Ota manager, system, method, non-transitory storage medium, and vehicle

Abstract

The present application relates to an OTA manager, a system, a method, a non-transitory storage medium, and a vehicle, which controls software update of an electronic control unit mounted on a vehicle, the OTA manager including: a communication unit that independently receives, from a center, a distribution data packet of update data for an electronic control unit mounted with a first category of nonvolatile memory having one storage area and a distribution data packet of update data for an electronic control unit mounted with a second category of nonvolatile memory having two storage areas; and a control unit that preferentially transfers update data for an electronic control unit mounted with the second category of nonvolatile memory to the electronic control unit that is an update target, as compared with update data for an electronic control unit mounted with the first category of nonvolatile memory.

Description

Technical Field

[0001] This disclosure relates to an OTA manager, system, method, non-transitory storage medium, and vehicle for controlling software updates of electronic control units. Background Technology

[0002] The vehicle is equipped with multiple electronic control units (ECUs) for controlling the vehicle's movements. Each ECU has a processor, temporary storage such as RAM, and non-volatile storage such as flash ROM (non-volatile memory). The processor executes software stored in the non-volatile memory to implement the ECU's control functions. The software stored in each ECU can be rewritten; by updating to a newer version of the software, the functionality of each ECU can be improved, and new vehicle control functions can be added.

[0003] As a technology for updating the software of electronic control units (ECUs), OTA (Over-The-Air) technology is known: This involves wirelessly connecting an in-vehicle communication device connected to the vehicle network to a communication network such as the Internet. The device responsible for updating the vehicle's software downloads software from a server via wireless communication and installs the downloaded software into the ECU, thus updating or adding software to the ECU. For example, see Japanese Patent Application Laid-Open No. 2004-326689.

[0004] As a type of non-volatile memory integrated into electronic control units (ECUs), there are memory types with one storage area for storing data such as software (single-library memory) and memory types with two storage areas for storing data such as software (dual-library memory). The type used may vary depending on the specifications of the ECU. ECUs equipped with dual-library memory can store two versions of data, old and new, in two separate storage areas.

[0005] In vehicle software update events, there are two types of electronic control units (ECUs): one with a single-database memory and the other with a dual-database memory. The recovery methods for update failures differ between the ECUs with single and dual-database memories due to the different memory configurations.

[0006] Therefore, when an activity involving both electronic control units with single-database memory and electronic control units with dual-database memory are applied to a vehicle as electronic control units to be updated, if the download and installation are not performed according to the memory structure of the electronic control unit to be updated, there is a possibility that time may be spent until the electronic control unit with the updated software starts up normally. Summary of the Invention

[0007] The purpose of this disclosure is to provide an OTA manager, system, method, non-transitory storage medium, and vehicle capable of performing software updates adapted to single-library memory and dual-library memory.

[0008] The first aspect of this disclosure is an OTA manager for controlling software updates of electronic control units (ECUs) installed in vehicles. The OTA manager comprises: a communication unit that independently receives, from a central location, distribution data packets for update data to ECUs equipped with a first type of non-volatile memory having one storage area, and distribution data packets for update data to ECUs equipped with a second type of non-volatile memory having two storage areas; and a control unit that, compared to update data to ECUs equipped with the first type of non-volatile memory, prioritizes transmitting update data to ECUs equipped with the second type of non-volatile memory to the ECUs to be updated.

[0009] In the first method described above, the communication unit can obtain category information from the center indicating whether the non-volatile memory mounted on the electronic control unit is of the first category or the second category.

[0010] In the first method described above, the OTA manager may also include a storage device configured to store the aforementioned category information.

[0011] In the first method described above, the control unit can transfer the updated data received by the communication unit to the electronic control unit that is the object of the update based on the category information described above.

[0012] The second aspect of this disclosure relates to a system comprising: an OTA manager for controlling software updates of electronic control units (ECUs) installed in a vehicle; and a center configured to communicate with the OTA manager. The center includes a first communication unit that sends distribution data packets for update data of the ECUs equipped with a first type of non-volatile memory having one storage area, and distribution data packets for update data of the ECUs equipped with a second type of non-volatile memory having two storage areas, to the OTA manager. The OTA manager includes: a second communication unit that independently receives distribution data packets for update data of the ECUs equipped with the first type of non-volatile memory, and distribution data packets for update data of the ECUs equipped with the second type of non-volatile memory, from the center; and a control unit configured to, rather than receiving update data of the ECUs equipped with the first type of non-volatile memory via the distribution data packets, preferably forward update data of the ECUs equipped with the second type of non-volatile memory received via the distribution data packets to the ECUs to which the update is to be performed.

[0013] In the second approach described above, at least one of the center and the OTA manager may include a storage device for storing category information indicating whether the non-volatile memory mounted on the electronic control unit is of the first or second category.

[0014] The third aspect of this disclosure is a method performed by an OTA manager that has a processor and memory and controls software updates of electronic control units installed in a vehicle. The method includes: independently receiving, from a central location, a distribution data packet for update data of the aforementioned electronic control unit equipped with a first type of non-volatile memory having one storage area, and a distribution data packet for update data of the aforementioned electronic control unit equipped with a second type of non-volatile memory having two storage areas; and prioritizing the transfer of update data of the aforementioned electronic control unit equipped with the second type of non-volatile memory to the electronic control unit that is to be updated, compared to the update data of the aforementioned electronic control unit equipped with the first type of non-volatile memory.

[0015] The fourth aspect of this disclosure is a non-transitory storage medium that stores commands that can be executed by the processor of an OTA manager, which has a processor and memory and controls software updates of electronic control units installed in a vehicle, and that causes the processor to perform functions. These functions include: independently receiving, from a central location, distribution data packets for update data of the electronic control unit equipped with a first type of non-volatile memory having one storage area, and distribution data packets for update data of the electronic control unit equipped with a second type of non-volatile memory having two storage areas; and prioritizing the transfer of update data of the electronic control unit equipped with the second type of non-volatile memory to the electronic control unit that is to be updated, compared to update data of the electronic control unit equipped with the first type of non-volatile memory.

[0016] The fifth method disclosed herein is a vehicle equipped with the aforementioned OTA manager.

[0017] According to the various embodiments of this disclosure, OTA managers, systems, methods, non-transitory storage media, and vehicles are capable of providing software updates (downloads, installations) adapted to single-library storage and dual-library storage. Attached Figure Description

[0018] Hereinafter, the features, advantages, technical and industrial importance of exemplary embodiments of the present invention will be described with reference to the accompanying drawings, in which the same reference numerals denote the same constituent elements, wherein:

[0019] Figure 1 It is a block diagram showing the overall structure of the network system involved in the implementation method.

[0020] Figure 2 It is a block diagram representing the simplified structure of the center.

[0021] Figure 3 This is the central functional block diagram.

[0022] Figure 4 This is a block diagram representing a simplified structure of the OTA manager.

[0023] Figure 5 This is a functional block diagram of the OTA Manager.

[0024] Figure 6A This is a block diagram illustrating an example of a simplified structure of an electronic control unit.

[0025] Figure 6B This is a block diagram illustrating an example of a simplified structure of an electronic control unit.

[0026] Figure 7 This is a diagram representing an example of category information.

[0027] Figure 8 This is a flowchart example of the download processing steps performed by the center and OTA manager.

[0028] Figure 9 This is a flowchart example of the installation process steps performed by the OTA manager and the target electronic control unit.

[0029] Figure 10 This is a flowchart example of the activation process steps performed by the OTA manager and the target electronic control unit. Detailed Implementation

[0030] In the network system disclosed herein, the OTA manager receives update data from the center for electronic control units (ECUs) equipped with single-library memory and for ECUs equipped with dual-library memory via independent distribution data packets. It prioritizes the installation of update data for ECUs equipped with dual-library memory over the installation of update data for ECUs equipped with single-library memory. This enables software updates adapted to both single-library and dual-library memory systems.

[0031] Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the accompanying drawings.

[0032] Implementation

[0033] structure

[0034] Figure 1 This is a block diagram illustrating the overall structure of a network system according to one embodiment of this disclosure. Figure 1 The network system shown is used to update the software of multiple electronic control units 40a to 40d installed in the vehicle, and has a center 10 located outside the vehicle and an in-vehicle network 20 built inside the vehicle.

[0035] (1) Center

[0036] The center 10 can communicate with the OTA manager 30 (described later) of the vehicle network 20 via the network 70. The center 10 can send software update data for the electronic control units 40a-40d and receive notifications indicating the progress of software update processing, and control and manage the software updates of multiple electronic control units 40a-40d connected to the OTA manager 30. The center 10 functions as a server.

[0037] Figure 2 It means Figure 1 A simplified block diagram of the structure of center 10. (See diagram below.) Figure 2As illustrated, the center 10 includes a CPU (Central Processing Unit) 11, RAM (Random Access Memory) 12, a storage device 13, and a communication device 14. The storage device 13 is a device equipped with a read / write storage medium such as a hard disk drive (HDD) or a solid-state drive (SSD), storing programs for executing software update management, information used in software update control and management, and software update data for each electronic control unit. In the center 10, the CPU 11 executes the programs read from the storage device 13 using the RAM 12 as its operating area to perform the required processing related to software updates. The communication device 14 is used for communication via... Figure 1 The device shown is a network 70 that communicates with an OTA manager 30.

[0038] Figure 3 yes Figure 2 The functional block diagram of center 10 is shown. Figure 3 The illustrated center 10 includes a storage unit 16, a communication unit 17, and a control unit 18. The functions of the storage unit 16 are achieved through... Figure 2 The storage device 13 shown is used for implementation. The functions of the communication unit 17 and the control unit 18 are achieved through... Figure 2 The CPU 11 shown uses RAM 12 to execute programs stored in storage device 13.

[0039] The storage unit 16 stores information related to software update processing for one or more electronic control units (ECUs) installed in the vehicle. As information related to software update processing, the storage unit 16 stores at least update management information and software update data for ECUs 40a-40d that are associated with information indicating the software available in each ECU (Vehicle Identification Number) for the identified vehicle. For example, the information indicating the software available in ECUs 40a-40d can be a combination of the latest version information of each software in multiple ECUs 40a-40d. Furthermore, as information related to software update processing, the storage unit 16 can store update status indicating the update status of the software being implemented in the vehicle. Additionally, the storage unit 16 can store information related to the type of non-volatile memory installed in each of the multiple ECUs 40a-40d (described later).

[0040] The communication unit 17 functions as both a transmitter and a receiver for sending and receiving data, information, and requests with the OTA manager 30. The communication unit 17 receives software update confirmation requests from the OTA manager 30 (receiving unit). An update confirmation request, for example, is information sent from the OTA manager 30 to the center 10 when the vehicle's power or ignition is turned on (hereinafter referred to as "power on"), and is used to request the center 10 to confirm the existence of update data for the electronic control units 40a-40d based on the vehicle configuration information described later. Furthermore, in response to the update confirmation request received from the OTA manager 30, the communication unit 17 sends information indicating the presence or absence of update data to the OTA manager 30 (transmitting unit). Additionally, the communication unit 17 receives transmission requests (download requests) for distribution data packets from the OTA manager 30 (receiving unit). Furthermore, if the communication unit 17 receives a download request for a distribution data packet, it sends a distribution data packet containing the software update data for the electronic control units 40a-40d generated in the control unit 18 described later to the OTA manager 30 (transmitting unit).

[0041] If the communication unit 17 receives an update confirmation request from the OTA manager 30, the control unit 18 determines, based on the update management information stored in the storage unit 16, whether software update data exists for the electronic control units 40a-40d installed in the vehicle whose vehicle ID is included in the update confirmation request. The determination result of whether update data exists by the control unit 18 is sent by the communication unit 17 to the OTA manager 30. If the control unit 18 determines that software update data for the electronic control units 40a-40d exists, and a download request for a distribution data packet is received from the OTA manager 30, a distribution data packet for the corresponding update data is generated and stored in the storage unit 16.

[0042] The control unit 18 independently generates distribution data packets for update data only for electronic control units equipped with single-library memory (described later) and distribution data packets for update data only for electronic control units equipped with dual-library memory (described later). If the category information described later is pre-stored in the storage unit 16, the control unit 18 can intentionally and independently generate distribution data packets for update data of different categories. By generating distribution data packets for update data separately based on such categories, distribution data packets for update data of electronic control units equipped with non-volatile memory of the first category and distribution data packets for update data of electronic control units equipped with non-volatile memory of the second category can be independently sent from the center 10 (communication unit 17) to the OTA manager 30.

[0043] (2) In-vehicle network

[0044] The vehicle network 20 includes an OTA manager 30, multiple electronic control units 40a-40d, and a communication module 50. The OTA manager 30 and the communication module 50 are connected via bus 60a. The OTA manager 30 is connected to electronic control units 40a and 40b via bus 60b. The OTA manager 30 is connected to electronic control units 40c and 40d via bus 60c.

[0045] The OTA manager 30 can wirelessly communicate with the center 10 via the bus 60a and the communication module 50 through the network 70. This OTA manager 30 is a device that manages the OTA status and controls the software update process, i.e., the update timing, to implement software updates for the electronic control units (hereinafter referred to as "target electronic control units") that are to be updated. The OTA manager 30 controls the software updates of the target electronic control units among the electronic control units 40a to 40d based on update data obtained from the center 10. The OTA manager 30 may also be referred to as a central gateway (CGW).

[0046] Figure 4 It means Figure 1 A simplified block diagram of the OTA Manager 30 in the system. (See diagram below.) Figure 4 As illustrated, the OTA manager 30 includes a CPU 31, RAM 32, ROM (Read-Only Memory) 33, storage device 34, and communication device 36. The CPU 31, RAM 32, ROM 33, and storage device 34 constitute a microcomputer 35. In the OTA manager 30, the CPU 31 executes programs read from the ROM 33 using the RAM 32 as its operating area to perform processing related to software updates. The communication device 36 is used for... Figure 1 The devices shown are for communicating with the bus 60a-60c, the communication module 50, and the electronic control units 40a-40d, respectively.

[0047] Figure 5 yes Figure 4 The diagram shown is a functional block diagram of OTA Manager 30. Figure 5 The illustrated OTA manager 30 includes a storage unit 37, a communication unit 38, and a control unit 39. The functions of the storage unit 37 are achieved through... Figure 4 The storage device 34 shown is used to implement this. The functions of the communication unit 38 and the control unit 39 are achieved through... Figure 4 The CPU 31 shown uses RAM 32 to execute programs stored in ROM 33.

[0048] In addition to storing the program (control program for OTA manager 30) used to perform software updates for the multiple electronic control units 40a-40d, and various data used during software updates, the storage unit 37 also stores software update data downloaded from the center 10. Furthermore, the storage unit 37 can store information (described later) related to the type of non-volatile memory mounted on each of the multiple electronic control units 40a-40d.

[0049] The communication unit 38 functions as both a transmitter and a receiver for sending and receiving data, information, and requests between itself and the center 10. For example, when the vehicle's power is turned on, the communication unit 38 sends a software update confirmation request to the center 10 (transmitter). The update confirmation request includes, for example, information related to the vehicle ID used to identify the vehicle and the current version of the software for the electronic control units 40a-40d connected to the vehicle network 20. The vehicle ID and the current version of the software for the electronic control units 40a-40d are used to determine whether update data for the software of the electronic control units 40a-40d exists by comparing it with the latest version of the software maintained by the center 10 for each vehicle ID. Additionally, the communication unit 38 receives a notification from the center 10 indicating the presence or absence of update data as a response to the update confirmation request (receiver). If update data for the software of the electronic control units 40a-40d exists, the communication unit 38 sends a request to download the software update data distribution data packet to the center 10 (transmitter) and receives (downloads) the distribution data packet sent from the center 10 (receiver). In addition, the communication unit 38 sends the update status of the software sent by the electronic control units 40a to 40d to the center 10 (sending unit).

[0050] The control unit 39 determines whether software update data for electronic control units 40a-40d exists based on the response from the center 10 to the update confirmation request received by the communication unit 38. Furthermore, the control unit 39 verifies the authenticity of the distribution data packets received (downloaded) from the center 10 and stored in the storage unit 37 by the communication unit 38. Additionally, the control unit 39 uses the update data received (downloaded) from the center 10 to control the software update process (various verifications, installations, activations, etc.) of the electronic control units 40a-40d. Specifically, the control unit 39 forwards one or more update data packets downloaded using the distribution data packets to the target electronic control unit, causing the target electronic control unit to install the update software based on the update data. After installation, the control unit 39 instructs the target electronic control unit to activate the installed update software. During this software update process, the control unit 39 appropriately controls the sequence of various verifications, installations, activations, etc., among the multiple electronic control units 40a-40d.

[0051] Multiple electronic control units (ECUs) 40a-40d are devices used to control the actions of various parts of the vehicle. Figure 1 The example shown is an in-vehicle network 20 with four electronic control units 40a to 40d, but the number of electronic control units is not particularly limited. For example, a display device (HMI) for various displays, such as displaying the presence of updated data during software update processing of the electronic control units 40a to 40d, displaying a consent request screen to the vehicle user or administrator requesting consent for the software update, and displaying the results of the software update, can be connected to the OTA manager 30. As a display device, a car navigation system can be used. Furthermore, the number of buses connecting the electronic control units to the OTA manager 30 is not particularly limited. For example, the aforementioned display device can be connected to the OTA manager 30 via a bus other than buses 60a to 60c.

[0052] An example of a simplified structure of the electronic control unit 40a-40d is as follows: Figure 6A as well as Figure 6B As shown.

[0053] Figure 6A The illustrated electronic control unit 40a includes a CPU 41, RAM 42, non-volatile memory 43a, and a communication device 44. The CPU 41 executes programs read from the non-volatile memory 43a using RAM 42 as its working area to implement the functions of the electronic control unit 40a. The non-volatile memory 43a is a memory with a single storage area 45 for storing data such as software (hereinafter referred to as "single-database memory"). Hereinafter, the type of memory with this single storage area 45 is referred to as "Category 1". In some cases, the storage area 45 stores not only the software used to implement the functions of the electronic control unit 40a, but also version information, parameter data, boot programs, software update programs, etc. The communication device 44 is a device for communicating with other electronic control units 40b to 40d connected to the OTA manager 30 and the vehicle network 20.

[0054] Figure 6BThe electronic control unit 40b shown, like the electronic control unit 40a, includes a CPU 41, RAM 42, non-volatile memory 43b, and a communication device 44. The non-volatile memory 43b mounted in the electronic control unit 40b is a memory with two storage areas 46a and 46b for storing software and other data (hereinafter referred to as "dual-database memory"). Hereinafter, this type of memory with the structure of two storage areas 46a and 46b is referred to as "Category 2". There are cases where storage areas 46a and 46b store not only the software used to implement the functions of the electronic control unit 40b, but also version information, parameter data, boot programs, software update programs, etc. The CPU 41 of the electronic control unit 40b uses either of the two storage areas 46a and 46b of the non-volatile memory 43b as the storage area to be read (the application area), and executes the software stored in that storage area. In a storage area other than the read object (non-application area), during the execution of the program in the storage area (application area) of the read object, the installation (writing) of the update software (updated version of the program) based on the updated data can be performed in the background. During the activation (validation of the update software) in the software update process, the update software can be activated by switching the storage area of ​​the read object of the program using the CPU 41 of the electronic control unit 40b.

[0055] As a specific example, imagine a situation where current software is stored in storage area 46a of the non-volatile memory 43b, which is a dual-library memory, and update software is installed in storage area 46b. If the OTA manager 30 instructs the activation of new software, then, for example, by switching the read start address of CPU 41 from the front address of storage area 46a to the front address of storage area 46b via the electronic control unit 40b, the storage area of ​​the read target (application surface) of CPU 41 can be switched, and the update software installed in storage area 46b can be executed. Furthermore, in this disclosure, a structure called "single-sided suspended memory," which virtually divides one storage area into two surfaces and allows writing of a program stored on one surface to the other surface during the execution of a program stored on one surface, is also classified as a second type of memory.

[0056] Figure 7 This represents an example of category information, which relates to the category of non-volatile memory respectively mounted in multiple electronic control units 40a-40d. Figure 7In the example category information, the number used to identify the electronic control unit, i.e., ECU_ID, is associated with the category of the non-volatile memory (Category 1 (single library) / Category 2 (dual library)) installed on that electronic control unit. This category information is stored and managed by one or both of the storage unit 37 of the OTA manager 30 and the storage unit 16 of the center 10. The category information is pre-created based on the specifications of the electronic control units 40a to 40d constituting the vehicle network 20. It can be stored in the storage unit 37 of the OTA manager 30 during vehicle manufacturing, or it can be obtained by the OTA manager 30 from the target electronic control unit through communication within the vehicle network 20 during software update processing. If the category of the non-volatile memory is obtained from the target electronic control unit each time a software update is performed, the OTA manager 30 can centrally manage the categories of the non-volatile memory installed on multiple electronic control units installed in the vehicle, and can appropriately respond even if the category of the non-volatile memory changes due to replacement of the electronic control unit, etc. In addition, when the category information is managed by the center 10, the OTA manager 30 can obtain the category information from the center 10 via the network 70.

[0057] The communication module 50 is a unit that controls the communication between the center 10 and the vehicle, and is a communication device used to connect the vehicle network 20 to the center 10. The communication module 50 is wirelessly connected to the center 10 via the network 70 to perform vehicle authentication, download update data, and other functions related to the OTA manager 30. This communication module 50 can be configured to be included in the OTA manager 30.

[0058] Summary of software update processing

[0059] The OTA manager 30 sends a software update confirmation request to the center 10, for example, when the vehicle is powered on. The update confirmation request includes information related to the status (system configuration) of the electronic control units (ECUs) 40a-40d, such as the vehicle ID used to identify the vehicle and the current version of the hardware and software of the ECUs 40a-40d connected to the vehicle network 20; that is, vehicle configuration information. Vehicle configuration information can be created by obtaining the ECU identification number (ECU_ID) and the ECU software version identification number (ECU_Software_ID) from the ECUs 40a-40d connected to the vehicle network 20. The vehicle ID and the current version of the ECU software are used to determine whether update data for the ECUs 40a-40d exists by comparing it with the latest version of the software maintained by the center 10 for each vehicle ID. The center 10 sends a notification indicating the presence or absence of update data to the OTA manager 30 as a response to the update confirmation request received from the OTA manager 30. When update data for the software of electronic control units 40a-40d is available, the OTA manager 30 sends a download request for a distribution data packet to the center 10. The center 10, based on the download request received from the OTA manager 30, sends the update data distribution data packet to the OTA manager 30. The distribution data packet may include, in addition to the update data, verification data for verifying the authenticity of the update data, the quantity and category information of the update data, and various control information used during the software update.

[0060] The OTA manager 30 determines whether software update data for electronic control units 40a-40d exists based on the response to the update confirmation request received from the center 10. Additionally, the OTA manager 30 verifies the authenticity of the distribution data packets received from the center 10 and stored in the storage device 13. Furthermore, the OTA manager 30 forwards one or more update data packets downloaded using the distribution data packets to the target electronic control unit, causing the target electronic control unit to install the update data. After installation, the OTA manager 30 instructs the target electronic control unit to activate the installed updated software.

[0061] Furthermore, during the consent request processing, the OTA manager 30 outputs a notification to the output device that consent is required for a software update, or a notification urging consent to the software update. As the output device, a display device (not shown) for display-based notifications and a sound output device (not shown) for sound-based notifications, both installed in the vehicle network 20, can be used. For example, when using a display device as the output device in the consent request processing, the OTA manager 30 can display a consent request screen for requesting consent from the user or administrator for a software update, or display a notification urging the user or administrator to press the consent button, or other specific input operations. Additionally, during the consent request processing, the OTA manager 30 can display statements, icons, etc., indicating that software update data for electronic control units 40a-40d exists, or display limitations in the software update process. If the OTA manager 30 receives consent input from the user or administrator, it executes the aforementioned installation and activation control processing to update the software of the target electronic control unit.

[0062] Here, when the non-volatile memory of the target electronic control unit is a single-library memory, since installation and activation are performed continuously in principle, a request for consent to software updates is processed before installation. Furthermore, even for a target electronic control unit with a single-library memory, update processing may be temporarily suspended after installation is complete, i.e., a request for standby (delayed) activation is made. Additionally, when the non-volatile memory of the target electronic control unit is a dual-library memory, a request for consent to software updates is processed at least after installation and before activation. Furthermore, when the non-volatile memory of the target electronic control unit is a dual-library memory, the request for consent to software updates before installation may or may not be performed.

[0063] The software update process consists of three phases: the OTA manager 30 downloads (receives) update data from the center 10 (download phase); the OTA manager 30 transfers the downloaded update data to the target electronic control unit and installs (writes) update software based on the update data in the storage area of ​​the target electronic control unit (installation phase); and the target electronic control unit activates (enables) the installed update software (activation phase).

[0064] The download process involves the OTA manager 30 receiving update data for updating the electronic control unit's software, sent from the center 10 via a data packet distribution mechanism, and storing it in the storage unit 37. During the download, update data reception is performed independently for electronic control units equipped with dual-library memory and for electronic control units equipped with single-library memory. The download phase includes not only the execution of the download but also the control of a series of download-related processes, such as determining whether the download can be executed and verifying the update data.

[0065] The update data sent from center 10 to OTA manager 30 may include any of the following: update software for electronic control units (complete data or differential data), compressed data resulting from compressed update software, or split data of split update software or compressed data. Additionally, the update data may include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The update data is downloaded as a distribution data packet, but the distribution data packet may contain update data for a single electronic control unit or multiple update data packets for multiple electronic control units of the same memory type.

[0066] The installation process involves the OTA manager 30 writing update software (updated programs) to the non-volatile memories 43a and / or 43b of multiple target electronic control units (ECUs) based on update data downloaded from the center 10, in a predetermined order. Regarding installation, update data for ECUs equipped with dual-memory memories, which have a lower probability of update failure, is prioritized over update data for ECUs equipped with single-memory memories, which have a higher probability of update failure. The installation phase includes not only the execution of the installation but also the control of a series of installation-related processes, such as determining whether the installation can be executed, transferring update data, and verifying the update software.

[0067] When the update data includes the update software itself (complete data), the OTA manager 30 transfers the update data (update software) to the target electronic control unit (ECU) during the installation phase. Alternatively, when the update data includes compressed, differential, or segmented data of the update software, the OTA manager 30 may transfer the update data to the target ECU, which then generates the update software based on the update data. Or, the OTA manager 30 may generate the update software based on the update data and then transfer the update software to the target ECU. Here, the generation of the update software can be achieved by decompressing compressed data or combining (integrating) differential or segmented data.

[0068] The installation of updated software can be performed by the target electronic control unit based on an installation request from the OTA manager 30. Furthermore, a specific target electronic control unit that receives the update data can also perform the installation autonomously without explicit instructions from the OTA manager 30.

[0069] Activation is the process by which the target electronic control unit (ECU) activates the update software installed in the non-volatile memory 43a and / or 43b. Activation can prioritize either update data for ECUs equipped with dual-library memory or update data for ECUs equipped with single-library memory, or it can proceed without preference between the two. The activation phase includes not only the execution of activation but also the control of a series of activation-related processes, such as determining whether activation is feasible, requesting the vehicle user or administrator's consent to activation, and verifying the execution result.

[0070] The activation of the updated software can be performed by the target electronic control unit based on an activation request from the OTA manager 30. Furthermore, a specific target electronic control unit that receives the update data can also activate itself after installation without explicit instructions from the OTA manager 30.

[0071] Among them, it is capable of performing software update processing on multiple target electronic control units, either continuously or in parallel.

[0072] In addition, the "software update processing" in this manual includes not only the entire process of continuous downloading, installation and activation, but also the process of only performing a part of the downloading, installation and activation.

[0073] deal with

[0074] Next, refer to Figure 8 , Figure 9 as well as Figure 10 Here are some specific examples related to software update processing performed in the network system described in this embodiment.

[0075] (1) Specific examples of downloading

[0076] Figure 8 This is a flowchart illustrating the processing steps involved in a specific example of downloading by the center 10 and the OTA manager 30. The download begins when the center 10 receives a download request for a distribution data packet from the OTA manager 30. Figure 8 The download process is illustrated.

[0077] (Step S801)

[0078] Center 10 generates a distribution data packet for update data of target ECUs of category 1 that are the targets of software updates. Additionally, Center 10 generates a distribution data packet for update data of target ECUs of category 2 that are the targets of software updates. At this time, Center 10 can determine the memory category of the non-volatile memory installed in the target ECU by referring to the category information stored in storage unit 16. When Center 10 manages the categories of non-volatile memories installed in multiple electronic control units 40a to 40d respectively, information related to the memory category can be included in the distribution data packet. If distribution data packets for update data of target ECUs of category 1 and distribution data packets for update data of target ECUs of category 2 are generated respectively, the process proceeds to step S802.

[0079] (Step S802)

[0080] Center 10 sends the update data distribution data packets for target ECUs of category 1 and target ECUs of category 2 to OTA manager 30 respectively. That is, center 10 sends the update data distribution data packets for target ECUs of category 1 and target ECUs of category 2 to OTA manager 30 independently. If each distribution data packet has been sent, the process proceeds to step S803.

[0081] (Step S803)

[0082] The OTA manager 30 receives distribution data packets for update data of target ECUs of category 1 and update data of target ECUs of category 2, which are sent independently from the center 10. If the reception of each distribution data packet is completed, the process proceeds to step S804.

[0083] (Step S804)

[0084] The OTA manager 30 stores the update data (and information related to the memory type, etc.) received from the center 10 via data packets in the storage unit 37. Thus, the download process ends.

[0085] According to this specific download example, the OTA manager 30 can independently receive distribution data packets for update data to target ECUs of category 1 and target ECUs of category 2 from the center 10. Through this process, since in the event that the download of any update data fails, it is only necessary to re-download the distribution data packet of the failed update data, the software update can be completed as soon as possible.

[0086] (2) Specific examples of installation

[0087] Figure 9 This is a flowchart illustrating the specific installation steps involved in the OTA manager 30 and the target ECU. The process begins after the update data for at least one target ECU has been downloaded and the specified conditions are met (installation can be performed, update data verification is successful, etc.). Figure 9 Specific examples of installation are shown.

[0088] (Step S901)

[0089] The OTA manager 30 obtains the category (Category 1 / Category 2) of the non-volatile memory installed in the target ECU. For this memory category, when managed by the OTA manager 30, the category information stored in the storage unit 37 can be referenced. Figure 7 The memory category of the target ECU can be obtained by referring to the memory category information sent in the form of a distribution data packet, when managed by the center 10. If the memory category of the target ECU is obtained, the process proceeds to step S902.

[0090] (Step S902)

[0091] The OTA manager 30 and the target ECU of category 2 begin the process of writing update software to the storage area of ​​the non-volatile memory of the target ECU of category 2 based on update data, i.e., installation. If the update data includes the update software itself, installation is performed by transferring the update data from the OTA manager 30 to the target ECU of category 2. This installation begins simultaneously or in a predetermined order for all target ECUs of category 2. If installation for the target ECU of category 2 has begun, the process proceeds to step S903.

[0092] (Step S903)

[0093] The OTA manager 30 and the target ECU of category 1 begin the process of writing update software to the storage area of ​​the non-volatile memory of the target ECU of category 1 based on update data, i.e., installation. If the update data includes the update software itself, installation is performed by transferring the update data from the OTA manager 30 to the target ECU of category 1. This installation can begin simultaneously or in a predetermined order for all target ECUs of category 1. The installation of the target ECUs of category 1 can begin after the installation of all target ECUs of category 2 is completed, or it can begin after the installation of a predetermined portion of the target ECUs of category 2 is completed. If the installation of the target ECUs of category 1 has begun, the process proceeds to step S904.

[0094] (Step S904)

[0095] The OTA manager 30 determines whether the installation of the update software in all target ECUs (Category 1 and Category 2) is complete. The OTA manager 30 can determine completion based on the presence of completion notifications from each target ECU, or based on the elapsed time since the start of installation. The specified time can be set to, for example, the maximum time required for each installation. If it is determined that the installation of the update software in all target ECUs is complete (step S904, Yes), then the installation for the target ECUs is complete, and this installation process ends.

[0096] Based on the specific installation example described above, installation of target ECUs that do not require stop control during the update can be prioritized compared to installation of target ECUs of category 1 that require stop control during the update. This process reduces the communication load within the vehicle (vehicle network 20) ​​and shortens the time required to stop vehicle control until all update software installation (writing) is complete.

[0097] (3) Specific examples of activation

[0098] Figure 10 This is a flowchart illustrating the specific steps involved in activating the OTA manager 30 and the target ECU. The process begins after installation of the target ECU for Category 1 and the target ECU for Category 2 are completed, and after certain conditions are met (activation can be performed, data update verification is passed, etc.). Figure 10 The activation process is illustrated.

[0099] (Step S1001)

[0100] The OTA manager 30 and the target ECU of category 1 begin activating the update software that has been written to the storage area of ​​the non-volatile memory of the target ECU of category 1. This activation is initiated simultaneously or in a predetermined order for all target ECUs of category 1. If the activation of the update software in the target ECU of category 1 has begun, the process proceeds to step S1002.

[0101] (Step S1002)

[0102] The OTA manager 30 and the target ECU of category 2 begin activating the update software that has been written to the storage area of ​​the non-volatile memory of the target ECU of category 2. This activation begins simultaneously or in a predetermined order for all target ECUs of category 2. Specifically, the activation of the update software for the target ECUs of category 2 can begin after the activation of the update software for all target ECUs of category 1 is completed, or it can begin after the activation of a predetermined portion of the update software for the target ECUs of category 1 is completed. If the activation of the update software in the target ECUs of category 2 has begun, the process proceeds to step S1003.

[0103] (Step S1003)

[0104] OTA Manager 30 determines whether the activation of the update software in all target ECUs (Category 1 and Category 2) has been completed. OTA Manager 30 can determine completion based on the presence of completion notifications from each target ECU, or based on the elapsed time since the start of activation. The specified time can be set to, for example, the maximum time required for each activation. If it is determined that the activation of the update software in all target ECUs has been completed (step S1003, Yes), then the activation of the target ECUs is complete, and this activation process ends.

[0105] Based on the specific example of activation described above, since the software update of the target ECU of the second category can be performed after the successful software update of the target ECU of the first category has been confirmed, it is possible to appropriately perform software update processing for a system that structurally includes both a target ECU equipped with a single-library memory and a target ECU equipped with a dual-library memory. Furthermore, as an activation process, it is also possible to first begin activation of the update software for the target ECU of the second category (step S1002), and then begin activation of the update software for the target ECU of the first category (step S1001).

[0106] Function / Effect

[0107] As described above, in a network system according to one embodiment of this disclosure, the OTA manager independently receives, from the center, distribution data packets for update data to electronic control units equipped with single-library memory (a type 1 non-volatile memory) and distribution data packets for update data to electronic control units equipped with dual-library memory (a type 2 non-volatile memory).

[0108] This process allows for the suppression of increased communication load between the central control center and the OTA manager, as the distribution of data packets can be suppressed simply by retransmitting the same data packet when communication anomalies or other issues prevent normal transmission and reception.

[0109] Furthermore, according to the network system involved in this embodiment, the OTA manager prioritizes installing the update software of the electronic control unit equipped with a dual-library memory, which does not require stop control during updates, compared to installing the update software of the electronic control unit equipped with a single-library memory that requires stop control during updates, for each update data received in parallel from the center.

[0110] This process allows for the prior writing of update software from the target electronic control unit equipped with dual-library memory to the storage area, and the commencement of the writing of update software from the target electronic control unit equipped with single-library memory to the storage area upon completion of the writing process. This reduces the communication load within the vehicle (in-vehicle network) and shortens the time required to stop vehicle control until all update software is written.

[0111] The above describes one embodiment of the technology disclosed herein. However, this disclosure can be understood not only as an OTA manager, but also as a method or program executed by an OTA manager having a processor and a memory, a computer-readable non-transitory storage medium storing a program, a center capable of communicating with an OTA manager, a system having a center and an OTA manager, or a vehicle having an OTA manager, etc.

[0112] The technology disclosed herein can be utilized in network systems used for updating the software of electronic control units.

Claims

1. An OTA manager for controlling software updates of electronic control units installed in a vehicle. The OTA manager is characterized by having: The communication unit independently receives, from the center, distribution data packets for update data of the electronic control unit equipped with a first-class non-volatile memory having one storage area, and distribution data packets for update data of the electronic control unit equipped with a second-class non-volatile memory having two storage areas, configured to obtain from the center category information indicating whether the non-volatile memory equipped in the electronic control unit is of the first or second class; and Based on the category information, the control unit prioritizes transferring update data of the electronic control unit equipped with non-volatile memory of the second category to the electronic control unit that is to be updated, compared with update data of the electronic control unit equipped with non-volatile memory of the first category, so that the electronic control unit to be updated installs update software based on the transferred update data. The electronic control unit that is subject to the update controls the operation of a part of the vehicle based on the updated software.

2. The OTA manager according to claim 1, characterized in that, It also includes a storage device configured to store the category information.

3. The OTA manager according to claim 1 or 2, characterized in that, The control unit is configured to transmit updated data received by the communication unit to the electronic control unit that is the subject of the update, based on the category information.

4. A system, characterized in that, include: OTA manager controls software updates for electronic control units installed in vehicles; and The center is configured to communicate with the OTA manager. The center includes a first communication unit that sends distribution data packets for update data of the electronic control unit equipped with a first-type non-volatile memory having one storage area, and distribution data packets for update data of the electronic control unit equipped with a second-type non-volatile memory having two storage areas, to the OTA manager. The OTA manager includes: The second communication unit independently receives, from the center, distribution data packets for update data of the electronic control unit equipped with the first type of non-volatile memory, and distribution data packets for update data of the electronic control unit equipped with the second type of non-volatile memory, configured to obtain from the center category information indicating whether the non-volatile memory equipped in the electronic control unit is of the first type or the second type; and Based on the category information, the control unit, compared with the update data of the electronic control unit equipped with the non-volatile memory of the first category received by the second communication unit through the distribution data packet, prioritizes forwarding the update data of the electronic control unit equipped with the non-volatile memory of the second category received by the second communication unit through the distribution data packet to the electronic control unit that is to be updated, so that the electronic control unit that is to be updated installs update software based on the forwarded update data. The electronic control unit that is subject to the update controls the operation of a part of the vehicle based on the updated software.

5. The system according to claim 4, characterized in that, At least one of the center and the OTA manager includes a storage device for storing category information indicating whether the non-volatile memory carried by the electronic control unit is of the first category or the second category.

6. A method performed by an OTA manager having a processor and memory and controlling software updates of an electronic control unit installed in a vehicle. The method is characterized by including: Independently receives, from the center, distribution data packets for update data of the electronic control unit equipped with a first-class non-volatile memory having one storage area, and distribution data packets for update data of the electronic control unit equipped with a second-class non-volatile memory having two storage areas; and obtains from the center category information indicating whether the non-volatile memory equipped in the electronic control unit is of the first or second class. Based on the category information, compared with the update data of the electronic control unit equipped with the non-volatile memory of the first category, the update data of the electronic control unit equipped with the non-volatile memory of the second category is preferentially transferred to the electronic control unit that is to be updated, so that the electronic control unit that is to be updated installs the update software based on the transferred update data. The electronic control unit that is subject to the update controls the operation of a part of the vehicle based on the updated software.

7. A non-transitory storage medium, characterized in that, The system stores commands that can be executed by the processor of an OTA manager, which has a processor and memory and controls software updates of electronic control units installed in the vehicle, and that cause the processor to perform the following functions: Independently receives, from the center, distribution data packets for update data of the electronic control unit equipped with a first-class non-volatile memory having one storage area, and distribution data packets for update data of the electronic control unit equipped with a second-class non-volatile memory having two storage areas; and obtains from the center category information indicating whether the non-volatile memory equipped in the electronic control unit is of the first or second class. Based on the category information, compared with the update data of the electronic control unit equipped with the non-volatile memory of the first category, the update data of the electronic control unit equipped with the non-volatile memory of the second category is preferentially transferred to the electronic control unit that is to be updated, so that the electronic control unit that is to be updated installs the update software based on the transferred update data. The electronic control unit that is subject to the update controls the operation of a part of the vehicle based on the updated software.

8. A vehicle, characterized in that, It is equipped with any one of the OTA managers according to claims 1 to 3.

Images