Update management server, update management method and computer readable storage medium

Abstract

The update management server comprises: an acquisition unit, which acquires version information of a program of a mobile body control unit and mobile body information as detected information from a plurality of mobile bodies; and a generation unit, which generates normal range information showing a normal range of the mobile body information for each version of the program of the mobile body control unit based on the version information and the mobile body information, wherein the generation unit generates the normal range information of the first version based on the mobile body information detected in a mobile body whose program of the mobile body control unit is the first version among the plurality of mobile bodies, and in the case of generating the normal range information of the second version newer than the first version, determines that the mobile body information detected when the version of the program of the mobile body control unit among the plurality of mobile bodies is the first version is a mobile body within the normal range of the first version, and generates the normal range information of the second version using the mobile body information detected by the determined mobile body when the version of the program of the mobile body control unit of the determined mobile body is the second version.

Description

Technical Field

[0001] The invention relates to an update management server, an update management method and a computer-readable storage medium. Background Art

[0002] Patent Document 1 discloses an ECU capable of rewriting an application program as an ECU for a vehicle.

[0003] Patent document 1: Japanese Patent Application Publication No. 2020-27666. Summary of the invention

[0004] In a first aspect, an update management server is provided. The update management server includes an acquisition unit that acquires version information of a program of a mobile body control unit that controls at least a part of each mobile body, and mobile body information that is information detected in each mobile body, from each of a plurality of mobile bodies. The update management server includes a generation unit that generates normal range information showing a normal range of the mobile body information for each version of the program of the mobile body control unit based on the version information and the mobile body information acquired by the acquisition unit. The generation unit generates the normal range information of the first version based on the mobile body information detected in a mobile body whose program of the mobile body control unit is a first version among the plurality of mobile bodies. When generating the normal range information of a second version newer than the first version, the generation unit determines that the mobile body information detected when the version of the program of the mobile body control unit is the first version among the plurality of mobile bodies is within the normal range of the first version, and generates the normal range information of the second version using the mobile body information detected by the determined mobile body when the version of the program of the mobile body control unit of the determined mobile body is the second version.

[0005] The acquisition unit may acquire, from each of the plurality of moving bodies, version information of a program of each of the plurality of moving body control units that controls at least a portion of each moving body, and the moving body information. The generation unit may generate the normal range information for each combination of versions of the programs of the plurality of moving body control units based on the version information and the moving body information acquired by the acquisition unit.

[0006] The acquisition unit may also acquire type information indicating the type of hardware of the controlled device controlled by the mobile body control unit. The generation unit may generate normal range information for each combination of the program version of the mobile body control unit and the type of hardware based on the type information acquired by the acquisition unit and the mobile body information.

[0007] The moving object information may include information indicating the moving states of the plurality of moving objects. The generating unit may generate the normal range information for each moving state of the moving object.

[0008] The moving state of the moving object may include at least one of the following: stopped, accelerating, moving at a constant speed, and decelerating.

[0009] The update management server may further include a notification control unit that identifies a mobile body among the plurality of mobile bodies for which mobile body information of a version of the program of the mobile body control unit outside a normal range is detected, and controls notification to a user associated with the identified mobile body.

[0010] The update management server may further include an update restriction unit that restricts rewriting of the program of the mobile body control unit by the program of the second version when the normal range of the first version is a single range and the normal range of the second version is a plurality of ranges.

[0011] The moving object may be a vehicle.

[0012] In a third aspect, an update management method is provided. The update management method comprises: a step of acquiring, from each of a plurality of mobile bodies, version information of a program of a mobile body control unit that controls at least a portion of each mobile body, and mobile body information that is information detected in each mobile body. The update management method comprises: a step of generating normal range information showing a normal range of the mobile body information for each version of the program of the mobile body control unit based on the acquired version information and the mobile body information. The step of generating normal range information showing a normal range of the mobile body information for each version of the program of the mobile body control unit comprises: a step of generating a first version of normal range information based on the mobile body information detected in a mobile body whose program of the mobile body control unit is a first version among the plurality of mobile bodies. The step of generating normal range information showing the normal range of moving body information for each version of the program of the moving body control unit comprises: the step of generating normal range information of a second version which is newer than the first version, wherein the step comprises: the step of determining a moving body among a plurality of moving bodies whose moving body information detected when the version of the program of the moving body control unit is the first version is within the normal range of the first version, and the step of generating the normal range information of the second version using the moving body information detected by the determined moving body when the version of the program of the moving body control unit of the determined moving body is the second version.

[0013] In a fourth aspect, a program is provided. The program causes a computer to execute a step of acquiring version information of a program of a mobile body control unit that controls at least a part of each mobile body, and mobile body information that is information detected in each mobile body, from each of a plurality of mobile bodies. The program causes a computer to execute a step of generating normal range information that shows a normal range of mobile body information for each version of the program of the mobile body control unit based on the acquired version information and mobile body information. The step of generating normal range information that shows a normal range of mobile body information for each version of the program of the mobile body control unit includes a step of generating normal range information of a first version based on mobile body information detected in a mobile body whose program of the mobile body control unit is a first version among a plurality of mobile bodies; and a step of generating normal range information of a second version that is newer than the first version, wherein the step includes a step of determining a mobile body whose mobile body information detected when the version of the program of the mobile body control unit is a first version among a plurality of mobile bodies is within the normal range of the first version, and a step of generating normal range information of a second version using mobile body information detected by a determined mobile body when the version of the program of the mobile body control unit of the determined mobile body is a second version.

[0014] In addition, the above-mentioned invention content does not list all the necessary features of the present invention. In addition, the combination of branch features in the above-mentioned multiple features can also become an invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 An updating system 10 of one embodiment is schematically shown.

[0016] Figure 2 The system configuration and controlled devices included in the control system 200 are schematically shown.

[0017] Figure 3 The system structure of the update management server 70 is shown.

[0018] Figure 4 An example of the data structure of the sensor information managed by the update management server 70 is shown.

[0019] Figure 5 An example of normal range information is schematically shown.

[0020] Figure 6 This is a diagram for explaining determination using the normal range 500.

[0021] Figure 7 An example of normal range information generated for each movement state of the vehicle is schematically shown.

[0022] Figure 8An example of an execution procedure of a process for generating normal range information corresponding to version “V2” of the program of ECU 204 is shown.

[0023] Fig. 9 This is a diagram for explaining a case where distribution of an update program is stopped based on normal range information generated after the program is updated.

[0024] Fig.10 The data structure of the sensor information in the modification example is shown in a data table format.

[0025] Fig.11 An example of a normal range considering the type of hardware is shown.

[0026] Fig.12 An example of a computer 2000 is shown. DETAILED DESCRIPTION

[0027] The present invention will be described below by way of the embodiments of the invention, but the embodiments below are not intended to limit the invention as to the scope of the claims. In addition, all combinations of the features described in the embodiments are not essential to the solution of the invention.

[0028] Figure 1 An update system 10 according to an embodiment is schematically shown. The update system 10 includes a vehicle 20 and an update management server 70. The vehicle 20 includes a control system 200. The control system 200 is responsible for controlling the vehicle 20 and communicating with the update management server 70 via a communication network 90. ​​The communication network 90 includes an IP network such as the Internet, a P2P network, a dedicated line including a VPN, a virtual network, a mobile communication network, and the like.

[0029] In the vehicle 20, the control system 200 has a plurality of ECUs (Electronic Control Units), and the ECUs control the vehicle 20. The control system 200 obtains an update program for the ECUs possessed by the control system 200 from the outside. For example, the control system 200 receives an update program sent from the update management server 70 via the communication network 90 by wireless communication. The control system 200 rewrites the program executed by the ECU possessed by the control system 200 with the update program, thereby reprogramming the ECU possessed by the control system 200. Such reprogramming is performed for the purpose of upgrading the functions of the ECU possessed by the control system 200, etc. In this way, the control system 200 reprograms the ECU via OTA (Over The Air), thereby updating the ECU. In the present embodiment, rewriting the program executed by a device such as an ECU using an update program is referred to as a "program update."

[0030] The update management server 70 transmits the update program to a plurality of vehicles including the vehicle 20. The update management server 70 collects sensor data detected in the vehicles from the plurality of vehicles including the vehicle 20.

[0031] For example, the control system 200 collects information detected by various sensors installed in the vehicle 20. For example, the control system 200 collects sensor data detected by an exhaust sound sensor, an engine speed sensor, and the like. The control system 200 sends the sensor data detected by the various sensors together with the current version information of the program that controls the ECU possessed by the control system 200 to the update management server 70. The update management server 70 uses the sensor data collected from a plurality of vehicles to generate a distribution model of the sensor data for each version of the ECU program, and uses the distribution model to determine normal range information showing the normal range of the sensor data for each version. The update management server 70 notifies the user of the vehicle in which the sensor data that deviates from the normal range is detected, and urges the dealer to check the vehicle.

[0032] Here, after the program of the ECU of the vehicle 20 is updated, the control system 200 sends the sensor data together with the new version of the ECU to the update management server 70. When the sensor data detected in the vehicle 20 before the program update is contained in the normal range of the previous version, the update management server 70 uses the sensor data obtained from the vehicle 20 after the program update to generate the normal range information of the new version. When the program of the ECU is updated, the normal range of the sensor data may change. According to the update management server 70, even in the system in which the program is updated, the sensor data of the vehicle with a high probability of being normal can be used to generate the normal range information of the new version.

[0033] Figure 2 The system configuration and controlled devices included in the control system 200 are schematically shown. The control system 200 includes a TCU 201 , an ECU 202 , an ECU 204 , an ECU 205 , an ECU 206 , an MID 298 , and an IVI 299 .

[0034] ECU 202 communicates with TCU 201, ECU 204, ECU 205, ECU 206, ECU 207, MID 298, and IVI 299 via communication network 280. ECU 202 generally controls TCU 201, ECU 204, ECU 205, ECU 206, ECU 207, MID 298, and IVI 299. Communication network 280 may be configured to include, for example, CAN (Controller Area Network) or Ethernet.

[0035] TCU201 is a telematics control unit. TCU201 is mainly responsible for mobile communication. TCU201 transmits and receives data with update management server 70 based on control of ECU202. TCU201 receives update programs sent from update management server 70 through mobile communication based on control of ECU202. TCU201 can function as a wireless communication unit.

[0036] MID298 is a multi-function information display. IVI299 is, for example, an in-vehicle entertainment program information device (IVI). MID298 and IVI299 can function as a display control unit. IVI299 has a wireless LAN communication function. IVI299 receives the update program sent from the update management server 70 by wireless LAN communication based on the control of ECU202.

[0037] ECU204, ECU205, ECU206 and ECU207 are ECUs that are vehicle control units that control at least a portion of the vehicle 20. ECU204, ECU205, ECU206 and ECU207 are examples of "mobile body control units". ECU204, ECU205, ECU206 and ECU207 control various controlled devices that the vehicle 20 has. Controlled devices are, for example, fuel injection devices, batteries, locking devices, various sensors, and the like. In the present embodiment, ECU204 controls FI294 that is a fuel injection device, and acquires information detected in FI294. In addition, ECU205, ECU206 and ECU207 control sensors such as sensor 295, sensor 296, sensor 297, and acquire sensor data detected by each sensor.

[0038] In the present embodiment, the system structure of the control system 200 including TCU201, ECU202, ECU204, ECU205, ECU206, ECU207, MID298 and IVI299 is illustrated, but the system structure of the control system 200 is not limited to the example of the present embodiment. In addition, in the present embodiment, as an example, it is explained that the mobile body control unit that can be the object of program update is ECU204 and ECU205, and ECU202 functions as an update control device that controls the program update. In addition, the mobile body control unit that can be the object of program update is not limited to these ECUs. The mobile body control unit that can be the object of program update can be any one of TCU201, ECU202, ECU204, ECU205, ECU206, ECU207, MID298 and IVI299.

[0039] ECU202 controls ECU205, ECU206, and ECU207, and acquires sensor data from sensor 295, sensor 296, and sensor 297. In addition, ECU202 maintains the current version information of the program that controls the operation of ECU204 in the internal memory. ECU202 transmits the sensor data collected from sensor 295, sensor 296, and sensor 297 to update management server 70 through TCU201. At this time, ECU202 transmits the current version information of ECU204 and ECU205 to update management server 70.

[0040] Here, the program update is explained. The program update process is explained in the case where the device that becomes the object of the program update is an ECU and the memory used for storing the firmware of the ECU is a single group memory (single bank memory, so-called single-sided ROM). In this case, the program storage area used for storing the firmware of the ECU is one, so when the ECU works according to the program stored in the program storage area, the update program cannot be written to the program storage area. In the case of performing a program update of the ECU, the ECU202 transfers the update program to the ECU, stores the update program in a predetermined data storage area of ​​the ECU, and then instructs the ECU to update the program. When the ECU is instructed to update the program, it executes the control code for performing the program update, writes the update program transferred to the data storage area into the program storage area, and activates the update program. The activation of the update program includes the processing of setting the startup parameters of the ECU so that the update program is loaded when the ECU is started, for example, and the control based on the update program begins.

[0041] Next, the program update process in the case where the internal memory of the ECU is a dual-group memory (dual bank memory, so-called double-sided ROM) is described. In this case, the ECU has two program storage areas for firmware storage, so when the ECU operates according to the program stored in the first program storage area, the update program can be written to the second program storage area. That is, the update program can be written to the second program storage area, which becomes the back side, by so-called back side writing. Therefore, for example, even when the vehicle 20 is traveling, the update program can be written to the second program storage area. Therefore, when the ECU 202 transfers the update program to the ECU, it instructs the ECU to write the update program to the second program storage area. When the writing of the update program to the second program storage area of ​​the ECU is completed, the ECU becomes in a state where the program update of the ECU can be performed. When the ECU 202 performs the program update of the ECU, the ECU 202 instructs the ECU to activate the update program written to the second program storage area. The activation of the update program includes a process of setting the startup parameters of the ECU so that, for example, when the ECU is started, the update program stored in the second program storage area is loaded and control based on the update program is started. For example, activation of the update program includes processing to validate the second program storage area as a program read area and invalidate the first program storage area as a program read area. Thus, "program update" is a concept including instructions to write the update program to the program storage area of ​​the ECU. In addition, "program update" is a concept including instructions to activate the update program written to the program storage area. By completing the activation, the existing program is rewritten as a new update program.

[0042] In the program update of the ECU having the internal memory of the single-bank memory, the ECU may not be able to control the vehicle during the period when the update program is written to the program storage area and the period when the update program is activated. On the other hand, in the program update of the ECU having the internal memory of the dual-bank memory, the ECU can control the vehicle by the program stored in the other surface (active surface) during the period when the update program is written to the program storage area on the back surface (non-active surface).

[0043] Figure 3 1 shows the system configuration of the update management server 70. The update management server 70 includes a communication unit 390, a storage unit 380, and a processing unit 300.

[0044] The processing unit 300 is realized by, for example, a calculation processing device including a processor. The storage unit 380 is realized as a nonvolatile storage medium. The processing unit 300 performs processing using information stored in the storage unit 380. The communication unit 390 is responsible for communication with a plurality of vehicles including the vehicle 20.

[0045] The processing unit 300 includes an acquisition unit 310 , a generation unit 320 , a notification control unit 340 , and an update restriction unit 350 .

[0046] The acquisition unit 310 acquires version information of the program of the ECU that controls at least a part of each vehicle, and vehicle information that is information detected in each vehicle, from each of the plurality of vehicles. The generation unit 320 generates normal range information showing a normal range of vehicle information for each version of the program of the ECU based on the version information and vehicle information acquired by the acquisition unit 310. The generation unit 320 generates the normal range information of the first version based on the vehicle information detected in the vehicle whose ECU program is the first version among the plurality of vehicles, and in the case of generating the normal range information of the second version newer than the first version, determines that the vehicle information detected when the version of the program of the ECU among the plurality of vehicles is the first version is a vehicle within the normal range of the first version, and generates the normal range information of the second version using the vehicle information detected by the determined vehicle when the version of the program of the ECU of the determined vehicle is the second version.

[0047] The acquisition unit 310 may acquire, from each of the plurality of vehicles, version information of a program of each of the plurality of ECUs that controls at least a portion of each of the plurality of vehicles, and vehicle information. The generation unit 320 may generate normal range information for each combination of the program versions of the plurality of ECUs based on the version information and vehicle information acquired by the acquisition unit 310.

[0048] The acquisition unit 310 may also acquire type information indicating the type of hardware of the controlled device controlled by the ECU. The generation unit 320 may generate normal range information for each combination of the ECU program version and the type of hardware based on the type information acquired by the acquisition unit 310 and the vehicle information.

[0049] The vehicle information may include information showing the movement states of a plurality of vehicles. The generator 320 may generate the normal range information for each movement state of the vehicle.

[0050] The moving state of the vehicle may include at least one of: stopped, accelerating, moving at a constant speed, and decelerating.

[0051] The notification control unit 340 determines a vehicle among a plurality of vehicles for which vehicle information outside the normal range of the version of the ECU program is detected, and controls notification to a user associated with the determined vehicle. The update restriction unit 350 restricts rewriting of the ECU program by the second version program when the normal range of the first version is a single range and the normal range of the second version is a plurality of ranges.

[0052] Figure 4 1 shows an example of the data structure of the sensor information managed by the update management server 70. The sensor information is stored in the storage unit 380. The sensor information includes "VIN", "program version 1", and "program version 2".

[0053] "VIN" is information for identifying a vehicle. "Program version 1" is, for example, version information of a program of ECU 204. "Program version 2" is, for example, version information of a program of ECU 206. Sensor information is sensor data detected by sensors 295 to 297. In vehicle 20, ECU 202 transmits VIN, program version 1, and program version 2 to update management server 70 when transmitting sensor data detected by sensors 295 to 297 to update management server 70. Acquisition unit 310 stores sensor data acquired from each vehicle in sensor information.

[0054] Figure 5 An example of normal range information is schematically shown. Figure 5 The normal range 500 shows a normal range in a two-dimensional space having exhaust noise and engine speed as parameters. Figure 5 (V1, V1) shows a normal range of information detected when the version of the program of ECU 204 is V1 and the version of the program of ECU 206 is V1.

[0055] An overview of the processing in the case of determining the normal range 500 is described. The generation unit 320 of the update management server 70 extracts data on exhaust noise and engine speed for each combination of program versions from the sensor data stored in the sensor information. For example, the generation unit 320 obtains data corresponding to (program version 1, program version 2) = (V1, V1) from the sensor information. The generation unit 320 uses the obtained data to draw in a two-dimensional space, which uses exhaust noise and engine speed as parameters. The generation unit 320 generates a distribution model by a method such as kernel density estimation, and the distribution model represents the density distribution in the two-dimensional space using exhaust noise and engine speed as parameters. The generation unit 320 determines the normal range 500 based on the distribution model. For example, the generation unit 320 determines the range in which the distribution density is higher than a predetermined value in the two-dimensional space using exhaust noise and engine speed as parameters as the normal range 500.

[0056] When the exhaust noise and engine speed data collected from the vehicle are plotted in the two-dimensional space of exhaust noise and engine speed, as long as they are within the normal range 500, it can be determined that the sensor data is within the normal range. On the other hand, when the exhaust noise and engine speed are not within the normal range 500, it can be determined that the sensor data is not within the normal range. In addition, in the present embodiment, exhaust noise and engine speed are exemplified as sensor data, but the modeled data is not limited thereto, and may be various sensor values ​​(including information based on sensor values) acquired by equipment mounted on the vehicle, and information related to the control state of the control device. For example, in addition to vehicle speed, acceleration, angular velocity, engine temperature, and battery temperature, it is also possible to apply accelerator throttle opening sensor value, atmospheric pressure sensor value, brake switch, travel distance, radiator water temperature sensor value, engine running time, oxygen sensor value, air-fuel ratio sensor value, intake air temperature at start-up, battery voltage, gear position, intake air temperature sensor, information related to engine idle stop mode, ignition timing, ignition input voltage, counts of misfires detected based on pulse changes from the immobilizer, crank sensor, crank sensor, top dead center sensor pulse undetected counts, purge control solenoid valve operating percentage, cooling water temperature sensor values ​​of the engine / inverter, etc., starter crank, torque converter slip ratio, fuel cut control status, air flow sensor value, Idle speed control state, misfire sensing learning state, ignition timing correction value for knock control, short-term correction for fuel supply, long-term correction for fuel supply, ignition timing delay for knock prevention, carbon deposition rate of drive-by-wire throttle, idle speed correction value, exhaust gas recirculation device valve opening value, exhaust gas recirculation device valve opening indication value, exhaust gas recirculation device valve opening sensor value, cylinder misfire detection state, crank sensor noise count value, top dead center sensor pulse noise count value, crank sensor sensing misfire count value, throttle valve opening, idle speed control target throttle valve opening value, throttle valve opening target value, injector control state, target idle speed, cooling water temperature at start-up, variable valve timing control CAM angle, variable valve timing control solenoid control state, etc. As a result, vehicle data can be collected with various evaluation axes, and thus, the determination of the problem can be verified from various angles.

[0057] Figure 6 500 is a diagram for explaining the judgment using the normal range. The exhaust noise and engine speed corresponding to the sensor data (V1, V1) collected from a certain vehicle are plotted in a two-dimensional space. Figure 6 The data point 600 is shown in FIG. 5 . Since the data point 600 is within the normal range 500, the exhaust noise and the engine speed of the sensor data detected from the vehicle can be regarded as normal.

[0058] On the other hand, the exhaust noise and engine speed corresponding to the sensor data (V1, V1) collected from a certain vehicle are plotted in two-dimensional space. Figure 6 The data point 610 is located at a position shown in FIG. 5 . Since the data point 610 is outside the normal range 500 , the notification control unit 340 notifies the user of the vehicle of a message urging the dealer to inspect the vehicle.

[0059] Figure 7 An example of normal range information generated for each vehicle movement state is schematically shown. Figure 7 In the example, "stopped", "accelerating", "driving at a constant speed", and "decelerating" are shown as the moving states. The generating unit 320 determines the moving state of the vehicle based on the acceleration data and speed data collected from the vehicle. In addition to each combination of the ECU program version, the generating unit 320 also generates normal range information for each moving state. In addition, the generating unit 320 uses not only Figure 5 and Figure 6 In addition, the sensor data of the combination of the exhaust noise and the engine speed illustrated in the example above are used to generate a plurality of normal range information for each moving state. This enables a more detailed judgment according to the moving state of the vehicle.

[0060] Figure 8 An example of an execution process of a process for generating normal range information corresponding to version "V2" of the program of ECU204 is shown. In S702, the generation unit 320 refers to the sensor information and identifies the vehicle that has detected sensor data within the normal range in the state of (V1, V1) in the past before the program of ECU204 is updated. In S704, the generation unit 320 collects the sensor data detected by the vehicle determined in S702 in the state of (V2, V1). In S706, the generation unit 320 generates normal range information of (V2, V1) using the sensor data collected in S704. In this way, it is possible to extract the vehicle that detected sensor data within the normal range before the program is updated, and generate normal range information using the sensor data detected by the extracted vehicle in the state after the program is updated. Therefore, it is possible to appropriately judge whether the sensor data is within the normal range for the vehicle that has undergone the program update.

[0061] Fig. 9 FIG. 2 is a diagram for explaining a case where the distribution of an update program is stopped based on normal range information generated after the program is updated. Fig. 9As shown, a single range is shown with respect to the normal range 500 in (V1, V1), and the normal range in (V2, V1) is separated into a first normal range 910 and a second normal range 920. In this way, the normal range generated from the sensor data detected before the program update is a single range, and on the other hand, the normal range generated from the sensor data detected after the program update is separated into a plurality of ranges. In this case, the update restriction unit 350 does not release the update program of version V2 of the ECU 204 to the vehicle 20.

[0062] The reason why the normal range is divided into a plurality of ranges may be due to differences in sensor manufacturers, etc. For example, it is considered that the normal range may be divided into a plurality of ranges because sensors manufactured by different manufacturers cannot be correctly controlled by the updated program. Therefore, by stopping the distribution of the update program to the vehicle 20, the distribution of the update program to a plurality of vehicles can be suppressed.

[0063] Fig.10 The data structure of the sensor information in the modification example is shown in a data table format. Fig.10 The sensor information shown is Figure 4 In addition to the data items possessed by the sensor information shown, there is also a data item of "hardware type". It is assumed that "hardware type" is information that determines the type of hardware of sensor 296. As described above, sensors are sometimes provided by multiple manufacturers. In this case, the normal range sometimes differs for each manufacturer of the sensor. In order to cope with this situation, the vehicle sends the sensor data and data including the hardware type of the sensor to the update management server 70. Then, the generation unit 320 generates a normal range according to each arbitrary combination of the program version and the hardware type. In addition, the hardware type is a concept that includes the version of the hardware.

[0064] In addition, not only when the normal range is separated due to the program update, but also when the shape, size, and position of the normal range are completely different before and after the program update, the update restriction unit 350 can stop issuing the update program to the vehicle 20. For example, when the area of ​​the normal range before the program update and the normal range after the program update overlap in the two-dimensional space is smaller than a predetermined value, the update program can be stopped from being issued to the vehicle 20.

[0065] Fig.11 An example of a normal range considering the hardware type is shown. Fig.11, (V1, V1, H1) shows that the program version of ECU204 is V1, and the program version of ECU206 is V1, and the type of sensor 295 is H1. (V1, V1, H2) shows that the program version of ECU204 is V1, and the program version of ECU206 is V1, and the type of sensor 295 is H2. The normal range 1110 shows the normal range generated by the generation unit 320 based on the sensor data detected in the vehicle of the combination of (V1, V1, H1). The normal range 1120 shows the normal range generated by the generation unit 320 based on the sensor data detected in the vehicle of the combination of (V1, V1, H2).

[0066] Thus, for different vehicles whose hardware types can be known in advance, the difference caused by the hardware type can be reflected and determined in the normal range. Therefore, it is possible to appropriately determine that each vehicle is within the normal range in consideration of the difference in hardware possessed by each vehicle.

[0067] As described above, according to the update management server 70, when generating the normal range information of a new version, the sensor data detected after the program update collected from the vehicle that could detect the sensor data within the normal range before the program update can be used to generate the normal range information of the new version. Therefore, even in the system in which the program is being updated, the sensor data of the vehicle with a high probability of being normal can be used to generate the normal range information of the new version.

[0068] In addition, Figure 3 In the implementation method described below, the case of generating normal range information for each combination of program versions of two ECUs is mainly described. However, it is possible to generate normal range information for each combination of two or more program versions, or to generate normal range information for each program version of one ECU. In addition, it is also possible to generate normal range information for each combination of two or more hardware types.

[0069] Vehicle 20 is a vehicle as an example of transportation equipment. The vehicle may be a car with an internal combustion engine, an electric car, a fuel cell vehicle (FCV), or the like. Cars include buses, trucks, two-wheeled vehicles, and the like. The vehicle may be a saddle-type vehicle or a motorcycle. As transportation equipment, in addition to vehicles, there are also aircraft including drones, ships, and other equipment. Transportation equipment may be any equipment that transports people or goods. Transportation equipment is an example of a mobile body. The mobile body is not limited to transportation equipment, and may be any movable equipment.

[0070] Fig.12An example of a computer 2200 that can embody multiple embodiments of the present invention in whole or in part is shown. The program installed in the computer 2200 can make the computer 2000 function as a system or parts of the system such as a control system involved in the embodiment, or a device such as an update management server 70 or parts of the device, can make the computer 2000 perform operations related to the system or parts of the system, or the device or parts of the device, and / or can make the computer 2000 perform a process or steps of the process involved in the embodiment. Such a program may be executed by the CPU 2012 for the purpose of making the computer 2000 perform certain operations related to the processing steps described in this specification and some or all items in the blocks of the block diagram.

[0071] The computer 2000 of this embodiment includes a CPU 2012 and a RAM 2014, which are interconnected by a main controller 2010. The computer 2000 also includes a ROM 2026, a flash memory 2024, a communication interface 2022, and an input / output chip 2040. The ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040 are connected to the main controller 2010 via the input / output controller 2020.

[0072] CPU 2012 operates according to the programs stored in ROM 2026 and RAM 2014 to control each unit.

[0073] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 stores programs and data that can be used by the CPU 2012 in the computer 2000. The ROM 2026 stores a boot program executed by the computer 2000 when activated, and / or a program that depends on the hardware of the computer 2000. The input / output chip 2040 can also connect various input / output units such as a keyboard, a mouse, and a display to the input / output controller 2020 via an input / output port such as a serial port, a parallel port, a keyboard port, a mouse port, a display port, a USB port, and an HDMI (registered trademark) port.

[0074] The program is provided via a computer-readable storage medium such as a CD-ROM, DVD-ROM or memory card or a network. RAM 2014, ROM 2026 or flash memory 2024 is an example of a computer-readable storage medium. The program is installed to flash memory 2024, RAM 2014 or ROM 2026 and executed by CPU 2012. The information processing described in the above programs is read to computer 2000, providing a link between the program and the various types of hardware resources described above. The device or method can be constituted by a process of realizing the operation or processing of information as the computer 2000 is used.

[0075] For example, in the case of performing communication between the computer 2000 and the update management server, the CPU 2012 may execute the communication program loaded in the RAM 2014, and based on the process described in the communication program, instruct the communication process to the communication interface 2022. Under the control of the CPU 2012, the communication interface 2022 reads the transmission data stored in the transmission buffer processing area provided in the recording medium such as the RAM 2014 and the flash memory 2024, and transmits the read transmission data to the network, and writes the reception data received from the network to the reception buffer processing area provided on the recording medium, etc.

[0076] Alternatively, the CPU 2012 may perform various processes on the data on the RAM 2014 so that all or a required portion of a file or database stored in a recording medium such as the flash memory 2024 is read into the RAM 2014. The CPU 2012 then writes the processed data back to the recording medium.

[0077] It can be that various types of information such as various types of programs, data, data tables and databases are stored in the recording medium and subjected to information processing. CPU2012 can perform various operations recorded in this specification and specified by the instruction sequence of the program, including various processing including information processing, conditional judgment, conditional branching, unconditional branching, information retrieval / replacement, etc., for the data read out from RAM2014, and write the results back to RAM2014. In addition, CPU2012 can retrieve information in files, databases, etc. in the recording medium. For example, in the case where multiple entries are stored in the recording medium and the multiple entries respectively have attribute values ​​of the first attribute related to the attribute value of the second attribute, it can be that CPU2012 retrieves an entry consistent with the condition specified by the attribute value of the first attribute from the multiple entries, and reads the attribute value of the second attribute stored in the entry, thereby obtaining the attribute value of the second attribute related to the first attribute that meets the predetermined condition.

[0078] The program or software module described above may be stored in a computer-readable storage medium on or near the computer 2000. A recording medium such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet can be used as a computer-readable storage medium. The program stored in the computer-readable storage medium may be provided to the computer 2000 via a network.

[0079] Programs installed in the computer 2000 and causing the computer 2000 to function as the control system 200 can be run in the CPU 2012 and the like, causing the computer 2000 to function as respective parts of the update management server 70. The information processing described in these programs is read into the computer 2000, and thus the respective parts of the update management server 70 function as specific means for the software to work in cooperation with the various hardware resources described above. Then, by using these specific means to realize the calculation or processing of information corresponding to the purpose of use of the computer 2000 in this embodiment, a unique control system 200 corresponding to the purpose of use can be constructed.

[0080] Various embodiments are described with reference to block diagrams and the like. In a block diagram, each block may represent (1) steps of a process in which an operation is performed or (2) parts of a device that performs an operation. Specific steps and parts may be implemented by dedicated circuits, programmable circuits supplied with computer-readable instructions stored on a computer-readable storage medium, and / or processors supplied with computer-readable instructions stored on a computer-readable storage medium. Dedicated circuits may include digital circuits and / or analog hardware circuits, and may include integrated circuits (ICs) and / or discrete circuits. Programmable circuits may include logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logical operations, including reconfigurable hardware circuits such as flip-flops, registers, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and the like.

[0081] A computer-readable storage medium may include any tangible device capable of storing instructions to be executed by an appropriate device, and as a result, a computer-readable storage medium having instructions stored therein constitutes at least a portion of a product containing the following instructions, which can be executed for the purpose of providing a means for performing the operations specified by the process sequence or block diagram. Examples of computer-readable storage media include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, etc. More specific examples of computer-readable storage media include Floppy (registered trademark) floppy disks, optical disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), electrically erasable programmable read-only memories (EEPROM), static random access memories (SRAM), compact disk read-only memories (CD-ROM), digital versatile disks (DVD), Blu-ray (RTM) disks, memory sticks, integrated circuit cards, etc.

[0082] Computer readable instructions may include assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or any source code or object code described using any combination of one or more programming languages ​​including object-oriented programming languages ​​such as Smalltalk, JAVA (registered trademark), C++, and existing procedural programming languages ​​such as the "C" programming language or similar programming languages.

[0083] The computer readable instructions may be provided to a processor or programmable circuit of a general-purpose computer, a special-purpose computer, or other programmable data processing device via a local area network (LAN), a wide area network (WAN) such as the Internet, and the computer readable instructions are executed for the purpose of providing a means for performing the operations specified by the described processing steps or block diagrams. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, etc.

[0084] The present invention is described above using the embodiments, but the technical scope of the present invention is not limited to the scope described in the above embodiments. For those skilled in the art, it is known that various changes or improvements can be applied to the above embodiments. According to the description of the scope of the claim for protection, the embodiments made by applying the above changes or improvements can also be included in the technical scope of the present invention.

[0085] It should be noted that, as for the execution order of each process such as work, process, step and stage in the apparatus, system, program and method shown in the scope of the claims, the specification and the drawings, unless the words such as "before" or "prior to" are specifically stated, and it is not stated that the output of the previous process is used in the subsequent process, they can be implemented in any order. Regarding the scope of the claims, the specification and the drawings, the workflow is described using "first," "second," etc. for convenience, but even so, it does not mean that it must be implemented in this order.

[0086] Description of Reference Numerals

[0087] 10. Update the system

[0088] 20 Vehicles

[0089] 70 Update Management Server

[0090] 90 Communication Network

[0091] 200 Control System

[0092] 201 TCU

[0093] 202 ECU

[0094] 204 ECU

[0095] 205 ECU

[0096] 206 ECU

[0097] 207 ECU

[0098] 280 Communication Network

[0099] 294 FI

[0100] 295, 296, 297 Sensors

[0101] 298 MID

[0102] 299 IVI

[0103] 310 Acquisition Department

[0104] 320 Generation Department

[0105] 340 Notification Control Department

[0106] 350 Update Restriction Department

[0107] 2000 Computer

[0108] 2010 Main Controller

[0109] 2012 CPU

[0110] 2014 RAM

[0111] 2020 Input / Output Controller

[0112] 2022 Communication Interface

[0113] 2024 Flash Memory

[0114] 2026 ROM

[0115] 2040 Input / Output Chip.

Claims

1. An update management server, wherein: have: an acquisition unit that acquires, from each of the plurality of moving bodies, version information of a program of a moving body control unit that controls at least a portion of each moving body, and moving body information that is information detected in each moving body; as well as a generating unit that generates normal range information indicating a normal range of the moving body information for each version of the program of the moving body control unit based on the version information and the moving body information acquired by the acquiring unit, The generating unit generates the normal range information of the first version based on the moving body information detected in a moving body whose program of the moving body control unit is the first version among the plurality of moving bodies, When the generating unit generates normal range information of a second version which is newer than the first version, determining that among the plurality of moving bodies, when the version of the program of the moving body control unit is the first version, the moving body information detected is a moving body within the normal range of the first version, The normal range information of the second version is generated using the moving body information detected by the specified moving body when the version of the program of the moving body control unit of the specified moving body is the second version.

2. The update management server according to claim 1, wherein: The acquisition unit acquires, from each of the plurality of moving bodies, version information of a program of each of a plurality of moving body control units that controls at least a part of each of the moving bodies, and the moving body information, The generating unit generates the normal range information for each combination of versions of the programs of the plurality of moving body control units based on the version information and the moving body information acquired by the acquiring unit.

3. The update management server according to claim 1 or 2, wherein: The acquisition unit further acquires type information indicating the type of hardware of the controlled device controlled by the mobile object control unit. The generating unit generates the normal range information for each combination of a version of a program of the moving body control unit and a type of the hardware based on the type information acquired by the acquiring unit and the moving body information.

4. The update management server according to claim 1 or 2, wherein: The moving body information includes information showing the moving states of the plurality of moving bodies, The generating unit generates the normal range information for each moving state of the moving object.

5. The update management server according to claim 1 or 2, wherein: The moving state of the moving object includes at least one of the following: stopped, accelerated, moving at a constant speed, and decelerated.

6. The update management server according to claim 1 or 2, wherein: A notification control unit is further provided for identifying a mobile body among the plurality of mobile bodies for which the mobile body information of a version of a program of the mobile body control unit outside a normal range is detected, and controlling notification to a user associated with the identified mobile body.

7. The update management server according to claim 1 or 2, wherein: The system further includes an update restriction unit configured to restrict rewriting of the program of the moving body control unit by the program of the second version when the normal range of the first version is a single range and the normal range of the second version is a plurality of ranges.

8. The update management server according to claim 1 or 2, wherein: The moving object is a vehicle.

9. An update management method, wherein: have: A step of acquiring, from each of a plurality of moving bodies, version information of a program of a moving body control unit that controls at least a part of each moving body, and moving body information that is information detected in each moving body; as well as a step of generating normal range information showing a normal range of the moving body information for each version of the program of the moving body control unit based on the acquired version information and the moving body information, The step of generating normal range information indicating a normal range of the moving body information for each version of the program of the moving body control unit comprises: a step of generating the normal range information of the first version based on the moving body information detected in a moving body of the plurality of moving bodies, the program of the moving body control unit of which is the first version; as well as A step of generating normal range information of a second version newer than the first version, wherein the step comprises: a step of determining, among the plurality of mobile bodies, a mobile body whose mobile body information is detected when the version of the program of the mobile body control unit is the first version as a mobile body within the normal range of the first version; and generating the normal range information of the second version using the moving body information detected by the determined moving body when the version of the program of the moving body control unit of the determined moving body is the second version.

10. A computer-readable storage medium storing a program, wherein: The program causes the computer to execute the following steps: A step of acquiring, from each of a plurality of moving bodies, version information of a program of a moving body control unit that controls at least a part of each moving body, and moving body information that is information detected in each moving body; as well as a step of generating normal range information indicating a normal range of the moving body information for each version of the program of the moving body control unit based on the acquired version information and the moving body information, The step of generating normal range information indicating a normal range of the moving body information for each version of the program of the moving body control unit comprises: a step of generating the normal range information of the first version based on the moving body information detected in a moving body among the plurality of moving bodies, the program of the moving body control unit of which is the first version; as well as A process for generating normal range information of a second version that is newer than the first version, wherein the process comprises: a process for determining a mobile body within the normal range of the plurality of mobile bodies, the mobile body information detected as the first version when the version of the program of the mobile body control unit is the first version, and a process for generating the normal range information of the second version using the mobile body information detected by the determined mobile body when the version of the program of the mobile body control unit of the determined mobile body is the second version.

Images