Software update device, software update method, non-temporary storage medium storing program, vehicle, and OTA host

Abstract

A software update device is provided with: a communication unit that requests a center to download update data; a storage unit that stores the downloaded update data; and a control unit that, on the basis of the update data, performs control for installing or installing and activating update software in one or more target electronic control units among the plurality of electronic control units connected via the in-vehicle network, and acquires software versions of the plurality of electronic control units. A determination is made as to whether or not the acquired combination of software versions has consistency, and if it is determined that there is no consistency, processing is performed for acquiring the consistency of the combination of software versions.

Description

Divisional Application Statement This application is a divisional application of a Chinese patent application titled "Software Update Device, Software Update Method, Non-Temporary Storage Medium Storing Program, Vehicle, and OTA Host", with the application number 202110763433.2, which was filed on July 6, 2021. Technical Field

[0001] The present invention relates to a software update device, a software update method, a non-temporary storage medium storing a program, a vehicle, and an OTA host for updating a program of in-vehicle devices mounted on a vehicle. Background Art

[0002] A network system is mounted on a vehicle, in which a plurality of in-vehicle devices called ECUs (Electronic Control Units) are connected to each other via a communication line. Each in-vehicle device sends and receives messages to and from each other and shares the execution of various functions of the vehicle.

[0003] Generally, an in-vehicle device includes a processor, a temporary storage unit such as a RAM, and a non-volatile storage unit such as a flash ROM. Programs (software) executed by the processor are stored in the non-volatile storage unit. By rewriting and updating the programs to a newer version, improvement and enhancement of the functions of the in-vehicle devices can be achieved.

[0004] In the update of a program, there are steps of downloading update data received from an external device (center) via wireless communication or the like, and steps of installing an update program (update software) by writing the downloaded update data into the storage unit of the in-vehicle device. In the installation, depending on the specifications of the in-vehicle device, there is an overwrite installation in which the downloaded update program is written over the current program (old program) into a region (single-sided: single library) determined as a program storage region in the storage region, and an other-side installation in which writing is performed in a region (the other side) of two regions (double-sided: double library) determined as program storage regions and not in the region (one side) storing the current program (old program).

[0005] In the case of the other-side installation, in the steps of program update, in addition to the steps of downloading and installation, there is also a step of configuring set values such as the start address of the update program, etc., so as to activate the installed update program as an execution version.

[0006] Regarding the program update of the ECU, Japanese Unexamined Patent Application Publication No. 2009-53920 discloses a system for updating the program of the ECU by a version upgrade program transmitted from a server. In the system of Japanese Unexamined Patent Application Publication No. 2009-53920, when updating the program of the ECU, the consistency of the version of the updated program with the versions of the programs of other ECUs is confirmed to suppress the inconsistency based on the updated version.

[0007] Japanese Unexamined Patent Application Publication No. 2016-16835 discloses that each ECU has a backup area for the program. Before implementing the update for the version upgrade program, the current program is saved as the old program in the backup area. When an operation abnormality occurs in the ECU after the update for the version upgrade program, the ECU is returned to the normal operation state before the update by using the old program saved in the backup area. Summary of the Invention

[0008] In order for the network system to work properly, the combination of the versions of the programs of multiple ECUs must be a combination that guarantees operation in advance (a consistent combination). Therefore, in the case of program update failure or when the user wishes to downgrade, it is desired not only to return the program of a specific ECU to the old version, but also to shift to a state where the consistency of the versions of the programs of multiple in-vehicle devices is achieved and the operation is guaranteed.

[0009] The present invention provides a software update device, a software update method, a non-temporary storage medium storing a program, a vehicle, and an OTA host that can shift to a state where the consistency of the versions of the programs of multiple in-vehicle devices is achieved and the operation is guaranteed during the program update of the in-vehicle devices.

[0010] The software update device according to the first aspect of the present invention includes: a communication unit configured to request the center to download update data; a storage unit configured to save the downloaded update data; and a control unit configured to, based on the update data, execute control for installing or installing and activating update software in one or more target electronic control units connected via an in-vehicle network. The control unit is configured to obtain the software versions of the multiple electronic control units, determine whether the combination of the obtained software versions is consistent, and when it is determined that the combination is not consistent, perform processing for achieving the consistency of the combination of the software versions.

[0011] In the above first aspect, the control unit is configured to restrict a specified operation of the vehicle at least during the period of performing the processing for achieving the consistency.

[0012] In the first mode described above, the control unit is configured to start restricting a specified operation of the vehicle before performing control for installation or activation, obtain a combination of the software versions of the plurality of electronic control units after the process for obtaining the conformity, and release the restriction on the specified operation of the vehicle when the obtained combination is in conformity.

[0013] In the first mode described above, the control unit is configured to identify, as a process for obtaining the conformity, the electronic control unit that causes non-conformity among the plurality of electronic control units, and update the software of the electronic control unit that causes non-conformity according to the data for updating the software of the electronic control unit that causes non-conformity in the update data.

[0014] In the first mode described above, the control unit is configured to identify the electronic control unit that causes non-conformity based on the combination of the software versions.

[0015] In the first mode described above, the control unit is configured to identify, as a process for obtaining the conformity, the electronic control unit that causes non-conformity among the plurality of electronic control units, and control the electronic control unit that causes non-conformity in such a manner that the software before the update is used as the execution version.

[0016] In the first mode described above, the control unit is configured to control the electronic control unit that causes non-conformity in such a manner that the stored software before the update is used as the execution version when the electronic control unit that causes non-conformity stores the software before the update.

[0017] In the first mode described above, the control unit is configured to control the electronic control unit that causes non-conformity in such a manner that the software before the update is used as the execution version when the version of the software of the electronic control unit that causes non-conformity is set to the version before the update and the combination of the versions is in conformity.

[0018] In the first mode described above, the control unit is configured to obtain the software versions of the plurality of electronic control units when a designation to use the software before the update as the execution version is received for the electronic control unit that stores the software before the update, and control the electronic control unit in such a manner that the software before the update is used as the execution version when the combination of the obtained versions is in conformity even if the version of the software of the designated electronic control unit is set to the version before the update.

[0019] In the first mode described above, the functions of the control unit are implemented by software of two or more of the plurality of electronic control units, or are implemented by software different from the software to be updated in one electronic control unit.

[0020] A second mode of the present invention is a software update method executed by a computer of a software update device. The software update method includes: a step of requesting the center to download update data; a step of saving the downloaded update data; a step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units connected via a vehicle network; obtaining software versions of the plurality of electronic control units, determining whether a combination of the obtained software versions is consistent, and, in a case where it is determined that the combination is not consistent, implementing a process for obtaining consistency of the combination of the software versions.

[0021] A third mode of the present invention is a non-transitory storage medium storing a program capable of being executed by a computer of a software update device and causing the computer to execute the following functions. The functions of the non-transitory storage medium include: a step of requesting the center to download update data; a step of saving the downloaded update data; a step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units connected via a vehicle network; obtaining software versions of the plurality of electronic control units, determining whether a combination of the obtained software versions is consistent, and, in a case where it is determined that the combination is not consistent, implementing a process for obtaining consistency of the combination of the software versions.

[0022] A fourth mode of the present invention is a vehicle having the software update device.

[0023] According to a fifth mode of the present invention, an OTA host includes: a communication unit configured to request the center to download update data; a storage unit configured to save the downloaded update data; a control unit configured to, according to the update data, execute control for installing or installing and activating updated software in one or more target electronic control units connected via a vehicle network, the control unit being configured to obtain software versions of the plurality of electronic control units, determine whether a combination of the obtained software versions is consistent, and, in a case where it is determined that the combination is not consistent, implement a process for obtaining consistency of the combination of the software versions.

[0024] A sixth aspect of the present invention is a software update method executed by a computer of an OTA host. The software update method includes: a step of requesting the center to download update data; a step of saving the downloaded update data; a step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units among a plurality of electronic control units connected via a vehicle network; obtaining software versions of the plurality of electronic control units, determining whether combinations of the obtained software versions are consistent, and in a case where it is determined that they are not consistent, implementing a process for obtaining consistency of the combinations of the software versions.

[0025] A seventh aspect of the present invention is a non - temporary storage medium that stores a program capable of being executed by a computer of an OTA host and causing the computer to execute the following functions. The functions of the non - temporary storage medium include: a step of requesting the center to download update data; a step of saving the downloaded update data; a step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units among a plurality of electronic control units connected via a vehicle network; obtaining software versions of the plurality of electronic control units, determining whether combinations of the obtained software versions are consistent, and in a case where it is determined that they are not consistent, implementing a process for obtaining consistency of the combinations of the software versions.

[0026] According to each aspect of the present invention, in the program update of in - vehicle devices, the consistency of combinations of versions of programs for a plurality of in - vehicle devices is confirmed. Therefore, the consistency of the versions of the programs of the plurality of in - vehicle devices as a whole can be obtained, and it is possible to migrate to a state where the operation of the network system is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Hereinafter, with reference to the drawings, features, advantages, and technical and industrial significance of exemplary embodiments of the present invention will be described. In the drawings, the same reference numerals denote the same elements. Figure 1 It is a structural diagram of a network system according to an embodiment. Figure 2 It is a flowchart showing a process according to an embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS Embodiment Structure

[0028] Figure 1It is a structural diagram of the network system 1 involved in this embodiment. The network system 1 is mounted on a vehicle. The network system 1 includes a software update device 50. Multiple buses 10, 20, 30... are connected to the software update device (OTA host) 50. Multiple in-vehicle devices (electronic control units) 11, 12... are connected to the bus 10. Multiple in-vehicle devices 21, 22... are connected to the bus 20. Multiple actuators 31, 32... are connected to the bus 30. In Figure 1 In the following description and later, as buses, buses 10, 20, 30 are exemplified, as in-vehicle devices, in-vehicle devices 11, 12, 21, 22 are exemplified, and actuators 31, 32 are exemplified, but the numbers of buses, in-vehicle devices, and actuators are not limited.

[0029] The software update device 50 includes a communication unit (communication module) 51 capable of communicating with an external device 100 (center) provided outside the vehicle, and a control unit 52 that controls the update of the programs of the respective in-vehicle devices 11, 12, 21, 22 based on update data provided from the external device 100. The software update device 50 is typically a computer including a non-volatile storage unit (memory) such as a flash ROM, a processor that performs various processes by reading and executing a program from the non-volatile storage unit, and a temporary storage unit such as a RAM that stores a part of the program and data. The software update device 50 also controls and relays the communication between the external device 100 and the respective in-vehicle devices 11, 12, 21, 22, the communication between the respective in-vehicle devices 11, 12, 21, 22, and the communication between the respective in-vehicle devices 11, 12, 21, 22 and the respective actuators 31, 32 via the respective buses 10, 20, 30. In this way, the software update device 50 also functions as a relay device that relays communication.

[0030] The respective in-vehicle devices 11, 12, 21, 22 communicate with each other and perform various processes for controlling the vehicle. These in-vehicle devices 11, 12, 21, 22 are typically computers having a storage unit (memory) and a processor, similar to the update device 50.

[0031] The actuators 31, 32 are devices that exert a mechanical action on a vehicle or its components such as a brake, an engine, or a power steering device, and operate according to instructions from the in-vehicle devices 11, 12, 21, 22.

[0032] The control unit 52 of the software update device 50 can update the programs stored in the storage units of the in-vehicle devices 11, 12, 21, and 22 respectively. That is, the software update device 50 performs download control, installation control, or further activation control. Regarding download, it is a process of receiving and storing update data (distribution package) for updating any one of the in-vehicle devices 11, 12, 21, and 22 sent from the external device 100. The control of download not only includes the execution of download, but also can include the control of a series of processes related to download such as the judgment of whether the download can be executed and the verification of update data. Regarding installation, it is a process of writing an updated version of the program (updated software) into the storage unit of the in-vehicle device to be updated according to the downloaded update data. The control of installation not only includes the execution of installation, but also can include the control of a series of processes related to installation such as the judgment of whether the installation can be executed, the forwarding of update data, and the verification of the updated version of the program. Regarding activation, it is a process of activating (validating) the installed updated version of the program. The control of activation can not only include the execution of activation, but also can include the control of a series of controls related to activation such as the judgment of whether the activation can be executed and the verification of the execution result.

[0033] In the control of installation, when the update data includes the update program itself, the control unit 52 can send the update program to the in-vehicle devices 11, 12, 21, and 22. In addition, when the update data includes compressed data, differential data, or segmented data of the update program, the control unit 52 can also perform decompression or assembly of the update data to generate an update program and send it to the in-vehicle devices 11, 12, 21, and 22. Alternatively, the control unit 52 can send the update data to the in-vehicle devices 11, 12, 21, and 22, and the in-vehicle devices 11, 12, 21, and 22 perform decompression or assembly of the update data to generate an update program.

[0034] Regarding the execution of the installation itself of writing the update program into the second storage unit of the in-vehicle device, it can be implemented by the control unit 52, or by the in-vehicle device that has received the instruction from the control unit 52. The in-vehicle device that has received the update data (or update program) can also perform it autonomously without an explicit instruction from the control unit 52.

[0035] Regarding the execution of the activation itself of validating the installed update program, it can be implemented by the control unit 52, or by the in-vehicle device that has received the instruction from the control unit 52. The in-vehicle device can also perform it autonomously after installation without an explicit instruction from the control unit 52.

[0036] In addition, such a program update process can be performed continuously or in parallel for each of the multiple in-vehicle devices 11, 12, 21, and 22. Processing

[0037] Next, an example of the processing of this embodiment will be described. Figure 2 This is a flowchart showing an example of the software update process implemented by the software update device 50. This process starts, for example, when the software update device 50 requests update data from the external device 100.

[0038] (Step S101) The communication unit 51 receives update data for updating one or more programs in the in-vehicle devices of the vehicle from the external device 100. The control unit 52 stores (downloads) the update data in the storage unit of the software update device 50.

[0039] Based on the inquiry from the software update device 50, the external device 100 determines whether the updated version programs of these in-vehicle devices exist in the programs provided to the external device 100 according to the types of in-vehicle devices included in the network system 1 and the current program versions pre-stored in the external device 100 or obtained from the software update device 50. If the updated version programs are provided, the external device 100 generates update data according to the provided updated version programs and provides them to the software update device 50. When the update of all programs based on the update data is successful, the external device 100 generates update data in such a way as to achieve consistency in the versions of the programs of all in-vehicle devices included in the network system 1.

[0040] (Step S102) The control unit 52 restricts the operation of the vehicle. For example, during the above-mentioned overwriting installation and activation of the in-vehicle device, it may affect the operation of the in-vehicle device and also affect the control of the vehicle based on the network system 1. Therefore, in this step, it is also possible to stop or prohibit the specified operations of the vehicle, such as engine driving, which are determined not to want to have an impact, and suppress unexpected behaviors. In addition, the control unit 52 can also make the restriction of such specified operations and the subsequent processing standby until user approval is obtained. In addition, if all the in-vehicle devices whose programs are to be updated are of the above-mentioned dual-library type, the control unit 52 can also implement the restriction of the specified operations after the above-mentioned installation on the other side and before activation.

[0041] (Step S103) The control unit 52 controls the communication unit 51 to cause the in-vehicle device whose program is to be updated to execute the above-mentioned installation, activation, etc. according to the update data. That is, when the in-vehicle device is of the above-mentioned single-library type, the control unit 52 causes the in-vehicle device to execute the above-mentioned overwriting installation. In addition, when the in-vehicle device is of the above-mentioned dual-library type, the control unit 52 causes the in-vehicle device to sequentially execute the above-mentioned installation on the other side and activation.

[0042] (Step S104) The control unit 52 obtains, via the communication unit 51, information indicating the version of the current program from each in-vehicle device.

[0043] (Step S105) The control unit 52 determines the consistency of the obtained version combination. For example, if all of the versions included in the obtained versions are the versions of the programs included in the update data, the control unit 52 can determine that there is consistency. Otherwise, the control unit 52 can determine that an abnormality has occurred for some reason during or after the program update process in a certain in-vehicle device. In the case of successful update, proceed to step S109; otherwise, proceed to step S106.

[0044] (Step S106) The control unit 52, for example, compares the obtained version combination with the versions of the programs included in the update data and determines the in-vehicle device that causes the lack of version consistency.

[0045] (Step S107) The control unit 52 repeatedly performs the same process as step S103 for each in-vehicle device that causes the lack of consistency and attempts to update again. Alternatively, in the case where the in-vehicle device that causes the lack of consistency is an in-vehicle device (dual library) that performs the above-mentioned other-side installation and stores the program before the update (the program that has been the execution target so far), the control unit 52 can also cause the in-vehicle device to perform the process of configuring the settings (recovery process) so that the program before the update continues to be the execution target. Even as the program before the update, there are many cases where consistency is achieved with respect to the versions of the programs of other in-vehicle devices. In the case of performing such a recovery process, the control unit 52 obtains the versions of the programs of multiple in-vehicle devices. In the obtained version combination, even if the version of the program of the in-vehicle device for which the recovery process is performed is set to the program version before the program update, after confirming that the version combination has consistency, the in-vehicle device can be caused to perform the recovery process.

[0046] (Step S108) Similarly to step S104, the control unit 52 obtains information indicating the version of the current program from each in-vehicle device, and confirms the consistency of the combination of the versions of the current program. Regarding the confirmation of consistency, for example, if all of the versions included in the obtained versions are the versions of the updated programs included in the update data, it can be determined that the update was successful. In addition, in the case where recovery processing has been performed on several in-vehicle devices, the combination of the versions of the current program may also be sent to the external device 100 to inquire whether there is consistency. The external device 100 can refer to a table of multiple combinations of versions that have obtained consistency provided in advance to determine whether such a combination of program versions has consistency. Alternatively, the control unit 52 may also obtain and store such a table from the external device 100 together with the update data in advance, and confirm the consistency of the combination of the versions of the current program with reference to this table.

[0047] In addition, in this step, in the case where it is not possible to confirm the consistency of the combination of the versions of the current program, the control unit 52 may repeat steps S107 and S108 until it can be confirmed. For example, in the case where it is not possible to confirm consistency after repeatedly attempting to update multiple times, the control unit 52 may cause the in-vehicle device to perform recovery processing. In addition, in the case where it is not possible to confirm consistency even after repeating steps S107 and S108 a specified number of times, it is possible that a non-temporary abnormality has occurred in the software update device 50 or the in-vehicle device, recovery processing has been performed, but as a result, its version is not consistent with the updated program versions of other in-vehicle devices. Therefore, the control unit 52 implements measures such as notifying the user of the occurrence of the abnormality. In addition, when such an abnormality occurs, in the case where the programs before the update are stored in all of the in-vehicle devices, it is also possible to cause all of the in-vehicle devices to perform recovery processing.

[0048] (Step S109) The control unit 52 releases the action restriction of the vehicle implemented in step S102. Thus, the process ends. In addition, in the above installation process, in the case where the update data includes the update program itself, the control unit 52 sends the update program to the in-vehicle device. In addition, in the case where the update data includes compressed data, differential data, or split data of the update program, the control unit 52 may also perform decompression or assembly of the update data, etc. to generate an update program, and send it to the in-vehicle device. Alternatively, the control unit 52 may send the update data to the in-vehicle device, and the in-vehicle device performs decompression or assembly of the update data, etc. to generate an update program. In addition, the external device 100 and the software update device 50 may also explicitly give instructions to the in-vehicle device to perform installation and activation, and the in-vehicle device performs these processes according to the instructions. The in-vehicle device that has received the update data (or the update program) may also perform these processes autonomously without explicit instructions.

[0049] As described above, in this embodiment, the update process is not completed and the vehicle's behavior is restricted until the consistency of the combination of program versions of each vehicle-mounted device is confirmed. Therefore, in the event of a program update failure, unexpected behavior of the vehicle can be suppressed while achieving version consistency.

[0050] In addition, even if a program update fails temporarily, you can increase the likelihood of eventual success by trying the update again.

[0051] Furthermore, even if the program update fails, the program before the update can be used on the premise that the consistency of the combination of the program versions of each vehicle-mounted device can be confirmed, so the operation of the network system 1 can be guaranteed.

[0052] In addition, after the program is successfully updated, the user may want to return to the program before the update for a specific vehicle-mounted device. In such a case, the control unit 52 can also accept the designation from the user for the vehicle-mounted device and return to the program before the update of the vehicle-mounted device. In the case where the vehicle-mounted device stores the program before the update, such processing can be performed by configuring the settings in a manner that uses the program before the update as the execution version. In this case, the control unit 52 obtains the versions of the programs of multiple vehicle-mounted devices, and in the combination of the obtained versions, even if the version of the program of the designated vehicle-mounted device is set to the version of the program before the program update, the configuration is performed when it can be confirmed that the combination of versions is consistent. Thus, according to the user's wishes, the program can be downgraded on the premise that the consistency of the combination of program versions of each vehicle-mounted device can be confirmed. In addition, during this processing, it is preferred that the control unit 52 executes the prescribed action of the vehicle in a restricted manner, and lifts the restriction after the consistency of the same version as step S108 can be confirmed.

[0053] As described above, when the combination of the versions of the programs obtained after the installation program (in the case of a single library) or the execution of installation and activation (in the case of a dual library) is not consistent, there is an error in the process of updating the program in any in-vehicle device, or even if there is no error in the processes of installation and activation, for example, there are some incompletions in the program provided as the updated version program, resulting in some abnormalities. As a result, the control unit 52 determines that it is not possible to notify the control unit 52 of the version of the program. The control unit 52 identifies this in-vehicle device as the in-vehicle device that causes the inconsistency of the version. In this way, in the present embodiment, not only in the process of updating the program in this manner, but also in the subsequent processes, even if some abnormality occurs in the in-vehicle device and the result is the inconsistency of the version, for example, if the in-vehicle device is of the dual-library type and stores the program before the update, it is also possible to restore to the state before the abnormality occurred and the combination of the versions of the programs is consistent. Thus, even if some abnormality occurs after the program update, there is no need to spend time and cost in judging whether there are incompletions in the program, and it is possible to reliably and quickly restore to the normal state where the operation is guaranteed. In addition, in the control unit 52, in addition to the version of the program, one or more other methods such as the result of the self-diagnosis of the in-vehicle device and the operation monitoring of the in-vehicle device by the control unit 52 can also be used to judge whether there are errors in the installation and activation of the program or incompletions in the program in each in-vehicle device, etc., which are caused by or accompanied by the program update and result in the in-vehicle device becoming the cause of the inconsistency of the version. The judgment method is not limited.

[0054] As described above, an example of the embodiment has been described, but the function of the control unit 52 can also be set in any in-vehicle device. For example, it can be installed in the programs of two or more in-vehicle devices that can be respectively installed in multiple in-vehicle devices, or it can also be installed in a program separately provided from the program to be updated in one in-vehicle device. In this way, a dedicated structure for the function of the control unit 52 may not be provided. In addition, when the function of the control unit 52 is respectively installed in the programs of two or more in-vehicle devices among multiple in-vehicle devices, when updating the program of one of the in-vehicle devices, the other in-vehicle device can execute the function of the control unit 52. Or, when installed in a program separately provided from the program to be updated in one in-vehicle device, when updating the program of this in-vehicle device, the in-vehicle device can execute the function of the control unit 52 without being hindered by this process. Effect

[0055] As described above, in the present embodiment, the software update device confirms the consistency of the combination of the versions of the programs of each in-vehicle device. Therefore, through the program update process, it is possible to transfer to the state where the consistency of the versions of the programs of multiple in-vehicle devices is achieved and the operation is guaranteed.

[0056] The technology of the present invention can be understood not only as a software update device, but also as a network system including the software update device, a method, a program executed by a computer of the software update device, a computer-readable non-transitory storage medium storing the program, a vehicle having the software update device, and the like.

[0057] The technology of the present invention is beneficial to a software update device for updating a program of in-vehicle equipment mounted on a vehicle.

Claims

1. A software update device, characterized in that, comprising: a communication unit configured to request the center to download updated data; a storage unit configured to save the downloaded updated data; a control unit configured to, based on the updated data, perform control to install or install and activate updated software in one or more target electronic control units connected via a vehicle network; the control unit is configured to, after the updated software is installed or installed and activated in the target electronic control unit, obtain the software versions of the plurality of electronic control units, determine whether the combination of the obtained software versions is consistent, and if it is determined that the combination is not consistent, perform a process a specified number of times to obtain the consistency of the combination of the software versions; the control unit further notifies the user of an abnormality when the consistency of the combination of the software versions cannot be obtained even after the process of the specified number of times is performed.

2. The software update device according to claim 1, wherein: the control unit is configured to restrict a specified operation of the vehicle at least during the process of obtaining the consistency.

3. The software update device according to claim 2, wherein: the control unit is configured to start restricting the specified operation of the vehicle before performing the control of installation or activation, obtain the combination of the software versions of the plurality of electronic control units after the process of obtaining the consistency, and release the restriction on the specified operation of the vehicle when the obtained combination is consistent.

4. The software update device according to claim 1, wherein: the control unit is configured to determine the electronic control unit that causes the lack of consistency among the plurality of electronic control units as a process for obtaining the consistency, and update the software of the electronic control unit that causes the lack of consistency according to the data for updating the software of the electronic control unit that causes the lack of consistency in the updated data.

5. The software update device according to claim 4, wherein: the control unit is configured to determine the electronic control unit that causes the lack of consistency based on the combination of the software versions.

6. The software update device according to claim 1, wherein: the control unit is configured to determine the electronic control unit that causes the lack of consistency among the plurality of electronic control units as a process for obtaining the consistency, and control the electronic control unit that causes the lack of consistency so that the software before the update is used as the execution version.

7. The software update device according to claim 6, wherein: the control unit is configured to, when the electronic control unit that causes the lack of consistency stores the software before the update, control the electronic control unit that causes the lack of consistency so that the stored software before the update is used as the execution version.

8. The software update device according to claim 6, wherein: the control unit is configured to, when the version of the software of the electronic control unit that causes the lack of the consistency is set to the pre-update version, and when the combination of the versions is consistent, control the electronic control unit that causes the lack of the consistency so that the pre-update software is used as the execution version.

9. The software update device according to claim 7, wherein: the control unit is configured to, when the version of the software of the electronic control unit that causes the lack of the consistency is set to the pre-update version, and when the combination of the versions is consistent, control the electronic control unit that causes the lack of the consistency so that the pre-update software is used as the execution version.

10. The software update device according to any one of claims 1 to 9, wherein: the control unit is configured to, when it receives a designation to use the pre-update software as the execution version for the electronic control unit storing the pre-update software, obtain the versions of the software of the plurality of electronic control units, and when, in the obtained combination of the versions, the combination of the versions remains consistent even if the version of the software of the designated electronic control unit is set to the version of the pre-update software, control the electronic control unit so that the pre-update software is used as the execution version.

11. The software update device according to any one of claims 1 to 9, wherein: the functions of the control unit are respectively implemented by the software of two or more of the plurality of electronic control units, or are implemented by software different from the software to be updated in one electronic control unit.

12. The software update device according to claim 10, wherein: the functions of the control unit are respectively implemented by the software of two or more of the plurality of electronic control units, or are implemented by software different from the software to be updated in one electronic control unit.

13. A software update method, which is executed by a computer of a software update device, the software update method being characterized by comprising: a step of requesting the center to download update data; a step of saving the downloaded update data; a step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units connected via a vehicle-mounted network; a step of, after the updated software is installed or installed and activated in the target electronic control unit, obtaining the software versions of the plurality of electronic control units, determining whether the combination of the obtained software versions is consistent, and when it is determined that the combination is not consistent, performing a process a specified number of times for obtaining the consistency of the combination of the software versions; a step of notifying the user of the occurrence of an abnormality when the consistency of the combination of the software versions cannot be obtained even after performing the process a specified number of times.

14. A non-transitory storage medium stores a program that can be executed by a computer of a software update device and causes the computer to execute the following functions. The non-transitory storage medium is characterized in that the functions include: A step of requesting the center to download update data; A step of saving the downloaded update data; A step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units connected via an in-vehicle network; After the updated software is installed or installed and activated in the target electronic control unit, obtaining the software versions of the plurality of electronic control units, determining whether the combination of the obtained software versions is consistent, and if it is determined that the combination is not consistent, implementing a process a specified number of times to obtain the consistency of the combination of the software versions; A step of notifying the user of an abnormality when the consistency of the combination of the software versions cannot be obtained even after implementing the process the specified number of times.

15. A vehicle includes the software update device according to any one of claims 1 to 12.

16. An OTA host, characterized in that, It includes: A communication unit configured to request the center to download update data; A storage unit configured to save the downloaded update data; A control unit configured to, according to the update data, execute control for installing or installing and activating updated software in one or more target electronic control units connected via an in-vehicle network. The control unit is configured to, after the updated software is installed or installed and activated in the target electronic control unit, obtain the software versions of the plurality of electronic control units, determine whether the combination of the obtained software versions is consistent, and if it is determined that the combination is not consistent, implement a process a specified number of times to obtain the consistency of the combination of the software versions. The control unit is further configured to notify the user of an abnormality when the consistency of the combination of the software versions cannot be obtained even after implementing the process the specified number of times.

17. A software update method is executed by a computer of an OTA host. The software update method is characterized in that it includes: A step of requesting the center to download update data; A step of saving the downloaded update data; A step of, according to the update data, executing control for installing or installing and activating updated software in one or more target electronic control units connected via an in-vehicle network; After the updated software is installed or installed and activated in the target electronic control unit, obtaining the software versions of the plurality of electronic control units, determining whether the combination of the obtained software versions is consistent, and if it is determined that the combination is not consistent, implementing a process a specified number of times to obtain the consistency of the combination of the software versions; A step of notifying the user of an abnormality when the consistency of the combination of the software versions cannot be obtained even after implementing the process the specified number of times.

18. A non-transitory storage medium stores a program that can be executed by a computer of an OTA host and causes the computer to execute the following functions. The non-transitory storage medium is characterized in that the functions include: A step of requesting the center to download update data; A step of saving the downloaded update data; A step of, according to the update data, executing control for installing or installing and activating update software in one or more target electronic control units connected via a vehicle-mounted network; After the update software is installed or installed and activated in the target electronic control unit, obtaining the software versions of the plurality of electronic control units, determining whether the combination of the obtained software versions is consistent, and implementing a process a specified number of times for obtaining the consistency of the combination of the software versions when it is determined that the combination is not consistent; A step of notifying a user of an abnormality when the consistency of the combination of the software versions cannot be obtained even after implementing the process a specified number of times.

Images