Update management device, update management system, and computer program

Abstract

To provide an update management device, system and program for installing and activating software on each ECU with update data, even when the ECUs on a vehicle having multiple power supply states cooperate with each other to actuate a function, thereby allowing a predetermined system to operate consistently.SOLUTION: An update management system manages update of software of an in-vehicle device on a vehicle having a plurality of power supply states including a first power supply state and a second power supply state. An update management ECU includes: a receiving unit that receives, from an external device, first update data for updating first software and second update data for updating second software; a synthesis unit that generates, from the first update data and the second update data, synthesized update data for installing synthesized software including a first function, which is the function of the updated first software, and a second function, which is the function of the updated second software; and a transmission unit that transmits the synthesized update data to the in-vehicle device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an update management device, an update management system, and a computer program. [Background technology]

[0002] In-vehicle devices that are installed in vehicles and connected to multiple ECUs (Electronic Control Units) are known. In recent years, vehicle power sources have become more complex and their power supply states have become more diverse. In addition, with the diversification of vehicle controls such as parking assistance systems, the opportunities for updating software installed in ECUs have also increased.

[0003] Patent Document 1 discloses a vehicle master device that acquires update data from an external source, instructs an ECU to be rewritten to install using the acquired update data, and distributes the acquired update data to the ECU to be rewritten, and that includes an installation condition determination unit that determines whether or not all of the following conditions are met: a first condition that a user's consent for installation has been obtained, a second condition that data communication with a center device is possible, a third condition that the vehicle state is in a state where installation is possible, a fourth condition that the ECU to be rewritten is in a state where installation is possible, and a fifth condition that the update data is normal data; and an installation instruction unit that instructs an electronic control device to be rewritten to install using the update data when it is determined by the installation condition determination unit that all of the first condition, the second condition, the third condition, the fourth condition, and the fifth condition are met. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-27629 A Summary of the Invention [Problem to be solved by the invention]

[0005] There are known vehicles that have multiple power supply states including a +B state, which is a power supply state when the vehicle cannot run, and an IG state, which is a power supply state when the vehicle can run, and that are equipped with multiple ECUs. For example, a first ECU may be installed with first software that operates in the +B state and the IG state, and a second software that does not operate in the +B state but operates in the IG state, and a second ECU may be installed with third software that does not operate in the +B state but operates in the IG state, and a predetermined system may operate in cooperation with the second software and the third software.

[0006] When the first software and the second software of the first ECU are updated by the update data, the first software and the second software are installed in one first ECU, so they can be activated even in the +B state. On the other hand, the second ECU has the third software installed, which operates in the IG state, installed, so that when the power state transitions to the IG state, the installation of the third software begins by the update data and the third software is activated. If the second software of the first ECU is already activated in the +B state, the second software may issue a command to the third software of the second ECU when the power state transitions to the IG state. However, the third software of the second ECU has just started to be installed, so it may not understand the command issued by the second software of the first ECU, and the specified system may not operate.

[0007] The vehicle master device of Patent Document 1 is compatible with one ECU, but cannot accommodate a case in which a predetermined system operates in cooperation with multiple ECUs in a vehicle having multiple power supply states.

[0008] In view of such problems, the present disclosure aims to provide an update management device that installs and activates software in each ECU using update data, allowing a specified system to operate without any inconsistencies, even when multiple ECUs in a vehicle having multiple power states work together to operate functions. [Means for solving the problem]

[0009] The update management device disclosed herein is an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and includes a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, and a first storage unit that, when the determining unit determines that the power state of the vehicle is the first power state, stores the first update data in the first storage unit. and a second memory unit, a first transmission unit that transmits the first update data to the in-vehicle device so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software, and a second transmission unit that transmits the first update data and the second update data to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state, so that the in-vehicle device installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0010] The update management system disclosed herein is an update management system that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, wherein the update management device includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, a first storage unit and a second storage unit, and when the determining unit determines that the power state of the vehicle is the first power state, the in-vehicle device includes a first transmission unit that transmits the first update data to the in-vehicle device in order to install the updated first software in the first storage unit and activate the updated first software, and when the determining unit determines that the power state of the vehicle is the second power state, the in-vehicle device transmits the first update data to the in-vehicle device. a second transmission unit configured to transmit the first update data and the second update data to the in-vehicle device in order to install the updated first software and the updated second software in a second storage unit and activate the updated first software and the updated second software; a first instruction unit configured to transmit a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit configured to transmit a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when the determination unit determines that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device includes a first activation unit configured to activate the updated first software installed in the first storage unit when the in-vehicle device receives the first activation instruction, and a second instruction unit configured to activate the updated first software and the updated second software when the determination unit determines that the power supply state of the vehicle is the second power supply state.and a second activation unit that activates the updated first software and the updated second software installed in the second storage unit.

[0011] A computer program disclosed herein is a computer program for controlling an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a determining step of determining whether the power state of the vehicle is the first power state or the second power state, and a first update data when it is determined that the power state of the vehicle is the first power state. A computer program for controlling an update management device, comprising: a first transmission step in which the in-vehicle device, which has a memory unit and a second memory unit, transmits the first update data to the in-vehicle device so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software; and a second transmission step in which, when the power supply state of the vehicle is determined to be the second power supply state, the in-vehicle device transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0012] The update management device disclosed herein is an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and includes a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a combining unit that creates combined update data from the first update data and the second update data for installing combined software including a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a memory unit, and the in-vehicle device includes the storage unit. memory a transmission unit that transmits the composite update data to the in-vehicle device to install the composite software into the in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and transmits the composite update data to the in-vehicle device to activate the second function when the power state of the vehicle is the second power state.

[0013] The update management system disclosed herein is an update management system for a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management system including an update management device for managing software updates of an in-vehicle device and the in-vehicle device, the update management device including a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining unit that creates combined update data from the first update data and the second update data for installing combined software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update, and a memory unit that stores the stored update data. memorya transmission unit that transmits the combined update data to the in-vehicle device to install the combined software into an in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state; a determination unit that determines whether the power state of the vehicle is the first power state or the second power state; a first instruction unit that transmits a first activation instruction to the in-vehicle device to activate the first function when the determination unit determines that the power state of the vehicle is the first power state; and a second instruction unit that transmits a second activation instruction to the in-vehicle device to activate the second function when the determination unit determines that the power state of the vehicle is the second power state, wherein the in-vehicle device includes a first activation unit that activates the first function when the first activation instruction is received, and a second activation unit that activates the second function when the second activation instruction is received.

[0014] A computer program disclosed herein is a computer program for controlling an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a combining step of creating combined update data from the first update data and the second update data for installing combined software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update, and a storage unit for storing the combined update data. memorya transmitting step of transmitting the composite update data to the in-vehicle device to install the composite software into a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram illustrating an example of an update management system. [Diagram 2] 2 is a block diagram showing an example of an internal configuration of an update management ECU. FIG. [Diagram 3] 2 is a block diagram showing an example of an internal configuration of an ECU. FIG. [Figure 4] 2 is a functional block diagram of an update management ECU according to the first embodiment. FIG. [Diagram 5] 1 is a table showing an example of an ECU table that lists ECUs. [Figure 6] 1 is a table showing an example of an ECU table that lists ECUs. [Figure 7] 4 is a flowchart showing a control method according to the first embodiment. [Figure 8] FIG. 2 is a sequence diagram of the update management system according to the first embodiment. [Figure 9] FIG. 11 is a functional block diagram of an update management ECU according to a second embodiment. [Figure 10] 10 is a flowchart showing a control method according to a second embodiment. [Figure 11] FIG. 11 is a sequence diagram of an update management system according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] [Description of the embodiments of the present disclosure] The gist of the present disclosure includes the following configurations.

[0017] (1) An update management device disclosed herein is an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management device including a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, and when the determining unit determines that the power state of the vehicle is the first power state, an update management device comprising: a first transmission unit that transmits the first update data to the in-vehicle device so that the in-vehicle device has a first memory unit and a second memory unit, and installs the updated first software in the first memory unit and activates the updated first software; and a second transmission unit that transmits the first update data and the second update data to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state, and installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0018] With this configuration, the update management device transmits update data to the in-vehicle device to alternately install and activate the software in the two storage units of the in-vehicle device according to the power supply state of the vehicle. This allows the software of the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working together operates without discrepancies.

[0019] (2) In the update management device of (1), the update management device may further include a first instruction unit that sends a first activation instruction to the in-vehicle device to activate the updated first software installed in the first memory unit when the determination unit determines that the power supply state of the vehicle is the first power supply state, and a second instruction unit that sends a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second memory unit when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0020] With this configuration, the update management device installs and activates software in the vehicle-mounted device using the update data according to the power supply state of the vehicle. This allows the software in the vehicle-mounted device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working together operates without any discrepancies.

[0021] (3) In the update management device of (1), the update management device may further include a first erasure instruction unit that transmits a first erasure instruction to the in-vehicle device for erasing the pre-update first software and the pre-update second software from the second storage unit when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit, and a second erasure instruction unit that transmits a second erasure instruction to the in-vehicle device for erasing the pre-update first software and the pre-update second software from the first storage unit when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit.

[0022] With this configuration, the update management device installs software in one storage unit, activates the software in the in-vehicle device, and then erases the software in the other storage unit. This makes the storage unit in which the next software is to be installed empty, allowing the next software to be installed.

[0023] (4) In the update management device of (1), the first power state may be a power state when the vehicle is in a state in which it cannot run, and the second power state may be a power state when the vehicle is in a state in which it can run.

[0024] With this configuration, the update management device transmits update data for alternately installing and activating the software in the two storage units of the in-vehicle device according to the power state when the vehicle can run and the power state when the vehicle cannot run to the in-vehicle device. This allows the software of the in-vehicle device to be updated and activated sequentially at appropriate times according to the power state, and the function of the software of multiple ECUs working in cooperation with each other works without any discrepancies.

[0025] (5) In the update management device according to (1) above, the receiving unit may receive the first update data and the second update data from the external device while the power supply state is the first power supply state.

[0026] With this configuration, the update data is downloaded to the update management device in the first power state, so that the software is quickly installed and activated after transition to the second power state.

[0027] (6) The update management system disclosed herein is an update management system including the update management device described in any one of (1) to (5) above and the in-vehicle device.

[0028] (7) An update management system according to the present disclosure is an update management system including an update management device for managing software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, wherein the update management device includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, a first storage unit and a second storage unit, and a first transmission unit that transmits the first update data to the in-vehicle device when the determining unit determines that the power state of the vehicle is the first power state, in order to install the updated first software in the first storage unit and activate the updated first software, and when the determining unit determines that the power state of the vehicle is the second power state, the in-vehicle device transmits the first update data to the in-vehicle device. a second transmission unit configured to transmit the first update data and the second update data to the in-vehicle device in order to install the updated first software and the updated second software in a second storage unit and activate the updated first software and the updated second software; a first instruction unit configured to transmit a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit configured to transmit a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when the determination unit determines that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device includes a first activation unit configured to activate the updated first software installed in the first storage unit when the in-vehicle device receives the first activation instruction, and a second instruction unit configured to activate the updated first software and the updated second software when the determination unit determines that the power supply state of the vehicle is the second power supply state.and a second activation unit that activates the updated first software and the updated second software installed in the second storage unit.

[0029] With this configuration, the update management device transmits update data to the in-vehicle device for alternately installing and activating the software in the two storage units of the in-vehicle device. The in-vehicle device installs and activates the software according to the power supply state of the vehicle using the transmitted update data. This allows the software of the in-vehicle device to be sequentially updated and activated at appropriate times according to the power supply state, and the function of the software of multiple ECUs working in conjunction with each other operates without discrepancies.

[0030] (8) In the update management device of (7), the update management system may further include a first erasure unit that erases the first software before the update and the second software before the update from the second storage unit when the first software is installed in the first storage unit, and a second erasure unit that erases the first software before the update and the second software before the update from the second storage unit when the updated first software is installed in the first storage unit, and a second erasure unit that erases the updated first software from the first storage unit when the updated first software and the updated second software are installed in the second storage unit.

[0031] With this configuration, the update management system installs software in one of the storage units of the in-vehicle device, activates the in-vehicle device, and then erases the software in the other storage unit. This makes the storage unit of the in-vehicle device into which software will next be installed empty, allowing the next software to be installed.

[0032] (9) A computer program disclosed herein is a computer program for controlling an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determination step of determining whether the power state of the vehicle is the first power state or the second power state, and when it is determined that the power state of the vehicle is the first power state, A computer program for controlling an update management device, comprising: a first transmission step in which the in-vehicle device has a first memory unit and a second memory unit, and transmits the first update data to the in-vehicle device so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software; and a second transmission step in which, when the power supply state of the vehicle is determined to be the second power supply state, the in-vehicle device transmits the first update data and the second update data to the in-vehicle device, and installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0033] With this configuration, the update management device transmits update data to the in-vehicle device to alternately install and activate the software in the two storage units of the in-vehicle device according to the power supply state of the vehicle. This allows the software of the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working together operates without discrepancies.

[0034] (10) An update management device according to the present disclosure is an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management device including a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a synthesis unit that creates synthesized update data from the first update data and the second update data to install synthesized software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update, and a memory unit, the in-vehicle device including the storage unit, memory a transmission unit that transmits the composite update data to the in-vehicle device to install the composite software into the in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and transmits the composite update data to the in-vehicle device to activate the second function when the power state of the vehicle is the second power state.

[0035] With this configuration, the update management device creates composite update data from the two update data for updating the two pieces of software, installs the composite update data in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working in conjunction with each other to operate without discrepancies.

[0036] (11) In the update management device of (10), the update management device may further include a judgment unit that judges whether the power supply state of the vehicle is the first power supply state or the second power supply state, a first instruction unit that sends a first activation instruction to the in-vehicle device for activating the first function when the judgment unit judges that the power supply state of the vehicle is the first power supply state, and a second instruction unit that sends a second activation instruction to the in-vehicle device for activating the second function when the judgment unit judges that the power supply state of the vehicle is the second power supply state.

[0037] With this configuration, the update management device activates the software in the in-vehicle device according to the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function in which the software of multiple ECUs operates in cooperation with each other operates without any discrepancies.

[0038] (12) In the update management device of (11), when the determination unit determines that the power supply state of the vehicle is the first power supply state, it stores information indicating the first power supply state in a state memory unit that stores information indicating a power supply state, and when the determination unit determines that the power supply state of the vehicle is the second power supply state, it stores information indicating the second power supply state in the state memory unit, and the first instruction unit may refer to the state memory unit and, when the information indicating the first power supply state is stored, send the first activation instruction to the in-vehicle device, and the second instruction unit may refer to the state memory unit and, when the information indicating the second power supply state is stored, send the second activation instruction to the in-vehicle device.

[0039] With this configuration, the update management device activates the software in the in-vehicle device based on the information indicating the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at an appropriate time according to the power supply state, and the function in which the software of multiple ECUs operates in cooperation with each other works without any discrepancies.

[0040] (13) In the update management device of (10), the first power state may be a power state when the vehicle is in a state in which it cannot run, and the second power state may be a power state when the vehicle is in a state in which it can run.

[0041] With this configuration, the update management device creates composite update data from two pieces of update data for updating two pieces of software, installs the composite update data in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the power supply state of the vehicle. As a result, the software of the in-vehicle device is updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working in cooperation with each other works without any discrepancies.

[0042] (14) In the update management device according to (10), the receiving unit may receive the first update data and the second update data from the external device while the power supply state is the first power supply state.

[0043] With this configuration, the update data is downloaded to the update management device in the first power state, so that the software is quickly installed and activated after transition to the second power state.

[0044] (15) The present disclosure provides an update management system including the update management device according to any one of (10) to (14) above and the in-vehicle device.

[0045] (16) An update management system according to the present disclosure is an update management system for a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management system including an update management device for managing software updates of an in-vehicle device and the in-vehicle device, the update management device including a receiving unit for receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a synthesis unit for creating synthesized update data from the first update data and the second update data for installing synthesized software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update, and a memory unit for storing the storage information. memory a transmission unit that transmits the combined update data to the in-vehicle device in order to install the combined software in a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state; a determination unit that determines whether the power supply state of the vehicle is the first power supply state or the second power supply state; and a first instruction unit that transmits a first activation instruction to the in-vehicle device to activate the first function when the power supply state of the vehicle is determined to be the first power supply state by the determination unit; an update management system that includes a second instruction unit that transmits a second activation instruction to the in-vehicle device for activating the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state, and the in-vehicle device includes a first activation unit that activates the first function when the first activation instruction is received, and a second activation unit that activates the second function when the second activation instruction is received.

[0046] With this configuration, the update management device creates composite update data from the two update data for updating the two pieces of software, installs the composite update data in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the power supply state of the vehicle. The update management device then sends an activation instruction to the in-vehicle device according to the power supply state of the vehicle, and the in-vehicle device activates the software. As a result, the software of the in-vehicle device is updated and activated sequentially at appropriate times according to the power supply state, and the function of operating the software of multiple ECUs in cooperation with each other operates without discrepancies.

[0047] (17) In the update management system of (16), when the determination unit determines that the power supply state of the vehicle is the first power supply state, it stores information indicating the first power supply state in a state memory unit that stores information indicating a power supply state, and when the determination unit determines that the power supply state of the vehicle is the second power supply state, it stores information indicating the second power supply state in the state memory unit, and the first instruction unit may refer to the state memory unit and, when the information indicating the first power supply state is stored, send the first activation instruction to the in-vehicle device, and the second instruction unit may refer to the state memory unit and, when the information indicating the second power supply state is stored, send the second activation instruction to the in-vehicle device.

[0048] With this configuration, the update management device activates the software in the in-vehicle device based on the information indicating the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at an appropriate time according to the power supply state, and the function in which the software of multiple ECUs operates in cooperation with each other works without any discrepancies.

[0049] (18) A computer program disclosed herein is a computer program for controlling an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining step of creating combined update data from the first update data and the second update data for installing combined software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update, and a storage unit for storing the combined update data. memory a transmitting step of transmitting the composite update data to the in-vehicle device to install the composite software into a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state.

[0050] With this configuration, the update management device creates composite update data from the two update data for updating the two pieces of software, installs the composite update data in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working in conjunction with each other to operate without discrepancies.

[0051] <Embodiment 1> [1. Details of the First Embodiment of the Present Disclosure] Hereinafter, the details of the first embodiment of the present disclosure will be described with reference to the drawings.

[0052] [1.1 Configuration of the update management system] Figure 1 shows EMBODIMENT 11 is a diagram showing an example of the configuration of an update management system 1 according to the present invention. The update management system 1 is a system installed in a vehicle such as an automobile. The update management system 1 includes an update management ECU 11, a first ECU 12, a second ECU 13, communication buses 14a and 14b, and a communication device 15.

[0053] The update management ECU11 (ECU: Electronic Control Unit) is an update management device that manages software updates of in-vehicle devices in a vehicle having a plurality of power supply states including a first power supply state and a second power supply state different from the first power supply state. The first power supply state is, for example, a power supply state when the vehicle is in a state in which it cannot run, and the second power supply state is a power supply state when the vehicle is in a state in which it can run. The first power state is, for example, a power state when a key switch that starts an engine by inserting a key is in the OFF position. Specifically, for example, the first power state is a state in which power is not supplied from the vehicle battery to most of the electric devices in the vehicle, but is supplied directly only to the minimum necessary in-vehicle devices. Examples of the small number of electric devices include a security system and a clock. Hereinafter, the first power state may be referred to as a +B state. The second power state is, for example, a power state when the key switch for starting the engine is in the ignition position. Specifically, for example, the second power state is a state in which power is supplied to all electrical devices and the vehicle starts moving when the accelerator is depressed. Hereinafter, the second power state may be referred to as the IG state. In addition, the power supply state of the vehicle will be described as being of two types, a first power supply state and a second power supply state, but the power supply state is not limited to this and may be further subdivided. Also, the in-vehicle device may be referred to as an ECU.

[0054] The update management ECU 11 manages software updates for in-vehicle devices in a vehicle having multiple power supply states. For this reason, the update management ECU 11 is configured to operate in a power supply state in which software updates are performed. For example, the update management ECU 11 can operate in the +B state and the IG state.

[0055] The update management ECU 11 functions, for example, as an integrated ECU that manages the first ECU 12 and the second ECU 13. The update management ECU 11 may transmit, to the first ECU 12 and the second ECU 13, update data downloaded from a server 2 that is an external device outside the vehicle and connected via a network 3, for example.

[0056] The update management ECU 11 may function as a GW-ECU (Gateway-ECU) that relays data transmitted and received between the first ECU 12 and the second ECU 13 and the communication device 15. The internal configuration of the update management ECU 11 will be described later.

[0057] The communication device 15 is, for example, a communication interface that performs wireless communication. The communication device 15 communicates with the server 2 via a network 3 such as the Internet. Specifically, the communication device 15 is a TCU (Telematics Communication Unit). The communication device 15 transmits data output from the update management ECU 11 to the server 2 via the network 3. The communication device 15 also receives data (such as update data) transmitted from the server 2 via the network 3. The communication device 15 transmits the data to the update management ECU 11 via the communication bus 14a.

[0058] The server 2 is a device installed outside the vehicle. The server 2 is, for example, a server including a control unit, a storage unit, and a communication unit (not shown). The storage unit of the server 2 stores, for example, programs or data for controlling each unit of the update management system 1 (for example, the update management ECU 11, the first ECU 12, and the second ECU 13). For example, the manufacturers of the first ECU 12 and the second ECU 13 update the programs or data as necessary, and store the updated programs or data in the storage unit of the server 2 as needed. The control unit of the server 2 uses the communication unit to transmit the updated programs or data to the update management ECU 11 as update data.

[0059] The communication buses 14a and 14b are in-vehicle communication networks connected to the update management ECU 11. The communication buses 14a and 14b extending from the update management ECU 11 are connected to various devices (such as the first ECU 12, the second ECU 13, and the communication device 15). In the example of FIG. 1, two communication buses 14a and 14b extend from the update management ECU 11, but the number of communication buses is not particularly limited. The communication buses 14a and 14b are compliant with, for example, a communication protocol such as CAN (Controller Area Network), Ethernet (registered trademark), or FlexRay (registered trademark), but are not limited thereto.

[0060] The update management ECU 11 is connected to the first ECU 12 and the second ECU 13 via the communication bus 14b. In the example of Fig. 1, the update management ECU 11 is connected to the first ECU 12 and the second ECU 13 via the communication bus 14b.

[0061] The number of ECUs included in the update management system 1 is not particularly limited as long as it is two or more. The ECU is, for example, a device (operation system ECU) that controls each part of the vehicle (for example, braking system, doors, battery, air conditioner, etc.). The multiple ECUs may have different functions or the same functions.

[0062] The first ECU 12 is an ECU in which a first software that operates in the +B state and the IG state and a second software that does not operate in the +B state but operates in the IG state are installed. The internal configuration of the first ECU 12 will be described later. Note that the software that operates in the +B state and the IG state is sometimes called +B software, and the software that does not operate in the +B state but operates in the IG state is sometimes called IG software.

[0063] The second ECU 13 is an ECU in which IG operating software is installed. The internal configuration of the second ECU 13 will be described later.

[0064] [1.2 Internal structure of update management ECU11] FIG. 2 is a diagram showing an example of the internal configuration of the update management ECU 11. As shown in FIG. The update management ECU 11 includes an information processing unit 21 including a control unit 22 and a storage unit 23, and a plurality of transceivers 25a and 25b. These units are electrically connected to each other via an internal bus 24.

[0065] The control unit 22 includes, for example, one or more CPUs (Central Processing Units), but is not limited to this. In the case of a CPU, the control unit 22 reads out a computer program stored in the storage unit 23 and executes various calculations and controls.

[0066] The storage unit 23 has a volatile memory and a non-volatile memory, and stores various data. The volatile memory includes, for example, a RAM (Random Access Memory). The non-volatile memory includes, for example, a flash memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a ROM (Read Only Memory). A part of the non-volatile memory may be provided outside the update management ECU 11.

[0067] The storage unit 23 stores, for example, computer programs, various parameters, and tables in a non-volatile memory. Note that the storage unit 23 stores, for example, computer programs, various parameters, and tables downloaded from the server 2 via the network 3 and the communication device 15.

[0068] A plurality of transceivers 25a, 25b transmit and receive signals flowing through the communication buses 14a, 14b via respective ports (not shown). The transceivers 25a, 25b transmit information contained in the received signals to the control unit 22 via the internal bus 24. The transceivers 25a, 25b receive information sent by the control unit 22 via the internal bus 24 and transmit it to the communication buses 14a, 14b. The transceiver 25a is connected to the communication bus 14a, and the transceiver 25b is connected to the communication bus 14b.

[0069] In the above, the control unit 22 of the information processing unit 21 includes a CPU, but the present invention is not limited to this. For example, the information processing unit 21 may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or the like. In the case of an FPGA, the information processing unit 21 executes various calculations and control according to a preprogrammed configuration. In the case of an ASIC, the information processing unit 21 executes various calculations and control according to a configuration built in at the time of manufacture.

[0070] [1.3 Internal structure of ECU] 3 is a diagram showing an example of the internal configuration of the first ECU 12. The internal configuration of the second ECU 13 is similar to that of the first ECU 12, and therefore a description thereof will be omitted.

[0071] The first ECU 12 includes an information processing unit 31 including a control unit 32, a first storage unit 33, and a second storage unit 34, a transceiver 35, an input unit 36, and an output unit 37. The transceiver 35 is electrically connected to the information processing unit 31 via an internal bus 38.

[0072] The control unit 32 includes, for example, one or more CPUs, but is not limited thereto. In the case of a CPU, for example, the CPU reads out a computer program stored in the first storage unit 33 or the second storage unit 34, and executes various calculations and controls.

[0073] The first storage unit 33 and the second storage unit 34 have a volatile memory and a nonvolatile memory, similar to the storage unit 23, and store various data. The first storage unit 33 stores, for example, a computer program, various parameters, and tables in a nonvolatile memory. For example, the first storage unit 33 and the second storage unit 34 are one bank obtained by dividing a physical memory into several banks. The information processing unit 31 may further include a bank register (not shown) for switching the bank. For example, the bank register is configured so that when 0 is written to the bank register, the first storage unit 33 becomes accessible, and when 1 is written to the bank register, the second storage unit becomes accessible. As another example, the first storage unit and the second storage unit may be the same storage unit, and, for example, the physical memory may be divided into several address spaces, and the memory in the first address space may be the first storage unit 33, and the memory in the second address space may be the second storage unit 34.

[0074] The transceiver 35 is, for example, an integrated circuit (IC), such as a CAN transceiver. The transceiver 35 is connected to the communication bus 14b and receives various control messages from the communication bus 14b.

[0075] The transceiver 35 includes a transmission circuit and a reception circuit (not shown). The transmission circuit and reception circuit communicate in accordance with the communication protocol of the communication bus 14b. The transmission circuit converts the digital signal data output by the information processing unit 31 into a predetermined analog signal and sends it to the communication bus 14b. The reception circuit converts the analog signal input from the communication bus 14b into a digital signal readable by the information processing unit 31 and outputs the digital signal to the information processing unit 31.

[0076] The input unit 36 ​​is connected to, for example, a sensor, an input device, etc. The input unit 36 ​​receives a signal corresponding to the state of the vehicle and a signal corresponding to an instruction from the driver, etc. The sensor is, for example, a temperature sensor that detects the temperature inside the vehicle, a door switch that detects that the door is closed, etc. The input device is, for example, a switch for operating an air conditioner, etc.

[0077] The output unit 37 is connected to, for example, a motor, a solenoid, etc. The output unit 37 drives the connected motor, solenoid, etc. based on information sent by the information processing unit 31. The information is, for example, information indicating the movement of the connected motor, etc. The motor is, for example, a motor that moves a door window up and down. The solenoid is, for example, a solenoid that locks a door.

[0078] [1.4 Problems to be solved by the present embodiment] There are known vehicles that have multiple power states including a +B state, an IG state, and the like, and that are equipped with multiple ECUs. For example, a first ECU is installed with first software that operates in the +B state and the IG state, and a second software that does not operate in the +B state but operates in the IG state, and a second ECU is installed with third software that does not operate in the +B state but operates in the IG state. In such a situation, the second software and the third software may work together to operate a specific system.

[0079] When the first software and the second software of the first ECU are updated by the update data, the first software and the second software are installed in one first ECU, so they can be activated even in the +B state. On the other hand, the second ECU has the third software installed, which operates in the IG state, installed, so that when the power state transitions to the IG state, the installation of the third software begins by the update data and the third software is activated. In a situation where the second software of the first ECU is already activated in the +B state, the second software may issue a command to the third software of the second ECU when the power state transitions to the IG state. However, the third software of the second ECU has just started to be installed, so it may not understand the command issued by the second software of the first ECU, and the specified system may not operate.

[0080] For example, the first ECU is a door ECU and the second ECU is a sensor ECU. For example, the first software is door lock software for controlling door locks, the second software is window software for controlling power windows, and the third software is raindrop detection software for a sensor that detects raindrops. The given system is a rainy weather window closing system that closes the windows when it rains.

[0081] In this case, when the door lock software and the window software of the door ECU are updated by the update data, the door lock software and the window software can be activated even in the +B state because they are installed in the door ECU. On the other hand, the raindrop detection software that operates in the IG state is installed in the sensor ECU, so when the power state transitions to the IG state, the raindrop detection software starts to be installed by the update data and is activated. Since the window software of the door ECU is already activated in the +B state, the window software may issue a command to the raindrop detection software of the sensor ECU when the power state transitions to the IG state. However, the raindrop detection software of the sensor ECU has just started to be installed, and it cannot understand the command issued by the window software of the door ECU, so there is a risk that the rainy weather window closing system will not work. For example, there is a risk that the window will not close in rainy weather.

[0082] Specific control contents in the update management system 1 will be described below with reference to FIG. 1 to FIG.

[0083] [1.5 Update management device functions Fig. 4 is a functional block diagram showing functions included in the update management ECU 11 according to the first embodiment. Fig. 5 and Fig. 6 are tables showing an example of an ECU table listing ECUs. The update management ECU 11 includes a receiving unit 41, a determining unit 42, a first transmitting unit 43, a second transmitting unit 44, a first instruction unit 45, a second instruction unit 46, a first erasure instruction unit 47, and a second erasure instruction unit 48.

[0084] [1.5.1 Receiver] The receiving unit 41 receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state.

[0085] Specifically, the receiving unit 41 has a function of downloading the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12.

[0086] The receiving unit 41 operates the control unit 22 to access the server 2 via the internal bus 24, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2. The download is started, for example, when update data is newly recorded in the server 2. In this case, the server 2 transmits information indicating that the update data has been newly recorded to each update management system 1. The information indicating that the update data has been newly recorded may include information indicating the version of the newly recorded update data. Hereinafter, the information indicating that the update data has been newly recorded is referred to as update software information. For example, an example of the update data being newly recorded in the server 2 may be when the wind software of the first ECU 12 and the raindrop detection software of the second ECU 13 are updated to realize a rainy weather window-closed system due to improved rain sensitivity compared to the previous rain sensor.

[0087] The update management ECU 11 of each update management system 1 is, for example, R Such an ECU table is stored in the storage unit 23. For example, the ECU table includes information indicating a predetermined system, an ECU and software that executes the predetermined system, a power supply state in which the software operates, and a version of the ECU software, and is recorded in the storage unit 23 in table form for each predetermined system. An example of the predetermined system is a rainy weather window closing system. As shown in FIG. 5, the ECU and software that execute this function are the window software of the door ECU and the raindrop detection software of the sensor ECU. The window software and the raindrop detection software are software that operate when the power supply state is the IG state. The version of the software is, for example, 1.02. In this example, the rainy weather window closing system is realized by the IG drive software, so that the whole system operates in the IG state. In the following description, the ECU table is stored in the storage unit 23 of the update management ECU 11, but the present invention is not limited to this. For example, the ECU table may be stored in the storage unit of the server 2.

[0088] FIG. 6 is another example of an ECU table. In this example, the predetermined system is, for example, a keyless entry system. The ECU and software that executes the predetermined system are, for example, door lock software in a door ECU and software in an ECU that cooperates with the door lock software. Since the keyless entry system operates in the +B state, the software in each ECU also operates in the +B state.

[0089] The receiving unit 41, for example, compares the version information included in the update software information sent from the server with the version information recorded in the ECU table to determine whether the software has been updated. If it is determined that the software has been updated, the receiving unit 41 requests the update data from the server 2 and downloads it. The receiving unit 41, for example, temporarily records the downloaded update data in the storage unit 23.

[0090] The receiving unit 41 may receive the first update data and the second update data from an external device while the power supply state is the first power supply state. For example, update data for updating door lock software, which is +B software, and window software, which is IG software, may be downloaded during the +B state, i.e., when the vehicle is in a state in which it cannot run, for example, while the vehicle is stopped. By downloading the update data while the vehicle is stopped, it is possible to start transmitting the update data and installing the IG software to an ECU in which the +B software is not installed but the IG software is installed, as soon as the power supply state transitions to the IG state.

[0091] [1.5.2 Judgment part] The determination unit 42 has a function of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state.

[0092] Specifically, the determination unit 42 detects the power supply state of the vehicle, for example, and determines whether the detected power supply state is the +B state or the IG state. The detection of the power supply state of the vehicle may be performed by the update management ECU 11, or may be performed by a power supply monitoring ECU (not shown) that monitors the power supply state of the vehicle. In the case of the +B state, for example, the voltage of a power supply bus connected to an electric device to which power is directly supplied from the vehicle battery is detected, and if the voltage is equal to or higher than a predetermined voltage, the power supply state is determined to be the +B state. In the case of the IG state, for example, the voltage of a power supply bus that supplies power to an ECU that operates when the vehicle starts to run when the accelerator is depressed, for example, an engine control ECU, is detected, and if the voltage is equal to or higher than a predetermined voltage, the power supply state is determined to be the IG state. Note that if the state is +B state and IG state, the power supply state is determined to be the IG state.

[0093] [1.5.3 First transmitter] The first transmission unit has a function of transmitting the first update data to the in-vehicle device, which has a first memory unit and a second memory unit, when the determination unit determines that the power supply state of the vehicle is the first power supply state, so that the in-vehicle device installs the updated first software into the first memory unit and activates the updated first software.

[0094] In the case of Figures 5 and 6, when the judgment unit 42 judges that the power supply state of the vehicle is in the +B state, the first transmission unit 43 transmits update data for installing door lock software, which is +B software, to the door ECU, which is the first ECU 12.

[0095] For example, the first transmission unit 43 operates the control unit 22 to execute the function of the first transmission unit 43. First, the control unit 22 reads out the first update data that has been temporarily stored. Next, the control unit 22 transmits the read out first update data to the communication bus 14b via the transceiver 25b. The first update data transmitted to the communication bus 14b reaches the transceiver 35 of the first ECU 12. The first ECU 12 is operated by the control unit 32, and the control unit 32 receives the arrived update data via the transceiver 35. The control unit 32 temporarily stores the received update data in the first storage unit 33 or a RAM (Random Access Memory) (not shown).

[0096] When the first transmission unit 43 transmits the first update data, the first ECU 12 installs the +B software in the first storage unit 33 based on the received first update data. For example, the door ECU installs door lock software in the first storage unit 33.

[0097] For example, when first update data is transmitted from the first transmission unit 43, after completion of reception of the transmitted update data, the control unit 32 of the first ECU 12 is configured to install software into the first memory unit 33 based on the temporarily stored update data.

[0098] As another example, when the first transmission unit transmits the first update data, the update management ECU 11 transmits a first installation instruction, which is an instruction to install the +B software in the first storage unit 33 using the first update data, to the first ECU 12. Then, the first ECU 12 that receives the first installation instruction is configured to install the +B software.

[0099] [1.5.4 Second transmitter] The second transmission unit has a function of transmitting the first update data and the second update data to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state, so that the in-vehicle device installs the updated first software and the updated second software into the second memory unit and activates the updated first software and the updated second software.

[0100] In the cases of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the IG state, the second transmission unit 44 transmits the first update data and the second update data for installing the door lock software, which is +B software, and the window software, which is IG software, to the door ECU, which is the first ECU 12.

[0101] For example, the second transmission unit 44 operates the control unit 22 to execute the function of the second transmission unit 44. First, the control unit 22 reads out the first update data temporarily stored in the memory unit 23. Next, the control unit 22 transmits the read out first update data to the communication bus 14b via the transceiver 25b. The first update data transmitted to the communication bus 14b reaches the transceiver 35 of the first ECU 12. The first ECU 12 is operated by the control unit 32, and the control unit 32 receives the arrived update data via the transceiver 35. The control unit 32 stores the temporarily received update data in the first memory unit 33 or a RAM (not shown).

[0102] When the second transmission unit transmits the first update data and the second update data, the first ECU 12 installs the +B software and the IG software in the second storage unit 34 based on the received first update data and second update data. For example, the door ECU installs door lock software and window software in the second storage unit 34.

[0103] When the first update data and the second update data are transmitted from the second transmission unit 44, the first ECU 12, for example, temporarily stores the transmitted first update data and second update data in the second storage unit 34. After the reception of the transmitted update data is completed, the control unit 32 of the first ECU 12 may be configured to install software based on the update data temporarily stored in the second storage unit 34.

[0104] As another example, when the second transmission unit transmits the first update data and the second update data, the update management ECU 11 transmits to the first ECU 12 a second installation instruction, which is an instruction to install the +B software and the IG software in the second storage unit 34 using the first update data and the second update data. The first ECU 12 that receives the second installation instruction may then install the +B software and the IG software.

[0105] [1.5.5 First instructions Department] The first instruction unit 45 has a function of transmitting a first activation instruction to the in-vehicle device to activate the updated first software installed in the first memory unit when the determination unit determines that the power supply state of the vehicle is the first power supply state.

[0106] In the example of Figure 6, i.e., in the case of a keyless entry system executed in the +B state, when the determination unit 42 determines that the power supply state is in the +B state, the first instruction unit 45 transmits an activation instruction to activate the door lock software, which is the +B software.

[0107] More specifically, the first instruction unit 45 refers to an ECU table stored in the storage unit 23, for example, the contents shown in Figs. 5 and 6. From the referred ECU table, the first instruction unit 45 obtains information indicating in which power state the system is executed by software that operates. In the example of Fig. 6, the door lock software that executes the keyless entry system operates in both the +B state and the IG state, so when the power state is the +B state, the first instruction unit 45 transmits a first activation instruction to the door ECU to activate the updated door lock software installed in the first storage unit 33. On the other hand, since the +B software is not listed in Fig. 5, the first instruction unit 45 does not transmit the first activation instruction.

[0108] It is preferable that the first activation instruction is transmitted to the in-vehicle device after the software is installed by the update data. This is because the software cannot be activated during installation. For example, the first instruction unit 45 is configured to wait for the transmission for a predetermined time. In another example, the in-vehicle device is configured to transmit installation completion information, which is information indicating that the installation of the software has been completed, to the update management device after the installation of the software is completed. Then, when the installation completion information is received, the first instruction unit 45 is configured to transmit the first activation instruction.

[0109] As an example, when the first ECU 12 receives a first activation instruction sent by the first instruction unit 45, the first ECU 12 is configured to operate the control unit 32 and activate the first software installed in the first memory unit 33.

[0110] [1.5.6 Second instructions Department] Second instructionsUnit 46 has a function of transmitting a second activation instruction to the in-vehicle device for activating the updated first software and the updated second software installed in the second storage unit when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0111] 5 and 6, when the determination unit 42 determines that the power supply state is the IG state, the second instruction unit 46 transmits to the door ECU a second activation instruction for activating the window software, which is the IG software, for the rainy weather window close system. In addition, the second instruction unit 46 transmits to the sensor ECU a second activation instruction for activating the raindrop detection software. In addition, the second instruction unit 46 transmits to the door ECU a second activation instruction for activating the door lock software, which is the +B software, for the keyless entry system.

[0112] More specifically, the second instructions The unit 46 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIG. 5 and FIG. 6. instructions The second instruction unit 46 obtains information indicating in which power supply state the system is executed by the operating software. In the example of Fig. 5, the rainy weather window closing system is executed by the window software and raindrop detection software that operate in the IG state, so when the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction to the door ECU for activating the updated window software installed in the second storage unit 34. Also, since the door lock software that executes the keyless entry system operates in both the +B state and the IG state, when the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction to the door ECU for activating the updated door lock software installed in the second storage unit 34. instructionsThe unit 46 transmits the activation command to the door ECU. In addition, it is preferable that the update management device also transmits an activation command to the sensor ECU to activate the raindrop detection software.

[0113] For the same reason as for the first instruction unit, it is preferable that the second instruction unit transmits the second activation instruction to the in-vehicle device after the software has been installed by the update data.

[0114] As an example, when the first ECU 12 receives a second activation instruction sent by the second instruction unit 46, the first ECU 12 is configured to operate the control unit 32 to activate the first software and the second software installed in the second memory unit 34.

[0115] [1.5.7 First erasure instruction part] The first erasure instruction unit 47 has a function of transmitting a first erasure instruction to the in-vehicle device for erasing the pre-update first software and the pre-update second software from the second storage unit when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit.

[0116] Specifically, the control unit 22 transmits a first erase instruction to the communication bus 14b via the transceiver 25b. The transmitted first erase instruction reaches the transceiver 35 of the first ECU 12 via the communication bus 14b. The first erase instruction that has reached the transceiver 35 is received by the control unit 32 of the first ECU 12. The data that has been installed in the second storage unit 34 by the received first erase instruction is hand The control unit 32 erases the pre-update first software and the pre-update second software that are currently installed.

[0117] By deleting the pre-update software in the second storage unit 34, the second storage unit 34 becomes empty, and when software is installed later, it is possible to suppress the risk that remnants of the pre-update software will adversely affect the later installed software. Note that if there is no particular problem with installing over the pre-update software, it is possible to skip sending the first deletion instruction.

[0118] It is more preferable to erase the pre-update software installed in the second storage unit 34 after the software installed in the first storage unit 33 is activated. This is because if the pre-update software installed in the second storage unit 34 was running until just before activation, it can be instantly swapped with the software in the first storage unit 33.

[0119] [1.5.8 Second erasure instruction part] The second erasure instruction unit 48 has a function of transmitting a second erasure instruction to the in-vehicle device for erasing the updated first software from the first storage unit when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit.

[0120] Specifically, the control unit 22 transmits a second erase instruction to the communication bus 14b via the transceiver 25b. The transmitted first erase instruction reaches the transceiver 35 of the first ECU 12 via the communication bus 14b. The control unit 32 of the first ECU 12 receives the second erase instruction that reaches the transceiver 35. The control unit 32 erases the updated first software installed in the first storage unit 33 in response to the received second erase instruction.

[0121] When the updated first software has been installed in the first storage unit 33, and the updated first software and the updated second software are installed in the second storage unit 34, it is preferable to erase the updated first software that was installed in the first storage unit 33.

[0122] This is to empty the first memory unit 33 because after the updated first software and the updated second software are installed in the second memory unit 34, the updated first software installed in the first memory unit 33 will not be executed.

[0123] It is more preferable to erase the updated software installed in the first storage unit 33 after the software is installed in the second storage unit 34 and activated. This is because if the first software installed in the first storage unit has been running until just before activation, it can be instantly swapped with the software in the second storage unit 34.

[0124] [1.6 Control method] Fig. 7 is a flowchart showing an example of a control method executed by the update management ECU 11 according to the first embodiment. The order of the steps shown in Fig. 7 may be changed as appropriate. A series of control methods will be described with reference to Fig. 7. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is the +B state.

[0125] The control executed by the update management ECU 11 is executed by an information processing unit 21. When the information processing unit 21 executes the control, a control unit 22 reads a computer program from a storage unit 23 and executes various calculations and processes. Moreover, the control executed by the first ECU 12 is executed by an information processing unit 31. When the information processing unit 31 executes the control, the control unit 32 reads a computer program from the first storage unit 33 and executes various calculations and processes.

[0126] [1.6.1 Step S101] First, the receiving unit 41 of the update management ECU 11 downloads update data from the server 2 (step S101). Specifically, the receiving unit 41 receives, from an external device of the vehicle, first update data for updating the first software that operates in the first power supply state and the second power supply state, and second update data for updating the second software that does not operate in the first power supply state but operates in the second power supply state. After the reception is completed, the update management ECU 11 proceeds to step S102.

[0127] More specifically, the receiving unit 41 of the update management ECU 11 downloads the first update data and the second data from the server 2. The server 2 stores update data for each ECU. The first update data is update data for installing +B software. The second update data is update data for installing IG software. The update management ECU 11 accesses the server 2 via the communication bus 14a, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2.

[0128] For example, when update data is newly recorded in the server 2, the server 2 transmits update software information including information indicating that the update data has been newly recorded to the update management system 1. The update software information may include information indicating the version of the newly recorded update data.

[0129] The update management ECU 11 of the update management system 1 stores, for example, an ECU table as shown in Fig. 5 in the storage unit 23. In the ECU table, information indicating a specific system, an ECU and software that executes the specific system, a power state in which the software operates, and the version of the ECU software is recorded in tabular form for each specific system.

[0130] The receiving unit 41 of the update management ECU 11, for example, compares the update software information (including information indicating the version) sent from the server with the ECU table recorded in the memory unit 23 to determine whether the software has been updated. For example, the software versions are compared to determine whether the software has been updated. If it is determined that the software has been updated, the receiving unit 41 requests the update data from the server 2 and downloads it. The receiving unit 41, for example, temporarily records the downloaded update data in the memory unit 23. After the download is completed, the process proceeds to step S102.

[0131] [1.6.2 Step S102] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the update management ECU 11 transmits the first update data to the vehicle-mounted device having a first storage unit and a second storage unit so that the vehicle-mounted device installs the updated first software in the first storage unit and activates the updated first software (step S102). As described above, since the initial state of the power supply state is the +B state, step S102 is executed. Then, the update management ECU 11 proceeds to step S103.

[0132] 5 and 6, since the +B software is door lock software for the first ECU 12, the first transmission unit 43 of the update management ECU 11 transmits first update data for installing the door lock software to the first ECU 12. The first ECU 12 includes a first storage unit 33 and a second storage unit 34, and the update data is to be installed in the first storage unit 33 and activated.

[0133] When the first transmission unit 43 of the first ECU 12 receives the first update data, the first ECU 12 installs the +B software in the first storage unit 33 based on the received first update data. In the cases of Figs. 5 and 6, the door ECU installs the door lock software in the first storage unit 33.

[0134] [1.6.3 Step S103] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 45 transmits a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit (step S103). As described above, since the initial state of the power supply state is the +B state, in step S10 3 Then, the update management ECU 11 proceeds to step S104.

[0135] In the case of the keyless entry system executed in the +B state in the cases of Figs. 5 and 6, the first activation instruction is an activation instruction for activating the door lock software, which is the +B software. The first activation instruction is sent to the first ECU 12, No. 1 instructions Part 4 5 is send.

[0136] Specifically, the first instruction unit 45 refers to an ECU table stored in the storage unit 23, for example, the contents shown in Figs. 5 and 6. From the referred ECU table, the first instruction unit 45 obtains information indicating in which power state the system is executed by software that operates. In the example of Fig. 6, the door lock software that executes the keyless entry system operates in both the +B state and the IG state, so when the power state is the +B state, the first instruction unit 45 transmits a first activation instruction to the door ECU to activate the updated door lock software installed in the first storage unit 33. On the other hand, since the +B software is not listed in Fig. 5, the first instruction unit 45 does not transmit the first activation instruction. It is preferable that the first activation instruction is transmitted to the in-vehicle device after the software is installed by the update data.

[0137] When the first ECU 12 receives the first activation instruction, the first ECU 12 activates the first software installed in the first storage unit 33 .

[0138] [1.6.4 Step S104] Next, when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit, the first deletion instruction unit 47 transmits a first deletion instruction to the in-vehicle device for deleting the pre-update first software and the pre-update second software from the second storage unit (step S104). 5 Proceed to.

[0139] Specifically, the control unit 22 transmits a first erase instruction to the communication bus 14b via the transceiver 25b. The first erase instruction transmitted via the communication bus 14b reaches the transceiver 35 of the first ECU 12. The first ECU 12 receives the first erase instruction that has reached the transceiver 35. The control unit 32 erases the pre-update first software and the pre-update second software installed in the first storage unit 33 in response to the received first erase instruction.

[0140] It is preferable to erase the pre-update software installed in the second storage unit 34 after the software is installed in the first storage unit 33 and activated. Also, if there is no particular problem with installing the software over the pre-update software, this step can be skipped.

[0141] [1.6.5 Step S105] Next, the determination unit 42 of the update management ECU 11 determines whether the power supply state of the vehicle is the first power supply state or the second power supply state (step S105). If the determination unit determines that the power supply state of the vehicle is the second power supply state, i.e., the IG state, the update management ECU 11 proceeds to step S106. On the other hand, if the determination unit determines that the power supply state of the vehicle is the first power supply state, i.e., the +B state, the update management ECU 11 returns to step S105 and repeats step S105. That is, the update management ECU 11 is in a state of waiting for the power supply state of the vehicle to transition from the +B state to the IG state.

[0142] [1.6.6 Step S106] Next, when the determination unit determines that the power supply state of the vehicle is the second power supply state, the second transmission unit of the update management ECU 11 transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit and activates the updated first software and the updated second software (step S106).Then, the update management ECU 11 proceeds to step S107.

[0143] In the case of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the IG state, that is, when the vehicle's power supply state transitions from the +B state to the IG state, the second transmission unit 44 transmits to the door ECU first update data for installing door lock software, which is +B software, and second update data for installing window software, which is IG software.

[0144] When the first ECU 12 receives the first update data and the second update data, the first ECU 12 installs the +B software and the IG software in the second storage unit 34 based on the received first update data and second update data. For example, the door ECU installs door lock software and window software in the second storage unit 34.

[0145] [1.6.7 Step S107] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 46 transmits a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit (step S107). Then, the update management ECU 11 proceeds to step S108.

[0146] 5 and 6, when the determination unit 42 determines that the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction for activating the window software, which is the IG software, for the rainy weather window close system. The second instruction unit 46 also transmits a second activation instruction for activating the door lock software, which is the +B software, for the keyless entry system. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU for activating the raindrop detection software. It is preferable that the second activation instruction is transmitted to the in-vehicle device after the software is installed by the update data.

[0147] When the in-vehicle device receives the second activation instruction, the in-vehicle device activates the first software and the second software installed in the second storage unit. In the cases of Fig. 5 and Fig. 6, the door ECU that receives the second activation instruction activates the window software and the door lock software installed in the second storage unit 34. In addition, it is preferable that the raindrop detection software of the sensor ECU is also activated. This is because the rainy weather window closing system is executed in cooperation with the window software and the raindrop detection software.

[0148] [1.6.8 Step S108] Next, when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit, the second deletion instruction unit 48 of the update management ECU transmits a second deletion instruction to the in-vehicle device to delete the updated first software from the first storage unit (step S108). After that, the update management ECU 11 ends the series of processes.

[0149] It is more preferable to erase the updated software installed in the first storage unit 33 after the software has been installed in the second storage unit 34 and activated. Also, this step may be skipped if there is no particular need to use the first storage unit 33 in the future.

[0150] [1.7 Control Sequences] Next, the control sequence of the update management system 1 will be described. Fig. 8 is a sequence diagram of the update management system according to the first embodiment. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is +B state. After that, the power supply state transitions from +B state to IG state.

[0151] [1.7.1 Step S201] First, the receiving unit 41 of the update management ECU 11 downloads update data from the server 2 (step S201). Specifically, the receiving unit 41 receives, from an external device of the vehicle, first update data for updating the first software that operates in the first power supply state and the second power supply state, and second update data for updating the second software that does not operate in the first power supply state but operates in the second power supply state. After the reception is completed, the update management system 1 performs step S 2 Go to 02.

[0152] Specifically, the receiving unit 41 of the update management ECU 11 downloads the first update data and the second data from the server 2. The server 2 stores update data for each ECU. The first update data is update data for installing +B software. In The second update data is for IG software. install In order to update The update management ECU 11 accesses the server 2 via the communication bus 14a, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2.

[0153] [1.7.2 Step S202] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the update management ECU 11 transmits the first update data to the in-vehicle device having a first storage unit and a second storage unit so that the in-vehicle device installs the updated first software in the first storage unit and activates the updated first software (step S202). As described above, since the initial state of the power supply state is the +B state, step S202 is executed. Then, the update management system 1 proceeds to step S203.

[0154] 5 and 6, since the +B software is door lock software for the first ECU 12, the first transmission unit 43 of the update management ECU 11 transmits first update data for installing the door lock software to the first ECU 12. The first ECU 12 includes a first storage unit 33 and a second storage unit 34, and the update data is to be installed in the first storage unit 33 and activated.

[0155] [1.7.3 Step S203] Next, when the first transmission unit 43 transmits the first update data, the first ECU 12 installs the +B software in the first storage unit 33 based on the received first update data (step S203). In the case of Figs. 5 and 6, the door ECU installs the door lock software in the first storage unit 33. After the installation, the update management ECU 11 performs step S Go to 204.

[0156] [1.7.4 Step S204] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 45 transmits a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit (step S204). Since the initial state of the power supply state is the +B state as described above, step S204 is executed. Then, the update management system 1 proceeds to step S205.

[0157] In the case of the keyless entry system executed in the +B state in the examples of Figs. 5 and 6, the first activation instruction is an activation instruction for activating the door lock software, which is the +B software. No. 1 instructions Part 4 5 is send.

[0158] [1.7.5 Step S205] Next, when the first ECU 12 receives the first activation instruction, the first ECU 12 activates the first software installed in the first storage unit 33 (step S205). Then, the update management system 1 proceeds to step S206.

[0159] [1.7.6 Step S206] Next, when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit, the first deletion instruction unit 47 transmits a first deletion instruction to the in-vehicle device for deleting the pre-update first software and the pre-update second software from the second storage unit (step S206). 207 Proceed to.

[0160] [1.7.7 Step S207] Next, when the first ECU 12 receives the first deletion instruction, the control unit 32 deletes the pre-update first software and the pre-update second software installed in the first storage unit 33 in accordance with the received first deletion instruction (step S207). Then, the update management system 1 proceeds to step S208. If there is no risk of problems occurring even if the pre-update first software and the pre-update second software are not erased, steps S206 and S207 may be skipped.

[0161] [1.7.8 Step S208] Next, the judgment unit 42 of the update management ECU 11 judges whether the power supply state of the vehicle is the first power supply state or the second power supply state (step S208). If the judgment unit 42 judges that the power supply state of the vehicle is the second power supply state, i.e., the IG state, the update management system 1 proceeds to step S209. On the other hand, if the judgment unit judges that the power supply state of the vehicle is the first power supply state, i.e., the +B state, the update management system 1 returns to step S208 and repeats step S208. That is, the system is waiting for the power supply state of the vehicle to transition from the +B state to the IG state. Therefore, from step S209 onwards, the power supply state is transitioning from the +B state to the IG state.

[0162] [1.7.9 Step S209] Next, when the determination unit determines that the power supply state of the vehicle is the second power supply state, the second transmission unit of the update management ECU 11 transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit and activates the updated first software and the updated second software (step S209).Then, the update management ECU 11 proceeds to step S210.

[0163] In the case of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the IG state, that is, when the vehicle's power supply state transitions from the +B state to the IG state, the second transmission unit 44 transmits to the door ECU first update data for installing door lock software, which is +B software, and second update data for installing window software, which is IG software.

[0164] [1.7.10 Step S210] When the first ECU 12 receives the first update data and the second update data transmitted by the second transmission unit, the first ECU 12 installs the +B software and the IG software in the second storage unit 34 based on the received first update data and second update data (step S210). In the case of Fig. 5 and Fig. 6, the door ECU installs the door lock software and the window software in the second storage unit 34. Then, the update management system 1 proceeds to step S211.

[0165] [1.7.11 Step S211] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 46 transmits a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit (step S211). Then, the update management ECU 11 proceeds to step S212.

[0166] 5 and 6, when the determination unit 42 determines that the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction for activating the window software, which is the IG software, for the rainy weather window close system. The second instruction unit 46 also transmits a second activation instruction for activating the door lock software, which is the +B software, for the keyless entry system. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU for activating the raindrop detection software.

[0167] [1.7.12 Step S212] Next, when the first ECU 12 receives the second activation instruction, the first ECU 12 activates the first software and the second software installed in the second storage unit 34 (step S212). Then, the update management system proceeds to step S213.

[0168] [1.7.13 Step S213] Next, when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit, the second erasure instruction unit 48 of the update management ECU transmits a second erasure instruction to the in-vehicle device to erase the updated first software from the first storage unit (step S21 3 The update management system then proceeds to step S214.

[0169] [1.7.14 Step S214] Next, when the first ECU 12 receives the second erasure instruction, the control unit 32 erases the updated first software installed in the first storage unit 33 in accordance with the received second erasure instruction (step S214). Then, the update management system 1 ends the series of processes. If there is no risk of problems occurring even if the updated first software is not erased, steps S213 and S214 may be skipped.

[0170] [1.8 Summary] There are known vehicles equipped with multiple ECUs and having multiple power states, including a +B state, an IG state, etc. In such vehicles, when the software of the ECU is updated, there is a risk that multiple pieces of software that work together to execute a specific system will be activated in different power states, and one piece of software may not be able to understand an instruction issued by the other piece of software, causing the specific system to not operate.

[0171] According to this embodiment, the update management device transmits update data to the in-vehicle device for alternately installing and activating the software in two storage units of the in-vehicle device in accordance with the power supply state of the vehicle. The update management device installs the software in the in-vehicle device using the update data in accordance with the power supply state of the vehicle, and activates the software in accordance with the power supply state of the vehicle. This allows the software of the in-vehicle device to be updated and activated sequentially at appropriate times in accordance with the power supply state, and the function of the software of multiple ECUs operating in cooperation with each other operates without any discrepancies.

[0172] In addition, when the +B software and the IG software are installed in the first ECU and the IG software is installed in the second ECU, and the IG software of the first ECU and the IG software of the second ECU work together to execute a predetermined system, it is preferable to simultaneously transmit an activation command to the IG software of the first ECU and the IG software of the second ECU to activate them. This further suppresses discrepancies such as the IG software of the first ECU and the IG software of the second ECU being unable to understand a command issued by the IG software of the first ECU being explicitly activated at the same time.

[0173] Although the in-vehicle device has been described as including the first storage unit and the second storage unit, the present invention is not limited to this, and the in-vehicle device may include an additional storage unit.

[0174] <Embodiment 2> [2. Details of the Second Embodiment of the Present Disclosure] Hereinafter, the second embodiment of the present disclosure will be described in detail with reference to the drawings. The differences between the first and second embodiments are as follows. In the first embodiment, software is installed alternately in two storage units provided in the in-vehicle device using first update data that updates the first software and second update data that updates the second software. On the other hand, in the second embodiment, the update management device creates combined update data from the first update data and the second update data in advance, and installs software in one storage unit of the in-vehicle device using the combined update data. All other points are the same. The same symbols are used for configurations that are the same as those in the first embodiment, and descriptions of the same configurations, functions, and operations are omitted.

[0175] [2.1 Configuration of the update management system] The configuration of the update management system of the second embodiment is the same as that of the first embodiment. Note that the in-vehicle device does not necessarily need to have two storage units, and may have only one storage unit. [2.2 Problems to be solved by the present embodiment] The problem to be solved by the second embodiment is the same as that of the first embodiment. However, when the in-vehicle device has only one storage unit, the first embodiment cannot be used. Therefore, the second embodiment aims to solve the problem even when there is only one storage unit.

[0176] Therefore, in the present embodiment, the update management device is an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device includes a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a combining unit that creates combined update data from the first update data and the second update data for installing combined software including a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a storage unit. memorya transmission unit that transmits the combined update data to the in-vehicle device so as to install the combined software in the in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state; The update management device includes:

[0177] With this configuration, the update management device transmits update data for alternately installing and activating the software in the two storage units of the in-vehicle device according to the power supply state of the vehicle to the in-vehicle device. This allows the software of the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working in cooperation with each other works without any discrepancies.

[0178] The update management device further includes a determination unit that determines whether the power supply state of the vehicle is the first power supply state or the second power supply state, a first instruction unit that transmits a first activation instruction to the in-vehicle device for activating the first function when the determination unit determines that the power supply state of the vehicle is the first power supply state, and a second instruction unit that transmits a second activation instruction to the in-vehicle device for activating the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0179] With this configuration, the update management device activates the software in the in-vehicle device according to the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function in which the software of multiple ECUs operates in cooperation with each other operates without any discrepancies.

[0180] [2.3 Functions of the update management device] 9 is a functional block diagram showing functions included in an update management ECU 11 according to embodiment 2. The update management ECU 11 includes a receiving unit 91, a combining unit 92, a transmitting unit 93, a determining unit 94, a first instruction unit 95, and a second instruction unit 96. A major difference from embodiment 1 is that the update management ECU 11 includes a combining unit 92.

[0181] [2.3.1 Receiver] The receiving unit 91 has a function of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state.

[0182] Specifically, the receiving unit 91 has a function of downloading the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12.

[0183] The receiving unit 91 operates the control unit 22 to access the server 2 via the internal bus 24, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2. The download is started, for example, when update data is newly recorded in the server 2. In this case, the server 2 transmits information indicating that the update data has been newly recorded to each update management system 1. The information indicating that the update data has been newly recorded may include information indicating the version of the newly recorded update data. Hereinafter, the information indicating that the update data has been newly recorded is referred to as update software information. For example, an example of the update data being newly recorded in the server 2 may be when the wind software of the first ECU 12 and the raindrop detection software of the second ECU 13 are updated to realize a rainy weather window-closed system due to improved rain sensitivity compared to the previous rain sensor.

[0184] The update management ECU 11 stores an ECU table as shown in FIG. 5 in the storage unit 23. For example, the ECU table includes information indicating a predetermined system, an ECU and software that executes the predetermined system, a power supply state in which the software operates, and a version of the ECU software, and is recorded in the storage unit 23 in table form for each predetermined system. An example of the predetermined system is a rainy weather window closing system. As shown in FIG. 5, the ECU and software that execute this function are the window software of the door ECU and the raindrop detection software of the sensor ECU. The window software and the raindrop detection software are software that operate when the power supply state is the IG state. The version of the software is, for example, 1.02. In this example, the rainy weather window closing system is realized by the IG drive software, so that the whole system operates in the IG state. In the following description, the ECU table is stored in the storage unit 23 of the update management ECU 11, but the present invention is not limited to this. For example, the ECU table may be stored in the storage unit of the server 2.

[0185] FIG. 6 is another example of an ECU table. In this example, the predetermined system is, for example, a keyless entry system. The ECU and software that executes the predetermined system are, for example, door lock software in a door ECU and software in an ECU that cooperates with the door lock software. Since the keyless entry system operates in the +B state, the software in each ECU also operates in the +B state.

[0186] Receiving section 9 The receiving unit 1, for example, compares the version information included in the updated software information sent from the server with the version information recorded in the ECU table, and determines whether the software has been updated. 9 1 requests update data from server 2 and downloads it. 9 1, for example, temporarily records the downloaded update data in the storage unit 23.

[0187] In addition, the receiving section9 1 may receive the first update data and the second update data from an external device while the power supply state is the first power supply state. For example, update data for updating door lock software, which is +B software, and window software, which is IG software, may be downloaded during the +B state, i.e., when the vehicle is in a state in which it cannot run, for example, while the vehicle is stopped. By downloading the update data while the vehicle is stopped, it is possible to start transmitting the update data and installing the IG software to an ECU in which the +B software is not installed but the IG software is installed, as soon as the power supply state transitions to the IG state.

[0188] [2.3.2 Composition section] The synthesis unit 92 has a function of creating synthesized update data from the first update data and the second update data for installing synthesized software including a first function which is a function of the first software after the update and a second function which is a function of the second software after the update.

[0189] Specifically, for example, the control unit 22 reads out the first update data and the second update data downloaded from the server 2 from the storage unit 23 in which they are temporarily stored. Next, the control unit 22 adds predetermined information to the beginning and end of the data to join the first update data and the second update data together to create combined update data for installing the combined software. Examples of the predetermined information include information indicating the beginning of the data, information indicating the end of the data, and information indicating the destination ECU. The portion of the combined update data corresponding to the first update data includes a first function that is a function of the first software after the update, and the portion corresponding to the second update data includes a second function that is a function of the second software after the update.

[0190] 5 and 6, for the first ECU 12, the window software, which is the IG software, is listed in Fig. 5, and the door lock software, which is the B software, is listed in Fig. 6. Therefore, the synthesis unit 92 creates synthesized update data including the functions of the window software and the door lock software from the first update data for installing the door lock software and the second update data for installing the window software.

[0191] [2.3.3 Transmitter] The transmission unit 93 transmits the information to the in-vehicle device having a storage unit. memory and transmitting the composite update data to the in-vehicle device in order to install the composite software in the in-vehicle device and activate the first function when the power state of the vehicle is the first power state and to activate the second function when the power state of the vehicle is the second power state.

[0192] Specifically, the control unit 22 transmits the combination update data created by the combination unit to the communication bus 14b via, for example, the transceiver 25b. The transmitted combination update data propagates through the communication bus 14b and reaches the transceiver 35 of the first ECU 12. The control unit 32 receives the combination update data that has reached the transceiver 35. The control unit 32 temporarily stores the received combination update data in the first storage unit 33 or a RAM (not shown).

[0193] In the case of Figures 5 and 6, the transmission unit 93 transmits to the door ECU combined update data created from first update data for installing door lock software and second update data for installing window software.

[0194] When the first ECU 12 receives the combined update data, the first ECU 12 installs the combined software in accordance with the received combined update data in the first storage unit 33. For example, the combined update data is transmitted from the transmission unit 93, and after reception of the transmitted combined update data is completed, the control unit 32 of the first ECU 12 installs the combined software in the first storage unit 33 based on the temporarily stored combined update data. In the cases of Figures 5 and 6, the door ECU installs door lock software and window software in the first storage unit 33.

[0195] As another example, when the transmission unit 93 transmits the combined update data, the update management ECU 11 transmits an installation instruction, which is an instruction to install the combined software in the first storage unit 33 by the combined update data, to the first ECU 12. Then, the first ECU 12 that receives the installation instruction is configured to install the combined software.

[0196] [2.3.4 Judgment part] The determination unit 94 has a function of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state.

[0197] Specifically, the determination unit 94 detects the power supply state of the vehicle, for example, and determines whether the detected power supply state is the +B state or the IG state. The detection of the power supply state of the vehicle may be performed by the update management ECU 11, or may be performed by a power supply monitoring ECU (not shown) that monitors the power supply state of the vehicle. In the case of the +B state, for example, the voltage of a power supply bus connected to an electric device to which power is directly supplied from the vehicle battery is detected, and if the voltage is equal to or higher than a predetermined voltage, the state is determined to be the +B state. In the case of the IG state, for example, the voltage of a power supply bus that supplies power to an ECU that operates when the vehicle starts to run when the accelerator is depressed, for example, an engine control ECU, is detected, and if the voltage is equal to or higher than a predetermined voltage, the state is determined to be the IG state. Note that if the state is +B state and IG state, the state is determined to be the IG state.

[0198] [2.3.5 First instructions Department] The first instruction unit 95 has a function of transmitting a first activation instruction to the in-vehicle device for activating the first function when the determination unit determines that the power supply state of the vehicle is the first power supply state.

[0199] Specifically, the first instruction unit 95 refers to an ECU table stored in the storage unit 23, for example, the contents shown in FIG. 5 and FIG. 6. From the referred ECU table, the first instruction unit 95 obtains information indicating in which power state the system is executed by software that operates. In the example of FIG. 5 and FIG. 6, the door lock software that executes the keyless entry system operates in both the +B state and the IG state. Therefore, when the power state is the +B state, the first instruction unit 95 transmits a first activation instruction to the door ECU to activate the function of the door lock software of the updated composite software installed in the first storage unit 33. For example, when the first activation instruction is received, the first ECU 12 is configured to activate the first function of the composite software installed in the first storage unit 33.

[0200] It is preferable that the first activation instruction is transmitted to the in-vehicle device after the software is installed by the update data. This is because the software cannot be activated during installation. For example, the first instruction unit 95 is configured to wait for transmission for a predetermined time. In another example, the in-vehicle device is configured to transmit installation completion information, which is information indicating that the installation of the software has been completed, to the update management device after the installation of the software is completed. Then, when the installation completion information is received, the first instruction unit 95 is configured to transmit the first activation instruction.

[0201] [2.3.6 Second instructions Department] Second instructionsThe unit 96 has a function of transmitting a second activation instruction to the in-vehicle device for activating the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0202] In the examples of FIGS. 5 and 6, the second instructions The unit 96 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIG. 5 and FIG. 6. instructions The unit 96 obtains information indicating in which power state the system is executed by the operating software. In the example of FIG. 5, the rainy weather window closing system is executed by the window software and the raindrop detection software operating in the IG state, so when the power state is the IG state, the second instruction unit 96 transmits a second activation instruction to the door ECU to activate the function of the updated window software installed in the first storage unit 33. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the raindrop detection software. The first ECU 12 that receives the second activation instruction activates the function of the updated software. For example, when the second activation instruction is received, the first ECU 12 is configured to activate the function of the first software and the function of the second software installed in the first storage unit 33.

[0203] For the same reason as for the first instruction unit, it is preferable that the second instruction unit transmits the second activation instruction to the in-vehicle device after the software has been installed by the update data.

[0204] [2.4 Control method] Fig. 10 is a flowchart showing an example of a control method executed by the update management ECU 11 according to the second embodiment. The order of the steps shown in Fig. 10 may be changed as appropriate. A series of control methods will be described with reference to Fig. 10. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is the +B state.

[0205] The control executed by the update management ECU 11 is executed by an information processing unit 21. When the information processing unit 21 executes the control, a control unit 22 reads a computer program from a storage unit 23 and executes various calculations and processes. Moreover, the control executed by the first ECU 12 is executed by an information processing unit 31. When the information processing unit 31 executes the control, the control unit 32 reads a computer program from the first storage unit 33 and executes various calculations and processes.

[0206] [2.4.1 Step S301] First, the receiving unit 91 of the update management ECU 11 receives, from an external device of the vehicle, first update data for updating the first software that operates in the first power supply state and the second power supply state, and second update data for updating the second software that does not operate in the first power supply state but operates in the second power supply state (step S301).Then, the update management ECU 11 proceeds to step S302.

[0207] Specifically, the receiving unit 91 downloads the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12.

[0208] The receiving unit 91 of the update management ECU 11, for example, compares the update software information (including information indicating the version) sent from the server with the ECU table recorded in the storage unit 23 to determine whether the software has been updated. For example, the software versions are compared to determine whether the software has been updated. If it is determined that the software has been updated, the receiving unit 91 requests the update data from the server 2 and downloads it. The receiving unit 91, for example, temporarily records the downloaded update data in the storage unit 23. After the download is completed, the process proceeds to step S302.

[0209] [2.4.2 Step S302] Next, the synthesis unit 92 of the update management ECU 11 creates synthesis update data for installing synthesis software including a first function, which is a function of the first software after the update, and a second function, which is a function of the second software after the update, from the first update data and the second update data (step S302).Then, the update management ECU 11 proceeds to step S303.

[0210] Specifically, for example, the control unit 22 reads out the first update data and the second update data downloaded from the server 2 from the storage unit 23 in which they are temporarily stored. Next, the control unit 22 adds predetermined information to the beginning and end of the data, and connects the first update data and the second update data to create combined update data for installing the combined software. Examples of the predetermined information include information indicating the beginning of the data, information indicating the end of the data, and information indicating the destination ECU. The combined software installed by the combined update data has a portion corresponding to the first update data that includes a first function that is a function of the first software after the update, and a portion corresponding to the second update data that includes a second function that is a function of the second software after the update. After creating the combined update data, the update management ECU 11 proceeds to step S303.

[0211] [2.4.3 Step S303] Next, the transmission unit 93 of the update management ECU 11 transmits the update information to the in-vehicle device having the storage unit. memoryThe update management ECU 11 then transmits the combined update data to the in-vehicle device in order to install the combined software in the in-vehicle device, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state (step S303). Then, the update management ECU 11 proceeds to step S304.

[0212] Specifically, the control unit 22 transmits the combination update data created by the combination unit to the communication bus 14b via, for example, the transceiver 25b. The transmitted combination update data propagates through the communication bus 14b and reaches the transceiver 35 of the first ECU 12. The control unit 32 receives the combination update data that has reached the transceiver 35. The control unit 32 temporarily stores the received combination update data in the first storage unit 33 or a RAM (not shown).

[0213] 5 and 6, the transmission unit 93 transmits to the door ECU the combined update data for installing the combined software including the door lock software function and the window software function. Then, the update management ECU 11 performs step S30. 4 Proceed to.

[0214] When the first ECU 12 receives the combined update data, the first ECU 12 installs the combined software including the functions of the +B software and the IG software according to the received combined update data in the first storage unit 33. In the cases of Fig. 5 and Fig. 6, the door ECU installs the combined software including the functions of the door lock software and the window software in the first storage unit 33.

[0215] [2.4.4 Step S304] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 95 of the update management ECU 11 transmits a first activation instruction for activating the first function to the in-vehicle device (step S304). Then, the update management ECU 11 proceeds to step S305.

[0216] Specifically, the first instruction unit 95 refers to an ECU table stored in the storage unit 23, for example, the contents shown in Figs. 5 and 6. From the referred ECU table, the first instruction unit 95 obtains information indicating in which power state the system is executed by software that operates. In the example of Figs. 5 and 6, the door lock software function that executes the keyless entry system operates in both the +B state and the IG state, so when the power state is the +B state, the first instruction unit 95 transmits a first activation instruction to the door ECU to activate the door lock software function of the updated composite software installed in the first storage unit 33. Then, the first ECU 12 that receives the first activation instruction activates the function of the first software of the composite software.

[0217] [2.4.5 Step S305] Next, the determination unit 94 of the update management ECU 11 determines whether the power supply state of the vehicle is the first power supply state or the second power supply state (step S305). If the determination unit 94 determines that the power supply state of the vehicle is the second power supply state, i.e., the IG state, the update management ECU 11 proceeds to step S306. On the other hand, if the determination unit 94 determines that the power supply state of the vehicle is the first power supply state, i.e., the +B state, the update management ECU 11 returns to step S305 and repeats step S305. That is, the update management ECU 11 is waiting for the power supply state of the vehicle to transition from the +B state to the IG state.

[0218] [2. 4 .6 Step S306 Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 96 transmits a second activation instruction for activating the second function to the in-vehicle device (step S306). Then, the update management ECU 11 ends a series of processes.

[0219] In the examples of FIGS. 5 and 6, the second instructionsThe unit 96 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIG. 5 and FIG. 6. instructions The unit 96 obtains information indicating the function of the software that operates in which power state the system is executed. In the example of FIG. 5, the rainy weather window closing system is executed by the function of the window software that operates in the IG state and the function of the raindrop detection software, so when the power state is the IG state, the second instruction unit 96 transmits a second activation instruction to the door ECU to activate the function of the window software of the updated composite software installed in the first storage unit 33. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the function of the raindrop detection software. Then, the first ECU 12 that receives the second activation instruction activates the function of the second software of the installed composite software.

[0220] For the same reason as for the first instruction unit, it is preferable that the second instruction unit transmits the second activation instruction to the in-vehicle device after the software has been installed by the update data.

[0221] [2.5 Control Sequences] Next, the control sequence of the update management system 1 will be described. Fig. 11 is a sequence diagram of the update management system according to the second embodiment. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is +B state. After that, the power supply state transitions from +B state to IG state.

[0222] [2.5.1 Step S401] First, the receiving unit 91 of the update management ECU 11 receives, from an external device of the vehicle, first update data for updating the first software that operates in the first power supply state and the second power supply state, and second update data for updating the second software that does not operate in the first power supply state but operates in the second power supply state (step S401).Then, the update management system 1 proceeds to step S402.

[0223] Specifically, the receiving unit 91 downloads the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12. After the download is completed, the process proceeds to step S402.

[0224] [2.5.2 Step S402] Next, the synthesis unit 92 of the update management ECU 11 creates synthesis update data for installing synthesis software including a first function, which is a function of the first software after the update, and a second function, which is a function of the second software after the update, from the first update data and the second update data (step S402).Then, the update management system 1 proceeds to step S403.

[0225] Specifically, for example, the control unit 22 reads out the first update data and the second update data downloaded from the server 2 from the storage unit 23 in which they are temporarily stored. Next, the control unit 22 adds predetermined information to the beginning and end of the data, and connects the first update data and the second update data to create combined update data for installing the combined software. Examples of the predetermined information include information indicating the beginning of the data, information indicating the end of the data, and information indicating the destination ECU. The combined software installed by the combined update data has a portion corresponding to the first update data that includes a first function that is a function of the first software after the update, and a portion corresponding to the second update data that includes a second function that is a function of the second software after the update. After creating the combined update data, the update management system 1 proceeds to step 403.

[0226] [2.5.3 Step S403] Next, the transmission unit 93 of the update management ECU 11 transmits the update information to the in-vehicle device having the storage unit. memory The update management system 1 then transmits the combined update data to the in-vehicle device in order to install the combined software in the in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state (step S403).Then, the update management system 1 proceeds to step S404.

[0227] 5 and 6, the transmitter 93 transmits to the door ECU the combined update data created from the second update data for installing the combined software including the door lock software function and the window software function. Then, the update management system 1 proceeds to step S404.

[0228] [2.5.4 Step S404] Next, when the first ECU 12 receives the combined update data, the first ECU 12 installs the combined software including the functions of the +B software and the IG software according to the received combined update data in the first storage unit 33 (step S404). In the case of Fig. 5 and Fig. 6, the door ECU installs the combined software including the functions of the door lock software and the functions of the window software in the first storage unit 33. After the first ECU 12 installs the software, the update management system 1 proceeds to step S405.

[0229] [2.5.5 Step S405] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 95 of the update management ECU 11 transmits a first activation instruction for activating the first function to the in-vehicle device (step S405). Then, the update management system 1 proceeds to step S406.

[0230] Specifically, the first instruction unit 95 refers to an ECU table stored in the storage unit 23, for example, the contents shown in Figs. 5 and 6. From the referred ECU table, the first instruction unit 95 obtains information indicating in which power state the system is executed by software that operates. In the example of Figs. 5 and 6, the door lock software function that executes the keyless entry system operates in both the +B state and the IG state, so when the power state is the +B state, the first instruction unit 95 transmits a first activation instruction to the door ECU to activate the door lock software function of the post-update composite software installed in the first storage unit 33. After transmission, the update management system 1 proceeds to step S406.

[0231] [2.5.6 Step S406] Next, the first ECU 12 that has received the first activation instruction activates the function of the first software (step S406). In the example of Figures 5 and 6, the function of the door lock software that executes the keyless entry system is a function of the +B software that operates in both the +B state and the IG state, so the first ECU 12 activates the function of the door lock software of the post-update combined software installed in the first storage unit 33. Then, the update management system 1 proceeds to step S407.

[0232] [2.5.7 Step S407] Next, the determination unit 94 of the update management ECU 11 determines whether the power supply state of the vehicle is the first power supply state or the second power supply state (step S407). If the determination unit 94 determines that the power supply state of the vehicle is the second power supply state, i.e., the IG state, the update management ECU 11 proceeds to step S408. On the other hand, if the determination unit 94 determines that the power supply state of the vehicle is the first power supply state, i.e., the +B state, the update management ECU 11 returns to step S407 and repeats step S408. That is, the update management ECU 11 is waiting for the power supply state of the vehicle to transition from the +B state to the IG state.

[0233] [2.5.8 Step S408] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 96 transmits a second activation instruction for activating the second function to the in-vehicle device (step S408). Then, the update management system 1 proceeds to step S409.

[0234] In the examples of FIGS. 5 and 6, the second instructions The unit 96 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIG. 5 and FIG. 6. instructionsThe unit 96 obtains information indicating in which power state the system is executed by the software function that operates in. In the example of Fig. 5, the rainy weather window closing system is executed by the window software function that operates in the IG state and the raindrop detection software function, so when the power state is the IG state, the second instruction unit 96 transmits a second activation instruction to the door ECU for activating the window software function of the post-update composite software installed in the first storage unit 33. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU for activating the raindrop detection software.

[0235] [2.5.9 Step S409] Next, the first ECU 12 that has received the second activation instruction activates the function of the updated software (step S409). In the cases of Fig. 5 and Fig. 6, the first ECU 12 activates the function of the window software installed in the first storage unit 33. In addition, if the activation instruction has been sent to the second ECU 13, the second ECU 13 activates the function of the installed raindrop detection software. Then, the update management system 1 ends the series of processes.

[0236] [2.6 Summary] There are known vehicles equipped with multiple ECUs and having multiple power states, including a +B state, an IG state, etc. In such vehicles, when the software of the ECU is updated, there is a risk that multiple pieces of software that work together to execute a specific system will be activated in different power states, and one piece of software may not be able to understand an instruction issued by the other piece of software, causing the specific system to not operate.

[0237] According to this embodiment, the update management device creates composite update data from multiple update data in advance, and transmits the update data to the in-vehicle device for installing and activating the software in the storage unit of the in-vehicle device. The update management device then installs the software in the in-vehicle device using the update data. The update management device then activates the installed software according to the power supply state of the vehicle. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply state, and the function of the software of multiple ECUs working in conjunction with each other operates without any discrepancies.

[0238] In addition, when the +B software and the IG software are installed in the first ECU and the IG software is installed in the second ECU, and the IG software of the first ECU and the IG software of the second ECU work together to execute a predetermined system, it is preferable to simultaneously transmit an activation command to the IG software of the first ECU and the IG software of the second ECU to activate them. This further suppresses discrepancies such as the IG software of the first ECU and the IG software of the second ECU being unable to understand a command issued by the IG software of the first ECU being explicitly activated at the same time.

[0239] [3.1 Supplement 1] The present disclosure includes the following control method for an update management device. A control method for an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the control method including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining step of determining whether the power state of the vehicle is the first power state or the second power state, a first transmission step of the in-vehicle device, which has a first storage unit and a second storage unit, installing the updated first software in the first storage unit and transmitting the first update data to the in-vehicle device to activate the updated first software by the determining step, and Steps and a second transmission step of transmitting the first update data and the second update data to the in-vehicle device when the power supply state of the vehicle is determined to be the second power supply state by the determination step, in order for the in-vehicle device to install the updated first software and the updated second software into the second storage unit and to activate the updated first software and the updated second software.

[0240] [3.2 Supplement 2] The present disclosure includes the following control method for an update management device. The control method of the update management device described in Supplementary Note 1 further includes a first activation instruction step of sending to the in-vehicle device a first activation instruction for activating the updated first software installed in the first memory unit when the power supply state of the vehicle is determined to be the first power supply state by the determination step, and a second activation instruction step of sending to the in-vehicle device a second activation instruction for activating the updated first software and the updated second software installed in the second memory unit when the power supply state of the vehicle is determined to be the second power supply state by the determination step.

[0241] [3.3 Supplement 3] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, the control method including the update management device including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining step of determining whether the power state of the vehicle is the first power state or the second power state, a first transmission step of the in-vehicle device, which includes a first storage unit and a second storage unit, installing the updated first software in the first storage unit and transmitting the first update data to the in-vehicle device in order to activate the updated first software, and a second transmission step of the in-vehicle device transmitting the second update data to the in-vehicle device in order to activate the updated first software, when it is determined by the determining step that the power state of the vehicle is the second power state. a second transmission step of transmitting the first update data and the second update data to the in-vehicle device in order to install the updated first software and the updated second software in a storage unit and activate the updated first software and the updated second software; a first activation instruction step of transmitting a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit when it is determined in the determination step that the power supply state of the vehicle is the first power supply state; and a second activation instruction step of transmitting a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when it is determined in the determination step that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device activates the updated first software installed in the first storage unit when it receives the first activation instruction;and a second activation step of activating the updated first software and the updated second software installed in the second storage unit when the second activation instruction is received.

[0242] [3.4 Supplement 4] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, the control method including a receiving step in which the update management device receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determination step in which the update management device determines whether the power state of the vehicle is the first power state or the second power state, and a control method for an update management system including a first storage unit and a second storage unit, the update management device performs a control process for the update management device to receive, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, when it is determined in the determination step that the power state of the vehicle is the first power state, the update management device performs a control process for the update management device to receive, from an external device of the vehicle, first update data for updating the first software that operates in the first power state and the second power state, and The method includes a first transmission step of transmitting update data to the in-vehicle device; a second transmission step of the update management device transmitting the first update data and the second update data to the in-vehicle device when it is determined in the determination step that the power supply state of the vehicle is the second power supply state, in order for the in-vehicle device to install the updated first software and the updated second software in the second storage unit; a first activation step of the in-vehicle device activating the updated first software installed in the first storage unit by the first update data transmitted in the first transmission step; and a second activation step of the in-vehicle device activating the updated first software and the updated second software installed in the second storage unit by the first update data and the second update data transmitted in the second transmission step.

[0243] [3.5 Supplement 5] The present disclosure includes the following control method for an update management device. A control method for an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the control method comprising the steps of: receiving, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state; creating, from the first update data and the second update data, combined update data for installing combined software including a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and storing the combined update data in the in-vehicle device having a storage unit. memory and a transmitting step of transmitting the composite update data to the in-vehicle device to install the composite software in a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state.

[0244] [3.6 Supplement 6] The present disclosure includes the following control method for an update management device. The control method of the update management device described in Addendum 4 further includes a determination step of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state, a first activation instruction step of sending a first activation instruction to the in-vehicle device for activating the first function when the power supply state of the vehicle is determined to be the first power supply state by the determination step, and a second activation instruction step of sending a second activation instruction to the in-vehicle device for activating the second function when the power supply state of the vehicle is determined to be the second power supply state by the determination step.

[0245] [3.7 Supplement 7] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device for managing software updates of an in-vehicle device and the in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management device performing a receiving step of receiving, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state, a combining step of creating combined update data from the first update data and the second update data for installing combined software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update, and a storage unit storing the combined update data. memory a transmitting step of transmitting the combined update data to the in-vehicle device in order to install the combined software in a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state; a determining step of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state; a first activation instruction step of transmitting a first activation instruction to the in-vehicle device to activate the first function when the power supply state of the vehicle is determined to be the first power supply state by the determining step; Steps and a second activation instruction step of transmitting a second activation instruction to the in-vehicle device for activating the second function when the power supply state of the vehicle is determined to be the second power supply state by the determination unit, wherein the in-vehicle device includes a first activation step of activating the first function when the in-vehicle device receives the first activation instruction, and a second activation step of activating the second function when the in-vehicle device receives the second activation instruction.

[0246] [3.8 Supplement 8] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device for managing software updates of an in-vehicle device and the in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the control method including a receiving step in which the update management device receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power state and the second power state, and second update data for updating a second software that does not operate in the first power state but operates in the second power state; a combining step in which the update management device creates combined update data from the first update data and the second update data, for installing combined software including a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and a storage unit in the in-vehicle device storing the stored update data. memory a transmitting step of the update management device transmitting the combined update data to the in-vehicle device in order to install the combined software in the in-vehicle device; memory a first activation step of activating the first function of the composite software installed in the vehicle-mounted device by the vehicle-mounted device; and memory and a second activation step in which the in-vehicle device activates the second function of the combined software installed in the in-vehicle device.

[0247] [3.9 Supplement 9] In addition, at least a part of the above-mentioned embodiment and various modified examples may be arbitrarily combined with each other. In addition, the embodiment and modified examples disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present disclosure is indicated by the claims, and it is intended to include all modifications within the meaning and scope equivalent to the claims. [Explanation of symbols]

[0248] 1 Update Management System 2 Server 3. Network 11 Update management ECU 12 1st ECU 13 2nd ECU 14a Communication bus 14b Communication bus 15. Communications Equipment 21 Information Processing Section 22 Control section 23 Memory section 24 Internal Bus 25a transceiver 25b Transceiver 31 Information Processing Section 32 Control section 33 1st memory section 34 2nd memory section 35 Transceiver 36 Input section 37 Output section 38 Internal Bus 41 Receiving section 42 Judgment section 43 First Transmission Unit 44 Second Transmission Unit 45 1st instruction section 46 2nd instruction part 47 1st erasure instruction section 48 Second erasure instruction section 91 Receiving section 92 Synthesis section 93 Transmitter 94 Judgment section 95 1st instruction section 96 2nd instruction part

Claims

1. 1. An update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power supply state and the second power supply state, and second update data for updating a second software that does not operate in the first power supply state but operates in the second power supply state; a synthesis unit that creates, from the first update data and the second update data, synthesized update data for installing synthesized software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update; a transmission unit that transmits the combined update data to the in-vehicle device so that the in-vehicle device has a storage unit, the combined software is installed in the storage unit, the first function is activated when the power supply state of the vehicle is the first power supply state, and the second function is activated when the power supply state of the vehicle is the second power supply state; An update management device comprising:

2. The update management device further comprises: a determination unit that determines whether a power supply state of the vehicle is the first power supply state or the second power supply state; a first instruction unit that transmits a first activation instruction to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit that transmits a second activation instruction to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state; and The update management device of claim 1 .

3. The determination unit is when it is determined that the power supply state of the vehicle is the first power supply state, storing information indicating that the power supply state is the first power supply state in a state storage unit that stores information indicating a power supply state; when it is determined that the power supply state of the vehicle is the second power supply state, storing information indicating the second power supply state in the state storage unit; the first instruction unit refers to the state storage unit, and when information indicating the first power supply state is stored, transmits the first activation instruction to the in-vehicle device; the second instruction unit refers to the state storage unit, and when information indicating the second power supply state is stored, transmits the second activation instruction to the in-vehicle device. The update management device according to claim 2 .

4. 2. The update management device according to claim 1, wherein the first power state is a power state when the vehicle is in a state in which it cannot run, and the second power state is a power state when the vehicle is in a state in which it can run.

5. the receiving unit receives the first update data and the second update data from the external device while the power supply state is the first power supply state; The update management device according to claim 1 .

6. The update management device according to any one of claims 1 to 5; The in-vehicle device; An update management system comprising:

7. 1. An update management system for a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management system including an update management device for managing software updates of an in-vehicle device and the in-vehicle device, The update management device includes: a receiving unit that receives, from an external device of the vehicle, first update data for updating a first software that operates in the first power supply state and the second power supply state, and second update data for updating a second software that does not operate in the first power supply state but operates in the second power supply state; a synthesis unit that creates, from the first update data and the second update data, synthesized update data for installing synthesized software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update; a transmission unit that transmits the combined update data to the in-vehicle device so that the in-vehicle device has a storage unit, the combined software is installed in the storage unit, the first function is activated when the power supply state of the vehicle is the first power supply state, and the second function is activated when the power supply state of the vehicle is the second power supply state; a determination unit that determines whether a power supply state of the vehicle is the first power supply state or the second power supply state; a first instruction unit that transmits a first activation instruction to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit that transmits a second activation instruction to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state, for activating the second function, The in-vehicle device includes: a first activation unit that activates the first function when the first activation instruction is received; a second activation unit that activates the second function when the second activation instruction is received. Update management system.

8. The determination unit is when it is determined that the power supply state of the vehicle is the first power supply state, storing information indicating that the power supply state is the first power supply state in a state storage unit that stores information indicating a power supply state; when it is determined that the power supply state of the vehicle is the second power supply state, storing information indicating the second power supply state in the state storage unit; the first instruction unit refers to the state storage unit, and when information indicating the first power supply state is stored, transmits the first activation instruction to the in-vehicle device; the second instruction unit refers to the state storage unit, and when information indicating the second power supply state is stored, transmits the second activation instruction to the in-vehicle device. The update management system according to claim 7.

9. 1. A computer program for controlling an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power supply state and the second power supply state, and second update data for updating second software that does not operate in the first power supply state but operates in the second power supply state; a synthesis step of generating, from the first update data and the second update data, synthesized update data for installing synthesized software including a first function that is a function of the first software after the update and a second function that is a function of the second software after the update; a transmitting step of transmitting the combined update data to the in-vehicle device, the in-vehicle device having a storage unit, so that the combined software is installed in the storage unit, the combined update data is transmitted to the in-vehicle device, the combined update data being transmitted to the in-vehicle device so that the combined software is installed in the storage unit, the combined update data being transmitted to the in-vehicle device so that the combined update data is transmitted to the in-vehicle device when the power supply state of the vehicle is the first power supply state, and the combined update data is transmitted to the in-vehicle device so that ... when the power supply state of the vehicle is the second power supply state, and the combined update data is transmitted to the in-vehicle device so that A computer program for controlling an update management device comprising:

Images