center, ota manager, system, method, non-transitory storage medium

Abstract

The present application relates to a center, an OTA manager, a system, a method, a non-transitory storage medium, and a vehicle, the center including: a communication unit configured to communicate with an OTA manager configured to control software update of a plurality of electronic control units mounted on a vehicle based on update data, and transmit update data for a first electronic control unit mounted with a first category of nonvolatile memory having one storage area, that is, first category update data, and update data for a second electronic control unit mounted with a second category of nonvolatile memory having two storage areas, that is, second category update data, to the OTA manager; and a control unit configured to control transmission of the first category update data and the second category update data to the OTA manager based on a communication condition between the center and the OTA manager. The first electronic control unit and the second electronic control unit are included in the plurality of electronic control units.

Description

Technical Field

[0001] This disclosure relates to a center, an OTA manager, a system, a method, a non-transitory storage medium, and a vehicle. Background Technology

[0002] The vehicle is equipped with multiple electronic control units (ECUs) for controlling the vehicle's movements. Each ECU has a processor, temporary storage such as RAM, and non-volatile storage such as flash ROM (non-volatile memory). The processor executes software stored in the non-volatile memory to implement the ECU's control functions. The software stored in each ECU can be rewritten; by updating to a newer version of the software, the functionality of each ECU can be improved, and new vehicle control functions can be added.

[0003] As a technology for updating the software of electronic control units (ECUs), OTA (Over-The-Air) technology is known: This involves wirelessly connecting an in-vehicle communication device connected to the vehicle network to a communication network such as the Internet. The device responsible for updating the vehicle's software downloads software from a server via wireless communication and installs the downloaded software into the ECU, thus updating or adding software to the ECU. For example, see Japanese Patent Application Laid-Open No. 2004-326689.

[0004] As a type of non-volatile memory integrated into electronic control units (ECUs), there are memory types with one storage area for storing data such as software (single-library memory) and memory types with two storage areas for storing data such as software (dual-library memory). The type used may vary depending on the specifications of the ECU. ECUs equipped with dual-library memory can store two versions of data, old and new, in two separate storage areas.

[0005] In vehicle software update events, there are two types of electronic control units (ECUs): one with a single-database memory and the other with a dual-database memory. The recovery methods for update failures differ between the ECUs with single and dual-database memories due to the different memory configurations.

[0006] Therefore, when applying an activity to a vehicle that mixes electronic control units (ECUs) equipped with single-database memory and ECUs equipped with dual-database memory as ECUs to be updated, it is necessary to take into account the different memory structures of the ECUs to be updated when performing the download and installation. Summary of the Invention

[0007] This disclosure provides a center, OTA manager, system, method, non-transitory storage medium, and vehicle capable of performing software updates adapted to single-library storage and dual-library storage.

[0008] The first aspect of this disclosure involves a central unit comprising: a communication unit configured to communicate with an OTA manager configured to control software updates of multiple electronic control units (ECUs) mounted in a vehicle based on update data, and to send the aforementioned update data (i.e., first-category update data) to a first ECU equipped with a first-category non-volatile memory having one storage area, and the aforementioned update data (i.e., second-category update data) to a second ECU equipped with a second-category non-volatile memory having two storage areas to the OTA manager; and a control unit configured to control the transmission of the first-category update data and the second-category update data to the OTA manager based on the communication status between the central unit and the OTA manager. The first ECU and the second ECU are included in the plurality of ECUs.

[0009] The second aspect of the present invention relates to an OTA manager comprising: a communication unit configured to receive, from a center, update data for a first type of electronic control unit equipped with a first type of non-volatile memory having one storage area, and update data for a second type of electronic control unit equipped with a second type of non-volatile memory having two storage areas; and a control unit configured to control the reception of the update data for the first type of electronic control unit and the update data for the second type of electronic control unit from the center based on the communication status between the center and the OTA manager. The first and second electronic control units are included in a plurality of electronic control units mounted in a vehicle, and the update data for the first type of electronic control unit and the update data for the second type of electronic control unit are update data for controlling software updates of the plurality of electronic control units.

[0010] The third aspect of the present invention relates to a system comprising: an OTA manager configured to control software updates of a plurality of electronic control units (ECUs) installed in a vehicle based on update data; and a center. The center includes: a first communication unit configured to communicate with the OTA manager and send update data (i.e., first-category update data) to the OTA manager for a first ECU equipped with a first-category non-volatile memory having one storage area, and update data (i.e., second-category update data) to a second ECU equipped with a second-category non-volatile memory having two storage areas; and a control unit configured to control the transmission of the first-category update data and the second-category update data to the OTA manager based on the communication status between the center and the OTA manager. The OTA manager includes a second communication unit configured to receive the first-category update data and the second-category update data sent by the center. The first and second ECUs are included in the plurality of ECUs.

[0011] The fourth aspect of the present invention involves a method executed by a central system configured to communicate with an OTA manager, the OTA manager having one or more processors and one or more memories and configured to control software updates of multiple electronic control units (ECUs) installed in a vehicle based on update data. The method includes: sending update data (i.e., first-category update data) to the OTA manager for a first ECU equipped with a first-category non-volatile memory having one storage area, and update data (i.e., second-category update data) to a second ECU equipped with a second-category non-volatile memory having two storage areas; and controlling the transmission of the first-category update data and the second-category update data to the OTA manager based on the communication status between the central system and the OTA manager. The first and second ECUs are included in the plurality of ECUs.

[0012] The fifth aspect of the present invention relates to a non-transitory storage medium storing commands that can be executed by a computer configured to communicate with an OTA manager, and that the computer executes the method of the fourth aspect. The OTA manager has one or more processors and one or more memories and is configured to control software updates of electronic control units mounted in a vehicle.

[0013] The vehicle involved in the sixth aspect of the present invention includes the OTA manager involved in the second aspect.

[0014] According to the various methods disclosed herein, software updates (downloads) can be appropriately performed in vehicles equipped with both single-library and dual-library storage systems based on the communication status between the center and the vehicle (OTA manager). Attached Figure Description

[0015] Hereinafter, the features, advantages, technical and industrial importance of exemplary embodiments of the present invention will be described with reference to the accompanying drawings, in which the same reference numerals denote the same constituent elements, wherein:

[0016] Figure 1 It is a block diagram showing the overall structure of the network system involved in the implementation method.

[0017] Figure 2 It is a block diagram representing the simplified structure of the center.

[0018] Figure 3 This is the central functional block diagram.

[0019] Figure 4 This is a block diagram representing a simplified structure of the OTA manager.

[0020] Figure 5 This is a functional block diagram of the OTA Manager.

[0021] Figure 6A This is a block diagram illustrating an example of a simplified structure of an electronic control unit.

[0022] Figure 6B This is a block diagram illustrating an example of a simplified structure of an electronic control unit.

[0023] Figure 7 This is a diagram representing an example of category information.

[0024] Figure 8 This is a flowchart example of the download processing steps performed by the center and OTA manager.

[0025] Figure 9 This is a flowchart example of the installation process steps performed by the OTA manager and the target electronic control unit.

[0026] Figure 10 This is a flowchart example of the activation process performed by the OTA manager and the target electronic control unit. Detailed Implementation

[0027] In the network system disclosed herein, the download of update data appropriate to the memory type (single-library memory / dual-library memory) of the electronic control unit (ECU) to be updated is performed based on the communication status between the center and the vehicle. This process reduces the time spent until the updated ECU starts up normally.

[0028] Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the accompanying drawings.

[0029] Implementation

[0030] structure

[0031] Figure 1 This is a block diagram illustrating the overall structure of a network system according to one embodiment of this disclosure. Figure 1 The network system shown is used to update the software of multiple electronic control units 40a to 40d installed in the vehicle, and has a center 10 located outside the vehicle and an in-vehicle network 20 built inside the vehicle.

[0032] (1) Center

[0033] The center 10 can communicate with the OTA manager 30 (described later) of the vehicle network 20 via the network 70. The center 10 can send software update data for the electronic control units 40a-40d and receive notifications indicating the progress of software update processing, and control and manage the software updates of multiple electronic control units 40a-40d connected to the OTA manager 30. The center 10 functions as a server.

[0034] Figure 2 It means Figure 1 A simplified block diagram of the structure of center 10. (See diagram below.) Figure 2 As shown, the center 10 includes a CPU (Central Processing Unit) 11, RAM (Random Access Memory) 12, a storage device 13, and a communication device 14. The number of each of these components is not limited to one. The storage device 13 is a device equipped with a read / write storage medium such as a hard disk drive (HDD) or a solid-state drive (SSD), storing programs used for software update management, information used in software update control and management, and software update data for each electronic control unit. In the center 10, the CPU 11 executes programs read from the storage device 13 using the RAM 12 as its working area to perform the prescribed processing related to software updates. The communication device 14 is a device for communicating with the OTA manager 30 via the network 70.

[0035] Figure 3 yes Figure 2 The functional block diagram of center 10 is shown. Figure 3 The center 10 shown includes a storage unit 16, a communication unit 17, and a control unit 18. The functions of the storage unit 16 are achieved through... Figure 2 The storage device 13 shown is used to implement this. The functions of the communication unit 17 and the control unit 18 are achieved through... Figure 2 The CPU 11 shown uses RAM 12 to execute programs stored in storage device 13.

[0036] The storage unit 16 stores information related to software update processing for one or more electronic control units (ECUs) installed in the vehicle. As information related to software update processing, the storage unit 16 stores at least update management information associated with information indicating the software available in the ECUs 40a-40d based on each vehicle identification number (Vehicle ID) of the identified vehicle, and update data (or distribution data packets including update data) of the software in the ECUs 40a-40d. For example, the information indicating the software available in the ECUs 40a-40d can be a combination of the latest version information of the software for each of the multiple ECUs 40a-40d. Furthermore, as information related to software update processing, the storage unit 16 can store update status indicating the update status of the software being implemented in the vehicle. Additionally, the storage unit 16 can store information related to the type of non-volatile memory installed in the multiple ECUs 40a-40d (described later).

[0037] The communication unit 17 functions as a transmitter and receiver for sending and receiving data, information, and requests between itself and the OTA manager 30. The communication unit 17 receives software update confirmation requests from the OTA manager 30 (receiving unit). An update confirmation request, for example, is information sent from the OTA manager 30 to the center 10 when the vehicle's power or ignition is turned on (hereinafter referred to as "power on"), and is used to request the center 10 to confirm the existence of update data for the electronic control units 40a to 40d based on the vehicle configuration information described later. Furthermore, in response to the update confirmation request received from the OTA manager 30, the communication unit 17 sends information indicating the presence or absence of update data to the OTA manager 30 (transmitting unit). Additionally, the communication unit 17 receives transmission requests (download requests) for distribution data packets from the OTA manager 30 (receiving unit). Furthermore, if the communication unit 17 receives a download request for a distribution data packet, it sends a distribution data packet (described later) containing update data for the software of the electronic control units 40a to 40d to the OTA manager 30 based on the communication status between the center 10 and the OTA manager 30.

[0038] If the communication unit 17 receives an update confirmation request from the OTA manager 30, the control unit 18 determines, based on the update management information stored in the storage unit 16, whether software update data exists for the electronic control units 40a-40d installed in the vehicle whose vehicle ID is included in the update confirmation request. The control unit 18 sends the result of its determination regarding the existence of update data to the OTA manager 30. If the control unit 18 determines that software update data for the electronic control units 40a-40d exists, and a download request for a distribution data packet is received from the OTA manager 30, the control unit 18 controls the transmission of update data to the OTA manager 30 based on the communication status between the center 10 and the OTA manager 30. Furthermore, the control unit 18 generates a distribution data packet including the corresponding update data stored in the storage unit 16 as needed.

[0039] (2) In-vehicle network

[0040] The vehicle network 20 includes an OTA manager 30, multiple electronic control units 40a-40d, and a communication module 50. The OTA manager 30 and the communication module 50 are connected via bus 60a. The OTA manager 30 is connected to electronic control units 40a and 40b via bus 60b. The OTA manager 30 is connected to electronic control units 40c and 40d via bus 60c.

[0041] The OTA manager 30 can wirelessly communicate with the center 10 via the bus 60a and the communication module 50 through the network 70. This OTA manager 30 is a device that manages the OTA status and controls the software update process, i.e., the update timing, to implement software updates for the electronic control units (hereinafter referred to as "target electronic control units") that are to be updated. The OTA manager 30 controls the software updates of the target electronic control units among the electronic control units 40a to 40d based on update data obtained from the center 10. The OTA manager 30 may also be referred to as a central gateway (CGW).

[0042] Figure 4 It means Figure 1 A simplified block diagram of the OTA Manager 30 in the system. (See diagram below.) Figure 4 As shown, the OTA manager 30 includes a CPU 31, RAM 32, ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, RAM 32, ROM 33, and storage device 34 constitute a microcomputer 35. The number of microcomputers 35 is not limited to one. In the OTA manager 30, the CPU 31 uses RAM 32 as its working area to execute programs read from ROM 33 to perform the processing related to software updates. The communication device 36 is used for... Figure 1 The devices shown are for communicating with the bus 60a-60c, the communication module 50, and the electronic control units 40a-40d, respectively.

[0043] Figure 5 yes Figure 4 The diagram shown is a functional block diagram of OTA Manager 30. Figure 5 The OTA manager 30 shown includes a storage unit 37, a communication unit 38, and a control unit 39. The functions of the storage unit 37 are achieved through… Figure 4 The storage device 34 shown is used to implement this. The functions of the communication unit 38 and the control unit 39 are achieved through... Figure 4 The CPU 31 shown uses RAM 32 to execute programs stored in ROM 33.

[0044] In addition to storing the program (control program for OTA manager 30) used to perform software updates for the multiple electronic control units 40a-40d, and various data used during software updates, the storage unit 37 also stores software update data downloaded from the center 10. Furthermore, the storage unit 37 can store information (described later) related to the type of non-volatile memory mounted on each of the multiple electronic control units 40a-40d.

[0045] The communication unit 38 functions as both a transmitter and a receiver for sending and receiving data, information, and requests between itself and the center 10. For example, the communication unit 38 sends a software update confirmation request to the center 10 (transmitter) when the vehicle's power is turned on. The update confirmation request includes, for example, information related to the vehicle ID used to identify the vehicle and the current version of the software for the electronic control units 40a-40d connected to the vehicle network 20. The vehicle ID and the current version of the software for the electronic control units 40a-40d are used to determine whether update data for the software of the electronic control units 40a-40d exists by comparing it with the latest version of the software maintained by the center 10 for each vehicle ID. Furthermore, the communication unit 38 receives a notification from the center 10 indicating the presence or absence of update data as a response to the update confirmation request (receiver). When software update data for electronic control units 40a-40d is available, the communication unit 38 sends a download request for the software update data distribution data packet to the center 10 (sending unit). Based on the control involved in the control unit 39, the communication unit 38 receives (downloads) the distribution data packet sent from the center 10 based on the communication status between the center 10 and the OTA manager 30 (receiving unit). Additionally, the communication unit 38 sends the software update status sent by the electronic control units 40a-40d to the center 10 (sending unit).

[0046] The control unit 39 determines whether software update data for the electronic control units 40a-40d exists based on the response from the center 10 to the update confirmation request received by the communication unit 38. Furthermore, the control unit 39 verifies the authenticity of the distribution data packets received (downloaded) from the center 10 and stored in the storage unit 37 by the communication unit 38. Additionally, the control unit 39 uses the update data received (downloaded) from the center 10 to control the software update process (various verifications, installations, activations, etc.) of the electronic control units 40a-40d. Specifically, the control unit 39 forwards one or more update data packets downloaded using the distribution data packets to the target electronic control unit, causing the target electronic control unit to install the update software based on the update data. After installation, the control unit 39 instructs the target electronic control unit to activate the installed update software. During this software update process, the control unit 39 appropriately controls the sequence of various verifications, installations, activations, etc., among the multiple electronic control units 40a-40d.

[0047] Multiple electronic control units (ECUs) 40a-40d are devices used to control the actions of various parts of the vehicle. Figure 1 The example shown is an in-vehicle network 20 with four electronic control units 40a to 40d, but the number of electronic control units is not particularly limited. For example, a display device (HMI) for various displays, such as displaying the presence of updated data during software update processing of the electronic control units 40a to 40d, displaying a consent request screen to the vehicle user or administrator requesting consent for the software update, and displaying the results of the software update, can be connected to the OTA manager 30. As a display device, a car navigation system can be used. Furthermore, the number of buses connecting the electronic control units to the OTA manager 30 is not particularly limited. For example, the aforementioned display device can be connected to the OTA manager 30 via a bus other than buses 60a to 60c.

[0048] An example of a simplified structure of the electronic control unit 40a-40d is as follows: Figure 6A as well as Figure 6B As shown.

[0049] Figure 6AThe illustrated electronic control unit 40a includes a CPU 41, RAM 42, non-volatile memory 43a, and a communication device 44. The CPU 41 executes programs read from the non-volatile memory 43a using RAM 42 as its working area to implement the functions of the electronic control unit 40a. The non-volatile memory 43a is a memory with a single storage area 45 for storing data such as software (hereinafter referred to as "single-database memory"). Hereinafter, the type of memory with this single storage area 45 is referred to as "Category 1". In some cases, the storage area 45 stores not only the software used to implement the functions of the electronic control unit 40a, but also version information, parameter data, boot programs, software update programs, etc. The communication device 44 is a device for communicating with other electronic control units 40b to 40d connected to the OTA manager 30 and the vehicle network 20.

[0050] Figure 6B The electronic control unit 40b shown, like the electronic control unit 40a, includes a CPU 41, RAM 42, non-volatile memory 43b, and a communication device 44. The non-volatile memory 43b mounted in the electronic control unit 40b is a memory with two storage areas 46a and 46b for storing software and other data (hereinafter referred to as "dual-library memory"). Hereinafter, this type of non-volatile memory 43b with the structure of two storage areas 46a and 46b is referred to as "Category 2". There are cases where storage areas 46a and 46b store not only the software used to implement the functions of the electronic control unit 40b, but also version information, parameter data, boot programs, software update programs, etc. The CPU 41 of the electronic control unit 40b uses either of the two storage areas 46a and 46b of the non-volatile memory 43b as the storage area to be read (the application area), and executes the software stored in that storage area. In a storage area other than the read object (non-application surface, write surface), during the execution of the program in the storage area (application surface) of the read object, the installation (writing) of the update software (updated version of the program) based on the updated data can be performed in the background. During the activation (validation of the update software) in the software update process, the update software can be activated by switching the storage area of ​​the read object of the program using the CPU 41 of the electronic control unit 40b.

[0051] As a specific example, imagine a scenario where current software is stored in storage area 46a of the non-volatile memory 43b, which is a dual-library memory, and update software is installed in storage area 46b. If the OTA manager 30 instructs the activation of new software, then, for example, by switching the read start address of CPU 41 from the front address of storage area 46a to the front address of storage area 46b via the electronic control unit 40b, the storage area of ​​the read target (application surface) of CPU 41 can be switched, and the update software installed in storage area 46b can be executed. Furthermore, in this disclosure, a structure called "single-sided suspended memory," which virtually divides one storage area into two surfaces and allows writing software (programs) to the other surface while executing a program stored on one surface, is also classified as a second type of memory.

[0052] Figure 7 This represents an example of category information, which relates to the category of non-volatile memory respectively mounted in multiple electronic control units 40a-40d. Figure 7 In the example category information, the identifier of the electronic control unit (ECU_ID) is associated with the category (Category 1 (single library) / Category 2 (dual library)) of the non-volatile memory installed in that ECU. This category information is managed by storing it in either the storage unit 37 of the OTA manager 30 or the storage unit 16 of the center 10. Category information is pre-created based on the specifications of the electronic control units 40a-40d constituting the vehicle network 20. It can be stored in the storage unit 37 of the OTA manager 30 during vehicle manufacturing, or retrieved by the OTA manager 30 from the target ECU via communication within the vehicle network 20 during software update processing. Furthermore, when the category information is managed by the center 10, the OTA manager 30 can retrieve the category information from the center 10 via the network 70.

[0053] The communication module 50 is a unit that controls the communication between the center 10 and the vehicle, and is a communication device used to connect the vehicle network 20 to the center 10. The communication module 50 is wirelessly connected to the center 10 via the network 70 to perform vehicle authentication, download update data, and other functions related to the OTA manager 30. This communication module 50 can be configured to be included in the OTA manager 30.

[0054] Summary of software update processing

[0055] The OTA manager 30 sends a software update confirmation request to the center 10, for example, when the vehicle is powered on. The update confirmation request includes information related to the status (system configuration) of the electronic control units (ECUs) 40a-40d, such as the vehicle ID used to identify the vehicle and the current version of the hardware and software of the ECUs 40a-40d connected to the vehicle network 20; that is, vehicle configuration information. Vehicle configuration information can be created by obtaining the ECU identification number (ECU_ID) and the ECU software version identification number (ECU_Software_ID) from the ECUs 40a-40d connected to the vehicle network 20. The vehicle ID and the current version of the ECU software are used to determine whether update data for the ECUs 40a-40d exists by comparing it with the latest version of the software maintained by the center 10 for each vehicle ID. The center 10 sends a notification indicating the presence or absence of update data to the OTA manager 30 as a response to the update confirmation request received from the OTA manager 30. When update data for the software of electronic control units 40a to 40d is available, the OTA manager 30 sends a download request for a distribution data packet to the center 10. The center 10, based on the download request received from the OTA manager 30, sends a distribution data packet (described later) containing the update data based on the communication status between the center 10 and the OTA manager 30 to the OTA manager 30. The distribution data packet may include, in addition to the update data, verification data for verifying the authenticity of the update data, the quantity and category information of the update data, and various control information used during software updates.

[0056] The OTA manager 30 determines whether software update data for the electronic control units 40a-40d exists based on the response to the update confirmation request received from the center 10. Furthermore, the OTA manager 30 verifies the authenticity of distribution data packets received from the center 10 and stored in the storage device 13 based on the communication status between the center 10 and the OTA manager 30. Additionally, the OTA manager 30 forwards one or more update data packets downloaded using the distribution data packets to the target electronic control unit, causing the target electronic control unit to install the update data. After installation, the OTA manager 30 instructs the target electronic control unit to activate the installed updated software.

[0057] Furthermore, during the consent request processing, the OTA manager 30 outputs a notification to the output device that consent is required for a software update, or a notification urging consent to the software update. As the output device, a display device (not shown) for display-based notifications and a sound output device (not shown) for sound-based notifications, both installed in the vehicle network 20, can be used. For example, when using a display device as the output device in the consent request processing, the OTA manager 30 can display a consent request screen for requesting consent from the user or administrator for a software update, or display a notification urging the user or administrator to press the consent button, or other specific input operations. Additionally, during the consent request processing, the OTA manager 30 can display statements, icons, etc., indicating that software update data for electronic control units 40a-40d exists, or display limitations in the software update process. If the OTA manager 30 receives consent input from the user or administrator, it executes the aforementioned installation and activation control processing to update the software of the target electronic control unit.

[0058] Here, when the non-volatile memory of the target electronic control unit is a single-library memory, since installation and activation are performed continuously in principle, a request for consent to software updates is processed before installation. Furthermore, even for a target electronic control unit with a single-library memory, update processing may be temporarily suspended after installation is complete, i.e., a request for standby (delayed) activation is made. Additionally, when the non-volatile memory of the target electronic control unit is a dual-library memory, a request for consent to software updates is processed at least after installation and before activation. Furthermore, when the non-volatile memory of the target electronic control unit is a dual-library memory, the request for consent to software updates before installation may or may not be performed.

[0059] The software update process consists of three phases: the OTA manager 30 downloads update data from the center 10 (download phase); the OTA manager 30 transfers the downloaded update data to the target electronic control unit and installs the update software based on the update data in the storage area of ​​the target electronic control unit (installation phase); and the target electronic control unit activates the installed update software (activation phase).

[0060] The download process involves the OTA manager 30 receiving update data from the center 10 for updating the software of the electronic control unit and storing it in the storage unit 37. During the download, update data for electronic control units equipped with dual-database memory and update data for electronic control units equipped with single-database memory are downloaded based on the communication status between the center 10 and the OTA manager 30, using predetermined distribution data packets (described later). The download phase includes not only the execution of the download but also the control of a series of download-related processes, such as determining whether the download can be executed and verifying the update data.

[0061] The update data sent from center 10 to OTA manager 30 may include any of the following: electronic control unit update software (complete data or differential data), compressed data resulting from compressed update software, split update software, or split data of compressed data. Additionally, the update data may include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The downloaded distribution data package may include update data for a single electronic control unit or update data for multiple electronic control units.

[0062] The installation process involves the OTA manager 30 writing update software (updated program) to the non-volatile memories 43a and / or 43b of multiple target electronic control units in a predetermined order, based on update data downloaded from the center 10 according to the communication status between the center 10 and the OTA manager 30. Installation can prioritize either update data for electronic control units equipped with dual-library memories or update data for electronic control units equipped with single-library memories, or it can proceed without preference between the two. The installation phase includes not only the execution of the installation but also the control of a series of installation-related processes, such as determining whether the installation can be executed, transferring update data, and verifying the update software.

[0063] When the update data includes the update software itself (complete data), the OTA manager 30 transfers the update data (update software) to the target electronic control unit (ECU) during the installation phase. Alternatively, when the update data includes compressed, differential, or segmented data of the update software, the OTA manager 30 may transfer the update data to the target ECU, which then generates the update software based on the update data. Or, the OTA manager 30 may generate the update software based on the update data and then transfer the update software to the target ECU. Here, the generation of the update software can be achieved by decompressing compressed data or combining (integrating) differential or segmented data.

[0064] The installation of updated software can be performed by the target electronic control unit based on an installation request from the OTA manager 30. Furthermore, a specific target electronic control unit that receives the update data can also perform the installation autonomously without explicit instructions from the OTA manager 30.

[0065] Activation is the process by which the target electronic control unit (ECU) activates the update software installed in the non-volatile memory 43a and / or 43b. Activation can prioritize either update data for ECUs equipped with dual-library memory or update data for ECUs equipped with single-library memory, or it can proceed without preference between the two. The activation phase includes not only the execution of activation but also the control of a series of activation-related processes, such as determining whether activation is feasible, requesting the vehicle user or administrator's consent to activation, and verifying the execution result.

[0066] The activation of the updated software can be performed by the target electronic control unit based on an activation request from the OTA manager 30. Furthermore, a specific target electronic control unit that receives the update data can also activate itself after installation without explicit instructions from the OTA manager 30.

[0067] Among them, it is capable of performing software update processing on multiple target electronic control units, either continuously or in parallel.

[0068] In addition, the "software update processing" in this manual includes not only the entire process of continuous downloading, installation and activation, but also the process of only performing a part of the downloading, installation and activation.

[0069] deal with

[0070] Next, refer to Figure 8 , Figure 9 as well as Figure 10 Here are some specific examples related to software update processing performed in the network system described in this embodiment.

[0071] (1) Specific examples of downloading

[0072] Figure 8 This is a flowchart illustrating the processing steps involved in a specific example of downloading by the center 10 and the OTA manager 30. The download begins when the center 10 receives a download request for a distribution data packet from the OTA manager 30. Figure 8 The download process is illustrated.

[0073] (Step S801)

[0074] Center 10 determines whether the communication status between Center 10 and OTA Manager 30 is good. The communication status can be determined based on the execution status of the application responsible for communication control between Center 10 and the vehicle (e.g., the idle status of the communication band, the state of the communication load). For example, a good communication status can be defined as when there is more than a specified value of idle space in the communication band, or when the communication load is less than a specified value. This specified value can be arbitrarily set considering factors such as the size of the update data, the communication environment installed in the vehicle, and the software update deadline, and based on whether the selection of independently distributed data packets (described later) is the desired situation. If the communication status between Center 10 and OTA Manager 30 is good (step S801, Yes), the process proceeds to step S802. Conversely, if the communication status between Center 10 and OTA Manager 30 is poor (step S801, No), the process proceeds to step S803.

[0075] (Step S802)

[0076] Center 10 simultaneously sends update data (hereinafter referred to as "Category 1 update data") to the OTA manager 30 for both the target electronic control unit equipped with Category 1 non-volatile memory (single-library memory) and the target electronic control unit equipped with Category 2 non-volatile memory (dual-library memory). This simultaneous transmission of Category 1 and Category 2 update data can be performed by sending a single distribution data packet, i.e., the same distribution data packet, where both Category 1 and Category 2 update data are packaged together. Center 10 can generate the same distribution data packet based on update data obtained from the vehicle manufacturer (OEM), or it can directly use a single distribution data packet generated by the vehicle manufacturer. The same distribution data packet, which combines Category 1 and Category 2 update data, can be generated in multiple parts according to the target electronic control unit. If both Category 1 and Category 2 update data are simultaneously sent from Center 10, the process proceeds to step S804.

[0077] (Step S803)

[0078] Center 10 sends Category 1 update data and Category 2 update data to OTA Manager 30 respectively. This independent transmission of Category 1 and Category 2 update data can be performed by sending a distribution data packet containing only Category 1 update data (an independent distribution data packet) and a distribution data packet containing only Category 2 update data (an independent distribution data packet) separately. As an example, one could send an independent distribution data packet containing Category 2 update data (which has a lower failure probability) first, followed by an independent distribution data packet containing Category 1 update data. Center 10 can generate independent distribution data packets based on update data obtained from the vehicle manufacturer (OEM), or it can directly use independent distribution data packets generated by the vehicle manufacturer. Alternatively, if Center 10 obtains update data from the vehicle manufacturer in the same distribution data packet format, it can regenerate independent distribution data packets for both Category 1 and Category 2 update data. Furthermore, Center 10 can divide an independent distribution data packet containing multiple update data packets generated by the vehicle manufacturer into multiple data packets, for example, according to the target electronic control unit. The center 10 can determine the memory category of the non-volatile memory mounted on the target electronic control unit by referring to the category information stored in the storage unit 16. If update data for category 1 and update data for category 2 are sent from the center 10 respectively, the process proceeds to step S804.

[0079] (Step S804)

[0080] OTA Manager 30 receives update data sent from Center 10 via a distribution data packet. When communication between Center 10 and OTA Manager 30 is good, OTA Manager 30 can simultaneously receive update data for Category 1 and Category 2 using the same distribution data packet downloaded from Center 10. Conversely, when communication between Center 10 and OTA Manager 30 is poor, OTA Manager 30 can receive update data for Category 1 and Category 2 separately using independent distribution data packet downloads from Center 10. If a distribution data packet is received from Center 10, the process proceeds to step S805.

[0081] (Step S805)

[0082] The OTA manager 30 determines whether the download of all update data (Category 1 / Category 2) sent from the center 10 is complete. The completion of the download can be determined by whether all update data requested from the center 10 via download requests has been received. If the download of all update data is complete (step S805, Yes), the process proceeds to step S806. Conversely, if the download of all update data is incomplete (step S806, No), the process proceeds to step S801.

[0083] (Step S806)

[0084] The OTA manager 30 stores the update data received from the center 10 via data packets in the storage unit 37. This completes the download process.

[0085] According to the specific example of this download, the center 10 and the OTA manager 30 can download update data suitable for the software update of each target ECU based on the communication status between the center 10 and the OTA manager 30.

[0086] In the specific example described above, the control of which distribution data packet or independent distribution data packet to send to the OTA manager 30 is explained by the center 10 determining the communication status between the center 10 and the OTA manager 30. Conversely, control can also be implemented by the OTA manager 30 determining the communication status between the center 10 and the OTA manager 30, and receiving the appropriate distribution data packet in response to a download request from the center 10 regarding which distribution data packet or independent distribution data packet to send.

[0087] (2) Specific examples of installation

[0088] Figure 9 This is a flowchart illustrating the installation process for a specific example involving the OTA manager 30 and the target electronic control unit (hereinafter referred to as the "target ECU"). The process begins after at least one Category 2 update data download is completed and the specified conditions are met (installation is executable, update data verification is passed, etc.). Figure 9 Specific examples of installation are shown.

[0089] (Step S901)

[0090] The OTA manager 30 obtains the category (Category 1 / Category 2) of the non-volatile memory installed in the target ECU. For this memory category, when managed by the OTA manager 30, the category information stored in the storage unit 37 can be referenced. Figure 7The memory category of the target ECU can be obtained by referring to the memory category information contained in the distribution data packet, when managed by the center 10. If the memory category of the target ECU is obtained, the process proceeds to step S902.

[0091] (Step S902)

[0092] The OTA manager 30 and the target ECU of category 2 begin the process of writing the update software to the storage area of ​​the non-volatile memory of the target ECU of category 2 based on the update data; that is, installation. The installation is initiated simultaneously or in a predetermined order for all target ECUs of category 2. If installation for the target ECU of category 2 has begun, the process proceeds to step S903.

[0093] (Step S903)

[0094] The OTA manager 30 and the target ECU of category 1 begin the process of writing the update software to the storage area of ​​the non-volatile memory of the target ECU of category 1 based on the update data; that is, installation. This installation can begin simultaneously or in a predetermined order for all target ECUs of category 1. The installation of the target ECU of category 1 can begin after the installation of all target ECUs of category 2 is completed, or it can begin after the installation of a predetermined portion of the target ECUs of category 2 is completed. If the installation of the target ECU of category 1 has begun, the process proceeds to step S904.

[0095] (Step S904)

[0096] The OTA manager 30 determines whether the installation of the update software in all target ECUs (Category 1 and Category 2) is complete. The OTA manager 30 can determine completion based on the presence of completion notifications from each target ECU, or based on the elapsed time since the start of installation. The specified time can be set to, for example, the maximum time required for each installation. If the OTA manager 30 determines that the installation of the update software in all target ECUs is complete (step S904, Yes), then the installation process ends for the target ECUs.

[0097] Based on the specific installation example described above, the installation of target ECUs of category 2, which do not require control interruption during the update, can be initiated before the installation of target ECUs of category 1, which require control interruption during the update. This process reduces the communication load within the vehicle (vehicle network 20) ​​and shortens the time required for vehicle control to be stopped until all update software has been written.

[0098] (3) Specific examples of activation

[0099] Figure 10 This is a flowchart illustrating the specific steps involved in activating the OTA Manager 30 and the target ECU. The process begins after the installation of the update software for both Category 1 and Category 2 target ECUs is complete and the specified conditions are met (activation executable, update data verification passed, etc.). Figure 10 The activation process is illustrated.

[0100] (Step S1001)

[0101] The OTA manager 30 and the target ECU of category 1 begin activating the update software that will be written to the storage area of ​​the non-volatile memory of the target ECU of category 1. This activation begins simultaneously or in a predetermined order for all target ECUs of category 1. If the activation of the update software in the target ECU of category 1 begins, the process proceeds to step S1002.

[0102] (Step S1002)

[0103] The OTA manager 30 and the target ECU of category 2 begin activating the update software that will be written to the storage area of ​​the non-volatile memory of the target ECU of category 2. This activation begins simultaneously or in a predetermined order for all target ECUs of category 2. Activation of the target ECUs of category 2 can begin after the activation of all target ECUs of category 1 is completed, or it can begin after the activation of a predetermined portion of the target ECUs of category 1 is completed. If the activation of the update software for the target ECUs of category 2 has begun, the process proceeds to step S1003.

[0104] (Step S1003)

[0105] The OTA manager 30 determines whether the activation of the updated software in all target ECUs (Category 1 and Category 2) is complete. The OTA manager 30 can determine completion based on the presence of completion notifications from each target ECU, or based on the elapsed time since the start of activation. The specified time can be set to, for example, the maximum time required for each activation. If it is determined that the activation of the updated software in all target ECUs is complete (step S1003, Yes), then the activation process ends for the target ECUs.

[0106] Based on the specific example of activation described above, activation of the update software for the target ECU of category 1 begins first, followed by activation of the update software for the target ECU of category 2. Through this process, since the software update for the target ECU of category 2 can be implemented after the successful confirmation of the software update for the target ECU of category 1, it is appropriate to perform software update processing on systems comprising both target ECUs equipped with a single-library memory and target ECUs equipped with a dual-library memory.

[0107] Function / Effect

[0108] As described above, according to one embodiment of the network system disclosed herein, the method for downloading update data for electronic control units equipped with single-library memory (a type 1 non-volatile memory) and for electronic control units equipped with dual-library memory (a type 2 non-volatile memory) can be appropriately controlled based on the communication status between the center and the OTA manager.

[0109] This process enables the appropriate transmission and reception of updated data based on the communication status between the center and the vehicle. Therefore, it reduces the time spent until the updated electronic control unit starts up normally.

[0110] More specifically, when the communication load between the central control center and the OTA manager is less than a specified value, the control is configured to use the same distribution data packet to receive update data (update data for Category 1) for electronic control units equipped with single-library memory and update data (update data for Category 2) for electronic control units equipped with dual-library memory. Conversely, when the communication load between the central control center and the OTA manager is greater than or equal to the specified value, the control is configured to use separate distribution data packets to receive update data for electronic control units equipped with single-library memory and update data for electronic control units equipped with dual-library memory.

[0111] This process enables seamless post-download processing even under low communication load conditions between the center and the vehicle, as it allows for the simultaneous downloading of update data for both electronic control units equipped with single-database memory and electronic control units equipped with dual-database memory.

[0112] The above describes one embodiment of the technology disclosed herein. However, this disclosure can be understood not only as a center, but also as a method or program executed by a center having one or more processors and one or more memories, a computer-readable non-transitory storage medium storing a program, an OTA manager capable of communicating with the center, a system having a center and an OTA manager, or a vehicle having an OTA manager, etc.

[0113] The technology disclosed herein can be utilized in network systems used for updating the software of electronic control units.

Claims

1. A central device, characterized in that, include: The communication unit is configured to communicate with an OTA manager configured to control software updates of multiple electronic control units (ECUs) installed in a vehicle based on update data, and to send update data (i.e., first-category update data) to a first ECU equipped with a first-category non-volatile memory having one storage area, and update data (i.e., second-category update data) to a second ECU equipped with a second-category non-volatile memory having two storage areas, wherein the first ECU and the second ECU are included in the plurality of ECUs; and The control unit is configured to control the transmission of the first category update data and the second category update data to the OTA manager based on the communication status between the central device and the OTA manager. The control unit is configured such that, when the communication load between the central device and the OTA manager is less than a predetermined value, the communication unit sends a distribution data packet, including update data for the first category and update data for the second category, to the OTA manager. Furthermore, when the communication load between the central device and the OTA manager exceeds the specified value, a first distribution data packet including update data for the first category and a second distribution data packet including update data for the second category will be sent independently to the OTA manager.

2. An OTA manager, characterized in that, include: The communication unit is configured to receive, from a central device, update data for a first category of electronic control unit equipped with a first category of non-volatile memory having one storage area, and update data for a second category of electronic control unit equipped with a second category of non-volatile memory having two storage areas. The first and second electronic control units are included in a plurality of electronic control units mounted in the vehicle, and the update data for the first and second categories are update data for controlling software updates of the plurality of electronic control units. and The control unit is configured to control the reception of the first category update data and the second category update data from the central device based on the communication status between the central device and the OTA manager. The control unit is configured to, when the communication load between the central device and the OTA manager is less than a predetermined value, request the central device to send a distribution data packet including the update data for the first category and the update data for the second category. Furthermore, if the communication load between the central device and the OTA manager exceeds the specified value, the central device is requested to send a first distribution data packet including update data for the first category and a second distribution data packet including update data for the second category.

3. A system, characterized in that, include: An OTA manager is configured to control software updates for multiple electronic control units installed in a vehicle based on update data. and Central device, The central device includes: The first communication unit is configured to communicate with the OTA manager and send update data (i.e., update data for the first category) to a first electronic control unit equipped with a first type of non-volatile memory having one storage area, and update data (i.e., update data for the second category) to a second electronic control unit equipped with a second type of non-volatile memory having two storage areas, wherein the first electronic control unit and the second electronic control unit are included in the plurality of electronic control units; and The control unit is configured to control the transmission of the first category update data and the second category update data to the OTA manager based on the communication status between the central device and the OTA manager. in, The OTA manager includes a second communication unit configured to receive update data for the first category and update data for the second category sent by the central device. The control unit is configured as follows: If the communication load between the central device and the OTA manager is less than a predetermined value, the control is to transmit via distribution data packets that include update data for the first category and update data for the second category. Furthermore, when the communication load between the central device and the OTA manager is above the specified value, the control is to send a first distribution data packet including update data for the first category and a second distribution data packet including update data for the second category.

4. A method performed by a central device configured to communicate with an OTA manager, the OTA manager having one or more processors and one or more memories and configured to control software updates of multiple electronic control units mounted in a vehicle based on update data. The method is characterized by including: The step of determining the communication status between the central device and the OTA manager; If, based on the communication status, it is determined that the communication load between the central device and the OTA manager is less than a specified value, the update data (i.e., the first-category update data) for the electronic control unit equipped with a first-category non-volatile memory having one storage area and the update data (i.e., the second-category update data) for the electronic control unit equipped with a second-category non-volatile memory having two storage areas are sent to the OTA manager in the same distribution data packet. as well as If, based on the communication status, the communication load between the central device and the OTA manager is determined to be above the specified value, the step of sending the first category update data and the second category update data to the OTA manager as independent distribution data packets.

5. A non-transitory storage medium, characterized in that, The non-transitory storage medium stores commands that can be executed by a computer configured to communicate with an OTA manager, causing the computer to perform the method of claim 4. The OTA manager has one or more processors and one or more memories and is configured to control software updates of electronic control units mounted in the vehicle.

6. A vehicle, characterized in that, Includes the OTA manager as described in claim 2.

Images