Vehicle control system and method for confirming software consistency

Abstract

The invention provides a vehicle-mounted device, a vehicle, a method and a program. Wherein the apparatus includes: a first instruction unit configured to execute a switching instruction to switch software installed on a plurality of in-vehicle apparatuses; an acquisition unit configured to acquire version information of switched software of the plurality of in-vehicle devices in response to the switching instruction; a confirmation unit configured to confirm, based on the version information acquired by the acquisition unit, whether versions of the software installed on the plurality of in-vehicle devices have consistency; and a notification unit configured to notify a user that the plurality of in-vehicle devices restore the switched software to the pre-switching software based on confirmation that versions of the software installed on the plurality of in-vehicle devices do not have consistency.

Description

[0001] Divisional Application Statement

[0002] This application is a divisional application of Chinese invention patent application No. 201910165359.7 filed on March 5, 2019, claiming the priority of Japanese patent application No. 2018-040981 filed on March 7, 2018, and the invention name is “VEHICLE CONTROL SYSTEM AND METHOD FOR CONFIRMING SOFTWARE CONSISTENCY”. Technical Field

[0003] The invention relates to a vehicle control system and a method for confirming software consistency. Background Art

[0004] Japanese Patent Application Publication No. 2009-53920 (JP 2009-53920A) discloses a system for updating an ECU (Electronic Control Unit, ECU) program using an upgrade program sent from a server. In the system of JP 2009-53920A, before updating the relevant program, it is determined whether to update the ECU program by referring to the dependency information between the upgrade program of the ECU program to be updated and other ECU programs, so as to prevent the occurrence of operation failures caused by inconsistent versions of the ECU program. Summary of the invention

[0005] When the versions of multiple in-vehicle programs are inconsistent, unexpected vehicle control may be performed. Although the system of JP 2009-53920A confirms the dependency between the program to be updated and other programs when updating, confirming the dependency when updating the program may not be enough to prevent unexpected vehicle control.

[0006] The present invention provides a vehicle control system and a method for confirming software consistency, which can further reduce the possibility of executing unexpected vehicle control due to inconsistent versions of multiple vehicle-mounted software.

[0007] A vehicle control system according to a first aspect of the present invention includes a plurality of vehicle-mounted devices, wherein any one of the plurality of vehicle-mounted devices is a specific vehicle-mounted device, and the specific vehicle-mounted device includes: a first consistency information storage unit; a version acquisition unit; and a first judgment unit. The first consistency information storage unit is configured to pre-store first consistency information, which includes an allowed combination of versions of software of all vehicle-mounted devices constituting the vehicle control system. The version acquisition unit is configured to acquire the version of software contained in other vehicle-mounted devices when the power of the vehicle is turned on. Other vehicle-mounted devices are vehicle-mounted devices other than the specific vehicle-mounted device. The first judgment unit is configured to determine whether the versions of software of all vehicle-mounted devices constituting the vehicle control system are consistent by comparing the version of the software of the specific vehicle-mounted device and the version of the software acquired from the other vehicle-mounted devices with the first consistency information when the version acquisition unit acquires the version of software from the other vehicle-mounted devices.

[0008] In the vehicle control system according to the above aspect, when the power of the vehicle is turned on, a specific vehicle-mounted device determines whether the software versions of all vehicle-mounted devices constituting the vehicle control system are consistent. This makes it possible to further reduce the possibility of performing unexpected vehicle control due to inconsistent versions of the vehicle-mounted software.

[0009] In the above aspect, the specific vehicle-mounted device further includes: a first sending unit; and a receiving unit. The first sending unit may be configured to send version information including the versions of the software of all the vehicle-mounted devices constituting the vehicle control system to an external server when the first judgment unit judges that the versions of the software of all the vehicle-mounted devices constituting the vehicle control system are inconsistent. The receiving unit may be configured to receive judgment result information from the external server, the judgment result information being information about a judgment result judged by the external server based on the version information sent by the first sending unit. The judgment result information indicates whether the versions of the software of all the vehicle-mounted devices constituting the vehicle control system are consistent.

[0010] According to the above configuration, even when a specific vehicle-mounted device fails to confirm the consistency of the software version, the consistency of the software version can be confirmed based on the judgment result of the external server. Therefore, the consistency of the software version can be confirmed with high accuracy.

[0011] In the above aspects, the vehicle-mounted device may also be configured to save the current version of the software and the previous version of the software, respectively. The first consistency information storage unit may be configured to store the first consistency information in the current version and the first consistency information in the previous version. The specific vehicle-mounted device may also include a switching indication unit, which may be configured to instruct other vehicle-mounted devices to switch the execution target software to the previous version of the software when the first sending unit cannot communicate with the external server. The version acquisition unit may be configured to obtain the version of the switched software from other vehicle-mounted devices after the switching indication unit instructs the software to be switched. The first judgment unit may be configured to judge whether the software versions of all vehicle-mounted devices constituting the vehicle control system are consistent by comparing the version of the software of the switched specific vehicle-mounted device and the version of the switched software obtained from other vehicle-mounted devices with the first consistency information in the previous version.

[0012] According to this configuration, when the vehicle is in an environment where communication with an external server is impossible, the software of the vehicle-mounted device is switched to the previous version of the software. Therefore, the consistency of the software of all the vehicle-mounted devices constituting the vehicle control system can be ensured at an early stage.

[0013] In the above aspects, the specific vehicle-mounted device may also include: a software acquisition unit; and a software update unit. The software acquisition unit may be configured to, when any of the other vehicle-mounted devices fails, acquire the software of the version at the time when the faulty vehicle-mounted device fails from an external server and save the software. The software update unit may be configured to, when the vehicle-mounted device is replaced or repaired and then the first judgment unit determines that the replaced or repaired vehicle-mounted device is inconsistent with the first consistency information, use the software saved in the software acquisition unit to update the software of the replaced or repaired vehicle-mounted device. The version acquisition unit may be configured to acquire the version of the software from other vehicle-mounted devices after the software update unit updates the software. The first judgment unit may be configured to determine whether the versions of the software of all vehicle-mounted devices constituting the vehicle control system are consistent by comparing the version of the software of the specific vehicle-mounted device and the version of the software acquired from other vehicle-mounted devices with the first consistency information.

[0014] According to this configuration, even when the software versions of all vehicle-mounted devices constituting the vehicle control system become inconsistent due to replacement or repair of the vehicle-mounted devices, and the vehicle does not have a sufficient wireless communication environment available, it is possible to quickly restore the state in which the software versions of all vehicle-mounted devices are consistent.

[0015] In the above aspect, the external server may further include: a second consistency information storage unit; a second judgment unit; and a second sending unit. The second consistency information storage unit may be configured to pre-store second consistency information, which includes allowed combinations of versions of software of all vehicle-mounted devices constituting the vehicle control system. The second judgment unit may be configured to judge whether the versions of software of all vehicle-mounted devices constituting the vehicle control system are consistent based on the version information sent from the first sending unit by comparing the versions of software of all vehicle-mounted devices constituting the vehicle control system with the second consistency information. The second sending unit may be configured to send the judgment result made by the second judgment unit as judgment result information to a specific vehicle-mounted device.

[0016] According to this configuration, the consistency of the software versions of all the vehicle-mounted devices constituting the vehicle control system can be confirmed based on the second consistency information stored in the external server. This makes it possible to determine the consistency of the software versions of the vehicle-mounted devices with high accuracy.

[0017] In the above aspect, the specific vehicle-mounted device may further include a consistency information updating unit. The consistency information updating unit may be configured to update the first consistency information stored in the first consistency information storage unit when the second judgment unit judges that the software versions of all vehicle-mounted devices constituting the vehicle control system are consistent.

[0018] According to this configuration, the first consistency information stored in the representative vehicle-mounted device can be updated based on the determination result in the external server. Therefore, the vehicle control system can quickly perform the next consistency determination process without communicating with the external server.

[0019] In the above aspect, the specific vehicle-mounted device may further include an update instruction unit. The update instruction unit may be configured to instruct the vehicle-mounted device storing the software of a version inconsistent with the second consistency information used by the second judgment unit for judgment to perform software update when the second judgment unit determines that the software versions of all the vehicle-mounted devices constituting the vehicle control system are inconsistent.

[0020] According to this configuration, the software of the version inconsistent with the second consistency information can be updated based on the determination result in the external server. Therefore, the state in which the software versions of all the vehicle-mounted devices are consistent can be quickly restored.

[0021] The method for confirming software consistency according to the second aspect of the present invention is executed in a computer included in any one of the multiple vehicle-mounted devices constituting a vehicle control system. The method for confirming software consistency includes: pre-storage; acquisition; and judgment. Pre-storage is to pre-store first consistency information, and the first consistency information includes the allowed combination of software versions of all vehicle-mounted devices constituting the vehicle control system. Acquisition is to obtain the version of the software in other vehicle-mounted devices when the power of the vehicle is turned on. Judgment is when the version of the software is obtained from other vehicle-mounted devices, by comparing the version of the software of the specific vehicle-mounted device and the version of the software obtained from the other vehicle-mounted devices with the first consistency information, it is judged whether the versions of all vehicle-mounted devices constituting the vehicle control system are consistent.

[0022] In the method for confirming software consistency according to the above aspect, when the power of the vehicle is turned on, the specific vehicle-mounted device determines whether the versions of the software of all the vehicle-mounted devices constituting the vehicle control system are consistent. This makes it possible to further reduce the possibility of performing unexpected vehicle control due to inconsistent versions of the software of the vehicle-mounted devices.

[0023] The present invention also allows further reduction of the possibility of performing unintended vehicle control due to inconsistent versions of software of a plurality of vehicle-mounted devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Features, advantages, and technical and industrial significance of exemplary embodiments of the present invention will be described below with reference to the accompanying drawings, in which like reference numerals represent like elements, and in which:

[0025] Figure 1 is a block diagram showing a schematic configuration of a vehicle control system according to a first embodiment;

[0026] Figure 2 for Figure 1 A functional block diagram of a vehicle control system shown in FIG.

[0027] Figure 3 Shows Figure 2 An example of a consistency table stored in the consistency information storage unit shown in;

[0028] Figure 4 is a flowchart showing an example of a process of confirming consistency performed by a representative vehicle-mounted device in the vehicle control system according to the first embodiment;

[0029] Figure 5 is a functional block diagram of a vehicle control system according to a second embodiment;

[0030] Figure 6is a flowchart showing an example of a consistency confirmation process executed by a representative vehicle-mounted device in the vehicle control system according to the second embodiment;

[0031] Figure 7 is a schematic diagram for describing the background of a vehicle control system according to a third embodiment;

[0032] Figure 8 is a functional block diagram of a vehicle control system according to a third embodiment;

[0033] Fig. 9 is a flowchart showing an example of software acquisition processing executed by a representative vehicle-mounted device in the vehicle control system according to the third embodiment; and

[0034] Fig.10 1 is a flowchart showing an example of consistency confirmation processing executed by a representative vehicle-mounted device in the vehicle control system according to the third embodiment. DETAILED DESCRIPTION

[0035] summary

[0036] In the vehicle control system according to the present invention, whenever the power of the vehicle is turned on, one of the multiple vehicle-mounted devices constituting the vehicle control system confirms the consistency of the software version to reduce the possibility of performing unexpected vehicle control due to inconsistent software versions.

[0037] First embodiment

[0038] Configuration

[0039] Figure 1 is a block diagram showing a schematic configuration of a vehicle control system according to the first embodiment.

[0040] The vehicle control system 100 is a system composed of a plurality of vehicle-mounted devices A to D that can communicate with each other. The system realizes specific vehicle control by combining the functions of the plurality of vehicle-mounted devices A to D. Figure 1 In the example, the vehicle control system 100 is composed of four vehicle-mounted devices A to D. However, the number of vehicle-mounted devices constituting the vehicle control system 100 is not limited to four. Examples of specific vehicle control implemented by the vehicle control system 100 may include automatic driving. The vehicle-mounted devices A to D correspond to ECUs that control vehicle driving functions (such as acceleration, deceleration, and steering), and correspond to ECUs that provide driving assistance by combining ECUs that control vehicle driving functions. The vehicle-mounted devices A to D are capable of communicating with an external server 2 via a wireless communication device 1. In the following description, a specific vehicle-mounted device A, which is one of the multiple vehicle-mounted devices A to D constituting the vehicle control system, is referred to as a "representative vehicle-mounted device A".

[0041] Figure 2 for Figure 1 A functional block diagram of a vehicle control system is shown. Figure 3 Shows Figure 2 An example of a consistency table stored in the consistency information storage unit shown in FIG.

[0042] Representative vehicle-mounted device A

[0043] Although the representative vehicle-mounted device A is one of a plurality of vehicle-mounted devices that provide a control function of the vehicle control system 100, the representative vehicle-mounted device A serves as a master device in a process of confirming the consistency of software versions of the vehicle-mounted devices A to D. When the power of the vehicle is turned on, the representative vehicle-mounted device A confirms the consistency of the versions of software of all the vehicle-mounted devices A to D constituting the vehicle control system 100. The representative vehicle-mounted device A includes a software storage unit 10, a consistency information storage unit 11, a version acquisition unit 12, a judgment unit 13, a transmission unit 14, a reception unit 15, a consistency information update unit 16, and an update instruction unit 17.

[0044] The software storage unit 10 stores software for operating the representative vehicle-mounted device A. The representative vehicle-mounted device A realizes a specific function for controlling the operation of the vehicle by executing the software stored in the software storage unit 10 .

[0045] The consistency information storage unit 11 stores a consistency table in advance, which defines the combination of versions of the software of all the vehicle-mounted devices A to D constituting the vehicle control system 100. The combination of versions of the software of the vehicle-mounted devices A to D defined in the consistency table is a combination of versions that are confirmed to operate the vehicle control system 100 normally. This combination is also a combination of versions that are allowed to be executed. For example, Figure 3 As shown, the consistency table may include a system number identifying the vehicle control system 100, and software versions of the vehicle-mounted devices A to D. An identifier identifying the vehicle control system 100 may be used as the system number, or a version of the vehicle control system 100 may be used as the system number. Figure 3 In the example of , a single version of each vehicle-mounted device is defined, but the consistency table may also limit the range of versions of vehicle-mounted devices that can be combined. The consistency table may also limit the combination of multiple versions (or ranges of versions) that are allowed to be executed simultaneously. When a vehicle-mounted device stores multiple software, the consistency table limits the allowed version of each software. The consistency table is used as consistency information (first consistency information) for the judgment unit 13 described later to determine whether the versions of the software of the vehicle-mounted devices A to D are consistent.

[0046] Whenever the power of the vehicle is turned on, the version acquisition unit 12 acquires the version of each software in the other vehicle-mounted devices B to D through communication. When there is any vehicle-mounted device storing a plurality of software among the vehicle-mounted devices B to D, the version acquisition unit 12 acquires the versions of all software stored in the relevant vehicle-mounted device.

[0047] Each time the version acquisition unit 12 acquires the version of software from other vehicle-mounted devices B to D, the judgment unit 13 judges whether the versions of the software of all vehicle-mounted devices A to D constituting the vehicle control system 100 are consistent. The judgment unit 13 makes the judgment by comparing the version of the software stored in the software storage unit 10 of the representative vehicle-mounted device A and the version of the software acquired by the version acquisition unit 12 from other vehicle-mounted devices B to D with the consistency information stored in the consistency information storage unit 11. When it is judged based on the consistency table stored in the consistency information storage unit 11 that the versions of the software of all vehicle-mounted devices A to D constituting the vehicle control system 100 are consistent, the judgment unit 13 permits the execution of a specific vehicle control realized by the combination of the functions of the vehicle-mounted devices A to D.

[0048] When the judgment unit 13 judges that the versions of the software of all the vehicle-mounted devices A to D constituting the vehicle control system 100 are inconsistent, the sending unit 14 sends the version information including the versions of the software of the vehicle-mounted devices A to D to the external server 2. The version information sent by the sending unit 14 is used in the external server 2 to reconfirm whether the versions of the software of the vehicle-mounted devices A to D are consistent.

[0049] The receiving unit 15 receives various items of information transmitted by the external server 2. One of the items of information received by the receiving unit 15 from the external server 2 is the judgment result information. The judgment result information indicates whether the versions of the software of the vehicle-mounted devices A to D are consistent. The judgment result information can be obtained as the judgment result made by the external server 2 based on the version information received from the transmitting unit 14.

[0050] The sending unit 14 and the receiving unit 15 are connected by Figure 1 The wireless communication device 1 shown in FIG. 1 communicates with an external server 2 .

[0051] When the judgment result information received by the receiving unit 15 indicates that the versions of the software of the vehicle-mounted devices A to D are consistent, the consistency information updating unit 16 updates the consistency information stored in the consistency information storage unit 11. The consistency information updating unit 16 may update the consistency information by replacing the combination of the versions of the software contained in the consistency table (first consistency information) stored in the consistency information storage unit 11 with the combination of the current versions of the software of the vehicle-mounted devices A to D, or by adding the combination of the current versions of the software of the vehicle-mounted devices A to D to the consistency table stored in the consistency information storage unit 11. The consistency information updating unit 16 may update the consistency information by obtaining an updated consistency table from the external server 2 and replacing the consistency table stored in the consistency information storage unit 11 with the consistency table obtained from the external server 2.

[0052] When the determination result information received by the receiving unit 15 indicates that the software versions of the vehicle-mounted devices A to D are inconsistent, the update instructing unit 17 instructs the vehicle-mounted device storing the software inconsistent with the allowed version combination to perform software update.

[0053] Vehicle mounted devices B to D

[0054] The in-vehicle devices B to D each include a software storage unit 20 , a transmission unit 21 , and a reception unit 22 .

[0055] The software storage unit 20 stores software for operating each of the vehicle-mounted devices B to D. The vehicle-mounted devices B to D implement specific functions for controlling the operation of the vehicle by executing the software stored in the software storage unit 20, respectively.

[0056] The sending unit 21 sends the version of the software stored in the software storage unit 20 to the representative vehicle-mounted device A. The sending unit 21 may send the version of the software to the representative vehicle-mounted device A when the vehicle-mounted power is turned on. Alternatively, the sending unit 21 may send the version of the software to the representative vehicle-mounted device A in response to a request sent by the representative vehicle-mounted device A when the vehicle power is turned on.

[0057] The receiving unit 22 receives various information sent by the representative vehicle-mounted device A or the external server 2 .

[0058] External Server 2

[0059] The external server 2 includes a consistency information storage unit 30 , a determination unit 31 , a sending unit 32 and a receiving unit 33 .

[0060] The consistency information storage unit 30 stores a consistency table in advance, which defines the combination of versions of software of all vehicle-mounted devices A to D constituting the vehicle control system 100. The combination of software of the vehicle-mounted devices A to D defined in the consistency table is a combination of versions that is confirmed to operate the vehicle control system 100 normally. This combination is also a combination of versions that are allowed to be executed. Figure 3 In the case shown in FIG. 1 , the consistency table stored in the consistency information storage unit 30 may include the system number identifying the vehicle control system 100 and the software versions of the vehicle-mounted devices A to D. The consistency table is used as consistency information (second consistency information) for the judgment unit 31 described later to judge whether the versions of the software of the vehicle-mounted devices A to D are consistent.

[0061] The judgment unit 31 judges whether the versions of the software of all the vehicle-mounted devices A to D constituting the vehicle control system 100 are consistent. The judgment unit 31 makes a judgment by comparing the versions of the software of the vehicle-mounted devices A to D contained in the version information received from the representative vehicle-mounted device A with the consistency table stored in the consistency information storage unit 30. The external server 2 is capable of managing all versions of the software of the vehicle-mounted devices A to D. Therefore, compared with the consistency table stored in the consistency information storage unit 11 of the representative vehicle-mounted device A, the consistency table stored in the consistency information storage unit 30 is capable of limiting a large number of allowed combinations of the versions of the software of the vehicle-mounted devices A to D. Therefore, even when the representative vehicle-mounted device A cannot confirm the consistency of the software versions, the consistency of the software versions of the vehicle-mounted devices A to D can be judged with high accuracy by making a judgment again in the external server 2.

[0062] The transmission unit 32 transmits the judgment result information which is the result of the judgment made by the judgment unit 31 to the representative vehicle-mounted device A. The judgment result information indicates whether the versions of the software of the vehicle-mounted devices A to D are consistent.

[0063] The receiving unit 33 receives various information transmitted by the representative vehicle-mounted device A.

[0064] Control Processing

[0065] The following will be combined Figures 2 to 4 The control processing performed by the representative vehicle-mounted device A will be described.

[0066] Figure 4 is a flowchart showing an example of a process of confirming consistency performed by a representative vehicle-mounted device in the vehicle control system according to the first embodiment. Figure 4 The control process shown in FIG.

[0067] Step S1: The version acquisition unit 12 acquires the versions of the software of the other vehicle-mounted devices B to D. Then, the process proceeds to step S2.

[0068] Step S2: The judgment unit 13 compares the software version of the representative vehicle-mounted device A and the software versions obtained from other vehicle-mounted devices B to D with the consistency table stored in the consistency information storage unit 11 to judge whether the software versions of the vehicle-mounted devices A to D are consistent. When the judgment result in step S2 is "yes", the process goes to step S3. Otherwise, the process goes to step S4.

[0069] Step S3: The judgment unit 13 permits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the judgment unit 13 ends the process.

[0070] Step S4: The transmission unit 14 transmits version information to the external server 2, the version information including the version of the software of the representative vehicle-mounted device A and the versions of the software acquired from the other vehicle-mounted devices B to D. Then, the process proceeds to step S5.

[0071] Step S5: The receiving unit 15 determines whether the judgment result information is received from the external server 2. When the judgment result in step S5 is "yes", the process goes to step S6. Otherwise, after waiting for a predetermined time, the receiving unit 15 performs the judgment process of step S5 again. When the state in which the receiving unit 15 cannot receive the judgment result information from the external server 2 in step S5 continues for a predetermined time (timeout time), the receiving unit 15 determines that it has timed out and ends the process of step S5. Then the process proceeds to step S6.

[0072] Step S6: The judgment unit 13 judges whether the versions of the software of the vehicle-mounted devices A to D are consistent based on the judgment result information received from the external server 2. When the judgment result in step S6 is "yes", the process goes to step S7. Otherwise, the process goes to step S9. When the receiving unit 15 judges the timeout in step S5, the judgment unit 13 judges that the versions of the software of the vehicle-mounted devices A to D are inconsistent.

[0073] Step S7: The determination unit 13 permits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the process proceeds to step S8.

[0074] Step S8: The consistency information updating unit 16 updates the consistency table stored in the consistency information storage unit 11. As described above, the consistency table may be updated by using the version of the software used for determination in step S2, or may be updated by using the consistency table obtained from the external server 2 by the receiving unit 15. Then, the process ends.

[0075] Step S9: The determination unit 13 prohibits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the process proceeds to step S10.

[0076] Step S10: The update instruction unit 17 instructs the vehicle-mounted device storing the software of the version inconsistent with the consistency table stored in the consistency information storage unit 11 to perform software update. Then, the update instruction unit 17 ends the processing.

[0077] When the update instruction unit 17 instructs software update and the vehicle-mounted device to be updated completes receiving the updated software from the server 2, the user is encouraged to temporarily disconnect and then connect the power of the vehicle again to switch the execution target software from the current version of the software to the updated software.

[0078] When the software of any vehicle-mounted device is updated based on the update instruction in step 10 , the consistency information updating unit 16 may update the consistency table stored in the consistency information storage unit 11 as needed.

[0079] Effect

[0080] In the vehicle control system 100 according to the present embodiment, when the power of the vehicle is turned on, the representative vehicle-mounted device A acquires the versions of the software of the vehicle-mounted devices B to D, and determines whether the versions of the software of the vehicle-mounted devices A to D are consistent based on the consistency table prepared in advance. Since the consistency of the software version is confirmed every time the power of the vehicle is turned on, the possibility of performing unexpected vehicle control due to inconsistent versions of the software of the vehicle-mounted devices A to D can be further reduced.

[0081] In the vehicle control system 100 according to the present embodiment, when the representative vehicle-mounted device A determines inconsistency based on the consistency check (first check) of the software version, the representative vehicle-mounted device A sends the versions of the software of the vehicle-mounted devices A to D to the external server 2. The external server 2 then performs the consistency check of the software version again (second check) using the consistency table stored in the external server 2. Even when the representative vehicle-mounted device A cannot confirm the consistency using the information stored in the representative vehicle-mounted device A, the external server 2 performs the consistency check again using the information stored in the external server 2. This makes it possible to determine with high accuracy whether the versions of the software of the vehicle-mounted devices A to D are consistent.

[0082] In the vehicle control system 100 according to the present embodiment, it is determined whether the versions of the software of the vehicle-mounted devices A to D are consistent by comparison with the consistency table prepared in advance. As a result of the comparison, it is possible to identify which version of the software of which vehicle-mounted device is consistent with the consistency table. Since the information for identifying the vehicle-mounted device inconsistent with the consistency table is applicable to software update, repair, etc. of the vehicle-mounted device, it is possible to deal with the situation of inconsistent software versions at an early stage.

[0083] In the vehicle control system 100 according to the present embodiment, when the representative vehicle-mounted device A determines that the versions of the software of the vehicle-mounted devices A to D are inconsistent and then the external server 2 determines that the versions of the software of the vehicle-mounted devices A to D are consistent, the consistency table stored in the consistency information storage unit 11 of the representative vehicle-mounted device A can be updated. If the consistency table stored in the consistency information storage unit 11 is updated, unless the software of the vehicle-mounted devices A to D is changed, the representative vehicle-mounted device A can confirm the consistency of the software version by itself when the power of the vehicle is turned on next time. Therefore, the time for confirmation of consistency can be shortened.

[0084] The representative vehicle-mounted device A can be composed only of Figure 2 The functional block diagram of the representative vehicle-mounted device A shown in FIG. 1 is composed of a software storage unit 10, a consistency information storage unit 11, a version acquisition unit 12, and a judgment unit 13. Therefore, it is possible to construct a simple vehicle control system that can only judge the consistency of the software versions of the vehicle-mounted devices A to D when the power of the vehicle is turned on. It is also possible to add a sending unit 14 and a receiving unit 15 to this configuration to constitute a vehicle control system that allows a primary check in the representative vehicle-mounted device A and a secondary check in the external server 2. It is also possible to construct a vehicle control system in which the consistency information update unit 16 or the update instruction unit 17 is updated from Figure 2 excluding the functional block diagram of the representative vehicle-mounted device A shown in .

[0085] Second embodiment

[0086] Configuration

[0087] Figure 5 is a functional block diagram of a vehicle control system according to the second embodiment.

[0088] The vehicle control system 200 according to the second embodiment is characterized in that after the representative vehicle-mounted device A determines that the versions of the software of the vehicle-mounted devices A to D are inconsistent, even in a state where communication is impossible between the representative vehicle-mounted device A and the external server 2, the consistency of the versions of the software of the vehicle-mounted devices A to D can be ensured. The following mainly describes the differences between this embodiment and the first embodiment.

[0089] Representative vehicle-mounted device A

[0090] The software storage unit 10 of the representative vehicle-mounted device A stores the current version of software Sa_cur and the previous version of software Sa_old as software for operating the representative vehicle-mounted device A. The current version of software Sa_cur and the previous version of software Sa_old are stored in different storage areas in the software storage unit 10. When the software is updated, the previous version of software Sa_old is deleted, the current version of software is saved as the previous version of software, and the updated software is stored again as the current version of software.

[0091] The consistency information storage unit 11 stores the consistency table T_cur of the current version and the consistency table T_old of the previous version as consistency information. When updating the consistency information, the consistency table T_old of the previous version is deleted, the consistency table of the current version is saved as the consistency table of the previous version, and the updated consistency table is stored again as the consistency table of the current version.

[0092] The representative vehicle-mounted device A further includes a switching instruction unit 18 and a software switching unit 19 .

[0093] When the judgment unit 13 judges that the versions of the software of the vehicle-mounted devices A to D are inconsistent and the representative vehicle-mounted device A is in a state where it cannot communicate with the external server 2, the switching instruction unit 18 instructs each of the vehicle-mounted devices A to D to switch the execution target software from the current version of the software to the previous version of the software. When the switching instruction unit 18 instructs the vehicle-mounted devices A to D to switch the software, the user may be notified that the software is switched to the previous version through the display on the display unit or by sound.

[0094] When the switching instruction unit 18 instructs the switching of the software, the software switching unit 19 switches the execution target software from the current version of the software Sa_cur to the previous version of the software Sa_old. At the same time, the software switching unit 19 switches the consistency information used by the judgment unit 13 from the consistency table T_cur of the current version to the consistency table T_old of the previous version. When the power of the vehicle is turned on next time, the software switching unit 19 switches the software before the process of confirming the consistency of the versions of the software of the vehicle-mounted devices A to D.

[0095] In the case where the switching instruction unit 18 instructs the switching of the software, the version acquisition unit 12 and the judgment unit 13 confirm the consistency of the versions of the software of the vehicle-mounted devices A to D when the power of the vehicle is turned on. The processing performed by the version acquisition unit 12 and the judgment unit 13 is the same as the normal processing performed when the power is turned on. As a result of the processing, the version acquisition unit 12 acquires the versions of the software after switching from the other vehicle-mounted devices B to D. The judgment unit 13 confirms the consistency of the versions of the software by comparing the version of the software of the representative vehicle-mounted device A after switching and the versions of the software acquired from the other vehicle-mounted devices B to D after switching with the consistency table of the previous version.

[0096] Vehicle mounted devices B to D

[0097] The software storage unit 20 of the vehicle-mounted devices B, C, and D stores the current version of software Sb_cur, Sc_cur, and Sd_cur and the previous version of software Sb_old, Sc_old, and Sd_old as software for operating the vehicle-mounted devices B, C, and D. Moreover, in the vehicle-mounted devices B to D, the current version of software and the previous version of software are respectively stored in different storage areas of the software storage unit 20. When the software is updated, the previous version of software is deleted, the updated software is re-stored as the current version of software, and the current version of software is saved as the previous version of software. The previous version of software Sa_old to Sd_old is a combination of software used before the current version of software Sa_cur to Sd_cur, and is also a combination of software with version consistency.

[0098] Each of the vehicle-mounted devices B to D further includes a software switching unit 23. When the switching instruction unit 18 instructs the switching of the software, the software switching unit 23 switches the execution target software from the current version of the software Sb_cur, Sc_cur, Sd_cur to the previous version of the software Sb_old, Sc_old, Sd_old, respectively. When the power of the vehicle is turned on next time, the software switching unit 23 also switches the software before the process of confirming the consistency of the versions of the software of the vehicle-mounted devices A to D.

[0099] Control Processing

[0100] The following will be combined Figure 5 and Figure 6 A control process performed by a representative vehicle-mounted device A is described.

[0101] Figure 6 is a flowchart showing an example of a process for confirming consistency performed by a representative vehicle-mounted device in a vehicle control system according to the second embodiment. Figure 6 The control process shown.

[0102] Step S21: The software switching unit 19 determines whether the switching of the software is instructed before the power of the vehicle is turned on. In the case where an instruction is made in step S28 described later to switch the current version of the software of the vehicle-mounted devices A to D to the previous version of the software, step S21 is a judgment step required to perform the switching of the software when the power is turned on for the first time after the instruction is made. Whether the switching of the software is instructed before the power of the vehicle is turned on can be determined based on a flag set in the non-volatile storage area. When the judgment result in step S21 is "yes", the processing goes to step S22. Otherwise, the processing goes to step S23.

[0103] Step S22: When it is determined in step S21 that software switching is indicated, the software switching unit 19 switches the execution target software from the current version of the software Sa_cur to the previous version of the software Sa_old. The software switching unit 19 also switches the consistency information used by the judgment unit 13 from the consistency table T_cur of the current version to the consistency table T_old of the previous version.

[0104] Although illustration is omitted, in other vehicle-mounted devices instructed to switch software, the software switching unit 23 switches the execution target software from the current version of software to the previous version of software in parallel with the time when the software is switched in the representative vehicle-mounted device A.

[0105] Step S23: The version acquisition unit 12 acquires the versions of the software of the other vehicle-mounted devices B to D. Then, the process proceeds to step S24.

[0106] Step S24: The judgment unit 13 judges whether the software versions of the vehicle-mounted devices A to D are consistent by comparing the software version of the representative vehicle-mounted device A and the software versions obtained from the other vehicle-mounted devices B to D with the consistency table stored in the consistency information storage unit 11. When the judgment result in step S24 is "yes", the process goes to step S25. Otherwise, the process goes to step S26.

[0107] Step S25: The determination unit 13 permits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the determination unit ends the process.

[0108] Step S26: The sending unit 14 determines whether it is possible to communicate with the external server 2. The sending unit 14 can determine whether communication with the external server 2 is established based on, for example, the signal strength of the wireless signal received by the receiving unit 15. When the determination result in step S26 is "yes", the process goes to step S29. Otherwise, the process goes to step S27.

[0109] Step S27: The determination unit 13 prohibits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the process proceeds to step S28.

[0110] Step S28: The switching instruction unit 18 instructs the vehicle-mounted device that needs to switch the software from the current version to the previous version to switch the current version to the previous version. Then, the switching instruction unit 18 ends the process.

[0111] When the switching instruction unit 18 instructs the in-vehicle devices A to D to switch software, the representative in-vehicle device A can notify the user that the software is switched. The representative in-vehicle device A can also encourage the user to temporarily disconnect and then connect the power of the vehicle when preparations for the process of switching software are completed.

[0112] Step S29: The transmission unit 14 transmits version information including the version of the software of the representative vehicle-mounted device A and the versions of the software acquired from the other vehicle-mounted devices B to D to the external server 2. Then, the process proceeds to step S30.

[0113] Step S30: The receiving unit 15 determines whether the judgment result information is received from the external server 2. When the judgment result in step S30 is "yes", the process goes to step S31. Otherwise, after waiting for a predetermined time, the receiving unit 15 performs the judgment step of step S30 again. When the state in which the receiving unit 15 cannot receive the judgment result information from the external server 2 in step S30 continues for a predetermined time (timeout time), the receiving unit 15 determines that it is timeout, and ends the process of step S30. Then the process proceeds to step S31.

[0114] Step S31: The judgment unit 13 judges whether the versions of the software of the vehicle-mounted devices A to D are consistent based on the judgment result information received from the external server 2. When the judgment result in step S31 is "yes", the process goes to step S32. Otherwise, the process goes to step S34. When the receiving unit 15 judges the timeout in step S30, the judgment unit 13 judges that the versions of the software of the vehicle-mounted devices A to D are inconsistent.

[0115] Step S32: The determination unit 13 permits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the process proceeds to step S33.

[0116] Step S33: The consistency information updating unit 16 updates the consistency information stored in the consistency information storage unit 11. Then, the consistency information updating unit 16 ends the process.

[0117] Step S34: The determination unit 13 prohibits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the process proceeds to step S35.

[0118] Step S35: The update instruction unit 17 instructs the vehicle-mounted device storing the software of the version inconsistent with the consistency table stored in the consistency information storage unit 11 to perform software update. Then, the update instruction unit 17 ends the processing.

[0119] When the update indication unit 17 indicates a software update and the vehicle-mounted device to be updated completes reception of the updated software from the server 2, the user can be encouraged to temporarily disconnect and then reconnect the power of the vehicle in order to switch the execution target software from the current version of the software to the updated software.

[0120] Effect

[0121] In the vehicle control system 200 according to the present embodiment, as in the first embodiment, it is determined whether the versions of the software of the vehicle-mounted devices A to D are consistent when the power of the vehicle is turned on. This makes it possible to further reduce the possibility of performing unexpected vehicle control due to inconsistent versions of the software of the vehicle-mounted devices A to D.

[0122] Furthermore, in the vehicle control system 200 according to the present embodiment, each vehicle-mounted device stores a previous version of software, and the representative vehicle-mounted device A stores a consistency table of the previous version. Therefore, when the representative vehicle-mounted device A determines that the versions of the software of the vehicle-mounted devices A to D are inconsistent, but the representative vehicle-mounted device A and the external server 2 are not in a communicable state, it is possible to switch to the previous version of the software. According to this configuration, when the latest version of the software is inconsistent and the representative vehicle-mounted device A cannot communicate with the external server, the consistency of the versions of the software of the vehicle-mounted devices A to D can be ensured.

[0123] It is also possible to construct a vehicle control system in which the consistency information updating unit 16 or the update instruction unit 17 is updated from Figure 5 The functional block diagram of the representative vehicle-mounted device A is shown excluded.

[0124] Third embodiment

[0125] Configuration

[0126] Figure 7 is a schematic diagram for describing the background of the vehicle control system according to the third embodiment.

[0127] The vehicle-mounted devices A to D constituting the vehicle control system 300 have versions Sa to Sd ( Figure 7 The consistency of the software versions of the vehicle-mounted devices A to D may be affected because of the version mismatch caused by the replacement of the vehicle-mounted devices A to D or the replacement of the components (e.g., substrate) included in the vehicle-mounted devices A to D. For example, suppose that the vehicle-mounted device C fails ( Figure 7), and the faulty vehicle-mounted device C is replaced with a new vehicle-mounted device. As a result of the replacement, the version of the software Sc' of the new vehicle-mounted device C may be different from the version of the software Sc before the replacement ( Figure 7 ). In this case, the version of the software Sc' of the new vehicle-mounted device C does not have to be consistent with the version of the software of the vehicle-mounted devices A, B, and D. Based on the version of the software Sc', it may be difficult to confirm the software consistency of the vehicle-mounted devices A to D only through the consistency confirmation process performed by the representative vehicle-mounted device A. In the case where the vehicle is used in a place where there is no sufficient wireless communication environment (for example, underground or in a mountainous area), it is difficult to confirm the consistency through communication with an external server. This may lead to a situation where the vehicle control function implemented by the combination of vehicle-mounted devices A to D is assumed to be limited, or the software update is assumed to be time-consuming. Therefore, the convenience of the user may be deteriorated.

[0128] Under the assumption of these problems, the vehicle control system according to the third embodiment is characterized in that even when the vehicle-mounted devices A to D need to be repaired or replaced, the consistency of the versions of the software of the vehicle-mounted devices A to D can be quickly ensured. The following mainly describes the differences between this embodiment and the first embodiment.

[0129] Figure 8 is a functional block diagram of a vehicle control system according to a third embodiment.

[0130] Representative vehicle-mounted device A

[0131] In addition to the software storage unit 10 , consistency information storage unit 11 , version acquisition unit 12 , judgment unit 13 , sending unit 14 , and receiving unit 15 described in the first embodiment, the representative vehicle-mounted device A also includes a software acquisition unit 40 and a software update unit 41 .

[0132] When any one of the other on-board devices B to D fails and needs to be replaced or repaired, the software acquisition unit 40 acquires the current version of the software of the failed on-board device from the external server 2 and stores the acquired software when it is able to communicate with the external server 2. The software acquisition unit 40 can detect the occurrence of a failure of any one of the on-board devices B to D based on the failure notification output from the failed on-board device. Figure 7 and Figure 8An example is shown in which a vehicle-mounted device C fails. The software acquisition unit 40 acquires the software Sc of the vehicle-mounted device C that is consistent with the versions of the software Sa, Sb, Sd of the vehicle-mounted devices A, B, D from the external server 2, and stores the acquired software Sc. The version of the software acquired by the software acquisition unit 40 from the external server 2 can be acquired from the failed vehicle-mounted device C through communication, or can be acquired from the consistency table stored in the consistency information storage unit 11.

[0133] When the judgment unit 13 judges that the versions of the software of the vehicle-mounted devices A to D are inconsistent after the replacement or repair of the faulty vehicle-mounted device, and judges that the vehicle-mounted device storing the software of the version judged to be inconsistent with the consistency table is the replaced or repaired vehicle-mounted device, the software update unit 41 writes the software to be stored in the software acquisition unit 40 into the software storage unit 20 of the replaced or repaired vehicle-mounted device. Then, the software update unit 41 instructs the replaced or repaired vehicle-mounted device to switch the software.

[0134] In the case where the software update unit 41 instructs switching of the software, when the power of the vehicle is turned on next time, the version acquisition unit 12 and the judgment unit 13 confirm the consistency of the versions of the software of the vehicle-mounted devices A to D. The processing performed by the version acquisition unit 12 and the judgment unit 13 is the same as the normal processing performed when the power is turned on.

[0135] Vehicle mounted devices B to D

[0136] The vehicle-mounted devices B to D may also include a software switching unit 23 that is the same as the software switching unit described in the second embodiment. When the software update unit 41 instructs switching of software, the software switching unit 23 switches the execution target software from the current version of the software to the software written by the software update unit 41. When the power of the vehicle is turned on next time, the software switching unit 23 switches the software before the process of confirming the consistency of the versions of the software of the vehicle-mounted devices A to D.

[0137] Control Processing

[0138] The following will be combined Figures 8 to 10 A control process performed by a representative vehicle-mounted device A is described.

[0139] Fig. 9 is a flowchart showing an example of software acquisition processing executed by a representative vehicle-mounted device in the vehicle control system according to the third embodiment.

[0140] Step S41: The receiving unit 15 determines whether a failure notification is received from other vehicle-mounted devices B to D. When the determination result in step S41 is "Yes", the process goes to step S42. Otherwise, the receiving unit 15 ends this step.

[0141] Step S42: The software acquisition unit 40 acquires the current version of the software of the vehicle-mounted device from the external server 2 and stores the acquired software. Then, the software acquisition unit 40 ends the process.

[0142] Fig.10 is a flowchart showing an example of a process for confirming consistency performed by a representative vehicle-mounted device in a vehicle control system according to the third embodiment. Fig.10 The control process shown.

[0143] Step S51: The version acquisition unit 12 acquires the versions of the software of the other vehicle-mounted devices B to D. Then, the process proceeds to step S52.

[0144] Step S52: The judgment unit 13 judges whether the software versions of the vehicle-mounted devices A to D are consistent by comparing the software version of the representative vehicle-mounted device A and the software versions of the other vehicle-mounted devices B to D with the consistency table stored in the consistency information storage unit 11. When the judgment result in step S52 is "yes", the process goes to step S53. Otherwise, the process goes to step S54.

[0145] Step S53: The judgment unit 13 permits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the judgment unit 13 ends the process.

[0146] Step S54: The determination unit 13 determines whether the vehicle-mounted device having the software version inconsistent with the consistency table is a replaced or repaired vehicle-mounted device. Fig. 9 The failure notification received in step S41 can identify whether the vehicle-mounted device has been replaced or repaired. When the determination result in step S54 is "yes", the process proceeds to step S55. Otherwise, the process proceeds to step S56.

[0147] Step S55: The software update unit 41 writes the software to be stored in the software acquisition unit 40 into the specific area of ​​the software storage unit 20 of the replaced or repaired vehicle-mounted device. Then, the software update unit 41 instructs the replaced or repaired vehicle-mounted device to update the software. Then, the process ends.

[0148] Step S56: The determination unit 13 prohibits execution of vehicle control using the combination of the vehicle-mounted devices A to D. Then, the determination unit 13 ends the process.

[0149] When the software update unit 41 instructs switching of software, the user may be encouraged to temporarily disconnect and then connect the power of the vehicle again in order to switch the execution target software of the replaced or repaired vehicle-mounted device from the current version of the software to the updated software. The representative vehicle-mounted device A may temporarily disconnect and then connect the power of the vehicle-mounted device instructed by the software update unit 41 to switch software again. In the vehicle-mounted device instructed by the software update unit 41 to switch software, the software switching unit 23 switches the execution target software to the software written to the software storage unit 20 by the software update unit 41 when the power is turned on next time.

[0150] Effect

[0151] In the vehicle control system 300 according to the present embodiment, as in the first embodiment, it is determined whether the versions of the software of the vehicle-mounted devices A to D are consistent when the power of the vehicle is turned on. This makes it possible to further reduce the possibility of performing unexpected vehicle control due to inconsistent versions of the software of the vehicle-mounted devices A to D.

[0152] Furthermore, in the vehicle control system 300 according to the present embodiment, when the vehicle-mounted devices B to D need to be replaced or repaired due to a fault, the representative vehicle-mounted device A obtains the software of the faulty vehicle-mounted device that has been confirmed to be consistent in advance from the external server 2. After the faulty vehicle-mounted device is replaced or repaired, when the version of the software of the replaced or repaired vehicle-mounted device is inconsistent with the consistency table, the representative vehicle-mounted device A switches the inconsistent software with the software obtained from the external server 2 in advance. Therefore, even when the versions of the software of the vehicle-mounted devices A to D are inconsistent due to the replacement or repair of the vehicle-mounted devices, and there is no sufficient wireless communication environment, the vehicle-mounted devices A to D can be quickly restored to a consistent state. Therefore, the limitation on the vehicle control function realized by the combination of the vehicle-mounted devices A to D can be eliminated at an early stage, so the convenience of the user can be improved.

[0153] The method for confirming software consistency according to the third embodiment can be combined with the vehicle control system 100 according to the first embodiment or the vehicle control system 200 according to the second embodiment. Specifically, the vehicle control system 100 according to the first embodiment or the vehicle control system 200 according to the second embodiment can also include a software acquisition unit 40 and a software update unit 41, and the representative vehicle-mounted device A is configured to be able to perform Fig. 9 The processing of steps S41 and S42 shown in Fig.10 After the initial check that the judgment unit 13 judges that the software version is inconsistent, and before the external server 2 performs a secondary check, it is preferably performed Fig.10, is the processing of steps S54 and S55 shown. With this configuration, consistency is determined preferentially using information stored in the representative vehicle-mounted device A, and when it is difficult to make a determination only by the representative vehicle-mounted device A, a secondary check in the external server 2 is performed. Therefore, the process of determining software consistency can be performed efficiently without communication. When there is a step of determining whether communication between the vehicle and the external server 2 is possible ( Figure 6 S26), and the vehicle cannot communicate with the external server 2, it can be executed Fig.10 Processing of steps S54 and S55 in .

[0154] Other changes

[0155] The processing of each step can be realized by using a dedicated circuit or by causing a computer (e.g., an ECU having a processor, a read-only memory (ROM), a random access memory (RAM), a hard disk, etc.) to execute the processing. Figure 4 , Figure 6 , Fig. 9 and Fig.10 When the computer (such as ECU) executes Figure 4 , Figure 6 , Fig. 9 and Fig.10 When a control process is performed, a program described as being capable of performing the control process may be pre-stored in a storage device (such as a ROM or a hard disk) so that the program can be read from the storage device and executed by a processor included in the computer.

[0156] In the above-mentioned embodiment, one of the vehicle-mounted devices providing the control function of the vehicle control system confirms the consistency of the software version as a representative vehicle-mounted device. However, the above-mentioned control process may be performed by a vehicle-mounted device dedicated to confirming the consistency of the software version.

[0157] The present invention can be used in a vehicle control system that realizes a specific vehicle control function by combining a plurality of vehicle-mounted devices.

Claims

1. Devices installed on vehicles, It is characterized in that include: A first instruction unit configured to execute a switching instruction for switching software installed on a plurality of vehicle-mounted devices; an acquisition unit configured to acquire version information of software that has been switched of the plurality of vehicle-mounted devices in response to the switching instruction; a confirmation unit configured to confirm whether the versions of the software installed on the plurality of vehicle-mounted devices are consistent based on the version information acquired by the acquisition unit; as well as A notification unit is configured to notify a user that the plurality of vehicle-mounted devices restore the switched software to the software before switching based on the confirmation that the versions of the software installed on the plurality of vehicle-mounted devices do not have consistency.

2. The device according to claim 1, It is characterized in that The notification unit is configured to notify the user through a display on a display unit that the plurality of vehicle-mounted devices restore the switched software to the software before the switching.

3. The device according to claim 1, It is characterized in that The system further includes a second instruction unit configured to instruct the plurality of vehicle-mounted devices to restore the switched software to the software before the switching based on the confirmation that the versions of the software installed on the plurality of vehicle-mounted devices are inconsistent.

4. The device according to claim 3, It is characterized in that The system further includes a storage unit, the storage unit storing a combination of versions of software allowed to be executed before switching and a combination of versions of switched software allowed to be executed, wherein after the second instruction unit instructs to restore the switched software to the software before switching: The acquisition unit is configured to acquire version information of software of the plurality of vehicle-mounted devices; and The confirmation unit is configured to confirm whether the versions of the software installed on the plurality of vehicle-mounted devices have consistency by comparing the version information acquired by the acquisition unit with a combination of versions of the execution-permitted software before the switching.

5. The device according to claim 3, It is characterized in that It also includes a sending unit, which is configured to send the version information acquired by the acquisition unit; wherein the second instruction unit is configured to instruct the multiple vehicle-mounted devices to restore the switched software to the software before switching when i) the confirmation unit confirms that the versions of the switched software installed on the multiple vehicle-mounted devices are inconsistent and ii) the sending unit is unable to communicate with the external server.

6. The device according to claim 5, It is characterized in that The method further includes a receiving unit configured to receive, from the external server, confirmation result information confirmed by the external server based on the version information sent by the sending unit, the confirmation result information indicating whether the versions of the software installed on the plurality of vehicle-mounted devices are consistent, wherein when iii) the confirmation unit confirms that the versions of the switched software installed on the plurality of vehicle-mounted devices are inconsistent and iv) the sending unit is able to communicate with the external server, The sending unit is configured to send the version information acquired by the acquiring unit to the external server, The receiving unit is configured to receive the confirmation result information from the external server, and The confirmation unit is configured to confirm whether versions of the software installed on the plurality of vehicle-mounted devices have consistency based on the confirmation result information received by the receiving unit.

7. The device according to any one of claims 1 to 6, It is characterized in that The confirmation unit is configured to allow execution of predetermined vehicle control implemented by the plurality of vehicle-mounted devices when the confirmation unit confirms that versions of the software installed on the plurality of vehicle-mounted devices have consistency.

8. Vehicles, It is characterized in that Comprising the device according to claim 1.

9. A method performed by a computer included in a device installed on a vehicle, It is characterized in that The method comprises: executing a switching instruction for switching software installed on a plurality of vehicle-mounted devices; acquiring version information of software that has been switched of the plurality of vehicle-mounted devices in response to the switching instruction; Based on the obtained version information, confirm whether the versions of the software installed on the plurality of vehicle-mounted devices are consistent; and Based on the confirmation that the versions of the software installed on the plurality of vehicle-mounted devices do not have consistency, the plurality of vehicle-mounted devices are notified to restore the switched software to the software before the switching to the user.

10. A program executable by a computer included in a device mounted on a vehicle, the program causing the computer to execute functions including: executing a switching instruction for switching software installed on a plurality of vehicle-mounted devices; acquiring version information of software that has been switched of the plurality of vehicle-mounted devices in response to the switching instruction; Based on the obtained version information, confirm whether the versions of the software installed on the plurality of vehicle-mounted devices are consistent; as well as Based on the confirmation that the versions of the software installed on the plurality of vehicle-mounted devices do not have consistency, the plurality of vehicle-mounted devices are notified to restore the switched software to the software before the switching to the user.

Images