Systems, centers, methods, and non-transitory storage media

Abstract

The present application relates to a system, a center, a method, and a non-transitory storage medium, the system including a vehicle including an electronic control unit, a center configured to control update of software of the electronic control unit, and an information terminal associated with the vehicle. The vehicle includes a display device and a first communication unit configured to communicate with the center. The center includes a second communication unit configured to communicate with the vehicle and the information terminal, and a processing unit. The processing unit is configured to transmit information related to the update of the software to the information terminal, transmit a notification to the vehicle indicating that the information related to the update of the software has been transmitted to the information terminal, and cause the display device of the vehicle to display the notification received from the center.

Description

Technical Field

[0001] This disclosure relates to systems, centers, methods, and non-transitory storage media for controlling software updates of electronic control units installed in vehicles. Background Technology

[0002] Vehicles are equipped with multiple Electronic Control Units (ECUs) for controlling vehicle movements. Each ECU has a processor, temporary storage such as RAM, and non-volatile storage such as flash ROM (non-volatile memory). The processor executes software stored in the non-volatile memory to perform the control functions of the ECU. The software stored in each ECU can be rewritten. By updating the software to a newer version, the functionality of each ECU can be improved, and new vehicle control functions can be added.

[0003] Over-the-Air (OTA) technology is a known technique for updating the software of electronic control units (ECUs). In OTA technology, the device responsible for updating the vehicle's software wirelessly connects to the vehicle's communication network and a communication network such as the Internet. The device downloads software from a server via wireless communication, writes the downloaded software to the ECU for installation, and then activates the installed software to update or add to the ECU's software. For example, see Japanese Patent Application Laid-Open No. 2017-149323.

[0004] When software updates are performed using OTA (Over-The-Air) technology, the process involves notifying vehicle users and administrators of the software update and requesting their consent. This notification and consent request can be sent to vehicle users and administrators via information terminals such as vehicle navigation systems or smartphones that can communicate wirelessly with the vehicle.

[0005] Smartphones and other information terminals can receive a large volume of emails. Generally, terminal owners select only the necessary or reliable emails from a large pool of emails for verification. However, determining the authenticity and reliability of an email based solely on its subject line and sender's address is tedious. Therefore, users and administrators may not notice, or fail to interpret, information sent via email to their terminals during OTA software updates as necessary and reliable. Summary of the Invention

[0006] This disclosure provides a system, center, method, and non-transitory storage medium that enables users, administrators, etc., to notice that the information sent to the information terminals owned by users, administrators, etc., when using OTA software updates is reliable information via email or the like.

[0007] The first aspect of this disclosure is a system comprising: a vehicle equipped with an electronic control unit; a center configured to control software updates of the electronic control unit; and an information terminal associated with the vehicle. The vehicle includes a display device and a first communication unit configured to communicate with the center. The center includes a second communication unit and a processing unit configured to communicate with both the vehicle and the information terminal. The processing unit is configured to send information related to software updates to the information terminal. When the processing unit has already sent information related to software updates to the information terminal, the processing unit sends a notification to the vehicle indicating that information related to software updates has been sent to the information terminal. The processing unit is configured to cause the vehicle's display device to display the notification received from the center.

[0008] In the system according to the first aspect of the present disclosure, the processing unit of the aforementioned center may be configured to send information related to the software update to the aforementioned information terminal when the display device mounted on the aforementioned vehicle is unable to display information related to the software update.

[0009] In the system according to the first aspect of the present disclosure, the vehicle may also include a switch for instructing the center to resend information related to the software update to the information terminal.

[0010] In the system according to the first aspect of the present disclosure, the aforementioned center may further include a control unit configured to control the update of the software based on an update consent notification received from the aforementioned information terminal in response to information related to the update of the aforementioned software.

[0011] In the system according to the first aspect of the present disclosure, the vehicle may further include a transmitting unit configured to transmit information related to the display device to the center. The center may further include an acquiring unit configured to acquire information related to the display device from the vehicle.

[0012] The second aspect of this disclosure is a center configured to control software updates of an electronic control unit installed in a vehicle, comprising: a communication unit configured to communicate with the vehicle and an information terminal associated with the vehicle; and a processing unit. The processing unit is configured to send information related to the software update to the information terminal. Furthermore, when the processing unit has already sent the information related to the software update to the information terminal, the processing unit is configured to send a notification to the vehicle indicating that information related to the software update has been sent to the information terminal.

[0013] The second aspect of this disclosure involves a central unit that can acquire information related to a display device mounted on the vehicle. The processing unit can be configured to send information related to a software update to an information terminal when the display device cannot display such information.

[0014] In the second aspect of the present disclosure, the processing unit may be configured to resend information related to the software update to the information terminal when the communication unit receives a retransmission request from the vehicle.

[0015] The second aspect of the present disclosure may further include a control unit configured to control the software update based on an update consent notification received by the communication unit from the information terminal in response to information related to the update of the software.

[0016] The third aspect of this disclosure is a method executed by a center configured to control software updates of an electronic control unit installed in a vehicle. The center includes a memory and one or more processors. The method includes: sending information related to the software update to an information terminal associated with the vehicle; and, if the center has already sent the information related to the software update to the information terminal, sending a notification to the vehicle indicating that the information related to the software update has been sent to the information terminal.

[0017] The fourth aspect of this disclosure is a non-transitory storage medium storing commands executable by one or more central computers to perform the following functions. The central computer includes a memory and one or more processors. The central computer is configured to control software updates of an electronic control unit installed in a vehicle. The functions include: sending information related to software updates to an information terminal associated with the vehicle; and, when information related to software updates has been sent to the information terminal, sending a notification to the vehicle indicating that information related to software updates has been sent to the information terminal.

[0018] According to the system disclosed herein, users, managers, etc., can be made aware that the information sent to the information terminals owned by the vehicle users, managers, etc. via email or the like when OTA software updates are used is reliable information. Attached Figure Description

[0019] Hereinafter, the features, advantages, technical and industrial importance of exemplary embodiments of the present invention will be described with reference to the accompanying drawings, in which the same reference numerals denote the same constituent elements, wherein:

[0020] Figure 1 It is a block diagram showing the overall structure of the network system involved in the implementation method.

[0021] Figure 2 It is a block diagram representing the simplified structure of the center.

[0022] Figure 3 This is the central functional block diagram.

[0023] Figure 4 This is a block diagram representing a simplified structure of the OTA manager.

[0024] Figure 5 This is a functional block diagram of the OTA Manager.

[0025] Figure 6A This is a flowchart of the process by which the center sends information related to software updates.

[0026] Figure 6B This is a flowchart of the process by which the center sends information related to software updates.

[0027] Figure 7 This is a flowchart illustrating an example of the software update control process performed by the center, OTA manager, and target electronic control unit. Detailed Implementation

[0028] When the software of the electronic control unit installed in the vehicle is updated, and the vehicle's display device cannot fully display information related to the software update, the system disclosed herein sends the software update-related information to an information terminal associated with the vehicle via email or the like, and sends a notification to the vehicle that the software update-related information has been sent to the information terminal. The vehicle then displays the notification that the software update-related information received from the center has been sent to the display device. Thus, by observing the content displayed on the display device, vehicle users, managers, etc., can be aware that the emails, etc., sent to their information terminals are reliable information.

[0029] Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the accompanying drawings.

[0030] Implementation

[0031] System Structure

[0032] Figure 1 This is a block diagram illustrating the overall structure of a network system according to one embodiment of this disclosure. Figure 1 The network system shown is used to update the software of at least one of the multiple electronic control units (ECUs) 50a to 50d installed in a vehicle. The network system includes a center 10 located outside the vehicle, an in-vehicle network 90 built inside the vehicle, an information terminal 95 associated with the vehicle, and a network 100.

[0033] (1) Center

[0034] The center 10 can communicate with the OTA manager 30 (described later) of the vehicle network 90 via the network 100. The center 10 sends notifications to vehicle users and administrators regarding software updates, provides explanations related to software updates, sends update data for the electronic control units 50a-50d and information defining the steps of the software update process, and receives notifications indicating the progress of the software update process. The center 10 can control and manage software updates for multiple electronic control units 50a-50d connected to the OTA manager 30. The center 10 functions as a server. Furthermore, the center 10 can communicate with the information terminal 95 via the network 100. The center 10 can send notifications to vehicle users and administrators regarding software updates for the electronic control units 50a-50d, and provide explanations related to the software updates.

[0035] Figure 2 It means Figure 1 A simplified block diagram of the structure of center 10. (See diagram below.) Figure 2As shown, the center 10 includes a CPU (Central Processing Unit) 11, RAM (Random Access Memory) 12, a storage device 13, and a communication device 14. The storage device 13 includes a read / write storage medium such as a hard disk drive (HDD) or a solid-state drive (SSD). The storage device 13 stores programs used for software update management, information used in software update control and management, and software update data for each electronic control unit. In the center 10, the CPU 11 executes programs read from the storage device 13 using the RAM 12 as its working area to perform the prescribed processing related to software updates. The communication device 14 communicates with the OTA manager 30 and the information terminal 95 via the network 100.

[0036] Figure 3 yes Figure 2 The functional block diagram of center 10 is shown. Figure 3 The center 10 shown includes a storage unit 16, a communication unit 17, a control unit 18, an acquisition unit 19, and a processing unit 20. The storage unit 16 consists of... Figure 2 The storage device 13 shown is used to implement this. The communication unit 17, control unit 18, acquisition unit 19, and processing unit 20 are connected via... Figure 2 The CPU 11 shown uses RAM 12 to execute programs stored in storage device 13.

[0037] Storage unit 16 stores information related to software update processing of one or more electronic control units (ECUs) installed in the vehicle. As information related to software update processing, storage unit 16 stores at least update management information and software update data for ECUs 50a-50d. Update management information is information that associates information indicating the software available in ECUs 50a-50d with each vehicle identification number (Vehicle ID) of the identified vehicle. For example, information indicating the software available in ECUs 50a-50d can be a combination of the latest version information of the software for each of multiple ECUs 50a-50d. As information related to software update processing, storage unit 16 can store the status of software updates currently being performed in the vehicle. Additionally, as information related to software update processing, storage unit 16 can store information related to the update sequence indicating the steps of the software update process, including instructions for controlling the OTA manager 30. Furthermore, storage unit 16 can store information related to the display device 70 installed in the vehicle, acquired by acquisition unit 19 (described later).

[0038] The communication unit 17 functions as a transmitter and receiver for sending and receiving data, information, notifications, and requests between the OTA manager 30 (vehicle) and the information terminal 95. The communication unit 17 receives software update confirmation requests from the OTA manager 30 (receiving unit). An update confirmation request is, for example, information sent from the OTA manager 30 to the center 10 when the vehicle's power or ignition is turned on (hereinafter referred to as "power on"). The update confirmation request is information used to request the center 10 to confirm the existence of update data for the electronic control units 50a to 50d based on the vehicle configuration information described later. Furthermore, in response to the update confirmation request received from the OTA manager 30, the communication unit 17 sends information indicating the presence or absence of update data to the OTA manager 30 (transmitting unit). Additionally, the communication unit 17 receives transmission requests (download requests) for distribution data packets from the OTA manager 30 (receiving unit). Furthermore, if the communication unit 17 receives a download request for distribution data packets (receiving unit), it sends the distribution data packets to the OTA manager 30 (transmitting unit). The data packets distributed include software update data for electronic control units 50a-50d generated by the control unit 18 (described later). Additionally, the communication unit 17, based on instructions from the processing unit 20, sends notifications to the vehicle and information terminal 95 regarding the existence of a software update, explanations related to the software update, requests for consent to the software update, etc. (hereinafter collectively referred to as "software update related information") (sending unit). Furthermore, the communication unit 17 can receive requests from the vehicle to retransmit information related to the display device 70 installed in the vehicle, as well as requests for retransmission of software update related information (receiving unit). The communication unit 17 is an example of a "second communication unit".

[0039] If the communication unit 17 receives an update confirmation request from the OTA manager 30, the control unit 18 determines, based on the update management information stored in the storage unit 16, whether software update data exists for the electronic control units 50a-50d installed in the vehicle whose vehicle ID is included in the update confirmation request. The determination result of the control unit 18 regarding the existence of update data is sent to the OTA manager 30 via the communication unit 17. If the control unit 18 determines that software update data for the electronic control units 50a-50d exists, and a download request for a distribution data packet is received from the OTA manager 30, the control unit 18 generates one or more distribution data packets including the corresponding update data stored in the storage unit 16. In addition, the control unit 18 controls the software update processing of the electronic control units 50a-50d based on update consent notifications received from the information terminal 95 from vehicle users, administrators, etc., as a response to software update-related information sent by the processing unit 20.

[0040] The acquisition unit 19 obtains information related to the display device 70 installed in the vehicle from the communication unit 17. The information related to the display device 70 includes at least information indicating whether, during an OTA software update, it is possible to display information (such as control changes) that should be explained to the vehicle's users or administrators beforehand via the display device 70's screen. The ability to display information via the screen typically means that all the information that should be explained beforehand can be displayed to the vehicle's users or administrators. For example, the center 10 can obtain information related to the display device 70 from the vehicle whenever the vehicle is powered on, or it can obtain the information related to the display device 70 in advance through other methods.

[0041] When implementing an OTA (Over-The-Air) software update, the processing unit 20 processes and sends information related to the software update via the vehicle's display device 70. More specifically, if the display device 70 can display a screen showing information that should be explained to the vehicle's users or administrators beforehand during an OTA software update, the processing unit 20 sends the software update-related information to the vehicle (OTA manager 30). Conversely, if the display device 70 cannot display the screen showing the information that should be explained to the vehicle's users or administrators beforehand during an OTA software update, the processing unit 20 sends the software update-related information to the information terminal 95. This sending of the software update-related information can be done, for example, via email sent by the center 10 via the communication unit 17, or via cloud email. When the processing unit 20 sends the software update-related information to the information terminal 95, the processing unit 20 sends a notification to the vehicle (OTA manager 30) that the software update-related information has been sent to the information terminal 95. The preferred method is to display the notification that information related to the software update has been sent to the information terminal 95 in a way that allows it to be displayed on the simple display device 70. Furthermore, the processing unit 20 can send the notification that information related to the software update has been sent to the information terminal 95 simultaneously with the sending of the software update-related information to the information terminal 95, before sending, or after sending. In this way, the processing unit 20 operates as a so-called Human-Machine Interface (HMI) functional unit. Moreover, for notifications from the center 10 to the vehicle, the OTA manager 30 can be used to control the display device 70 based on the notification, or the display device 70 can directly receive and display the notification without going through the OTA manager 30.

[0042] (2) Information terminal

[0043] The information terminal 95 is a device such as a smartphone or personal computer owned by the vehicle's user or manager. In this embodiment, the information terminal 95 has the function of receiving information related to software updates sent by the center 10, etc., and allowing the vehicle's user or manager to view the content of this information. This information terminal 95 can be associated with the vehicle through registration and management. The information terminal 95 functions as a human-machine interface (HMI) used for specific vehicle-related operations (such as locking and unlocking vehicle doors, remote parking operations), information display, etc. The number of information terminals 95 associated with the vehicle is not limited to one; multiple terminals can be used.

[0044] (3) In-vehicle network

[0045] like Figure 1 As shown, the vehicle network 90 includes an OTA manager 30, multiple electronic control units 50a-50d, a display device 70, and a communication module 80. The OTA manager 30 and the communication module 80 are connected via bus 60a. The OTA manager 30 is connected to electronic control units 50a and 50b via bus 60b. The OTA manager 30 is connected to electronic control units 50c and 50d via bus 60c. The OTA manager 30 is connected to the display device 70 via bus 60d.

[0046] The OTA manager 30 can wirelessly communicate with the center 10 via bus 60a, communication module 80, and network 100. Additionally, the OTA manager 30 can wiredly communicate with electronic control units 50a-50d and display device 70 via buses 60b-60d. The OTA manager 30 manages the OTA status and controls the software update process, i.e., the update sequence, to implement software updates for the electronic control units (hereinafter referred to as "target electronic control units") that are the targets of the update. The OTA manager 30 controls the software updates of the target electronic control units among the electronic control units 50a-50d based on update data obtained from the center 10. The target electronic control unit is the electronic control unit that is the target of the software update. Furthermore, the OTA manager 30 can display appropriate screens on the display device 70 based on information and notifications related to software updates received from the center 10. The OTA manager 30 may also be referred to as a central gateway (CGW). One or more target electronic control units can also function as the OTA manager 30.

[0047] Figure 4 It means Figure 1 A simplified block diagram of the OTA Manager 30 in the system. (See diagram below.) Figure 4As shown, the OTA manager 30 includes a CPU 31, RAM 32, ROM (Read-Only Memory) 33, storage device 34, and communication device 36. The CPU 31, RAM 32, ROM 33, and storage device 34 constitute a microcomputer 35. In the OTA manager 30, the CPU 31 uses RAM 32 as its working area to execute programs read from ROM 33 to perform processing related to software updates. The communication device 36 connects via... Figure 1 The buses 60a to 60d shown communicate with the communication module 80, the electronic control unit 50a to 50d, and the display device 70, respectively.

[0048] Figure 5 yes Figure 4 The diagram shown is a functional block diagram of OTA Manager 30. Figure 5 The OTA manager 30 shown includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 consists of... Figure 4 The storage device 34 shown is used for implementation. The communication unit 38 and the control unit 39 are implemented through... Figure 4 The CPU 31 shown uses RAM 32 to execute programs stored in ROM 33.

[0049] In addition to storing programs (control programs for the OTA manager 30) used to perform software updates for the multiple electronic control units 50a-50d, and various data used during software updates, storage unit 37 also stores software update data downloaded from center 10. Furthermore, storage unit 37 can store information related to the type of non-volatile memory mounted on each of the multiple electronic control units 50a-50d. Additionally, storage unit 37 can store information related to display device 70.

[0050] The communication unit 38 functions as a sending and receiving unit for transmitting and receiving data, information, notifications, and requests with the center 10. For example, the communication unit 38 sends a software update confirmation request to the center 10 (sending unit) when the vehicle's power is turned on. The update confirmation request includes, for example, information related to the vehicle ID used to identify the vehicle and the current version of the software of the electronic control units 50a-50d connected to the vehicle network 90. ​​The vehicle ID and the current version of the software of the electronic control units 50a-50d are used to determine whether update data for the software of the electronic control units 50a-50d exists by comparing it with the latest version of the software maintained by the center 10 for each vehicle ID. Additionally, the communication unit 38 receives a notification from the center 10 indicating the presence or absence of update data as a response to the update confirmation request (receiving unit). If update data for the software of any of the electronic control units 50a-50d exists, the communication unit 38 sends a download request for a distribution data packet including the software update data to the center 10 (sending unit). The communication unit 38 receives (downloads) distribution data packets sent from the center 10 (receiving unit). Additionally, the communication unit 38 sends the software update status sent by the electronic control units 50a-50d to the center 10 (sending unit). Furthermore, the communication unit 38 can, based on instructions from the control unit 39, cause the display device 70 to display information related to software updates, notifications related to the transmission of such information, and the software update status. Additionally, the communication unit 38 can send information related to the display device 70 to the center 10 (sending unit). The communication unit 38 is an example of a "first communication unit".

[0051] The control unit 39 determines whether software update data exists for any of the electronic control units 50a-50d based on the response from the center 10 to the update confirmation request received by the communication unit 38. Furthermore, the control unit 39 verifies the authenticity of the update data received (downloaded) by the communication unit 38 from the center 10 via data packet distribution and stored in the storage unit 37. Additionally, the control unit 39 uses the update data downloaded from the center 10 to control the software update process (installation, activation, etc.) of the electronic control units 50a-50d. Specifically, the control unit 39 forwards the downloaded update data (update software) to the target electronic control unit, causing the target electronic control unit to install the update software based on the update data. After installation, the control unit 39 instructs the target electronic control unit to activate and enable the installed update software.

[0052] Multiple electronic control units (ECUs) 50a to 50d are devices used to control the actions of various parts of the vehicle. Figure 1The example shown is an in-vehicle network 90 equipped with four electronic control units 50a to 50d. However, the number of electronic control units is not limited to four. Furthermore, the number of buses connecting the electronic control units 50a to 50d to the OTA manager 30 is not particularly limited.

[0053] The display device 70 is a human-machine interface (HMI) used for various displays during the software update process of the electronic control units 50a-50d, including displaying information about the existence of update data, explanations related to the software update, notifications that information related to the software update has been sent to the information terminal 95, a consent request screen for requesting consent from vehicle users and managers for the software update, and displays of the results and status of the software update. A typical display device 70 is one that can be used with a car navigation system. The display device 70 is not particularly limited as long as it can display the information required for the software update process. For example, a simple HMI device such as an instrument panel that cannot display information related to the software update is also included in the display device 70. In this embodiment, the case where the display device 70 receives information and notifications sent from the center 10 via the OTA manager 30 has been described, but the display device 70 may also receive information and notifications directly from the communication module 80 or via other communication devices (not shown) without going through the OTA manager 30. Furthermore, in Figure 1 The bus 60d shown can connect to electronic control units, etc., in addition to the display device 70.

[0054] The communication module 80 is a unit that controls the communication between the center 10 and the vehicle. The communication module 80 is a communication device used to connect the vehicle network 90 to the center 10. The communication module 80 is wirelessly connected to the center 10 via the network 100. The OTA manager 30 uses the communication module 80 to perform vehicle authentication, download update data, etc. The communication module 80 can also be configured to be included within the OTA manager 30.

[0055] Furthermore, vehicles including the in-vehicle network 90 may also be equipped with input devices such as switches (not shown), which can request the center 10 to resend information related to software updates to the information terminal 95 (request resend). When vehicle users, managers, etc., who have received a notification displayed on the display device 70 that information related to software updates has been sent to the information terminal 95, wish to receive such information again through the information terminal 95, they can use this switch. Therefore, it is preferable that the switch be located near the display device 70, on the steering wheel, etc. The switch may also be displayed on the display device 70. Alternatively, it can be designed to allow direct request for resending of information related to software updates from the information terminal 95. In this way, information sent in response to actions initiated by users, managers, etc., can provide users, managers, etc., with a sense of reliability.

[0056] Summary of software update processing

[0057] The OTA manager 30 sends a software update confirmation request to the center 10, for example, when the vehicle is powered on. The update confirmation request includes a vehicle ID and vehicle configuration information for identifying the vehicle. This vehicle configuration information is related to the status (system configuration) of the electronic control units 50a-50d connected to the vehicle network 90, such as the current version of their hardware and software. The vehicle configuration information can be created by obtaining the identification number (ECU_ID) and the software version identification number (ECU_Software_ID) of the electronic control units 50a-50d connected to the vehicle network 90. ​​The vehicle ID and the current version of the software for the electronic control units 50a-50d are used to determine whether software update data for the electronic control units 50a-50d exists by comparing it with the latest version of the software maintained by the center 10 for each vehicle ID. The center 10 sends a notification indicating the presence or absence of update data, information related to the software update, etc., to the OTA manager 30 and / or the information terminal 95 as a response to the update confirmation request received from the OTA manager 30. When software update data for electronic control units 50a to 50d is available, the OTA manager 30 sends a download request for a distribution data package to the center 10. The center 10, based on the download request received from the OTA manager 30, sends a distribution data package, including the update data, to the OTA manager 30. The distribution data package may include, in addition to the update data, verification data for verifying the authenticity of the update data, the quantity and category of the update data, and various control information used during the software update.

[0058] The OTA manager 30 determines whether software update data for the electronic control units 50a-50d exists based on the response to the update confirmation request received from the center 10. Additionally, the OTA manager 30 verifies the authenticity of the distribution data packet received from the center 10 and stored in the storage device 34. Furthermore, the OTA manager 30 forwards the update data downloaded via the distribution data packet to the target electronic control unit. The OTA manager 30 instructs the target electronic control unit to install the updated software. After installation, the OTA manager 30 instructs the target electronic control unit to activate the installed updated software.

[0059] In addition, during the consent request processing, the center 10 outputs information explaining the software update, a notification that consent is required for the software update, and a notification urging the user to consent to the software update. As an output device, a display device 70 or an information terminal 95 installed in the vehicle network 90 can be used. For example, in the consent request processing, if the display device 70 can display information that should be explained to the vehicle's users or administrators beforehand, then the display device 70 is used as an output device. When using the display device 70 as an output device, the OTA manager 30 can display information related to the software update, a consent request screen for requesting consent from the user or administrator for the software update, and a notification urging the user or administrator to press the consent button if they consent. If the display device 70 cannot display information that should be explained to the vehicle's users or administrators beforehand, then the information terminal 95 can be used as an output device during the consent request processing. When using the information terminal 95 as an output device, the information terminal 95 can (via the center 10) display information related to software updates, consent requests for software updates from users or administrators, and notifications urging users or administrators to press the consent button if they consent. If the center 10 receives input of consent from the user or administrator via the OTA manager 30 and / or the information terminal 95, it updates the software of the target electronic control unit by executing the aforementioned installation and activation control process instructed by the OTA manager 30.

[0060] Here, when the non-volatile memory of the target electronic control unit is a single-library memory with one storage area for storing software and other data, installation and activation are generally performed continuously. Therefore, a request for consent to software updates is processed before installation. Furthermore, even if the non-volatile memory of the target electronic control unit is a single-library memory, the target electronic control unit may request to temporarily halt update processing, i.e., postpone (standby), activation after installation is complete, based on information related to the update timing indicated by the center 10. Additionally, when the non-volatile memory of the target electronic control unit is a dual-library memory with two storage areas for storing software and other data, a request for consent to software updates is processed at least after installation and before activation. In the case of a dual-library memory, the request for consent to software updates before installation may or may not be performed.

[0061] The software update process consists of three phases: download, installation, and activation. During the download phase, the OTA manager 30 downloads the update data from the center 10. During the installation phase, the OTA manager 30 transfers the downloaded update data (update software) to the target electronic control unit (ECU) and installs the update software based on the update data in the ECU's storage area. During the activation phase, the target ECU activates the installed update software.

[0062] The download process involves the OTA manager 30 receiving update data for updating the electronic control unit's software and storing it in the storage unit 37. The update data is contained in a distribution data packet and is sent from the center 10 to the OTA manager 30. The download phase includes not only the execution of the download but also the control of a series of download-related processes, such as determining whether the download can be executed and verifying the update data.

[0063] The update data sent from center 10 to OTA manager 30 may include any one of the following: update software for the electronic control unit (ECU) (complete data or differential data), compressed data resulting from compressed update software, or split data resulting from split compressed data. Additionally, the update data may include the ECU_ID (or serial number) of the target ECU and the ECU_Software_ID of the target ECU before the update. The update data is downloaded as the aforementioned distribution data package. However, the distribution data package may include update data for a single ECU or multiple ECUs.

[0064] Installation is the process by which the OTA Manager 30 writes the updated software (updated program) to the non-volatile memory of the target electronic control unit based on the update data downloaded from the center 10. The installation phase includes not only the execution of the installation but also the control of a series of installation-related processes, such as determining whether the installation can be executed, transferring the update data, and verifying the update software.

[0065] When the update data includes the update software itself (complete data), during the installation phase, the OTA manager 30 transfers the update data (update software) to the target electronic control unit (ECU). Alternatively, when the update data includes compressed, differential, or segmented data of the update software, the OTA manager 30 may transfer the update data to the target ECU, which then generates the update software based on the update data. Or, the OTA manager 30 may generate the update software based on the update data and then transfer the update software to the target ECU. Here, the generation of the update software can be achieved by decompressing compressed data or combining (integrating) differential or segmented data.

[0066] The installation of the updated software can be performed by the target electronic control unit based on an installation request from the OTA manager 30. Furthermore, a specific target electronic control unit that receives the update data can autonomously install the updated software without receiving explicit instructions from the OTA manager 30.

[0067] Activation is the process by which the target electronic control unit (ECU) validates (activates) the updated software already installed in its non-volatile memory. The activation phase includes not only the execution of activation but also a series of controls related to activation, such as determining whether activation is feasible, requesting the vehicle user's or manager's consent to activation, and verifying the execution result.

[0068] The activation of the updated software can be performed by the target electronic control unit based on an activation request from the OTA manager 30. Furthermore, a specific target electronic control unit that receives the update data can activate itself after installation without explicit instructions from the OTA manager 30.

[0069] Among them, it is capable of performing software update processing on multiple target electronic control units, either continuously or in parallel.

[0070] In addition, "software update processing" includes not only the entire process of continuous downloading, installation, and activation, but also processing of only a part of the downloading, installation, and activation process.

[0071] deal with

[0072] Next, refer to Figure 6A , Figure 6B ,as well as Figure 7 The software update process performed in the network system described in this embodiment will be explained.

[0073] Figure 6A as well as Figure 6B This is a flowchart illustrating the steps involved in sending and processing information related to the software update performed by Center 10. Figure 6A processing and Figure 6B The processing is done by connecting the X and Y operators.

[0074] Step S601

[0075] Center 10 determines whether there is any software in the vehicle that needs updating. Center 10 can make this determination based on the current version of the software of each electronic control unit 50a-50d installed in the vehicle, obtained from the vehicle configuration information, included in the update confirmation request sent from OTA manager 30, and the latest version of each software stored in the storage unit 16 of Center 10. When Center 10 determines that there is software in the target vehicle that needs updating (step S601, Yes), the process proceeds to step S602. On the other hand, when Center 10 determines that there is no software in the target vehicle that needs updating (step S601, No), the process ends.

[0076] Step S602

[0077] Center 10 determines whether the display device 70 installed in the vehicle to which the software update is being performed meets predetermined conditions. Here, the predetermined condition is that, when an OTA software update is performed, the display device 70 can display information (such as changes in control settings) that should be explained to the vehicle's users and administrators beforehand. Center 10 makes this determination based on information related to the display device 70 obtained by acquisition unit 19. If Center 10 determines that the display device 70 meets the predetermined conditions (step S602, Yes), the process proceeds to step S604. On the other hand, if Center 10 determines that the display device 70 does not meet the predetermined conditions (step S602, No), the process proceeds to step S603.

[0078] Step S603

[0079] Center 10 determines whether an information terminal 95 associated with the vehicle to be updated exists. Information terminals 95 associated with the vehicle are typically pre-registered in the vehicle's storage unit, external management devices, etc. Therefore, Center 10 can make this determination based on this registration information. If Center 10 determines that an information terminal 95 associated with the vehicle exists (step S603, Yes), the process proceeds to step S605. Conversely, if Center 10 determines that no information terminal 95 associated with the vehicle exists (step S603, No), this process ends without performing the software update.

[0080] Step S604

[0081] Center 10 sends information related to the software update (description of the software update content, request for consent to the software update, etc.) to the vehicle (OTA manager 30). Upon receiving this information, the vehicle displays a screen based on the software update-related information on the display device 70. If the software update-related information has been sent to the vehicle, the process proceeds to step S607.

[0082] Step S605

[0083] Center 10 sends information related to the software update (descriptions of the software update content, requests for consent to the software update, etc.) to information terminal 95. If, in step S603 above, it is determined that multiple information terminals 95 are associated with the vehicle, center 10 can send the information to all terminals or to a subset of terminals (e.g., the one closest to the vehicle). Upon receiving the information, information terminal 95 displays a screen based on the software update-related information. In addition to displaying the information in text form, the screen can also use various methods such as a link to a webpage containing the information, or a launch button for the application displaying the information. If the software update-related information is sent to information terminal 95, the process proceeds to step S606.

[0084] Step S606

[0085] Center 10 sends a notification to the vehicle (OTA manager 30) stating that information related to a software update has been sent to the information terminal 95. This notification contains less information than typical software update information, and can be displayed even on simple HMI devices such as instrument clusters that cannot display such information. The notification may include a string indicating an event initiated by the vehicle (OTA manager 30). This notification increases the probability that the software update-related information received by the information terminal 95 via email in step S605 will be noticed by the vehicle's users and administrators. Furthermore, it increases the likelihood that the vehicle's users and administrators will determine that the software update-related information received by the information terminal 95 via email in step S605 is reliable and important information. If the notification stating that information related to a software update has been sent to the information terminal 95 is sent to the vehicle, the process proceeds to step S607. Steps S605 and S606 can also be performed simultaneously.

[0086] Step S607

[0087] Center 10 determines whether an update consent notification has been received from the vehicle (OTA manager 30) or information terminal 95, as a response to information related to software updates. By receiving the update consent notification, Center 10 can determine that the vehicle's user, administrator, or other personnel have understood and agreed to the software update. If Center 10 determines that an update consent notification has been received from the vehicle (OTA manager 30) or information terminal 95 (step S607, Yes), the process proceeds to step S608. If Center 10 determines that no update consent notification has been received (step S607, No), the process repeatedly proceeds to step S607 (Center 10 waits to receive the update consent notification). Furthermore, if Center 10 is unable to receive an update consent notification from the vehicle (OTA manager 30) or information terminal 95 for a specified period, this process can be terminated without performing the software update.

[0088] Step S608

[0089] Center 10 executes the process of updating the software of the target electronic control unit installed in the vehicle (downloading, installing, activating). This concludes the process of sending information related to the software update. Furthermore, in this embodiment, as in step S602, the recipient of the software update-related information is determined based on whether the display device 70 meets predetermined conditions. However, it is also possible to pre-determine that the software update-related information will be sent to the information terminal 95. In this case, steps S602 and S604 can be omitted.

[0090] Figure 7 This is a flowchart illustrating an example of the software update control process performed by the center 10, the OTA manager 30, and the target electronic control unit. Figure 7 The aforementioned software update-related information sending process is implemented during the download phase in order to obtain permission for downloading during the software update process. Figure 6A as well as Figure 6B Examples of software update timings following this.

[0091] In addition, the processing of sending information related to software updates ( Figure 6A as well as Figure 6B This method can be implemented not only in the download phase described in this embodiment, but also in the installation phase to obtain permission for installation in the software update process, and in the activation phase to obtain permission for activation in the software update process.

[0092] Step S701

[0093] Center 10 determines whether a download request for a data packet distribution exists from OTA Manager 30. If Center 10 determines that a download request exists (step S701, Yes), the process proceeds to step S702. If Center 10 determines that there is no download request (step S701, No), the process repeatedly performs step S701 (Center 10 waits to receive a download request).

[0094] Step S702

[0095] OTA Manager 30 downloads update data. More specifically, OTA Manager 30 receives a distribution data packet containing update data sent from Center 10. OTA Manager 30 stores the received distribution data packet in Storage Unit 37. If update data download has been performed, the process proceeds to step S703.

[0096] Step S703

[0097] The OTA manager 30 performs software installation based on update data for the target electronic control unit. More specifically, the OTA manager 30 transfers update data included in the distribution data packet to the target electronic control unit based on the information included in the distribution data packet. Then, the OTA manager 30 instructs the installation of the update software. Installation is a process of writing the update data to the data storage area of ​​the target electronic control unit. If the update software installation is performed, the process proceeds to step S704.

[0098] Step S704

[0099] The OTA manager 30 activates the update software that has been installed on the target electronic control unit. More specifically, the OTA manager 30 instructs the target electronic control unit, for which the update software has been written to the data storage area, to activate the update software based on information included in the distribution data packet. The target electronic control unit restarts upon triggering a specific input operation such as power-off, and then activates the update software. Once the update software activation process is completed, the software update control process ends.

[0100] Function / Effect

[0101] As described above, according to one embodiment of the network system disclosed herein, when a software update is performed on the electronic control unit installed in a vehicle, if the display device 70 installed in the vehicle cannot fully display information related to the software update, the center 10 sends the software update-related information to the information terminal 95 associated with the vehicle via email or the like. Along with this transmission, the center 10 also sends a notification (OTA manager 30) to the vehicle that the software update-related information has been sent to the information terminal 95. The vehicle then displays the notification received from the center 10 on the display device 70.

[0102] Through this process, if the vehicle user or administrator observes the content displayed on the display device 70, they can determine that the email or other information sent to their information terminal 95 is reliable information. Furthermore, the vehicle user or administrator can notice that an email has been sent to their information terminal 95. Therefore, it avoids situations where users or administrators fail to notice information sent to their information terminal 95 via email or other means during OTA software updates, or fail to understand such information as necessary and reliable. Moreover, after determining that the vehicle user or administrator understands the software update content and has obtained consent for the update, the process of updating the software of the target electronic control unit installed in the vehicle can be executed.

[0103] The above describes one embodiment of the technology disclosed herein. However, this disclosure can be understood not only as a system having a center and a vehicle, but also as a method or program executed by a center having a processor and memory, a computer-readable non-transitory storage medium storing a program, an OTA manager capable of communicating with the center, or a vehicle having an OTA manager, etc. The center may have one or more processors. The OTA manager may have one or more processors.

[0104] The technology disclosed herein can be used in network systems for updating the software of electronic control units installed in vehicles.

Claims

1. A software update control system, characterized in that, include: The vehicle is equipped with an electronic control unit; The software update control center is configured to control the software updates of the electronic control unit; as well as The information terminal has established an association with the vehicle. in, The vehicle has the following features: Display device; and The first communication unit is configured to communicate with the software update control center. The software update control center has the following features: The second communication unit is configured to communicate with the vehicle and the information terminal; and Processing Department The processing unit is configured as follows: Information related to the software update is sent to the information terminal; If the processing unit has sent information related to the software update to the information terminal, a notification indicating that the information related to the software update has been sent to the information terminal is sent to the vehicle. as well as The vehicle causes the display device to show the notification received from the software update control center. The processing unit of the software update control center is configured to send information related to the software update to the information terminal when the display device mounted on the vehicle is unable to display information related to the software update.

2. The software update control system according to claim 1, characterized in that, The vehicle also includes a switch for instructing the software update control center to resend information related to the software update to the information terminal.

3. The software update control system according to claim 1 or 2, characterized in that, The software update control center also includes a control unit configured to control the software update based on an update consent notification received from the information terminal in response to information related to the software update.

4. The software update control system according to claim 1 or 2, characterized in that, The vehicle also includes a transmitting unit configured to send information related to the display device to the software update control center. The software update control center also includes an acquisition unit configured to acquire information related to the display device from the vehicle.

5. A software update control center configured to control the updates of software in an electronic control unit installed in a vehicle. The software update control center is characterized by including: The communication unit is configured to communicate with the vehicle and an information terminal associated with the vehicle. and Processing Department The processing unit is configured as follows: Send information related to the software update to the information terminal; and If the processing unit has already sent information related to the software update to the information terminal, a notification is sent to the vehicle indicating that information related to the software update has been sent to the information terminal. It also includes an acquisition unit configured to obtain information related to a display device mounted on the vehicle, the display device displaying the notification received from the software update control center. in, The processing unit is configured to send information related to the software update to the information terminal when the display device is unable to display information related to the software update.

6. The software update control center according to claim 5, characterized in that, The processing unit is configured to, upon receiving a retransmission request from the communication unit in the vehicle, retransmit information related to the software update to the information terminal.

7. The software update control center according to claim 5 or 6, characterized in that, It also includes a control unit configured to control the software update based on an update consent notification received by the communication unit from the information terminal in response to information related to the software update.

8. A software update control method, executed by a software update control center configured to control updates of software in an electronic control unit installed in a vehicle, the software update control center having a memory and one or more processors. The software update control method is characterized by including: Information related to the software update is sent to the information terminal associated with the vehicle; and If the software update control center has already sent information related to the software update to the information terminal, a notification will be sent to the vehicle indicating that the information related to the software update has been sent to the information terminal. The vehicle is equipped with a display device for displaying the notification received from the software update control center. The software update control center is configured to send information related to the software update to the information terminal when the display device mounted on the vehicle is unable to display information related to the software update.

9. A non-transitory storage medium storing commands executable by one or more computers of a software update control center, wherein the software update control center includes a memory and one or more processors, and the software update control center is configured to control the updating of software of an electronic control unit installed in a vehicle. The non-transitory storage medium is characterized in that, The functions include: Information related to the software update is sent to the information terminal associated with the vehicle; and If information related to the software update has been sent to the information terminal, a notification is sent to the vehicle indicating that information related to the software update has been sent to the information terminal. The vehicle is equipped with a display device for displaying the notification received from the software update control center. The software update control center is configured to send information related to the software update to the information terminal when the display device mounted on the vehicle is unable to display information related to the software update.

Images