OTA manager, center, system, method, and non-transitory storage medium

Abstract

The present invention relates to an OTA manager, a center, a system, a method, a non-transitory storage medium and a vehicle. The OTA manager is configured to control software updates of an electronic control unit mounted on a vehicle, and has a communication unit configured to receive a first distribution data packet from the center prior to a second distribution data packet. The second distribution data packet is a distribution data packet of update data for the electronic control unit equipped with a second category of non-volatile memory, and the second category of non-volatile memory has two storage areas. The first distribution data packet is a distribution data packet of update data for the electronic control unit equipped with a first category of non-volatile memory, and the first category of non-volatile memory has one storage area.

Description

[0001] This application claims the benefit of Japanese Patent Application No. 2021-095070 filed on June 7, 2021, and incorporates the entire contents of this application herein. Technical Field

[0002] The present disclosure relates to an OTA manager, a center, a system, a method, a non-transitory storage medium, and a vehicle that control the update of software of an electronic control unit. Background Art

[0003] The vehicle is equipped with a plurality of electronic control units for controlling the movement of the vehicle. The electronic control unit has a processor, a temporary storage unit such as RAM, and a non-volatile memory such as a flash ROM as a non-volatile storage unit. The electronic control unit implements the control function of the electronic control unit by executing the software stored in the non-volatile memory through the processor. The software stored in each electronic control unit is rewritable. By updating the software of the electronic control unit to a newer version of the software, the functions of each electronic control unit can be improved and new vehicle control functions can be added.

[0004] As a technology for updating the software of an electronic control unit, OTA (Over The Air) technology is known. A device responsible for updating the software of a vehicle and an on-board communication device connected to the on-board network are wirelessly connected via a communication network such as the Internet. The above-mentioned device updates and adds software to the electronic control unit by downloading software from a server via wireless communication and installing the downloaded software to the electronic control unit. For example, refer to Japanese Patent Laid-Open No. 2004-326689.

[0005] There are two types of non-volatile memories installed in electronic control units: a memory having one storage area for storing data such as software (single-bank memory) and a memory having two storage areas for storing data such as software (dual-bank memory). The types of non-volatile memories used are classified according to the specifications of the electronic control unit, etc. An electronic control unit equipped with a dual-bank memory can store two versions of data, new and old, in two storage areas.

[0006] In the event or activity of performing software update on a vehicle, there are cases where both an electronic control unit equipped with a single bank memory and an electronic control unit equipped with a dual bank memory are electronic control units to be updated with software. In this case, if the server aggregates the update data for the electronic control unit equipped with a dual bank memory and the update data for the electronic control unit equipped with a single bank memory into one data packet and transmits it to a device responsible for the software update processing of the vehicle, the communication volume required for retransmitting the data increases when a transmission abnormality occurs. Summary of the invention

[0007] The present disclosure provides an OTA manager, a center, a system, a method, a non-transitory storage medium, and a vehicle capable of performing software updates suitable for a single bank memory and a dual bank memory.

[0008] In a first mode of the disclosed technology, an OTA manager is disclosed, which is configured to control software updates of an electronic control unit mounted on a vehicle, and the OTA manager includes a communication unit. The communication unit is configured to receive a second distribution data packet from a center prior to the first distribution data packet. The second distribution data packet is a distribution data packet of update data for the electronic control unit equipped with a second category of non-volatile memory. The second category of non-volatile memory has two storage areas. The first distribution data packet is a distribution data packet of update data for the electronic control unit equipped with a first category of non-volatile memory. The first category of non-volatile memory has one storage area.

[0009] The OTA manager involved in the first mode of the disclosed technology may also have a control unit, which is configured to send information based on the above-mentioned update data received by the above-mentioned communication unit to the above-mentioned electronic control unit that is the update object based on category information, and the above-mentioned category information indicates whether the non-volatile memory carried by the above-mentioned electronic control unit is the above-mentioned first category or the above-mentioned second category.

[0010] In the OTA manager according to the first aspect of the presently disclosed technology, the communication unit may be configured to obtain the category information from the center.

[0011] The OTA manager according to the first aspect of the disclosed technology may further include a storage unit configured to store the category information.

[0012] In the OTA manager involved in the first mode of the presently disclosed technology, the above-mentioned control unit can be configured to, based on the above-mentioned category information, give priority to sending information on update data of the above-mentioned electronic control unit equipped with the above-mentioned second category non-volatile memory over information on update data of the above-mentioned electronic control unit equipped with the above-mentioned first category non-volatile memory to the above-mentioned electronic control unit that is the update object.

[0013] In a second aspect of the disclosed technology, a center is disclosed, which is configured to communicate with an OTA manager configured to control software updates of an electronic control unit mounted on a vehicle, and the center includes a storage unit configured to store category information, the category information indicating whether a non-volatile memory mounted on the electronic control unit is a first category non-volatile memory or a second category non-volatile memory. The first category non-volatile memory has one storage area. The second category non-volatile memory has two storage areas.

[0014] The center involved in the second mode of the disclosed technology may further include a first communication unit, which is configured to send a first distribution data packet and a second distribution data packet to the OTA manager based on the category information. The first distribution data packet is a distribution data packet for update data of the electronic control unit equipped with the first category of non-volatile memory. The second distribution data packet is a distribution data packet for update data of the electronic control unit equipped with the second category of non-volatile memory.

[0015] In the center according to the second aspect of the presently disclosed technology, the first communication unit may be configured to transmit the second distribution packet to the OTA manager prior to the first distribution packet based on the type information.

[0016] In the center according to the second aspect of the presently disclosed technology, the first communication unit may be configured to transmit the category information stored in the storage unit to the OTA manager.

[0017] The system in the third mode of the disclosed technology may include the center of the second mode and the above-mentioned OTA manager. The above-mentioned center may include a first communication unit, and the first communication unit is configured to send a first distribution data packet and a second distribution data packet to the above-mentioned OTA manager. The above-mentioned first distribution data packet may be a distribution data packet of update data for the above-mentioned electronic control unit equipped with the above-mentioned first category of non-volatile memory. The above-mentioned second distribution data packet may be a distribution data packet of update data for the above-mentioned electronic control unit equipped with the above-mentioned second category of non-volatile memory. The above-mentioned OTA manager may include a second communication unit configured to receive the above-mentioned second distribution data packet from the above-mentioned center before the above-mentioned first distribution data packet.

[0018] In the system involved in the third embodiment of the presently disclosed technology, the OTA manager may include a control unit, which is configured to, based on the category information, send information on update data of the electronic control unit equipped with the second category non-volatile memory to the electronic control unit that is the update target in priority over information on update data of the electronic control unit equipped with the first category non-volatile memory.

[0019] In the system according to the third aspect of the disclosed technology, the center may include the storage unit configured to store the category information. The first communication unit of the center may be configured to transmit the category information to the OTA manager.

[0020] In a fourth embodiment of the disclosed technology, a method is disclosed, which is executed by an OTA manager that controls the software update of an electronic control unit mounted on a vehicle. The above-mentioned OTA manager has a memory and one or more processors. The above-mentioned method includes receiving a second distribution data packet from a center prior to the first distribution data packet. The above-mentioned second distribution data packet is a distribution data packet of update data for the above-mentioned electronic control unit equipped with a second category of non-volatile memory. The above-mentioned second category of non-volatile memory has two storage areas. The above-mentioned first distribution data packet is a distribution data packet of update data for the above-mentioned electronic control unit equipped with a first category of non-volatile memory. The above-mentioned first category of non-volatile memory has one storage area.

[0021] In a fifth embodiment of the disclosed technology, a non-temporary storage medium is disclosed, storing commands that can be executed by a computer of an OTA manager that controls software updates of an electronic control unit mounted on a vehicle and causes the above-mentioned computer to perform the following functions. The above-mentioned OTA manager has a memory and one or more processors. The above-mentioned function includes receiving a second distribution data packet from a center prior to the first distribution data packet. The above-mentioned second distribution data packet is a distribution data packet of update data for the above-mentioned electronic control unit equipped with a second category of non-volatile memory. The above-mentioned second category of non-volatile memory has two storage areas. The above-mentioned first distribution data packet is a distribution data packet of update data for the above-mentioned electronic control unit equipped with a first category of non-volatile memory. The above-mentioned first category of non-volatile memory has one storage area.

[0022] The vehicle is equipped with the OTA manager according to the first aspect of the disclosed technology.

[0023] According to the OTA manager of the present disclosure, when an abnormality occurs in the communication of a distribution packet, only the distribution packet needs to be resent, so that software update suitable for a single bank memory and a dual bank memory can be performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Hereinafter, features, advantages, technical and industrial significance of exemplary embodiments of the present invention will be described with reference to the accompanying drawings, in which like reference numerals represent like components, wherein:

[0025] Figure 1 It is a block diagram showing the overall configuration of a network system according to an embodiment.

[0026] Figure 2 is a block diagram showing the simplified structure of the center.

[0027] Figure 3 It is the functional block diagram of the center.

[0028] Figure 4 is a block diagram showing the brief structure of the OTA manager.

[0029] Figure 5 This is the functional block diagram of the OTA manager.

[0030] Fig. 6A This is a block diagram showing an example of a schematic configuration of an electronic control unit.

[0031] Figure 6B This is a block diagram showing an example of a schematic configuration of an electronic control unit.

[0032] Figure 7 This is a diagram showing an example of category information.

[0033] Figure 8 This is a flow chart example of the download processing steps performed by the hub and OTA manager.

[0034] Fig. 9 is a flow chart example of the installation process steps performed by the OTA manager and the target electronic control unit.

[0035] Fig.10 is a flow chart example of activation processing steps performed by the OTA manager and the target electronic control unit. DETAILED DESCRIPTION

[0036] In the network system disclosed in the present invention, the OTA manager receives a distribution data packet of update data for an electronic control unit equipped with a dual-bank memory from the center before receiving a distribution data packet of update data for an electronic control unit (ECU) equipped with a single-bank memory. Thus, when a communication anomaly of a distribution data packet occurs, only the distribution data packet (the distribution data packet that caused the communication anomaly) is resent, which can suppress the increase in the communication volume (communication load) between the center and the OTA manager.

[0037] Hereinafter, one embodiment of the present disclosure will be described in detail with reference to the drawings.

[0038] Implementation

[0039] structure

[0040] Figure 1 This is a block diagram showing the overall configuration of a network system according to one embodiment of the present disclosure. Figure 1 The network system shown is a system for updating software of a plurality of electronic control units 40a to 40d mounted in a vehicle. The network system includes a center 10 located outside the vehicle, an in-vehicle network 20 constructed in the vehicle, and a network 70.

[0041] (1) Center

[0042] The center 10 can communicate with the OTA manager 30 provided in the vehicle network 20 via the network 70. The OTA manager 30 will be described later. The center 10 sends update data of the software of the electronic control units 40a to 40d to the OTA manager 30, receives notifications indicating the progress of the software update process from the OTA manager 30, and the like. Thus, the center 10 can control and manage the software update of the plurality of electronic control units 40a to 40d connected to the OTA manager 30. The center 10 has a function as a so-called server.

[0043] Figure 2 Yes means Figure 1 A block diagram of the simplified structure of the center 10 is shown in FIG. Figure 2 As shown, the center 10 includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a storage device 13, and a communication device 14. The storage device 13 is a device having a readable and writable storage medium such as a hard disk drive (HDD) and a solid state drive (SSD). The communication device 14 is an example of a "first communication device". The storage device 13 stores programs for executing software update management, information used in software update control and software update management, and update data of software of each electronic control unit. In the center 10, the CPU 11 executes the program read from the storage device 13 using the RAM 12 as a working area to perform prescribed processing related to software updates. The communication device 14 is a device for communicating with the OTA manager 30 via the network 70.

[0044] Figure 3 yes Figure 2 A functional block diagram of the center 10 is shown. Figure 3 The center 10 shown in FIG. 1 includes a storage unit 16, a communication unit 17, and a control unit 18. The storage unit 16 is composed of Figure 2 The communication unit 17 and the control unit 18 are implemented by Figure 2 The CPU 11 shown is implemented by executing a program stored in the storage device 13 using the RAM 12 .

[0045] The storage unit 16 stores information related to the software update process of one or more electronic control units mounted on the vehicle. As information related to the software update process, the storage unit 16 stores at least update management information and update data of the software of the electronic control units 40a to 40d. The update management information is information that associates information representing software that can be used in the electronic control units 40a to 40d with each vehicle identification information (vehicle ID) that identifies the vehicle. The information representing the software that can be used in the electronic control units 40a to 40d includes, for example, a combination of the latest version information of each software of the multiple electronic control units 40a to 40d. In addition, as information related to the software update process, the storage unit 16 can store the update status of the software being implemented in the vehicle. In addition, the storage unit 16 can store information related to the type of non-volatile memory respectively mounted on the multiple electronic control units 40a to 40d (described later).

[0046] The communication unit 17 functions as a sending unit and a receiving unit for sending and receiving data, information, and requests with the OTA manager 30. The communication unit 17 receives a request for software update confirmation from the OTA manager 30 (receiving unit). The update confirmation request is information sent from the OTA manager 30 to the center 10 when the power or ignition of the vehicle is turned on (hereinafter referred to as "power on"), for example. The update confirmation request is information for requesting the center 10 to confirm whether there is update data for the electronic control units 40a to 40d based on the vehicle configuration information described later. In addition, the communication unit 17 sends information indicating the presence or absence of update data to the OTA manager 30 in response to the update confirmation request received from the OTA manager 30 (sending unit). In addition, the communication unit 17 receives a request for sending a distribution data packet (download request) from the OTA manager 30 (receiving unit). In addition, if the communication unit 17 receives a download request for the distribution data packet, it sends the distribution data packet of the software update data of the electronic control units 40a to 40d generated by the control unit 18 described later to the OTA manager 30. The communication unit 17 is an example of a “first communication unit”.

[0047] If the communication unit 17 receives an update confirmation request from the OTA manager 30, the control unit 18 determines whether there is software update data for the electronic control units 40a to 40d mounted on the vehicle identified by the vehicle ID included in the update confirmation request based on the update management information stored in the storage unit 16. The determination result of whether there is update data by the control unit 18 is sent to the OTA manager 30 by the communication unit 17. If the control unit 18 determines that there is software update data for the electronic control units 40a to 40d and receives a download request for a distribution data package from the OTA manager 30, the control unit 18 generates a distribution data package of the corresponding update data stored in the storage unit 16.

[0048] The control unit 18 independently generates a distribution data packet for update data only for an electronic control unit equipped with a single-bank memory and a distribution data packet for update data only for an electronic control unit equipped with a dual-bank memory. The single-bank memory and the dual-bank memory will be described later. The distribution data packet for update data for an electronic control unit equipped with a single-bank memory is an example of a "first distribution data packet". The distribution data packet for update data only for an electronic control unit equipped with a dual-bank memory is an example of a "second distribution data packet". If the category information described later is pre-stored in the storage unit 16, the control unit 18 can intentionally and independently generate distribution data packets of update data of different categories. The center 10 (communication unit 17) can send the distribution data packet of update data for an electronic control unit equipped with a second category of non-volatile memory to the OTA manager 30 before sending the distribution data packet of update data for an electronic control unit equipped with a first category of non-volatile memory by generating distribution data packets of update data separately based on category.

[0049] (2) In-vehicle network

[0050] The in-vehicle network 20 includes an OTA manager 30, a plurality of electronic control units 40a to 40d, and a communication module 50. The OTA manager 30 and the communication module 50 are connected via a bus 60a. The OTA manager 30 and the electronic control units 40a and 40b are connected via a bus 60b. The OTA manager 30 and the electronic control units 40c and 40d are connected via a bus 60c.

[0051] The OTA manager 30 can realize wireless communication with the center 10 via the bus 60a and the communication module 50 and through the network 70. The OTA manager 30 manages the OTA status. The OTA manager 30 has the function of controlling the flow of software update processing, that is, the update sequence, to implement the software update of the electronic control unit that is the object of the software update (hereinafter referred to as the "target electronic control unit"). The OTA manager 30 controls the software update of the target electronic control unit based on the update data obtained from the center 10. The target electronic control unit is the electronic control unit that is the object of the software update among the electronic control units 40a~40d. It is also possible for one or more target electronic control units to function as the OTA manager 30. There is also a case where the OTA manager 30 is called a central gateway (CGW).

[0052] Figure 4 Yes means Figure 1 A block diagram of the simplified structure of the OTA manager 30 in FIG. Figure 4As shown, the OTA manager 30 includes a microcomputer 35 and a communication device 36. The microcomputer 35 includes a CPU 31, a RAM 32, a ROM 33, and a storage device 34. In the OTA manager 30, the CPU 31 executes a program read from the ROM 33 using the RAM 32 as a work area to perform a predetermined process related to software update. Figure 1 The buses 60a to 60c shown communicate with the communication module 50 and the electronic control units 40a to 40d, respectively. The communication device 36 is an example of a "second communication device".

[0053] Figure 5 yes Figure 4 A functional block diagram of the OTA manager 30 is shown. Figure 5 The OTA manager 30 shown in FIG. 1 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is composed of Figure 4 The communication unit 38 and the control unit 39 are implemented by Figure 4 The CPU 31 shown is implemented by executing a program stored in the ROM 33 using the RAM 32 .

[0054] The storage unit 37 stores a program for executing software updates of the plurality of electronic control units 40a to 40d (a control program of the OTA manager 30), various data used when executing software updates, and update data of software downloaded from the center 10. In addition, the storage unit 37 can store information related to the types of nonvolatile memories respectively mounted on the plurality of electronic control units 40a to 40d (described later).

[0055] The communication unit 38 functions as a transmission unit and a reception unit for transmitting and receiving data, information, and requests with the center 10. For example, the communication unit 38 transmits a software update confirmation request to the center 10 (transmission unit) when the power of the vehicle is turned on. The update confirmation request includes, for example, a vehicle ID for identifying the vehicle and information related to the current version of the software of the electronic control units 40a to 40d connected to the vehicle network 20. The vehicle ID and the current version of the software of the electronic control units 40a to 40d are used to determine whether there is update data for the software of the electronic control units 40a to 40d by comparing with the latest version of the software held by the center 10 for each vehicle ID. In addition, the communication unit 38 receives a notification indicating the presence or absence of update data from the center 10 as a response to the update confirmation request (reception unit). When there is update data for the software of the electronic control units 40a to 40d, the communication unit 38 transmits a download request for a distribution package of the software update data to the center 10 (transmission unit). The communication unit 38 receives (downloads) the distribution package transmitted from the center 10 (reception unit). The communication unit 38 transmits the update status of the software received from the electronic control units 40a to 40d to the center 10 (transmission unit). The communication unit 38 is an example of a "second communication unit".

[0056] The control unit 39 determines whether there is update data for the software of the electronic control units 40a to 40d based on the response from the center 10 to the update confirmation request received from the communication unit 38. In addition, the control unit 39 verifies the authenticity of the distribution data package received (downloaded) from the center 10 by the communication unit 38 and stored in the storage unit 37. In addition, the control unit 39 controls the software update processing (various verification, installation, activation, etc.) of the electronic control units 40a to 40d using the update data received (downloaded) from the center 10. Specifically, the control unit 39 transfers one or more update data downloaded by the distribution data package to the target electronic control unit. Then, the control unit 39 causes the target electronic control unit to install the update software based on the update data. After the installation is completed, the control unit 39 instructs the target electronic control unit to activate (validate) the installed update software. During the software update processing, the control unit 39 appropriately controls various verification, installation, activation, etc. steps in the plurality of electronic control units 40a to 40d.

[0057] The plurality of electronic control units 40a to 40d control the operation of various parts of the vehicle. Figure 1In the figure, an example is shown in which the in-vehicle network 20 has four electronic control units 40a to 40d, but the number of electronic control units is not particularly limited. A display device (HMI) for displaying various displays such as the existence of update data when the software of the electronic control units 40a to 40d is updated, displaying a consent request screen for requesting consent to the software update from the user or manager of the vehicle, and displaying the results of the software update can be connected to the OTA manager 30. As a display device, a car navigation system or the like can be used. In addition, the number of buses connecting the electronic control unit to the OTA manager 30 is not particularly limited. For example, the above-mentioned display device can be connected to the OTA manager 30 via a bus other than buses 60a to 60c.

[0058] An example of a simplified structure of the electronic control units 40a to 40d is as follows: Fig. 6A as well as Figure 6B shown.

[0059] Fig. 6A The electronic control unit 40a shown has a CPU 41, a RAM 42, a non-volatile memory 43a, and a communication device 44. The CPU 41 implements the functions of the electronic control unit 40a by executing a program read from the non-volatile memory 43a using the RAM 42 as a work area. The non-volatile memory 43a has a storage area 45 (hereinafter referred to as a "single library memory") for storing data such as software. Hereinafter, the memory category of the non-volatile memory 43a having a storage area 45 is referred to as "first category". In addition to storing software for implementing the functions of the electronic control unit 40a, the storage area 45 can also store version information, parameter data, a boot program for startup, and a program for software update. The communication device 44 communicates with the OTA manager 30 and other electronic control units 40b to 40d connected to the vehicle network 20.

[0060] Figure 6BThe electronic control unit 40b shown is similar to the electronic control unit 40a, and is provided with a CPU 41, a RAM 42, a non-volatile memory 43b, and a communication device 44. Among them, the non-volatile memory 43b mounted on the electronic control unit 40b has two storage areas 46a and 46b (hereinafter referred to as "dual library memory") for storing data such as software. Hereinafter, the category of the non-volatile memory 43b having the structure of the two storage areas 46a and 46b is referred to as "second category". In addition to storing software for realizing the functions of the electronic control unit 40b, the storage areas 46a and 46b can also store version information, parameter data, boot programs for startup, programs for software updates, etc. The CPU 41 of the electronic control unit 40b uses either of the two storage areas 46a and 46b of the non-volatile memory 43b as a storage area (operation surface) of the read object. The CPU 41 of the electronic control unit 40b executes the software stored in the storage area of ​​the read object. In the other storage area (non-operation surface) that is not the object of reading, the update software (updated version of the program) based on the update data can be installed (written) in the background during the execution of the software (program) in the storage area (operation surface) of the object of reading. When activating (validating the update software) in the software update process, the CPU 41 of the electronic control unit 40b switches the storage area of ​​the program to be read, so that the update software can be activated.

[0061] As a specific example, imagine a situation where the current software is stored in the storage area 46a of the non-volatile memory 43b as a dual-bank memory, and the update software is installed in the storage area 46b. If the OTA manager 30 instructs the electronic control unit 40b to activate the update software, the electronic control unit 40b can switch the storage area of ​​the read object (application surface) of the CPU 41 by, for example, switching the read start address of the CPU 41 from the front address of the storage area 46a to the front address of the storage area 46b. Thus, the electronic control unit 40b can execute the update software installed in the storage area 46b. Among them, in the present disclosure, a structure called "single-sided suspended memory" in which one storage area is virtually divided into two surfaces and the program can be written to the other surface during the execution of the program stored in one surface is also classified as a second category of memory.

[0062] Figure 7 An example of the type information, which is information related to the type of the nonvolatile memory mounted on each of the plurality of electronic control units 40a to 40d, is shown in FIG. Figure 7In the illustrated category information, an ECU ID, which is a number for identifying an electronic control unit, is associated with a category (first category (single library) / second category (dual library)) of a non-volatile memory mounted on the electronic control unit. The category information is stored and managed in at least one of the storage unit 37 of the OTA manager 30 and the storage unit 16 of the center 10. The category information can be created in advance based on the specifications of the electronic control units 40a to 40d constituting the in-vehicle network 20, and stored in the storage unit 37 of the OTA manager 30 when the vehicle is manufactured. The OTA manager 30 can obtain the category information from the target electronic control unit through communication within the in-vehicle network 20 during the software update process. In addition, when the category information is managed by the center 10, the OTA manager 30 can obtain the category information from the center 10 via the network 70.

[0063] The communication module 50 is a unit having a function of controlling communication between the center 10 and the vehicle. The communication module 50 connects the in-vehicle network 20 to the center 10. The communication module 50 is wirelessly connected to the center 10 via the network 70. Vehicle authentication, download of update data, etc. related to the OTA manager 30 are performed via the communication module 50. The communication module 50 may be configured to be included in the OTA manager 30.

[0064] Overview of the software update process

[0065] The OTA manager 30 sends a software update confirmation request to the center 10, for example, when the vehicle is powered on. The update confirmation request includes a vehicle ID for identifying the vehicle and vehicle configuration information. The vehicle configuration information is information related to the state (system configuration) of the electronic control unit, such as the current version of the hardware and software of the electronic control units 40a to 40d connected to the vehicle network 20. The vehicle configuration information can be created by obtaining the identification number (ECU ID) of the electronic control unit and the identification number (ECU Software ID) of the software version of the electronic control unit from the electronic control units 40a to 40d connected to the vehicle network 20. The center 10 determines whether there is update data for the software of the electronic control units 40a to 40d by comparing the vehicle ID and the current version of the software of the electronic control units 40a to 40d with the latest version of the software maintained by the center 10 for each vehicle ID. The center 10 sends a notification indicating the presence or absence of update data to the OTA manager 30 as a response to the update confirmation request received from the OTA manager 30. When there is update data of the software of the electronic control units 40a to 40d, the OTA manager 30 sends a download request of the distribution data packet to the center 10. The center 10 sends the distribution data packet of the update data to the OTA manager 30 according to the download request received from the OTA manager 30. The distribution data packet may include, in addition to the update data, verification data for verifying the authenticity of the update data, the number of update data, category information, various control information used when updating the software, and the like.

[0066] The OTA manager 30 determines whether there is update data for the software of the electronic control units 40a to 40d based on the response to the update confirmation request received from the center 10. In addition, the OTA manager 30 verifies the authenticity of the distribution data package received from the center 10 and stored in the storage device 13. In addition, the OTA manager 30 transfers one or more update data downloaded through the distribution data package to the target electronic control unit, so that the target electronic control unit installs the update data. After the installation is completed, the OTA manager 30 instructs the target electronic control unit to activate the installed updated version of the software.

[0067] In addition, the OTA manager 30 causes the output device to output a notification that the software update needs to be agreed to, and a notification urging the input of the content of agreeing to the software update in the consent request process. As the output device, a display device (not shown) that is provided in the vehicle network 20 and performs notification based on display, and a sound output device (not shown) that performs notification based on sound can be used. For example, when a display device is used as an output device in the consent request process, the OTA manager 30 can cause the display device to display a consent request screen for requesting the user or manager to agree to the software update, and display a notification of specific input operations such as urging the user or manager to press the consent button when the user or manager agrees. In addition, the OTA manager 30 can cause the display device to display a sentence, icon, etc. that notifies that there is update data for the software of the electronic control units 40a~40d in the consent request process, and display the restrictions on the execution of the software update process. If the OTA manager 30 receives the input of the content of the consent from the user or the manager, it executes the above-mentioned installation and activation control process to update the software of the target electronic control unit.

[0068] Here, in the case where the non-volatile memory of the target electronic control unit is a single-bank memory, in principle, the installation and activation are performed continuously. Therefore, before the installation is performed, a consent request process for the software update is performed. In addition, even if the non-volatile memory of the target electronic control unit is a single-bank memory, the target electronic control unit may temporarily stop the update process in the state where the installation is completed, that is, it is requested to wait (suspend) activation. In addition, in the case where the non-volatile memory of the target electronic control unit is a dual-bank memory, the consent request process for the software update is performed at least after the installation is performed and before the activation is performed. In addition, in the case where the non-volatile memory of the target electronic control unit is a dual-bank memory, the consent request process for the software update before the installation is performed can be performed or omitted.

[0069] The software update process consists of a download phase, an installation phase, and an activation phase. In the download phase, the OTA manager 30 downloads the update data from the center 10. In the installation phase, the OTA manager 30 transfers the downloaded update data (update software) to the target electronic control unit and installs the update software based on the update data in the storage area of ​​the target electronic control unit. In the activation phase, the update software installed in the target electronic control unit is validated.

[0070] Downloading is a process in which the OTA manager 30 receives update data sent by the distribution data packet from the center 10 and stores the received update data in the storage unit 37. Update data is data used to update the software of the electronic control unit. During downloading, update data for an electronic control unit equipped with a dual-bank memory, where the probability of update failure is relatively low, is received before update data for an electronic control unit equipped with a single-bank memory. The downloading stage includes not only the execution of the download, but also the control of a series of processes related to the download, such as the determination of whether the download can be executed and the verification of the update data.

[0071] The update data sent from the center 10 to the OTA manager 30 may include the update software (complete data or differential data) of the electronic control unit, compressed data obtained by compressing the update software, and any one of the segmented data obtained by segmenting the update software or compressed data. In addition, the update data may include the ECU ID (or serial number) of the target electronic control unit and the ECU Software ID of the target electronic control unit before the update. The update data is downloaded as the above-mentioned distribution data package. The distribution data package includes the update data of a single electronic control unit or multiple electronic control units.

[0072] Installation is the process of the OTA manager 30 writing the update software (updated version of the program) to the non-volatile memory 43a and / or 43b of multiple target electronic control units in a determined order based on the update data downloaded from the center 10. The installation of update data for electronic control units equipped with dual-bank memories is performed in priority to the installation of update data for electronic control units equipped with single-bank memories. The installation phase includes not only the execution of the installation, but also the control of a series of installation-related processes such as the determination of whether the installation can be performed, the transfer of update data, and the verification of update software.

[0073] In the case where the update data includes the update software itself (complete data), during the installation phase, the OTA manager 30 transfers the update data (update software) to the target electronic control unit. In addition, in the case where the update data includes compressed data, differential data, or segmented data of the update software, the OTA manager 30 may transfer the update data to the target electronic control unit, and the target electronic control unit generates the update software based on the update data. Alternatively, the update software may be transferred to the target electronic control unit after the OTA manager 30 generates the update software based on the update data. Here, the generation of the update software can be performed by decompressing the compressed data, combining (integrating) differential data or segmented data. Update data and update software are an example of "information based on update data".

[0074] The installation of the update software can be performed by the target electronic control unit based on the installation request from the OTA manager 30. In addition, a specific target electronic control unit that receives the update data may autonomously perform the installation without receiving an explicit instruction from the OTA manager 30.

[0075] Activation is the process of activating the update software installed in the non-volatile memory 43a and / or 43b by the target electronic control unit. For the activation of update data for an electronic control unit equipped with a dual-bank memory and the activation of update data for an electronic control unit equipped with a single-bank memory, either one can be given priority. Alternatively, the activation of update data for an electronic control unit equipped with a dual-bank memory and the activation of update data for an electronic control unit equipped with a single-bank memory can be performed without any superiority or inferiority. In the activation stage, it includes not only the execution of activation, but also a series of controls related to activation, such as the judgment of whether the activation can be executed, the request for consent to the activation to the user or manager of the vehicle, and the verification of the execution result.

[0076] Activation of the updated software can be performed by the target electronic control unit based on an activation request from the OTA manager 30. In addition, a specific target electronic control unit that receives the update data may autonomously activate without receiving an explicit instruction from the OTA manager 30 after installation is completed.

[0077] Furthermore, the software update process can be performed on a plurality of target electronic control units respectively, either continuously or in parallel.

[0078] The “software update process” includes not only a process of continuously performing all of downloading, installing, and activating, but also a process of performing only a part of downloading, installing, and activating.

[0079] deal with

[0080] Next, refer to Figure 8 , Fig. 9 as well as Fig.10 Several specific examples related to the software update process executed in the network system according to the present embodiment will be described.

[0081] (1) Specific example of downloading

[0082] Figure 8 The flowchart is a flowchart for explaining the processing steps involved in a specific example of downloading performed by the center 10 and the OTA manager 30. The center 10 receives a download request for a distribution data package from the OTA manager 30 and starts Figure 8 The download process is illustrated.

[0083] Step S801

[0084] Hereinafter, the target electronic control unit to be the target of software update is referred to as "target ECU". The center 10 generates a distribution packet of update data for a target ECU equipped with a non-volatile memory of the first category among the target ECUs (hereinafter referred to as "target ECU of the first category"). In addition, the center 10 generates a distribution packet of update data for a target ECU equipped with a non-volatile memory of the second category among the target ECUs (hereinafter referred to as "target ECU of the second category"). At this time, the center 10 can refer to the category information stored in the storage unit 16 to determine the memory category of the non-volatile memory installed in the target ECU. In the case where the center 10 manages the categories of non-volatile memories installed in a plurality of electronic control units 40a to 40d, information related to the memory category can be included in the distribution packet. If the distribution packet of update data for the target ECU equipped with the non-volatile memory of the first category and the distribution packet of update data for the target ECU equipped with the non-volatile memory of the second category are generated, the process proceeds to step S802.

[0085] Step S802

[0086] The center 10 transmits a distribution packet of update data for the target ECU of the second category to the OTA manager 30. When the distribution packet is transmitted, the process proceeds to step S803.

[0087] Step S803

[0088] The OTA manager 30 receives the distribution packet of update data for the target ECU of the second category transmitted from the center 10. When the reception of the distribution packet is completed, the process proceeds to step S804.

[0089] Step S804

[0090] The center 10 transmits a distribution packet of update data for the target ECU of the first category to the OTA manager 30. When the distribution packet is transmitted, the process proceeds to step S805.

[0091] Step S805

[0092] The OTA manager 30 receives the distribution packet of update data for the target ECU of the first category transmitted from the center 10. When the reception of the distribution packet is completed, the process proceeds to step S806.

[0093] Step S806

[0094] The OTA manager 30 stores the update data (and information on the memory type, etc.) received from the center 10 via the distribution packet in the storage unit 37. The download process is thus terminated.

[0095] According to this specific example of downloading, the OTA manager 30 can receive the distribution packet of update data for the target ECUs of the second category before the distribution packet of update data for the target ECUs of the first category.

[0096] (2) Specific example of installation

[0097] Fig. 9 The flowchart is a flowchart for explaining the installation processing steps involved in a specific example performed by the OTA manager 30 and the target ECU. After the download of the update data of at least one target ECU of the second category is completed and the specified conditions (installation executable, update data verification passed, etc.) are satisfied, the installation is started. Fig. 9 Specific examples of installation are shown.

[0098] Step S901

[0099] The OTA manager 30 obtains the type (first type / second type) of the nonvolatile memory mounted on the target ECU. When the OTA manager 30 manages the memory type, the OTA manager 30 can refer to the type information ( Figure 7 ) to obtain the memory type of the target ECU. In the case where the center 10 manages the memory type, the OTA manager 30 can obtain the memory type of the target ECU by referring to the information of the memory type included in the distribution data packet. If the memory type of the target ECU is obtained, the process proceeds to step S902.

[0100] Step S902

[0101] The OTA manager 30 and the second category target ECU start writing the update software to the storage area of ​​the non-volatile memory of the second category target ECU based on the update data, i.e., installation. The installation is started for all the second category target ECUs simultaneously or in a prescribed order. If the installation for the second category target ECU is started, the process proceeds to step S903.

[0102] Step S903

[0103] The OTA manager 30 and the first category target ECU start the process of writing the update software to the storage area of ​​the non-volatile memory of the first category target ECU based on the update data, i.e., installation. The installation is started for all the first category target ECUs simultaneously or in a prescribed order. The installation of the first category target ECU may be started after the installation of all the second category target ECUs is completed, or after the installation of a predetermined part of the second category target ECUs is completed. If the installation of the first category target ECU is started, the process proceeds to step S904.

[0104] Step S904

[0105] The OTA manager 30 determines whether the installation of the update software in all target ECUs (category 1 and category 2) is completed. When the OTA manager 30 receives a completion notification from each target ECU, the OTA manager 30 can determine that the installation of the update software for all target ECUs is complete. In addition, when a specified time has passed since the start of the installation, the OTA manager 30 can determine that the installation of the update software for all target ECUs is complete. The specified time can be set, for example, to be longer than the maximum time required for the installation of all target ECUs. If the OTA manager 30 determines that the installation of the update software in all target ECUs is complete (step S904, yes), the installation of the target ECUs is complete and the installation process ends.

[0106] According to the specific example of the above installation, the installation of the second type of target ECUs that do not need to stop control during the update can be started with priority over the installation of the first type of target ECUs that need to stop control during the update. Through this process, the communication load in the vehicle (vehicle network 20) ​​can be reduced. In addition, through this process, the time required to stop the control of the vehicle until the update software is written to all target ECUs can be shortened.

[0107] (3) Specific example of activation

[0108] Fig.10 The flowchart is a flowchart for explaining the processing steps involved in a specific example of activation performed by the OTA manager 30 and the target ECU. After the installation of the update software of the target ECU of the first category and the target ECU of the second category is completed and the predetermined conditions (activation executable, verification of update data passed, etc.) are satisfied, the activation is started. Fig.10 The activation process is illustrated.

[0109] Step S1001

[0110] The target ECU of the first category starts activating the update software written to the storage area of ​​the non-volatile memory of the target ECU of the first category. The activation is started for all the target ECUs of the first category at the same time or in a prescribed order. If the activation of the update software in the target ECU of the first category is started, the process proceeds to step S1002.

[0111] Step S1002

[0112] The target ECU of the second category starts activating the update software written to the storage area of ​​the non-volatile memory of the target ECU of the second category. The activation is started for all the target ECUs of the second category at the same time or in a prescribed order. In addition, the activation of the target ECU of the second category can be started after the activation of all the target ECUs of the first category is completed. The activation of the target ECU of the second category can also be started after the activation of a predetermined part of the target ECUs of the first category is completed. If the activation of the update software in the target ECU of the second category is started, the process proceeds to step S1003.

[0113] Step S1003

[0114] The OTA manager 30 determines whether the activation of the update software in all target ECUs (category 1 and category 2) is completed. When the OTA manager 30 receives a completion notification from each target ECU, the OTA manager 30 can determine that the activation of all target ECUs is completed. In addition, when a specified time has passed since the start of activation, the OTA manager 30 can also determine that the activation of all target ECUs is completed. The specified time can be set to, for example, a maximum time required for the activation of all target ECUs. If the OTA manager 30 determines that the activation of the update software in all target ECUs is completed (step S1003, yes), the activation process ends for the completion of the activation of the target ECUs. If the OTA manager 30 determines that the activation of the update software in some target ECUs is not completed (step S1003, no), step S1003 is repeated.

[0115] According to the above specific example of activation, the activation of the update software for the target ECU of the first category is started first, and then the activation of the update software for the target ECU of the second category is started. Through this process, the software update of the target ECU of the second category can be implemented after the success of the software update of the target ECU of the first category is confirmed. Therefore, the software update process of the system including both the target ECU equipped with a single bank memory and the target ECU equipped with a dual bank memory can be appropriately performed.

[0116] Function / Effect

[0117] As described above, according to the network system involved in one embodiment of the present disclosure, the center generates update data for an electronic control unit equipped with a single bank memory (a non-volatile memory of the first category) and update data for an electronic control unit equipped with a dual bank memory (a non-volatile memory of the second category) as independent distribution data packets. In addition, the center sends the distribution data packet of the update data for the electronic control unit equipped with the dual bank memory to the OTA manager before the distribution data packet of the update data for the electronic control unit equipped with the single bank memory.

[0118] Through this processing, when a communication anomaly occurs in a distribution data packet, only the distribution data packet (the distribution data packet in which the communication anomaly occurred) needs to be resent. Therefore, the increase in the communication volume (communication load) between the center and the OTA manager can be suppressed. In addition, the center can send the update data distribution data packet after confirming the compatibility of the software. Therefore, it is possible to avoid a situation where, after the update data is downloaded, it is clear in the OTA manager that the update data is not compatible and a resend request is sent to the center.

[0119] In addition, the OTA manager can receive a distribution data packet of update data for an electronic control unit equipped with a dual-bank memory before a distribution data packet of update data for an electronic control unit equipped with a single-bank memory. Therefore, the OTA manager can prioritize the installation of a target electronic control unit equipped with a dual-bank memory that does not require control to be stopped during the update over the installation of a target electronic control unit equipped with a single-bank memory that requires control to be stopped during the update.

[0120] Thus, the OTA manager can first write the update software to the storage area of ​​the target electronic control unit equipped with dual-bank memory, and start writing the update software to the storage area of ​​the target electronic control unit equipped with single-bank memory at the time when the writing of the update software to the storage area of ​​the target electronic control unit equipped with dual-bank memory is completed. Thus, the communication load in the vehicle (on-board network) can be reduced. Therefore, the time required to stop the control of the vehicle until the writing of the update software to all target ECUs is completed can be shortened.

[0121] An embodiment of the disclosed technology is described above, but the disclosed technology can be understood not only as an OTA manager, but also as a method executed by an OTA manager having a processor and a memory, a program, a computer-readable non-transitory storage medium storing a program, a center capable of communicating with an OTA manager, a system having a center and an OTA manager, or a vehicle having an OTA manager. In addition, the center can have more than one processor. The OTA manager can have more than one processor.

[0122] The disclosed technology can be utilized in a network system for updating software of an electronic control unit.

Claims

1. An OTA manager configured to control software update of an electronic control unit mounted on a vehicle, The OTA manager is characterized in that include: a communication unit configured to receive a distribution data packet of update data of the electronic control unit from a center; and The control unit controls the communication unit to receive the second distribution data packet from the center prior to the first distribution data packet when there exists a first distribution data packet for update data of the electronic control unit equipped with a first category non-volatile memory and a second distribution data packet for update data of the electronic control unit equipped with a second category non-volatile memory as the distribution data packets that can be received from the center, the first category non-volatile memory having one storage area and the second category non-volatile memory having two storage areas.

2. The OTA manager according to claim 1, characterized in that It also includes a control unit configured to send information based on the update data received by the communication unit to the electronic control unit that is the update target based on category information, wherein the category information indicates whether the nonvolatile memory mounted on the electronic control unit is the first category or the second category.

3. The OTA manager according to claim 2, characterized in that The communication unit is configured to obtain the category information from the center.

4. The OTA manager according to claim 2 or 3, characterized in that: The device further includes a storage unit configured to store the category information.

5. The OTA manager according to claim 2 or 3, characterized in that: The control unit is configured to transmit information based on update data of the electronic control unit equipped with the second type nonvolatile memory to the electronic control unit to be updated in priority to information based on update data of the electronic control unit equipped with the first type nonvolatile memory based on the type information.

6. A software update control center configured to communicate with an OTA manager configured to control software updates of an electronic control unit mounted on a vehicle, The center is characterized by include: a storage unit configured to store type information indicating whether the nonvolatile memory mounted on the electronic control unit is of a first type having one storage area or a second type having two storage areas; and A communication unit sends a first distribution data packet for update data for an electronic control unit equipped with a first category of non-volatile memory and a second distribution data packet for update data for an electronic control unit equipped with a second category of non-volatile memory to the OTA manager in a manner such that the OTA manager can receive the second distribution data packet prior to the first distribution data packet, when there is a first distribution data packet that can be sent to the OTA manager and is intended for update data for an electronic control unit equipped with a second category of non-volatile memory, wherein the first category of non-volatile memory has one storage area and the second category of non-volatile memory has two storage areas.

7. The software update control center according to claim 6, characterized in that: The communication unit is configured to transmit the category information stored in the storage unit to the OTA manager.

8. A software update control system, comprising the software update control center according to claim 6 and the OTA manager, The system is characterized in that The center includes a first communication unit configured to send a first distribution packet and a second distribution packet to the OTA manager, the first distribution packet being a distribution packet of update data for the electronic control unit equipped with the first type of non-volatile memory, and the second distribution packet being a distribution packet of update data for the electronic control unit equipped with the second type of non-volatile memory; The OTA manager includes a second communication unit configured to receive the second distribution packet from the center prior to receiving the first distribution packet.

9. The software update control system according to claim 8, characterized in that: The OTA manager includes a control unit configured to, based on the category information, send information based on update data of the electronic control unit equipped with the second category non-volatile memory to the electronic control unit that is the update target in priority to information based on update data of the electronic control unit equipped with the first category non-volatile memory.

10. The software update control system according to claim 9, characterized in that: The center includes the storage unit configured to store the category information. The first communication unit of the center is configured to transmit the category information to the OTA manager.

11. A software update control method, executed by an OTA manager for controlling software update of an electronic control unit mounted on a vehicle, the OTA manager comprising a memory and one or more processors, The method is characterized in that it comprises: When there is a first distribution packet for update data of the electronic control unit equipped with a first type of non-volatile memory and a second distribution packet for update data of the electronic control unit equipped with a second type of non-volatile memory in the center, the second distribution packet is received from the center before the first distribution packet, the first type of non-volatile memory having one storage area and the second type of non-volatile memory having two storage areas; and Based on category information indicating whether the non-volatile memory installed in the electronic control unit is of the first category or the second category, update data of the electronic control unit equipped with the second category non-volatile memory is transferred to the electronic control unit that is the update target with priority over update data of the electronic control unit equipped with the first category non-volatile memory.

12. A non-transitory storage medium storing a command executable by a computer of an OTA manager for controlling software update of an electronic control unit mounted on a vehicle and causing the computer to perform the following functions, the OTA manager comprising a memory and one or more processors, The non-transitory storage medium is characterized in that the functions include: When there is a first distribution packet for update data of the electronic control unit equipped with a first type of non-volatile memory and a second distribution packet for update data of the electronic control unit equipped with a second type of non-volatile memory in the center, the second distribution packet is received from the center before the first distribution packet, the first type of non-volatile memory having one storage area and the second type of non-volatile memory having two storage areas; and Based on category information indicating whether the non-volatile memory installed in the electronic control unit is of the first category or the second category, update data of the electronic control unit equipped with the second category non-volatile memory is transferred to the electronic control unit that is the update target with priority over update data of the electronic control unit equipped with the first category non-volatile memory.

13. A vehicle, characterized in that: The OTA manager according to any one of claims 1 to 5 is mounted.

Images