Center, method, and program

Abstract

To provide a center and the like capable of properly controlling a series of update processing of software of an electronic control unit mounted on a vehicle.SOLUTION: The center for controlling the update of software of an electronic control unit mounted on a vehicle includes: a communication unit that performs communications between the vehicle and information terminals associated with the vehicle; and a control unit that controls the software update processing based on an update acceptance notice that the communication unit receives from the information terminal. The control unit is configured so as to, when the communication between the vehicle and the information terminal is interrupted, restrict the software update processing even when the communication unit receives the update acceptance notice.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a center for controlling software updates of electronic control units mounted on vehicles, and a method and program executed by the center. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units (ECUs) for controlling the operation of the vehicle. Each electronic control unit includes a processor, a temporary storage unit such as a RAM, and a non-volatile memory that is a non-volatile storage unit such as a flash ROM, and the processor executes software stored in the non-volatile memory to realize the control functions of the electronic control unit. The software stored in each electronic control unit is rewritable, and by updating the software to a newer version, it is possible to improve the functions of each electronic control unit or add new vehicle control functions.

[0003] As a technology for updating software in an electronic control unit, there is known an OTA (Over The Air) technology, in which an in-vehicle communication device connected to an in-vehicle network is wirelessly connected to a communication network such as the Internet, and a device responsible for updating the software in the vehicle downloads software from a server via wireless communication, writes and installs the downloaded software in the electronic control unit, and activates the installed software, thereby updating or adding software to the electronic control unit. For example, see Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2017-149323 A Summary of the Invention [Problem to be solved by the invention]

[0005] When updating software using OTA, processes such as notifying the vehicle user or administrator that there is a software update and requesting consent to the software update are performed. These notifications and consent requests are sent to the vehicle user or administrator via an information terminal such as a car navigation device installed in the vehicle or a smartphone that can wirelessly communicate with the vehicle.

[0006] A portable information terminal such as a smartphone may move away from the vehicle after agreeing to a software update while linked to the vehicle, and may no longer be linked to the vehicle. However, with current software update control, once a software update is agreed to, the software update process continues to be performed on the vehicle even if the information terminal that agreed thereto subsequently no longer cooperates with the vehicle. For this reason, there is room for further improvement in the control of the software update process.

[0007] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a center or the like that can appropriately control the software update process of an electronic control unit mounted on a vehicle. [Means for solving the problem]

[0008] In order to solve the above problems, one aspect of the disclosed technology is a center that controls software updates for an electronic control unit installed in a vehicle, and includes a communication unit that communicates between the vehicle and an information terminal associated with the vehicle, and a control unit that controls the software update process based on an update acceptance notification received by the communication unit from the information terminal, and the control unit is a center that restricts the software update process even if the communication unit receives the update acceptance notification when communication between the vehicle and the information terminal is interrupted. Effect of the Invention

[0009] According to the center etc. of the present disclosure, it is possible to appropriately control the software update process of the electronic control unit mounted on the vehicle. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an overall configuration of a network system according to an embodiment; [Diagram 2] Block diagram showing the general configuration of the center [Diagram 3] Center functional block diagram [Figure 4] Block diagram showing the schematic configuration of the OTA master [Diagram 5] OTA Master Functional Block Diagram [Figure 6A] FIG. 1 is a block diagram showing an example of a schematic configuration of an electronic control unit; [Figure 6B] FIG. 1 is a block diagram showing an example of a schematic configuration of an electronic control unit; [Figure 7] FIG. 13 is a diagram showing an example of type information [Figure 8A] Flowchart of software update process according to specific example 1 performed by the center [Figure 8B] Flowchart of software update process according to specific example 1 performed by the center [Figure 9A] Flowchart of software update process according to specific example 2 performed by the center [Figure 9B] Flowchart of software update process according to specific example 2 performed by the center DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] When a software update for an electronic control unit mounted on a vehicle is approved by an information terminal outside the vehicle, the center according to the present disclosure further imposes necessary restrictions on the software update process based on the state of cooperation between the information terminal and the vehicle, thereby realizing safe and quick completion of the software update process for the electronic control unit. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0012] <Embodiment> [System Configuration] Fig. 1 is a block diagram showing an overall configuration of a network system according to an embodiment of the present disclosure. The network system shown in Fig. 1 is a system for updating software of a plurality of electronic control units (ECUs) 50a to 50d mounted on a vehicle, and includes a center 10 located outside the vehicle, an in-vehicle network 90 established within the vehicle, and an information terminal 95 linked (associated) with the vehicle.

[0013] (1) Center The center 10 can communicate with an OTA master 30 (described later) provided in the in-vehicle network 90 via the network 100, and can transmit update data for the software of the electronic control units 50a-50d and information defining the procedure of the update process, and receive notifications indicating the progress of the software update process, thereby controlling and managing the software updates of the multiple electronic control units 50a-50d connected to the OTA master 30. This center 10 has a function as a so-called server. The center 10 can also communicate with an information terminal 95 via the network 100, and can notify the user or manager of the vehicle that there is a software update for the electronic control units 50a-50d and request consent to the software update.

[0014] FIG. 2 is a block diagram showing a schematic configuration of the center 10 in FIG. 1. As shown in FIG. 2, the center 10 includes a central processing unit (CPU) 11, a random access memory (RAM) 12, a storage device 13, and a communication device 14. The storage device 13 is a device including a readable and writable storage medium such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a program for performing software update management, information used for software update control and update management, and software update data for each electronic control unit. In the center 10, the CPU 11 executes a program read from the storage device 13 by using the RAM 12 as a working area, thereby performing a predetermined process related to software update. The communication device 14 is a device for communicating with the OTA master 30 and the information terminal 95 via the network 100.

[0015] Fig. 3 is a functional block diagram of the center 10 shown in Fig. 2. The center 10 shown in Fig. 3 includes a memory unit 16, a communication unit 17, a control unit 18, a determination unit 19, and an HMI function unit 20. The memory unit 16 is realized by the storage device 13 shown in Fig. 2. The communication unit 17, the control unit 18, the determination unit 19, and the HMI function unit 20 are realized by the CPU 11 shown in Fig. 2 executing a program stored in the storage device 13 using the RAM 12.

[0016] The storage unit 16 stores information related to software update processing of one or more electronic control units mounted on the vehicle. As the information related to the software update processing, the storage unit 16 stores at least update management information in which information indicating software available in the electronic control units 50a to 50d is associated with each vehicle identification information (vehicle ID) that identifies the vehicle, and update data of the software of the electronic control units 50a to 50d. As the information indicating the software available in the electronic control units 50a to 50d, for example, a combination of the latest version information of each software of the multiple electronic control units 50a to 50d is defined. As the information related to the software update processing, the storage unit 16 can store an update status indicating the update state of the software being performed in the vehicle. As the information related to the software update processing, the storage unit 16 can store information related to an update sequence that indicates the procedure of the software update processing for issuing a control instruction to the OTA master 30.

[0017] The communication unit 17 functions as a transmitting unit and a receiving unit that transmits and receives data, information, notifications, requests, and the like between the OTA master 30 and the information terminal 95. The communication unit 17 receives a software update confirmation request from the OTA master 30 (receiving unit). The update confirmation request is information transmitted from the OTA master 30 to the center 10 when, for example, the power supply or ignition is turned on in the vehicle (hereinafter referred to as "power ON"), and is information for requesting the center 10 to confirm whether or not there is update data for the electronic control units 50a to 50d based on vehicle configuration information described later. In addition, in response to the update confirmation request received from the OTA master 30, the communication unit 17 transmits information indicating the presence or absence of update data to the OTA master 30 (transmitting unit). In addition, the communication unit 17 receives a transmission request (download request) for a distribution package from the OTA master 30 (receiving unit). Furthermore, when the communication unit 17 receives a download request for a distribution package (reception unit), the communication unit 17 transmits a distribution package including software update data for the electronic control units 50a to 50d generated by the control unit 18 described later to the OTA master 30 (transmission unit). Furthermore, the communication unit 17 can notify the OTA master 30 or the information terminal 95 of the availability of a software update for the vehicle user or manager, etc., and request consent to the software update, based on an instruction from the HMI function unit 20 (transmission unit). Furthermore, the communication unit 17 can receive information on the communication state between the vehicle and the information terminal 95, that is, information on whether the vehicle and the information terminal 95 are in a linked state (hereinafter referred to as "linkage information"), from the OTA master 30 (or the information terminal 95) (reception unit). Furthermore, the communication unit 17 can receive a response (update consent notification / update non-conformance notification) from the vehicle user or manager, etc., to the consent request for the software update, from the OTA master 30 and / or the information terminal 95 (reception unit).

[0018] When the communication unit 17 receives an update confirmation request from the OTA master 30, the control unit 18 determines whether or not there is software update data for the electronic control units 50a to 50d mounted on the vehicle identified by the vehicle ID included in the update confirmation request, based on the update management information stored in the storage unit 16. The control unit 18 transmits the determination result of whether or not there is update data to the OTA master 30 by the communication unit 17. When the control unit 18 determines that there is software update data for the electronic control units 50a to 50d, and receives a download request for a distribution package from the OTA master 30, the control unit 18 generates one or more distribution packages including the corresponding update data stored in the storage unit 16. In addition, the control unit 18 restricts the software update process of the electronic control units 50a to 50d as necessary, based on an instruction from a user or manager of the vehicle in response to a consent request for software update made by the HMI function unit 20 and the cooperation state between the vehicle and the information terminal 95 determined by the determination unit 19.

[0019] The determination unit 19 determines whether or not the vehicle and the information terminal 95 are in a linked state, based on link information between the vehicle and the information terminal 95 received by the communication unit 17 from the OTA master 30 (or the information terminal 95). In this embodiment, the linked state between the vehicle and the information terminal 95 refers to a state in which the OTA master 30 and the information terminal 95 are connected to be able to communicate with each other by a predetermined short-range wireless communication method, and the non-linked state between the vehicle and the information terminal 95 refers to a state in which communication between the OTA master 30 and the information terminal 95 by the short-range wireless communication method is interrupted.

[0020] The HMI functional unit 20 performs processes such as notifying the information terminal 95 of software updates for the electronic control units 50a to 50d installed in the vehicle, requesting consent to the software update, and notifying information such as the software update status, as necessary, via the communication unit 17.

[0021] The information terminal 95 is a communication device such as a smartphone owned by a vehicle user or manager. This information terminal 95 can be associated with the vehicle by being registered and managed by the vehicle, and functions as a human machine interface (HMI) used to perform specific operations related to the vehicle (for example, locking and unlocking the vehicle doors and remote parking operations) and display information. The number of information terminals 95 associated with the vehicle is not limited to one, and may be multiple.

[0022] (2) In-vehicle network The in-vehicle network 90 includes an OTA master 30, a plurality of electronic control units 50a to 50d, a display device 70, and a communication module 80. The OTA master 30 and the communication module 80 are connected via a bus 60a. The OTA master 30 and the electronic control units 50a and 50b are connected via a bus 60b. The OTA master 30 and the electronic control units 50c and 50d are connected via a bus 60c. The OTA master 30 and the display device 70 are connected via a bus 60d.

[0023] The OTA master 30 can communicate wirelessly with the center 10 via the bus 60a and the communication module 80 and the network 100. The OTA master 30 can also communicate with the information terminal 95 via the bus 60a and the communication module 80 using short-range wireless. The OTA master 30 can also communicate with the electronic control units 50a to 50d and the display device 70 via the buses 60b to 60d using wired communication. The OTA master 30 is a device that has a function of managing the OTA state, controlling an update sequence, which is a flow of software update processing, and performing software update of an electronic control unit to be updated (hereinafter referred to as a "target electronic control unit"). The OTA master 30 controls software update of the target electronic control unit among the electronic control units 50a to 50d, based on the update data acquired from the center 10 and the like, according to the presence or absence of update restrictions according to the cooperation state between the vehicle and the information terminal 95. The OTA master 30 is sometimes referred to as a central gateway (CGW).

[0024] 4 is a block diagram showing a schematic configuration of the OTA master 30 in FIG. 1. As shown in FIG. 4, the OTA master 30 includes a CPU 31, a RAM 32, a ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, the RAM 32, the ROM 33, and the storage device 34 constitute a microcomputer 35. In the OTA master 30, the CPU 31 executes a program read from the ROM 33 by using the RAM 32 as a working area, thereby executing a predetermined process related to software update. The communication device 36 is a device for communicating with the communication module 80, the electronic control units 50a to 50d, and the display device 70, respectively, via the buses 60a to 60d shown in FIG. 1.

[0025] Fig. 5 is a functional block diagram of the OTA master 30 shown in Fig. 4. The OTA master 30 shown in Fig. 5 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is realized by the storage device 34 shown in Fig. 4. The communication unit 38 and the control unit 39 are realized by the CPU 31 shown in Fig. 4 executing a program stored in the ROM 33 using the RAM 32.

[0026] The storage unit 37 stores a program for executing software updates of the multiple electronic control units 50a to 50d (a control program for the OTA master 30), various data used when executing the software updates, and software update data downloaded from the center 10. The storage unit 37 can also store information (described later) related to the type of non-volatile memory mounted in each of the multiple electronic control units 50a to 50d.

[0027] The communication unit 38 functions as a transmitting unit and a receiving unit that transmits and receives data, information, notifications, requests, and the like between the center 10 and the information terminal 95. The communication unit 38 transmits a software update check request to the center 10 when, for example, the power supply of the vehicle is turned on (transmitting unit). The update check request includes, for example, a vehicle ID for identifying the vehicle and information on the current version of the software of the electronic control units 50a to 50d connected to the in-vehicle network 90. ​​The vehicle ID and the current version of the software of the electronic control units 50a to 50d are used to determine whether or not there is update data for the software of the electronic control units 50a to 50d by comparing them with the latest version of the software held by the center 10 for each vehicle ID. In addition, the communication unit 38 receives a notification indicating the presence or absence of update data from the center 10 as a response to the update check request (receiving unit). When there is update data for the software of the electronic control units 50a-50d, the communication unit 38 transmits a download request for a distribution package including the software update data and the like to the center 10 (transmission unit), and receives (downloads) the distribution package transmitted from the center 10 (reception unit). The communication unit 38 also transmits the update status of the software transmitted by the electronic control units 50a-50d to the center 10 (transmission unit). The communication unit 38 can also display the update status of the software on the display device 70 or notify the information terminal 95 based on an instruction from the control unit 39.

[0028] The control unit 39 judges whether or not there is update data for the software of the electronic control units 50a to 50d based on a response from the center 10 to the update confirmation request received by the communication unit 38. The control unit 39 also verifies the authenticity of the update data that the communication unit 38 receives (downloads) from the center 10 in a distribution package and stores in the storage unit 37. The control unit 39 also uses the update data downloaded from the center 10 to control the software update process (installation, activation, etc.) of the electronic control units 50a to 50d. Specifically, the control unit 39 transfers the downloaded update data to the target electronic control unit and causes the target electronic control unit to install update software based on the update data. After the installation is completed, the control unit 39 instructs the target electronic control unit to activate the installed update software. During this software update process, the control unit 39 executes installation and activation based on information on the restriction of the update process based on the cooperation state between the vehicle and the information terminal 95 received from the center 10.

[0029] The electronic control units 50a to 50d are devices (ECUs) for controlling the operation of each part of the vehicle. Although Fig. 1 shows an example in which the in-vehicle network 90 includes four electronic control units 50a to 50d, the number of electronic control units is not particularly limited. Furthermore, the number of buses connecting the electronic control units 50a to 50d to the OTA master 30 is also not particularly limited. An example of a schematic configuration of the electronic control units 50a to 50d is shown in Figs. 6A and 6B.

[0030] The electronic control unit 50a shown in FIG. 6A includes a CPU 51, a RAM 52, a nonvolatile memory 53a, and a communication device 54. The CPU 51 executes a program read from the nonvolatile memory 53a by using the RAM 52 as a working area, thereby realizing the function of the electronic control unit 50a. The nonvolatile memory 53a is a memory having one storage area 55 for storing data such as software (hereinafter referred to as a "single bank memory"). In this embodiment, the memory type of the nonvolatile memory 53a, which is a single bank memory, may be described as a "first type" to distinguish it from other types. In addition to software for realizing the function of the electronic control unit 50a, the storage area 55 may store version information, parameter data, a boot program for startup, a program for software update, and the like. The communication device 54 is a device for communicating with the OTA master 30 and other electronic control units 50b to 50d connected to the in-vehicle network 90.

[0031] The electronic control unit 50b shown in FIG. 6B includes a CPU 51, a RAM 52, a non-volatile memory 53b, and a communication device 54, similar to the electronic control unit 50a. However, the non-volatile memory 53b mounted on the electronic control unit 50b is a memory having two storage areas 56a and 56b for storing data such as software (hereinafter referred to as a "dual bank memory"). In this embodiment, the memory type of the non-volatile memory 53b, which is a dual bank memory, may be described as a "second type" to distinguish it from others. In addition to software for realizing the functions of the electronic control unit 50b, the storage areas 56a and 56b may store version information, parameter data, a boot program for starting, a program for updating software, and the like. The CPU 51 of the electronic control unit 50b sets one of the two storage areas 56a and 56b of the non-volatile memory 53b as a storage area (operational aspect) to be read, and executes the software stored in the storage area to be read. In the other storage area (non-operational side) that is not the read target, update software (updated program) based on the update data can be installed (written) in the background while the program in the read target storage area (operational side) is being executed. When activating (enabling update software) in the software update process, the update software can be activated by switching the storage area that is the read target of the program by the CPU 51 of the electronic control unit 50b.

[0032] As a specific example, assume that current software is stored in the storage area 56a of the nonvolatile memory 53b, which is a dual bank memory, and update software is installed in the storage area 56b. When activation of the update software is instructed from the OTA master 30, for example, the electronic control unit 50b can switch the read start address of the CPU 51 from the top address of the storage area 56a to the top address of the storage area 56b, thereby switching the storage area to be read by the CPU 51 (operation side) and executing the update software installed in the storage area 56b. Note that in this disclosure, a nonvolatile memory configuration called a "one-side suspend memory" in which one storage area is partitioned into two sides in a pseudo manner and a program can be written to the other side while a program stored in one side is being executed is also classified as the second type of memory.

[0033] 7 shows an example of type information, which is information related to the type of nonvolatile memory mounted in each of the multiple electronic control units 50a to 50d. In the type information illustrated in FIG. 7, an ECU_ID, which is a number for identifying an electronic control unit, is associated with the type of nonvolatile memory mounted in the electronic control unit (first type (single bank) / second type (dual bank)). This type information is stored and managed at least in the storage unit 16 of the center 10. The type information is created in advance based on the specifications of the electronic control units 50a to 50d constituting the in-vehicle network 90, and may be stored in the storage unit 16 or the like when the vehicle is manufactured, or may be acquired from the target electronic control unit through communication within the in-vehicle network 90 during software update processing.

[0034] The display device 70 is a human machine interface (HMI) used to perform various displays, such as displaying the presence of update data during software update processing of the electronic control units 50a to 50d, displaying a consent request screen for requesting consent to the software update from the vehicle user or administrator, and displaying the results and status of the software update. A display device of a car navigation system can typically be used as the display device 70, but is not particularly limited as long as it can display information required during software update processing. In addition to the display device 70, an electronic control unit or the like may be further connected to the bus 60d shown in FIG. 1.

[0035] The communication module 80 is a unit having a function of controlling communication between the center 10 and the vehicle, and is a communication device for connecting the in-vehicle network 90 to the center 10. The communication module 80 is wirelessly connected to the center 10 via the network 100, and the OTA master 30 performs vehicle authentication and download of update data. The communication module 80 can also be wirelessly connected to the information terminal 95 without going through the network 100. For wireless connection with the information terminal 95, a short-range wireless communication method such as Bluetooth (registered trademark) or RF / LF communication can be used. The communication module 80 may be configured as being included in the OTA master 30.

[0036] [Software update process overview] The OTA master 30 transmits a software update check request to the center 10, for example, when the power supply of the vehicle is turned on. The update check request includes a vehicle ID for identifying the vehicle, and vehicle configuration information, which is information on the state (system configuration) of the electronic control units 50a to 50d connected to the in-vehicle network 90, such as the current versions of the hardware and software of the electronic control units 50a to 50d. The vehicle configuration information can be created by acquiring the identification numbers (ECU_ID) of the electronic control units and the identification numbers (ECU_Software_ID) of the software versions of the electronic control units from the electronic control units 50a to 50d connected to the in-vehicle network 90. ​​The vehicle ID and the current versions of the software of the electronic control units 50a to 50d are used to determine whether or not there is update data for the software of the electronic control units 50a to 50d by comparing them with the latest version of the software held by the center 10 for each vehicle ID. The center 10 transmits a notification indicating the presence or absence of update data to the OTA master 30 and / or the information terminal 95 as a response to the update check request received from the OTA master 30. When there is update data for the software of the electronic control units 50a to 50d, the OTA master 30 transmits a download request for a distribution package to the center 10. In response to the download request received from the OTA master 30, the center 10 transmits a distribution package including the update data and the like to the OTA master 30. In addition to the update data, the distribution package may include verification data for verifying the authenticity of the update data, the number and type information of update data, various control information used when updating the software, and the like.

[0037] The OTA master 30 determines whether or not there is update data for the software of the electronic control units 50a to 50d, based on the response to the update confirmation request received from the center 10. The OTA master 30 also verifies the authenticity of the distribution package received from the center 10 and stored in the storage device 13. The OTA master 30 also transfers the update data downloaded in the distribution package to the target electronic control unit, and causes the target electronic control unit to install the update data. After the installation is completed, the OTA master 30 instructs the target electronic control unit to activate the installed updated software to make it valid.

[0038] In addition, in the consent request process, the center 10 causes the output device to output a notification that consent is required for the software update or a notification that prompts input that the software update has been consented to. The output device may be a display device 70 or an information terminal 95 provided in the in-vehicle network 90. ​​For example, in the consent request process, when the display device 70 is used as the output device, the OTA master 30 can cause the display device 70 to display a consent request screen for requesting consent to the software update from the user or administrator, or cause the display device 70 to display a notification for prompting a specific input operation such as pressing an consent button if the user or administrator consents. In the consent request process, when the information terminal 95 is used as the output device, the OTA master 30 can cause the display screen of the information terminal 95 to display a consent request for requesting consent to the software update from the user or administrator, or cause the display screen of the information terminal 95 to display a notification for prompting a specific input operation such as pressing an consent button if the user or administrator consents. Furthermore, in the consent request process, the center 10 can display, on the display device 70 or the information terminal 95, a message or an icon notifying that update data for the software of the electronic control units 50a to 50d is available, and can display restrictions during execution of the software update process, on the display device 70 or the information terminal 95. When the center 10 receives an input of consent from the user or administrator via the OTA master 30 and / or the information terminal 95, it instructs the OTA master 30 to execute the above-mentioned installation and activation control processes, and updates the software of the target electronic control units.

[0039] Here, if the non-volatile memory of the target electronic control unit is a single bank memory having one storage area for storing data such as software, in principle, installation and activation are performed consecutively, so consent request processing for software update is performed before installation is performed. Note that even if the target electronic control unit is a single bank memory, depending on the information on the update sequence instructed by the center 10, it may be requested to temporarily stop the update processing in the state where installation is completed, that is, to suspend (standby) activation. Also, if the non-volatile memory of the target electronic control unit is a dual bank memory having two storage areas for storing data such as software, consent request processing for software update is performed at least after installation is performed and before activation is performed. Note that if the non-volatile memory of the target electronic control unit is a dual bank memory, consent request processing for software update before installation may be performed or may be omitted.

[0040] The software update process consists of a phase in which the OTA master 30 downloads update data from the center 10 (download phase), a phase in which the OTA master 30 transfers the downloaded update data to the target electronic control unit and installs update software based on the update data in the storage area of ​​the target electronic control unit (installation phase), and a phase in which the target electronic control unit activates the installed update software (activation phase).

[0041] Downloading is a process in which the OTA master 30 receives update data for updating the software of the electronic control unit, which is transmitted from the center 10 in a distribution package, and stores the data in the storage unit 37. When receiving update data by downloading, the download phase not only executes the download, but also includes control of a series of processes related to the download, such as determining whether the download can be executed and verifying the update data.

[0042] The update data transmitted from the center 10 to the OTA master 30 may include update software for the electronic control unit (all data or difference data), compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may also include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The update data is downloaded as the above-mentioned distribution package, and the distribution package includes update data for a single electronic control unit or multiple electronic control units.

[0043] The installation is a process in which the OTA master 30 writes update software (an updated version of a program) into the non-volatile memory of the target electronic control unit based on the update data downloaded from the center 10. The installation phase of this embodiment not only executes the installation, but also includes control of a series of processes related to the installation, such as judging whether the installation can be executed, transferring the update data, and verifying the update software.

[0044] If the update data includes the update software itself (all data), the OTA master 30 transfers the update data (update software) to the target electronic control unit in the installation phase. If the update data includes compressed data, difference data, or divided data of the update software, the OTA master 30 may transfer the update data to the target electronic control unit and the target electronic control unit may generate the update software from the update data, or the OTA master 30 may generate the update software from the update data and then transfer the update software to the target electronic control unit. Here, the update software can be generated by decompressing the compressed data or assembling (integrating) the difference data or divided data.

[0045] The target electronic control unit can install the update software based on an installation request from the OTA master 30, in accordance with update restrictions (described later) based on the cooperation state between the vehicle and the information terminal 95 received from the center 10. Note that for a specific target electronic control unit that has received update data, the installation may be performed autonomously without receiving an explicit instruction from the OTA master 30.

[0046] Activation is a process in which the target electronic control unit activates the update software installed in its own non-volatile memory. The activation phase includes not only the execution of activation, but also a series of controls related to activation, such as judging whether activation can be executed, requesting the vehicle user or administrator to consent to activation, and verifying the execution result.

[0047] The activation of the update software can be performed by the target electronic control unit based on an activation request from the OTA master 30, in accordance with update restrictions based on the cooperation state between the vehicle and the information terminal 95 received from the center 10 (described later). Note that, for a specific target electronic control unit that has received update data, activation may be performed autonomously after installation is completed, without receiving an explicit instruction from the OTA master 30.

[0048] The software update process can be performed consecutively or in parallel for each of the multiple target electronic control units.

[0049] Furthermore, in this specification, the "software update process" includes not only a process in which download, installation, and activation are all performed consecutively, but also a process in which only some of the download, installation, and activation are performed.

[0050] [process] Next, with further reference to FIGS. 8A, 8B, 9A, and 9B, some specific examples of the software update process executed in the network system according to this embodiment will be described.

[0051] (1) Specific Example 1 8A and 8B are flowcharts for explaining the procedure of software update processing according to specific example 1 performed by the center 10. The processing of FIG. 8A and the processing of FIG. 8B are connected by a connector X. The software update processing according to specific example 1 is an example in which the center 10 performs processing to update the vehicle software in accordance with update consent from the information terminal 95 when a target electronic control unit that implements software that requires updating is equipped with a dual bank memory.

[0052] (Step S801) The center 10 judges whether or not there is software that needs to be updated in the target vehicle. This judgment can be made based on, for example, the current version of the software in each of the electronic control units 50a to 50d mounted in the vehicle acquired from the vehicle configuration information included in the update confirmation request transmitted from the OTA master 30, and the latest version of each piece of software stored in the storage unit 16 of the center 10. Only if there is software that needs to be updated in the target vehicle (step S801, Yes), the process proceeds to step S802.

[0053] (Step S802) The center 10 judges whether or not there is consent to the download of update software (software based on update data) by the information terminal 95. This judgment can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update consent notification) to the download consent request transmitted by the center 10 to the information terminal 95. Only when there is consent to the download of update software by the information terminal 95 (step S802, Yes), the process proceeds to step S803.

[0054] (Step S803) The center 10 transmits the update software to the OTA master 30, and causes the OTA master 30 to download the update software. A predetermined distribution package can be used to transmit the update software. When the download of the update software by the OTA master 30 is completed, the process proceeds to step S804.

[0055] (Step S804) The center 10 judges whether or not there is consent to the installation of the update software by the information terminal 95. This judgment can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update consent notification) to the installation consent request transmitted by the center 10 to the information terminal 95. Only when there is consent to the installation of the update software by the information terminal 95 (Yes in step S804), the process proceeds to step S805.

[0056] (Step S805) The center 10 causes the OTA master 30 and the target electronic control unit to execute an installation process, which is a process of transferring and writing the update software downloaded by the OTA master 30 to the target electronic control unit. When the installation of the update software in the target electronic control unit is completed, the process proceeds to step S806.

[0057] (Step S806) The center 10 judges whether or not there has been consent to the activation of the updated software by the information terminal 95. This judgment can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update consent notification) to the activation consent request transmitted by the center 10 to the information terminal 95. Only when there has been consent to the activation of the updated software by the information terminal 95 (Yes in step S806), the process proceeds to step S807.

[0058] (Step S807) The center 10 acquires collaboration information indicating a collaboration state between the vehicle and the information terminal 95. Examples of the collaboration information include "collaboration OK" if the vehicle and the information terminal 95 are connected by short-range wireless communication, and "collaboration NG" if the vehicle and the information terminal 95 are not connected by short-range wireless communication. This collaboration information is basically acquired from the vehicle (OTA master 30), but may be acquired from the information terminal 95. When the collaboration information between the vehicle and the information terminal 95 is acquired, the process proceeds to step S808.

[0059] (Step S808) The center 10 judges whether or not the vehicle and the information terminal 95 are linked based on the link information acquired in the above step S807. The information terminal 95 targeted in this judgment is the information terminal 95 that has consented to the activation. If it is judged that the information terminal 95 that has consented to the activation is linked with the vehicle (step S808, Yes), the process proceeds to step S809, and if it is judged that the information terminal 95 that has consented to the activation is not linked with the vehicle and has been disconnected (step S808, No), the process proceeds to step S807.

[0060] (Step S809) The center 10 permits activation, which is a process for validating the update software installed in the target electronic control unit, and causes the OTA master 30 and the target electronic control unit to execute the activation. When activation of the update software in the target electronic control unit is completed, this software update process ends.

[0061] (2) Example 2 9A and 9B are flowcharts for explaining the procedure of software update processing according to specific example 2 performed by the center 10. The processing of FIG. 9A and the processing of FIG. 9B are connected by a connector Y. The software update processing according to specific example 2 is an example in which the center 10 performs processing to update the vehicle software in accordance with update consent from the information terminal 95 when a target electronic control unit that implements software that requires updating is equipped with a single bank memory.

[0062] (Step S901) The center 10 judges whether or not there is software that needs to be updated in the target vehicle. This judgment can be made based on, for example, the current version of the software in each of the electronic control units 50a to 50d mounted in the vehicle acquired from the vehicle configuration information included in the update confirmation request transmitted from the OTA master 30, and the latest version of each piece of software stored in the storage unit 16 of the center 10. Only if there is software that needs to be updated in the target vehicle (step S901, Yes), the process proceeds to step S902.

[0063] (Step S902) The center 10 judges whether or not there is consent to the download of update software (software based on update data) by the information terminal 95. This judgment can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update consent notification) to the download consent request transmitted by the center 10 to the information terminal 95. Only when there is consent to the download of update software by the information terminal 95 (step S902, Yes), the process proceeds to step S903.

[0064] (Step S903) The center 10 transmits the update software to the OTA master 30, and causes the OTA master 30 to download the update software. A predetermined distribution package can be used to transmit the update software. When the OTA master 30 completes downloading the update software, the process proceeds to step S904.

[0065] (Step S904) The center 10 judges whether or not there is consent to the installation of the update software by the information terminal 95. This judgment can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update consent notification) to the installation consent request transmitted by the center 10 to the information terminal 95. Only when there is consent to the installation of the update software by the information terminal 95 (Yes in step S904), the process proceeds to step S905.

[0066] (Step S905) The center 10 acquires collaboration information indicating a collaboration state between the vehicle and the information terminal 95. Examples of the collaboration information include "collaboration OK" if the vehicle and the information terminal 95 are connected by short-range wireless communication, and "collaboration NG" if the vehicle and the information terminal 95 are not connected by short-range wireless communication. This collaboration information is basically acquired from the vehicle (OTA master 30), but may be acquired from the information terminal 95. When the collaboration information between the vehicle and the information terminal 95 is acquired, the process proceeds to step S906.

[0067] (Step S906) The center 10 judges whether or not the vehicle and the information terminal 95 are linked based on the link information acquired in the above step S905. The information terminal 95 targeted in this judgment is the information terminal 95 that has consented to the installation. If it is judged that the information terminal 95 that has consented to the installation is linked with the vehicle (step S906, Yes), the process proceeds to step S907, and if it is judged that the information terminal 95 that has consented to the installation is not linked with the vehicle and has been disconnected (step S906, No), the process proceeds to step S905.

[0068] (Step S907) The center 10 permits installation, which is a process of transferring and writing the update software downloaded by the OTA master 30 to the target electronic control unit, and causes the OTA master 30 and the target electronic control unit to execute the installation. Furthermore, the center 10 causes the OTA master 30 and the target electronic control unit to execute activation, which is a process of validating the update software installed in the target electronic control unit. When the installation and activation of the update software in the target electronic control unit are completed, this software update process ends.

[0069] In the above-described specific examples 1 and 2, an example has been described in which, if the information terminal 95 that has consented to the installation or activation is not linked with the vehicle and communication is interrupted before the installation or activation process, the information terminal 95 waits until the link between the information terminal 95 and the vehicle is restored (the communication state is restored) before performing (permitting) the installation and activation process of the update software. However, if the information terminal 95 is not linked with the vehicle and communication is interrupted before the installation or activation process, the update process may be immediately stopped without waiting for the link to be restored (the communication state is restored) (i.e., the software update process is terminated by "No" in step S808 of FIG. 8B, and the software update process is terminated by "No" in step S906 of FIG. 9B).

[0070] <Actions and Effects> As described above, according to the network system according to an embodiment of the present disclosure, when the software update of the target electronic control unit mounted on the vehicle is approved by the information terminal 95, the center 10 further imposes necessary restrictions on the software update process based on the cooperation state between the information terminal 95 and the vehicle. More specifically, when the non-volatile memory of the target electronic control unit is a dual bank memory, even if approval has been given, the center 10 does not permit processes subsequent to activation that validates the update software installed in the target electronic control unit. Also, when the non-volatile memory of the target electronic control unit is a single bank memory, even if approval has been given, the center 10 does not permit processes subsequent to installation that writes the update software to the target electronic control unit.

[0071] With this restriction process, for example, in cases where consent processing must be performed via an information terminal 95 linked (associated) to the vehicle, such as a vehicle not equipped with a function capable of presenting information related to software updates via OTA, the update process can be permitted only when the information terminal 95 that has consented to the update is in the vicinity of the vehicle. This allows the software update to be completed safely and in a short time.

[0072] Furthermore, according to the network system of this embodiment, if the non-volatile memory of the target electronic control unit is a dual bank memory, the update process can proceed up to installation, and the activation and subsequent processes can be executed as soon as the connection between the information terminal 95 and the vehicle is restored. If the non-volatile memory of the target electronic control unit is a single bank memory, the update process can proceed up to download, and the installation and subsequent processes can be executed as soon as the connection between the information terminal 95 and the vehicle is restored. This makes it possible to appropriately control the software update process of the electronic control unit mounted on the vehicle.

[0073] In the above embodiment, the software update process is restricted based only on the cooperation state between the vehicle and the information terminal 95, but it may be restricted in combination with the vehicle's traveling state. For example, when communication between the vehicle and the information terminal 95 is interrupted and the vehicle is traveling, the software update process can be restricted.

[0074] In addition, in the above embodiment, an example was described in which restrictions on the software update process are lifted when communication between the vehicle and the information terminal 95 is interrupted but then restored, but the software update process may be stopped without being lifted. [Industrial Applicability]

[0075] The disclosed technique can be used in a network system for updating software of an electronic control unit mounted on a vehicle. [Explanation of symbols]

[0076] 10 Center 11, 31, 51 CPUs 12, 32, 52 RAM 13, 34 Storage device 14, 36, 54 Communication equipment 16, 37 Memory section 17, 38 Communications Department 18, 39 Control section 19 Judgment section 20 HMI function section 30 OTA Master 33 ROM 35 Microcomputer 50a~50d Electronic Control Unit (ECU) 53a, 53b Non-volatile memory 55, 56a, 56b Storage area 60a~60d Bus 70 Display device 80 Communication Module 90 In-vehicle network 95 Information terminal 100 Network

Claims

1. A center for controlling software updates of an electronic control unit mounted on a vehicle, comprising: a communication unit that communicates with the vehicle and an information terminal associated with the vehicle; a control unit that controls the software update process based on an update acceptance notification received by the communication unit from the information terminal; The control unit, when communication between the vehicle and the information terminal is interrupted, restricts the software update process even if the communication unit receives the update acceptance notification.

2. When the communication unit receives the update acceptance notification and communication between the vehicle and the information terminal is interrupted, The center described in claim 1, wherein the control unit does not allow processing subsequent to activation to enable the update software written to the storage area when the electronic control unit to be updated is equipped with a non-volatile memory having two storage areas.

3. When the communication unit receives the update acceptance notification and communication between the vehicle and the information terminal is interrupted, The center according to claim 1 , wherein the control unit, when the electronic control unit to be updated is equipped with a non-volatile memory having one storage area, does not allow processing subsequent to installation in which update software is written to the storage area.

4. The center according to claim 2 , wherein the control unit permits the processes subsequent to the activation when communication between the vehicle and the information terminal is restored.

5. The center according to claim 3 , wherein the control unit permits the processes subsequent to the installation when communication between the vehicle and the information terminal is restored.

6. A method executed by a center that controls software updates of an electronic control unit mounted on a vehicle, the method comprising: communicating between the vehicle and an information terminal associated with the vehicle; and controlling the software update process based on an update acceptance notification received from the information terminal, The method, wherein the controlling step limits the software update process when communication between the vehicle and the information terminal is interrupted even if the update acceptance notification is received.

7. A method executed by a computer at a center that includes a processor and a memory and controls software updates for an electronic control unit mounted on a vehicle, the method comprising: communicating between the vehicle and an information terminal associated with the vehicle; and controlling the software update process based on an update acceptance notification received from the information terminal, The program, in the controlling step, when communication between the vehicle and the information terminal is interrupted, restricting the software update process even if the update acceptance notice is received.

Images