embodiment of this disclosure, the center 10, during software update processing, advances update statuses sequentially according to a predetermined order when update status notifications are received from the OTA manager 30 in the correct order. When update status notifications are not received from the OTA manager 30 in the correct order, the update status is set based on the most recently received notification (this notification). This prevents the center 10 from mistakenly determining that the software update process has an anomaly.

[0080] Furthermore, in the software update process, when the center 10 of this embodiment cannot receive the final notification, i.e., the software update completion report, it determines whether the software update process has been completed normally based on the vehicle configuration information the next time vehicle configuration information is sent from the vehicle. This prevents the center 10 from mistakenly determining that the software update process has malfunctioned.

[0081] The above describes one embodiment of the present disclosure. However, the present disclosure can be understood not only as a center, but also as an update management method, update management program, or computer-readable non-transitory storage medium storing an update management program executed by a center having a processor and memory.

[0082] The technology disclosed herein can be utilized in network systems used for updating the software of electronic control units.

Claims

1. A software update control center configured to communicate with an over-the-air (OTA) download manager, the OTA manager being configured to control software updates of an electronic control unit installed in a vehicle. The software update control center is characterized by including: The communication unit is configured to receive a notification from the OTA manager indicating the progress of the software update process for the electronic control unit. The OTA manager sends a download completion notification to the software update control center after the software update download is complete. After sending the download completion notification, if a predetermined process is completed, the OTA manager sends a predetermined notification to the software update control center. The combination of the predetermined process and the predetermined notification is at least one of the following: i) obtaining consent to install the software update and the result of obtaining consent to install; ii) the installation process and the installation completion notification; iii) obtaining consent to activate the software update and the result of obtaining consent to activate; iv) the activation process and the activation completion notification. If the software update process is completed after sending the predetermined notification, an update completion notification is sent to the software update control center. and The control unit is configured to manage the update status, which indicates the processing status of the software update process in the vehicle, based on the notification received by the communication unit that indicates the progress of the software update process for the electronic control unit. Even if the update completion notification is received after the download completion notification but without receiving the specified notification, the update status is set based on the update completion notification.

2. The software update control center according to claim 1, characterized in that, The communication unit is configured to receive information indicating the status of the electronic control unit from the OTA manager if it is unable to receive either the specified notification or the update completion notification. The control unit is configured to determine whether the software update process has been completed normally based on the information.

3. An update management method, executed by a computer of a software update control center, the software update control center having a processor and memory and configured to communicate with an over-the-air (OTA) download manager, the OTA manager being configured to control software updates of electronic control units installed in a vehicle. The update management method is characterized by including: The OTA manager receives a notification indicating the progress of the software update process for the electronic control unit. After the software update download is complete, the OTA manager sends a download completion notification to the software update control center. After sending the download completion notification, if a specified process is completed, the OTA manager sends a specified notification to the software update control center. The combination of the specified process and the specified notification is at least one of the following: i) obtaining consent to install the software update and the result of obtaining consent to install; ii) the installation process and the installation completion notification; iii) obtaining consent to activate the software update and the result of obtaining consent to activate; iv) the activation process and the activation completion notification. If the software update process is completed after sending the specified notification, an update completion notification is sent to the software update control center. and The notification, which indicates the progress of the software update process for the electronic control unit, is used to manage the update status, which indicates the processing status of the software update process in the vehicle. in, Managing the update status includes setting the update status based on the update completion notification even if the update completion notification is received after the download completion notification has been received, without having received the specified notification.

4. A non-transitory storage medium storing an update management program, which can be executed by a computer of a software update control center to perform the following functions: the software update control center has a processor and memory and is configured to communicate with an over-the-air (OTA) download manager configured to control software updates of electronic control units installed in a vehicle. The non-transitory storage medium is characterized in that, The functions include: The OTA manager receives a notification indicating the progress of the software update process for the electronic control unit. After the software update download is complete, the OTA manager sends a download completion notification to the software update control center. After sending the download completion notification, if a specified process is completed, the OTA manager sends a specified notification to the software update control center. The combination of the specified process and the specified notification is at least one of the following: i) obtaining consent to install the software update and the result of obtaining consent to install; ii) the installation process and the installation completion notification; iii) obtaining consent to activate the software update and the result of obtaining consent to activate; iv) the activation process and the activation completion notification. If the software update process is completed after sending the specified notification, an update completion notification is sent to the software update control center. and The notification, which indicates the progress of the software update process for the electronic control unit, is used to manage the update status, which indicates the processing status of the software update process in the vehicle. in, Managing the update status includes setting the update status based on the update completion notification even if the update completion notification is received after the download completion notification has been received, without having received the specified notification.

Images