Server for update of software, update program of software, and update method of software

Abstract

To suppress that update software having a defect is applied to a vehicle.SOLUTION: A server for update of software comprises an execution device, and a storage device. The storage device stores campaign information including information which designates an object vehicle of update processing of the software, and the information which designates update software to be applied to a controller mounted in the object vehicle. The storage device stores accompanying information which indicates the information on whether or not the update software itself has a defect, for each update software. The execution device stores the accompanying information in the storage device based on input from the outside. The execution device, when the accompanying information indicates that the update software itself has the defect, about the campaign information which designates the update software having the defect, forbids the update processing according to the campaign information (S22).SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a software update server, a software update program, and a software update method. [Background technology]

[0002] The software update system described in Patent Document 1 includes an update server that distributes software, and a vehicle. The vehicle includes a master device and a plurality of control devices. The update server transmits a campaign notification to the master device of the vehicle when executing a software update for the control device of the vehicle. The master device receives the campaign notification and, when consent to the software update is obtained from the user of the vehicle, executes processing related to the software update for the control device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2022-109039 Summary of the Invention [Problem to be solved by the invention]

[0004] In a software update system such as that described in Patent Document 1, the possibility cannot be denied that the new software to be updated may have bugs or other defects. If the software itself has a defect, it is necessary to immediately prevent the software from being applied to each vehicle. [Means for solving the problem]

[0005] A software update server for solving the above problem comprises an execution device and a storage device, and the storage device stores campaign information including information specifying a target vehicle for the software update process and information specifying the update software to be applied to a control device installed in the target vehicle, and associated information indicating, for each update software, whether or not the update software itself has a defect, and the execution device stores the associated information in the storage device based on external input, and, if the associated information indicates that the update software itself has a defect, prohibits the update process corresponding to the campaign information that specifies the defective update software.

[0006] A software update program for solving the above problem is targeted at an update server having an execution device and a storage device, and the storage device stores campaign information including information specifying a target vehicle for the software update process and information specifying the update software to be applied to a control device installed in the target vehicle, and associated information for each update software indicating whether or not the update software itself has a defect, and causes the execution device to store the associated information in the storage device based on external input, and, if the associated information indicates that the update software itself has a defect, prohibit the update process corresponding to the campaign information that specifies the defective update software.

[0007] A software update method for solving the above problem targets an update server having an execution device and a storage device, and the storage device stores campaign information including information specifying a target vehicle for the software update process and information specifying the update software to be applied to a control device installed in the target vehicle, and for each update software, associated information indicating whether or not the update software itself has a defect, and the execution device stores the associated information in the storage device based on external input, and when the associated information indicates that the update software itself has a defect, prohibits the update process corresponding to the campaign information that specifies the defective update software. Effect of the Invention

[0008] According to the above configuration, if the update software has a defect such as a bug, all update processes corresponding to the campaign information that specifies the update software are prohibited. Therefore, for example, if an administrator of the update server inputs accompanying information, it is possible to collectively prevent the update software with the defect from being applied to the control device of each vehicle. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram of an update system. [Diagram 2] FIG. 2 is an explanatory diagram of campaign information. [Diagram 3] FIG. 3 is a flowchart showing the determination control. [Figure 4] FIG. 4 is a sequence diagram showing the acquisition control. [Diagram 5] FIG. 5 is a sequence diagram showing update control. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] <Outline of update system configuration> An embodiment of the present invention will now be described with reference to Figures 1 to 5. First, a schematic configuration of an update system US will be described.

[0011] As shown in Fig. 1, the update system US includes a plurality of vehicles 100. The vehicles 100 are, for example, automobiles owned by users. Note that Fig. 1 illustrates only one vehicle 100 as a representative example.

[0012] The vehicle 100 includes a central ECU 10, a powertrain ECU 20, a brake ECU 30, an advanced driving assistance ECU 40, and a DCM 50. The vehicle 100 also includes a first external bus 61, a second external bus 62, a third external bus 63, and a fourth external bus 64. "ECU" is an abbreviation for Electronic Control Unit. "DCM" is an abbreviation for Data Communication Module. In this embodiment, each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 is an example of a control device in which software is updated.

[0013] The central ECU 10 controls the entire vehicle 100. The central ECU 10 includes a CPU 11, a ROM 12, a RAM 13, a storage 14, and an internal bus 15. The internal bus 15 connects the CPU 11, the ROM 12, the RAM 13, and the storage 14 so that they can communicate with each other. The ROM 12 stores various programs and various data in advance. The ROM 12 also stores a master program 12A, which is executed when updating software, as one of the various programs. The RAM 13 is a volatile memory. The RAM 13 temporarily stores various programs and various data. The CPU 11 uses the RAM 13 as a working area to read out the programs in the ROM 12 and executes various processes. The CPU 11 also reads out the master program 12A and executes various processes related to the software update process of the control device. That is, the central ECU 10 functions as a master device for updating the software of the control device.

[0014] The storage 14 can store various programs and various data. The storage 14 is an electrically rewritable non-volatile memory. For example, the storage 14 is a NAND type flash memory.

[0015] The storage 14 prestores vehicle configuration information IV. The vehicle configuration information IV includes software information and vehicle identification information. Here, the software information is information indicating software for each ECU and the version of the software. Moreover, the vehicle identification information is information indicating the type and identification number of the vehicle 100.

[0016] The DCM 50 is connected to the central ECU 10 via a first external bus 61. The DCM 50 is capable of wireless communication with devices outside the vehicle 100 via a communication network NW. Therefore, the central ECU 10 is capable of wireless communication with devices outside the vehicle 100 via the first external bus 61 and the DCM 50.

[0017] The powertrain ECU 20 can communicate with the central ECU 10 via a second external bus 62. The powertrain ECU 20 executes various processes for controlling an engine, a transmission, and the like (not shown). The powertrain ECU 20 includes a CPU 21, a ROM 22, a RAM 23, a storage 24, and an internal bus 25. The internal bus 25 connects the CPU 21, the ROM 22, the RAM 23, and the storage 24 so that they can communicate with each other. The ROM 22 stores various programs and various data in advance. The ROM 22 also stores a control program 22A in advance as one of the various programs. The ROM 22 is a so-called EPROM (Erasable Programmable Read Only Memory). That is, the control program 22A stored in the ROM 22 is updatable. The ROM 22 is a so-called dual-sided ROM having two data storage areas. That is, even if the ROM 22 is in an ON state, the software can be installed in a storage area different from the storage area of ​​the data used in the ON state. The RAM 23 is a volatile memory. The RAM 23 temporarily stores various programs and various data. The CPU 21 uses the RAM 23 as a working area and executes various processes by reading out the programs in the ROM 22. The CPU 21 also executes various processes for controlling the engine, transmission, etc. by reading out the control program 22A.

[0018] The storage 24 can store various programs and various data. The storage 24 is an electrically rewritable non-volatile memory. For example, the storage 24 is a NOR type flash memory.

[0019] The brake ECU 30 can communicate with the central ECU 10 via a third external bus 63. The brake ECU 30 controls a brake device (not shown). The internal configuration of the brake ECU 30 is similar to the internal configuration of the powertrain ECU 20. That is, the brake ECU 30 includes a CPU 31, a ROM 32, a RAM 33, a storage 34, and an internal bus 35. The ROM 32 stores a control program 32A in advance as one of various programs. The CPU 31 reads out the control program 32A to execute various processes for controlling the brake device.

[0020] The advanced driving assistance ECU 40 can communicate with the central ECU 10 via the fourth external bus 64. The advanced driving assistance ECU 40 executes various application software to realize various driving assistance functions. The various application software includes software for following the vehicle 100 while maintaining a constant distance from a preceding vehicle that is traveling ahead of the vehicle 100, and software for automatically applying the brakes to reduce damage caused by a collision with the vehicle 100. The internal configuration of the advanced driving assistance ECU 40 is similar to that of the powertrain ECU 20. That is, the advanced driving assistance ECU 40 includes a CPU 41, a ROM 42, a RAM 43, a storage 44, and an internal bus 45. The ROM 42 stores a control program 42A in advance as one of various programs. The CPU 41 executes various processes for realizing the above-mentioned various driving assistance functions by reading out the control program 42A.

[0021] As shown in Fig. 1, the vehicle 100 includes a device group made up of a plurality of devices. Examples of these devices are a secondary battery 71 and a display 76. The secondary battery 71 supplies power to the central ECU 10, the powertrain ECU 20, the brake ECU 30, the advanced driving assistance ECU 40, the DCM 50, and the like. Note that Fig. 1 representatively illustrates only the power path connecting the secondary battery 71 and the central ECU 10 and the power path connecting the secondary battery 71 and the powertrain ECU 20.

[0022] The display 76 can display various types of information. The display 76 is a so-called touch panel display. Therefore, the user of the vehicle 100 can input various types of information via the display 76. In other words, the display 76 functions as both an output device that outputs information to the user and an input device that receives information from the user.

[0023] The central ECU 10 outputs a control signal to the display 76 to display various information on the display 76. In addition, the central ECU 10 acquires information input by the user of the vehicle 100 from the display 76.

[0024] As shown in FIG. 1, the update system US includes an update server 200. The update server 200 includes an execution device 210, a storage device 220, and a communication device 230. The communication device 230 is capable of wireless communication with devices outside the update server 200 via a communication network NW. The storage device 220 includes a read-only ROM, a readable and writable volatile RAM, and a readable and writable non-volatile storage. The storage device 220 stores various programs and various data in advance. The storage device 220 stores an update program 220A as one of the various programs. The execution device 210 realizes various processes in the software update method by reading out the update program 220A. An example of the execution device 210 is a CPU.

[0025] As shown in FIG. 1, the storage device 220 stores a plurality of campaign information ICs as various data. The campaign information IC is information about a campaign for performing software update processing of a control device mounted on the vehicle 100. Note that FIG. 1 shows only one campaign information IC as a representative. As shown in FIG. 2, the campaign information IC includes target vehicle information ITV, distribution time information IDT, a prohibition flag FF, and a synchronization assembly AS. The target vehicle information ITV is information specifying the vehicle 100 to be the target of the software update processing. For example, the target vehicle information ITV is information indicating the identification numbers of the plurality of vehicles 100, such as "00001 to 10000". Note that, in this embodiment, the target vehicle information ITV specifies a plurality of vehicles 100 classified by the country in which the vehicle 100 was sold, the sales time of the vehicle 100, the model of the vehicle 100, and the like. In addition, the distribution time information IDT is information that determines the time to distribute the software for software update processing. For example, the distribution time information IDT is information indicating the date and time, such as "*year*month*day*time". The synchronization assembly AS is information that specifies software to be updated simultaneously in the vehicle 100. That is, the synchronization assembly AS specifies one or more pieces of software. Here, the software specified by the synchronization assembly AS is new software to be applied to the control device of the vehicle 100. An example of the software specified by the synchronization assembly AS is one or more of the control program 22A, the control program 32A, and the control program 42A, which are newer versions than the software stored in the vehicle 100. In this embodiment, each of the software specified by the synchronization assembly AS corresponds to update software to be applied to the control device mounted on the vehicle 100. The storage device 220 stores the control program 22A, the control program 32A, and the control program 42A, which are newer versions than the software stored in the vehicle 100, separately from the campaign information IC. The prohibition flag FF is a flag for prohibiting the update process according to the campaign information IC.In this embodiment, when the prohibition flag FF is ON, it indicates that update processing according to the campaign information IC is prohibited. Note that the initial value of the prohibition flag FF is OFF.

[0026] As shown in FIG. 1, the storage device 220 stores a plurality of pieces of associated information IA as various data. The storage device 220 stores a total of three pieces of associated information IA for each update software, that is, corresponding to the control program 22A, the control program 32A, and the control program 42A. Note that FIG. 1 illustrates only one piece of associated information IA as a representative. The associated information IA includes a defect information ID and non-update information IN. The defect information ID is information on whether or not the corresponding update software itself has a defect. Therefore, for example, the defect information ID of the associated information IA corresponding to the control program 22A indicates information on whether or not the control program 22A itself has a defect. In addition, the non-update information IN is information specifying a non-update vehicle in which the corresponding update software should not be updated. Therefore, for example, the non-update information IN of the associated information IA corresponding to the control program 22A is information specifying a non-update vehicle in which the control program 22A should not be updated. In addition, an example of a situation in which a non-update vehicle in the non-update information IN is specified is when the control program 22A does not comply with the laws and regulations of the country in which the vehicle 100 is used. For example, the non-update information IN is information indicating identification numbers of multiple vehicles 100, such as "00001-10000." In this embodiment, for example, every time an administrator of the update server 200 or the like inputs associated information IA via an input device connected to the update server 200, the execution device 210 stores the input associated information IA in the storage device 220. In other words, the execution device 210 stores the associated information IA in the storage device 220 based on an input from outside.

[0027] <Decision control> Next, the determination control executed by the update server 200 will be described with reference to Fig. 3. This determination control is a control for the update server 200 to decide whether or not to prohibit the update process according to the campaign information IC. In this embodiment, the execution device 210 of the update server 200 executes the determination control for the update software corresponding to the associated information IA every time the associated information IA in the storage device 220 is updated.

[0028] 3, when the execution unit 210 of the updating server 200 starts the determination control, it executes the process of step S11. In step S11, the execution unit 210 of the updating server 200 acquires new associated information IA stored in the storage device 220. After step S11, the execution unit 210 advances the process to step S12.

[0029] In step S12, the executing device 210 determines whether or not the update software corresponding to the associated information IA has a defect based on the defect information ID of the associated information IA. In step S12, if the executing device 210 determines that the defect information ID of the associated information IA indicates that the update software itself has a defect (S12: YES), the executing device 210 proceeds to step S21.

[0030] In step S21, the execution device 210 extracts all campaign information ICs that specify defective update software from among the multiple campaign information ICs stored in the storage device 220. Specifically, the execution device 210 extracts the campaign information ICs that specify defective update software based on the synchronous assembly AS of each campaign information IC. After step S21, the execution device 210 advances the process to step S22.

[0031] In step S22, the execution device 210 sets the prohibition flag FF to ON for the campaign information IC extracted in step S21. In other words, for the campaign information IC that specifies the defective update software, the execution device 210 sets the prohibition flag FF of the campaign information IC to ON. After step S22, the execution device 210 ends the current judgment control.

[0032] On the other hand, in step S12 described above, if the executing device 210 determines that the defect information ID of the accompanying information IA indicates that there is no defect in the update software itself (S12: NO), the executing device 210 proceeds to step S13.

[0033] In step S13, the execution device 210 determines whether or not there is a non-update vehicle for which the update software corresponding to the associated information IA should not be updated, based on the non-update information IN of the associated information IA. In step S13, if the execution device 210 determines that there is no non-update vehicle for which the update software should not be updated (S13: NO), the execution device 210 ends the current determination control.

[0034] On the other hand, in step S13, if the execution device 210 determines that there is a non-update vehicle for which the update software should not be updated (S13: YES), the execution device 210 advances the process to step S31.

[0035] In step S31, the execution device 210 extracts all campaign information ICs that specify update software corresponding to the associated information IA and specify a non-updated vehicle as a target for update processing from among the multiple campaign information ICs stored in the storage device 220. Specifically, the execution device 210 extracts campaign information ICs that specify update software and specify a non-updated vehicle as a target for update processing based on the synchronous assembly AS and the target vehicle information ITV of the campaign information IC. At this time, the execution device 210 also extracts campaign information ICs in which the vehicle 100 specified by the target vehicle information ITV of the campaign information IC overlaps with the non-updated vehicle specified by the non-updated information IN of the associated information IA, even if only partially. After step S31, the execution device 210 advances the process to step S32.

[0036] In step S32, the execution device 210 sets the prohibition flag FF to ON for the campaign information IC extracted in step S31. In other words, for the campaign information IC that specifies update software and specifies a non-updated vehicle as a target for update processing, the execution device 210 sets the prohibition flag FF of the campaign information IC to ON. After step S32, the execution device 210 ends the current determination control.

[0037] <Acquisition Control> Next, the acquisition control executed by the update server 200 and the central ECU 10 of the vehicle 100 will be described with reference to Fig. 4. This acquisition control is a control for the update server 200 to acquire the vehicle configuration information IV. Moreover, the acquisition control is executed in parallel between one update server 200 and the central ECU 10 of a plurality of vehicles 100. In this embodiment, the central ECU 10 of the vehicle 100 starts the acquisition control every time the system of the vehicle 100 is started.

[0038] 4, when the CPU 11 of the central ECU 10 starts the acquisition control, it executes the process of step S51. In step S51, the CPU 11 of the central ECU 10 transmits the vehicle configuration information IV to the update server 200. When the execution device 210 of the update server 200 acquires the vehicle configuration information IV, the execution device 210 of the update server 200 advances the process to step S52.

[0039] In step S52, the execution device 210 of the update server 200 determines whether or not a request for software update has occurred for the vehicle 100, based on the vehicle configuration information IV. For example, when the version of the control program 22A stored in the storage device 220 is newer than the version of the control program 22A of the vehicle 100, the execution device 210 of the update server 200 determines that a request for software update has occurred for the vehicle 100. The execution device 210 of the update server 200 executes update control, which will be described later, on the condition that a request for software update has occurred for the vehicle 100. After step S52, the execution device 210 of the update server 200 ends the current acquisition control.

[0040] <Update control> Next, the update control executed by the update server 200 and the central ECU 10 of the vehicle 100 will be described with reference to Fig. 5. This update control is control related to software updates of the vehicle 100. This update control is executed in parallel between one update server 200 and the central ECUs 10 of multiple vehicles 100.

[0041] In this embodiment, the execution device 210 of the update server 200 executes update control of the update software specified by the synchronous assembly AS of the campaign information IC when, for example, both of the following conditions (1) and (2) are satisfied. Note that, in the following, an example in which the update software specified by the synchronous assembly AS is the control program 22A will be used to explain the process of performing update control of the control program 22A.

[0042] Condition (1): In the acquisition control, a request for software update has occurred for the vehicle 100 specified in the target vehicle information ITV of the campaign information IC. Condition (2): The current time must be after the time specified in the distribution time information IDT of the campaign information IC.

[0043] As shown in FIG. 5, when the execution device 210 of the update server 200 starts update control, it executes the process of step S61. In step S61, the execution device 210 of the update server 200 checks the prohibition flag FF of the campaign information IC. If the prohibition flag FF is ON, the execution device 210 of the update server 200 does not execute the processes of steps S62 to S82 and ends the current update control. In other words, for a campaign information IC for which the prohibition flag FF is ON, the execution device 210 of the update server 200 prohibits the transmission of a campaign notification NC corresponding to the campaign information IC. The campaign notification NC will be described later. On the other hand, if the prohibition flag FF is OFF, the execution device 210 of the update server 200 advances the process to step S62.

[0044] In step S62, the execution device 210 of the update server 200 transmits a campaign notification NC corresponding to the campaign information IC to the vehicle 100 for which a software update request has occurred. Here, the campaign notification NC notifies the vehicle 100 for which the update process is targeted by the campaign information IC that the update software is applicable. Therefore, unless the execution device 210 transmits the campaign notification NC, the update process of the update software corresponding to the campaign notification NC is not performed. That is, as described above, when the prohibition flag FF is ON, the execution device 210 prohibits the transmission of the campaign notification NC, thereby prohibiting the update process of the update software corresponding to the campaign information IC. In addition, the campaign notification NC includes information indicating the type of the update software. Note that, in this example, the information indicating the type of the update software is information indicating that the update software is the control program 22A of the powertrain ECU 20. When the CPU 11 of the central ECU 10 acquires the campaign notification NC, the CPU 11 of the central ECU 10 advances the process to step S66.

[0045] In step S66, the CPU 11 of the central ECU 10 confirms with the user of the vehicle 100 whether or not the user agrees to the download of a new control program 22A for updating the control program 22A. Specifically, the CPU 11 of the central ECU 10 outputs a control signal to the display 76 to display on the display 76 an option for whether or not the user agrees to the download of the control program 22A. If the user of the vehicle 100 does not agree, the CPU 11 of the central ECU 10 periodically displays an option for whether or not the user agrees to the download of the control program 22A. On the other hand, if the user of the vehicle 100 agrees, the CPU 11 of the central ECU 10 advances the process to step S71.

[0046] In step S71, the CPU 11 of the central ECU 10 transmits a request signal for requesting transmission of a new control program 22A to the update server 200. When the execution device 210 of the update server 200 receives the request signal, the execution device 210 of the update server 200 advances the process to step S72.

[0047] In step S72, the execution device 210 of the update server 200 transmits a new control program 22A to the central ECU 10 as new software corresponding to the campaign notification NC. In other words, the CPU 11 of the central ECU 10 downloads the new control program 22A from the update server 200. At this time, the CPU 11 of the central ECU 10 stores the new control program 22A in the storage 14 of the central ECU 10. After step S72, the CPU 11 of the central ECU 10 advances the process to step S76.

[0048] In step S76, the CPU 11 of the central ECU 10 confirms with the user of the vehicle 100 whether or not the user agrees to install and activate the new control program 22A in order to update the control program 22A. Specifically, the CPU 11 of the central ECU 10 outputs a control signal to the display 76 to display options for whether or not the user agrees to install and activate the control program 22A on the display 76. If the user of the vehicle 100 does not agree, the CPU 11 of the central ECU 10 periodically displays options for whether or not the user agrees to install and activate the control program 22A. On the other hand, if the user of the vehicle 100 agrees, the CPU 11 of the central ECU 10 advances the process to step S80.

[0049] In step S80, the CPU 11 of the central ECU 10 determines whether a predetermined start condition is satisfied. Here, an example of the start condition is that the system of the vehicle 100 is in an off state. The off state of the system of the vehicle 100 refers to a state in which power is not supplied to each ECU except for the central ECU 10. Therefore, the state in which the vehicle 100 is running and the accessory on state in which each device of the vehicle 100 can be used are the on state. And, the state in which the vehicle 100 cannot run is the off state. If the CPU 11 of the central ECU 10 determines in step S80 that the start condition is not satisfied, the CPU 11 of the central ECU 10 executes the process of step S80 again.

[0050] On the other hand, if the CPU 11 of the central ECU 10 determines in step S80 that the start condition is satisfied, the CPU 11 of the central ECU 10 advances the process to step S81.

[0051] In step S81, the CPU 11 of the central ECU 10 installs the new control program 22A stored in the storage 14 into the ROM 22 of the powertrain ECU 20. After step S81, the CPU 11 of the central ECU 10 advances the process to step S82.

[0052] In step S82, the CPU 11 of the central ECU 10 activates the installed control program 22A. The term "activate" used here means to make the installed control program 22A executable by switching a reference address or the like for executing the control program 22A. After step S82, the CPU 11 of the central ECU 10 ends the current update control.

[0053] <Action of this embodiment> Suppose that the control program 22A, which is the update software specified by the synchronous assembly AS of the campaign information IC, has a defect such as a bug. In such a situation, for example, when an administrator of the update server 200 inputs the associated information IA corresponding to the control program 22A via an input device, the execution device 210 of the update server 200 stores the input associated information IA in the storage device 220. Then, as shown in FIG. 3, the execution device 210 of the update server 200 executes judgment control for the update software corresponding to the updated associated information IA. At this time, in step S12, if the defect information ID of the associated information IA indicates that the update software itself has a defect, the execution device 210 advances the process to step S21. Then, in steps S21 and S22, the execution device 210 sets the prohibition flag FF of the campaign information IC that specifies the defective update software to ON. When the prohibition flag FF of the campaign information IC is set to ON in this way, even if the executing device 210 starts update control, the executing device 210 does not execute the processes of steps S62 to S82 and ends the current update control, as shown in Fig. 5. In other words, for a campaign information IC that specifies defective update software, the executing device 210 of the update server 200 prohibits the update process of the update software corresponding to that campaign information IC.

[0054] <Effects of this embodiment> (1) According to this embodiment, if an update software has a defect such as a bug, the update process of the update software corresponding to all campaign information IC that specifies the update software is prohibited. Therefore, if an administrator of the update server 200 inputs the associated information IA, it is possible to collectively prevent the application of the update software with the defect to the control device of each vehicle 100.

[0055] (2) For example, even if the update software functions normally because there is no defect such as a bug in the update software, the update software may not comply with the laws and regulations of the country in which the vehicle 100 is used. In this regard, in the determination control, the execution device 210 of the update server 200 sets the prohibition flag FF of a campaign information IC that specifies the update software and specifies a non-updated vehicle as the target of the update process to ON. Therefore, even if there is no defect in the update software itself, for a campaign information IC that specifies a non-updated vehicle as the target of the update process, the update process of the update software according to the campaign information IC is prohibited. This makes it possible to prevent the update software from being applied to a control device of the vehicle 100 whose update software should not be updated.

[0056] (3) In the update control, the execution device 210 of the update server 200 prohibits the transmission of a campaign notification NC in response to the campaign information IC, thereby prohibiting the update process of the update software in response to the campaign information IC. That is, not only is the transmission of the update software in response to the campaign information IC not executed in step S72, but the transmission of the campaign notification NC in response to the campaign information IC is also not executed in step S62. This prevents the user of the vehicle 100 from misunderstanding that the update software is applicable due to the transmission of the campaign notification NC even when the update process of the update software cannot be executed.

[0057] <Example of change> This embodiment can be modified as follows: This embodiment and the following modifications can be combined with each other to the extent that there is no technical contradiction.

[0058] In the above embodiment, the determination control may be changed. For example, the judgment process of step S13 may be omitted. As a specific example, if the possibility of specifying a non-updated vehicle as the non-updated information IN of the associated information IA is relatively low, the impact of omitting the judgment process of step S13 is small. In this case, if the executing device 210 judges in step S12 that the defect information ID of the associated information IA indicates that there is no defect in the update software itself (S12: NO), the executing device 210 may end the current judgment control. In other words, the processes of steps S31 and S32 may also be omitted. Moreover, the associated information IA does not have to include non-updated information IN.

[0059] In the above embodiment, the update control may be changed. For example, the process of step S61 does not have to be executed before the process of step S62. As a specific example, the execution device 210 of the update server 200 may execute the process of step S61 after step S71 and before step S72. In this configuration, when the prohibition flag FF is ON, the execution device 210 of the update server 200 does not execute the processes of steps S72 to S82 and ends the current update control. In other words, when the prohibition flag FF is ON, the execution device 210 prohibits the transmission of update software corresponding to the campaign information IC in step S72, thereby prohibiting the update process of the update software corresponding to the campaign information IC. [Explanation of symbols]

[0060] IA... associated information IC... campaign information NC... campaign notification NW... communication network US... update system 10... central ECU 11... CPU 12... ROM 12A... master program 13... RAM 14... storage 20... power train ECU 21... CPU 22... ROM 22A... control program 23... RAM 24... storage 30... brake ECU 31... CPU 32... ROM 32A... control program 34... storage 40... advanced driving assistance ECU 41... CPU 42... ROM 42A... control program 44... storage 50... DCM 71... secondary battery 76... display 100... vehicle 200... update server 210... execution device 220... storage device 220A... update program 230... communication device

Claims

1. An execution device and a storage device, The storage device includes: Campaign information including information specifying a target vehicle for software update processing and information specifying update software to be applied to a control device mounted on the target vehicle; For each update software, accompanying information indicating whether or not the update software itself has a defect; I remember, The execution device is storing the associated information in the storage device based on an external input; When the associated information indicates that the update software itself has a defect, prohibiting the update process corresponding to the campaign information that designates the defective update software; Run Server for software updates.

2. The associated information includes, for each of the update software, information for designating a non-update vehicle that should not be updated to the update software, The execution device is Even if the associated information indicates that the update software itself is not defective, for the campaign information that specifies the update software and specifies the non-update vehicle as the target vehicle, prohibiting the update process according to the campaign information; Run 2. The software update server of claim 1.

3. The execution device is Transmitting a campaign notification notifying that the update software is applicable to the target vehicle in the campaign information; After transmitting the campaign notification, transmitting the update software to the target vehicles to which the campaign notification was transmitted; prohibiting the update process by prohibiting transmission of the campaign notification corresponding to the campaign information; Run 3. The software update server according to claim 1 or 2.

4. The present invention is directed to an update server including an execution device and a storage device, The storage device includes: Campaign information including information specifying a target vehicle for software update processing and information specifying update software to be applied to a control device mounted on the target vehicle; For each update software, accompanying information indicating whether or not the update software itself has a defect; I remember, The execution device, storing the associated information in the storage device based on an external input; When the associated information indicates that the update software itself has a defect, prohibiting the update process corresponding to the campaign information that designates the defective update software; Run Software updates.

5. The present invention is directed to an update server including an execution device and a storage device, The storage device includes: Campaign information including information specifying a target vehicle for software update processing and information specifying update software to be applied to a control device mounted on the target vehicle; For each update software, accompanying information indicating whether or not the update software itself has a defect; I remember, The execution device, storing the associated information in the storage device based on an external input; When the associated information indicates that the update software itself has a defect, prohibiting the update process corresponding to the campaign information that designates the defective update software; Run How to update your software.

Images