OTA master, system, method, program, and vehicle

Abstract

To provide an OTA master, or the like, that can execute a software update for an electronic control unit adapted to a single-bank memory and a dual-bank memory.SOLUTION: An OTA master which controls software update of electronic control units mounted on a vehicle includes: a communication unit configured to receive, from a center, first type update data for an electronic control unit on which a first-type non-volatile memory having one storage area is mounted and second type update data for an electronic control unit on which a second-type non-volatile memory having two storage areas is mounted; and a control unit configured to control transfer and activation of the first type update data and the second type update data with respect to target electronic control units which are to be subjected to software update.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an OTA master that controls software updates for electronic control units. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units for controlling the operation of the vehicle. Each electronic control unit includes a processor, a temporary storage unit such as a RAM, and a non-volatile memory that is a non-volatile storage unit such as a flash ROM. The processor executes software stored in the non-volatile memory to realize the control function of the electronic control unit. The software stored in each electronic control unit is rewritable, and by updating the software to a newer version, the function of each electronic control unit can be improved or a new vehicle control function can be added.

[0003] As a technology for updating software of an electronic control unit, there is known an OTA (Over The Air) technology in which an in-vehicle communication device connected to an in-vehicle network is wirelessly connected to a communication network such as the Internet, and a device in charge of updating the software of the vehicle downloads software from a server via wireless communication and installs the downloaded software in the electronic control unit, thereby updating or adding software to the electronic control unit. For example, see Patent Document 1.

[0004] There are two types of non-volatile memory installed in electronic control units: memory with one storage area for storing software and other data (single bank memory), and memory with two storage areas for storing software and other data (dual bank memory), and they may be used depending on the specifications of the electronic control unit. Electronic control units equipped with dual bank memory can store two versions of data, one old and one new, in each of the two storage areas. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2004-326689 A Summary of the Invention [Problem to be solved by the invention]

[0006] In a campaign, which is an event for updating software in vehicles, both an electronic control unit equipped with a single bank memory and an electronic control unit equipped with a dual bank memory may be electronic control units for which software is to be updated. The electronic control unit equipped with a single bank memory and the electronic control unit equipped with a dual bank memory have different recovery methods when an update fails due to the memory structure.

[0007] Therefore, when a campaign is applied to a vehicle in which electronic control units equipped with single bank memory and electronic control units equipped with dual bank memory are mixed as electronic control units to be updated, if the software update (installation and activation) is not performed according to the communication conditions of the in-vehicle network to which the electronic control unit is connected, it may take some time for the electronic control unit to start up normally after the software update.

[0008] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide an OTA master and the like that can perform software updates of electronic control units that are compatible with single bank memories and dual bank memories. [Means for solving the problem]

[0009] In order to solve the above problems, one aspect of the disclosed technology is an OTA master that controls software updates of an electronic control unit mounted on a vehicle, and includes a communication unit that receives from a center first type update data, which is update data intended for an electronic control unit equipped with a first type of non-volatile memory having one storage area, and second type update data, which is update data intended for an electronic control unit equipped with a second type of non-volatile memory having two storage areas, and a control unit that controls the transfer and activation of the first type update data and the second type update data to a target electronic control unit, which is an electronic control unit to be updated. Effect of the Invention

[0010] According to the OTA master of the present disclosure, software updates (installation and activation) of electronic control units adapted to single bank memories and dual bank memories can be performed based on the communication status of the in-vehicle network. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing an overall configuration of a network system according to an embodiment; [Diagram 2] Block diagram showing the general configuration of the center [Diagram 3] Center functional block diagram [Figure 4] Block diagram showing the schematic configuration of the OTA master [Diagram 5] OTA Master Functional Block Diagram [Figure 6A] FIG. 1 is a block diagram showing an example of a schematic configuration of an electronic control unit; [Figure 6B] FIG. 1 is a block diagram showing an example of a schematic configuration of an electronic control unit; [Figure 7] FIG. 13 is a diagram showing an example of type information [Figure 8] Flowchart of download processing procedure according to concrete example 1 performed by the center and the OTA master [Figure 9A]1 is a flowchart of an installation and activation process performed by an OTA master and a target electronic control unit according to a second embodiment of the present invention; [Figure 9B] 1 is a flowchart of an installation and activation process performed by an OTA master and a target electronic control unit according to a second embodiment of the present invention; [Figure 10] 13 is a flowchart of an installation and activation process performed by an OTA master and a target electronic control unit according to a third embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] In the network system disclosed herein, the process order of installation and activation is controlled for update data for electronic control units that are the subject of update and that are downloaded from a center, for update data intended for electronic control units equipped with a single bank memory and update data intended for electronic control units equipped with a dual bank memory. This process allows software updates for the electronic control units to be performed in accordance with the type of memory installed. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0013] <Embodiment> [composition] Fig. 1 is a block diagram showing an overall configuration of a network system according to an embodiment of the present disclosure. The network system shown in Fig. 1 is a system for updating software of a plurality of electronic control units 40a to 40d mounted on a vehicle, and includes a center 10 located outside the vehicle and an in-vehicle network 20 built inside the vehicle.

[0014] (1) Center The center 10 is capable of communicating with an OTA master 30 (described later) provided in the in-vehicle network 20 via the network 70. The center 10 can control and manage software updates of the multiple electronic control units 40a-40d connected to the OTA master 30 by transmitting update data for the software of the electronic control units 40a-40d and receiving notifications indicating the progress of the software update process between the center 10 and the OTA master 30. The center 10 functions as a so-called server.

[0015] FIG. 2 is a block diagram showing a schematic configuration of the center 10 in FIG. 1. As shown in FIG. 2, the center 10 includes a central processing unit (CPU) 11, a random access memory (RAM) 12, a storage device 13, and a communication device 14. The storage device 13 is a device including a readable and writable storage medium such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a program for performing software update management, information used for software update control and update management, and software update data for each electronic control unit. In the center 10, the CPU 11 executes a program read from the storage device 13 by using the RAM 12 as a working area, thereby executing a predetermined process related to software update. The communication device 14 is a device for communicating with the OTA master 30 via a network 70.

[0016] Fig. 3 is a functional block diagram of the center 10 shown in Fig. 2. The center 10 shown in Fig. 3 includes a storage unit 16, a communication unit 17, and a control unit 18. The storage unit 16 is realized by the storage device 13 shown in Fig. 2. The communication unit 17 and the control unit 18 are realized by the CPU 11 shown in Fig. 2 executing a program stored in the storage device 13 using the RAM 12.

[0017] The storage unit 16 stores information related to software update processing of one or more electronic control units mounted on the vehicle. As information related to the software update processing, the storage unit 16 stores at least update management information in which information indicating software available in the electronic control units 40a to 40d is associated with each vehicle identification information (vehicle ID) that identifies the vehicle, and update data of the software of the electronic control units 40a to 40d. As information indicating software available in the electronic control units 40a to 40d, for example, a combination of the latest version information of each software of the multiple electronic control units 40a to 40d is defined. Furthermore, as information related to the software update processing, the storage unit 16 can store update status indicating the update state of the software being performed in the vehicle. Furthermore, the storage unit 16 can store information (described later) related to the type of non-volatile memory mounted in each of the multiple electronic control units 40a to 40d.

[0018] The communication unit 17 functions as a transmitting unit and a receiving unit that transmits and receives data, information, requests, and the like to and from the OTA master 30. The communication unit 17 receives a software update confirmation request from the OTA master 30 (receiving unit). The update confirmation request is information transmitted from the OTA master 30 to the center 10 when, for example, the power supply or ignition is turned on in the vehicle (hereinafter referred to as "power ON"), and is information for requesting the center 10 to confirm whether or not there is update data for the electronic control units 40a to 40d based on vehicle configuration information described later. In response to the update confirmation request received from the OTA master 30, the communication unit 17 transmits information indicating the presence or absence of update data to the OTA master 30 (transmitting unit). In addition, the communication unit 17 receives a transmission request (download request) for a distribution package from the OTA master 30 (receiving unit). In addition, when the communication unit 17 receives a download request for a distribution package, it transmits a distribution package including software update data for the electronic control units 40a to 40d to the OTA master 30.

[0019] When the communication unit 17 receives an update check request from the OTA master 30, the control unit 18 determines whether or not there is software update data for the electronic control units 40a-40d mounted on the vehicle identified by the vehicle ID included in the update check request, based on the update management information stored in the storage unit 16. The determination result by the control unit 18 as to whether or not there is update data is transmitted to the OTA master 30 by the communication unit 17. When the control unit 18 determines that there is software update data for the electronic control units 40a-40d, upon receiving a download request for a distribution package from the OTA master 30, the control unit 18 controls the update data to be transmitted to the OTA master 30.

[0020] (2) In-vehicle network The in-vehicle network 20 includes an OTA master 30, a plurality of electronic control units 40a to 40d, and a communication module 50. The OTA master 30 and the communication module 50 are connected via a bus 60a. The OTA master 30 and the electronic control units 40a and 40b are connected via a bus 60b. The OTA master 30 and the electronic control units 40c and 40d are connected via a bus 60c.

[0021] The OTA master 30 can wirelessly communicate with the center 10 via the bus 60a and the communication module 50 and the network 70. The OTA master 30 is a device having a function of managing an OTA state, controlling an update sequence, which is a flow of a software update process, and performing a software update of an electronic control unit to be updated (hereinafter referred to as a "target electronic control unit"). The OTA master 30 controls software updates of the target electronic control units among the electronic control units 40a to 40d based on update data acquired from the center 10, etc. The OTA master 30 is sometimes referred to as a central gateway (CGW).

[0022] Fig. 4 is a block diagram showing a schematic configuration of the OTA master 30 in Fig. 1. As shown in Fig. 4, the OTA master 30 includes a CPU 31, a RAM 32, a ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, the RAM 32, the ROM 33, and the storage device 34 constitute a microcomputer 35. In the OTA master 30, the CPU 31 executes a program read from the ROM 33 by using the RAM 32 as a working area, thereby executing a predetermined process related to software update. The communication device 36 is a device for communicating with the communication module 50 and each of the electronic control units 40a to 40d via the buses 60a to 60c shown in Fig. 1.

[0023] Fig. 5 is a functional block diagram of the OTA master 30 shown in Fig. 4. The OTA master 30 shown in Fig. 5 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is realized by the storage device 34 shown in Fig. 4. The communication unit 38 and the control unit 39 are realized by the CPU 31 shown in Fig. 4 executing a program stored in the ROM 33 using the RAM 32.

[0024] The storage unit 37 stores a program for executing software updates of the multiple electronic control units 40a to 40d (a control program for the OTA master 30), various data used when executing software updates, and software update data downloaded from the center 10. The storage unit 37 can also store information (described later) related to the type of non-volatile memory mounted in each of the multiple electronic control units 40a to 40d.

[0025] The communication unit 38 functions as a transmitting unit and a receiving unit that transmits and receives data, information, requests, and the like to and from the center 10. The communication unit 38 transmits a software update check request to the center 10, for example, when the power of the vehicle is turned on (transmitting unit). The update check request includes, for example, a vehicle ID for identifying the vehicle and information on the current version of the software of the electronic control units 40a to 40d connected to the in-vehicle network 20. The vehicle ID and the current version of the software of the electronic control units 40a to 40d are used to determine whether or not there is update data for the software of the electronic control units 40a to 40d by comparing them with the latest version of the software held by the center 10 for each vehicle ID. In addition, the communication unit 38 receives a notification indicating the presence or absence of update data from the center 10 as a response to the update check request (receiving unit). When there is update data for the software of the electronic control units 40a to 40d, the communication unit 38 transmits a download request for a distribution package of the software update data to the center 10 (transmission unit), and receives (downloads) the distribution package transmitted from the center 10 (reception unit). In addition, the communication unit 38 transmits the update status of the software transmitted by the electronic control units 40a to 40d to the center 10 (transmission unit).

[0026] The control unit 39 judges whether or not there is update data for the software of the electronic control units 40a to 40d based on a response from the center 10 to the update confirmation request received by the communication unit 38. The control unit 39 also verifies the authenticity of the distribution package that the communication unit 38 receives (downloads) from the center 10 and stores in the storage unit 37 based on its own control. The control unit 39 also controls software update processing (various verifications, installation, activation, etc.) of the electronic control units 40a to 40d using the update data received (downloaded) from the center 10. Specifically, the control unit 39 transfers one or more pieces of update data downloaded by the distribution package to the target electronic control unit in a predetermined order, and causes the target electronic control unit to install update software based on the update data. After the installation is completed, the control unit 39 instructs the target electronic control unit to activate the installed update software in a predetermined order. During this software update process, the control unit 39 appropriately controls procedures such as various verifications, installations, and activations in the multiple electronic control units 40a to 40d.

[0027] The electronic control units 40a to 40d are devices (ECUs: Electronic Control Units) for controlling the operation of each part of the vehicle. In FIG. 1, an example is shown in which the in-vehicle network 20 includes four electronic control units 40a to 40d, but the number of electronic control units is not particularly limited. For example, a display device (HMI) for performing various displays, such as a display that there is update data during software update processing of the electronic control units 40a to 40d, a display of a consent request screen for requesting consent to the software update from the vehicle user or administrator, and a display of the result of the software update, may be connected to the OTA master 30. A car navigation system or the like can be used as the display device. In addition, the number of buses connecting the electronic control units to the OTA master 30 is not particularly limited. For example, the above-mentioned display device may be connected to the OTA master 30 by a bus other than the buses 60a to 60c.

[0028] An example of a schematic configuration of the electronic control units 40a to 40d is shown in FIGS. 6A and 6B.

[0029] The electronic control unit 40a shown in FIG. 6A includes a CPU 41, a RAM 42, a non-volatile memory 43a, and a communication device 44. The CPU 41 executes a program read from the non-volatile memory 43a by using the RAM 42 as a working area, thereby realizing the function of the electronic control unit 40a. The non-volatile memory 43a is a memory having one storage area 45 for storing data such as software (hereinafter referred to as a "single bank memory"). Hereinafter, the memory type of the non-volatile memory 43a having the one storage area 45 is referred to as a "first type". In addition to software for realizing the function of the electronic control unit 40a, the storage area 45 may store version information, parameter data, a boot program for starting, a program for updating software, and the like. The communication device 44 is a device for communicating with the OTA master 30 and other electronic control units 40b to 40d connected to the in-vehicle network 20.

[0030] The electronic control unit 40b shown in FIG. 6B includes a CPU 41, a RAM 42, a non-volatile memory 43b, and a communication device 44, similar to the electronic control unit 40a. However, the non-volatile memory 43b mounted on the electronic control unit 40b is a memory having two storage areas 46a and 46b for storing data such as software (hereinafter referred to as a "dual bank memory"). Hereinafter, the type of the non-volatile memory 43b having the two storage areas 46a and 46b is referred to as a "second type". In addition to software for realizing the functions of the electronic control unit 40b, the storage areas 46a and 46b may store version information, parameter data, a boot program for starting, a program for updating software, and the like. The CPU 41 of the electronic control unit 40b sets one of the two storage areas 46a and 46b of the non-volatile memory 43b as a storage area (operational aspect) to be read, and executes the software stored in the storage area to be read. In the other storage area (non-operational side) that is not the read target, update software (updated program) based on update data can be installed (written) in the background while the software (program) in the read target storage area (operational side) is being executed. When activating (enabling update software) in the software update process, the update software can be activated by switching the storage area that is the read target of the program by the CPU 41 of the electronic control unit 40b.

[0031] As a specific example, assume that current software is stored in the storage area 46a of the nonvolatile memory 43b, which is a dual bank memory, and update software is installed in the storage area 46b. When the OTA master 30 instructs activation of the update software, for example, the electronic control unit 40b can switch the read start address of the CPU 41 from the top address of the storage area 46a to the top address of the storage area 46b, thereby switching the storage area to be read by the CPU 41 (operation side), and executing the update software installed in the storage area 46b. Note that in this disclosure, a configuration called a "one-side suspend memory" in which one storage area is partitioned into two sides in a pseudo manner and software (program) can be written to one side while software (program) stored in the other side is being executed is also classified as the second type of nonvolatile memory.

[0032] FIG. 7 shows an example of type information, which is information related to the type of nonvolatile memory mounted in each of the electronic control units 40a to 40d. In the type information shown in FIG. 7, an ECU_ID, which is a number for identifying an electronic control unit, is associated with the type of nonvolatile memory mounted in the electronic control unit (first type (single bank) / second type (dual bank)). This type information is stored and managed in one or both of the storage unit 37 of the OTA master 30 and the storage unit 16 of the center 10. The type information may be created in advance based on the specifications of the electronic control units 40a to 40d constituting the in-vehicle network 20 and stored in the storage unit 37 of the OTA master 30 when the vehicle is manufactured, or may be acquired by the OTA master 30 from the target electronic control unit through communication within the in-vehicle network 20 during software update processing. In addition, when the type information is managed by the center 10, the OTA master 30 may acquire the type information from the center 10 via the network 70.

[0033] The communication module 50 is a unit having a function of controlling communication between the center 10 and the vehicle, and is a communication device for connecting the in-vehicle network 20 to the center 10. The communication module 50 is wirelessly connected to the center 10 via the network 70, and performs vehicle authentication by the OTA master 30, downloading update data, etc. This communication module 50 may be configured as being included in the OTA master 30.

[0034] [Software update process overview] The OTA master 30 transmits a software update check request to the center 10, for example, when the power supply of the vehicle is turned on. The update check request includes a vehicle ID for identifying the vehicle, and vehicle configuration information, which is information on the state (system configuration) of the electronic control units 40a to 40d connected to the in-vehicle network 20, such as the current versions of the hardware and software of the electronic control units 40a to 40d. The vehicle configuration information can be created by acquiring the identification numbers (ECU_ID) of the electronic control units and the identification numbers (ECU_Software_ID) of the software versions of the electronic control units from the electronic control units 40a to 40d connected to the in-vehicle network 20. The vehicle ID and the current versions of the software of the electronic control units 40a to 40d are used to determine whether or not there is update data for the software of the electronic control units 40a to 40d by comparing them with the latest version of the software held by the center 10 for each vehicle ID. The center 10 transmits a notification indicating the presence or absence of update data to the OTA master 30 as a response to the update check request received from the OTA master 30. When there is update data for the software of the electronic control units 40a to 40d, the OTA master 30 transmits a download request for a distribution package to the center 10. In response to the download request received from the OTA master 30, the center 10 transmits a distribution package of the update data to the OTA master 30. In addition to the update data, the distribution package may include verification data for verifying the authenticity of the update data, the number and type information of the update data, various control information used when updating the software, and the like.

[0035] The OTA master 30 determines whether or not there is update data for the software of the electronic control units 40a to 40d, based on the response to the update confirmation request received from the center 10. The OTA master 30 also verifies the authenticity of the distribution package received from the center 10 and stored in the storage device 13. The OTA master 30 also transfers one or more pieces of update data downloaded in the distribution package to the target electronic control unit in a predetermined order, and causes the target electronic control unit to install the update data. After the installation is completed, the OTA master 30 instructs the target electronic control unit to activate the installed updated software in a predetermined order.

[0036] In addition, in the consent request process, the OTA master 30 causes the output device to output a notification that consent is required for the software update or a notification that prompts input that the software update has been consented to. As the output device, a display device (not shown) that provides a notification by display and an audio output device (not shown) that provides a notification by audio, which are provided in the in-vehicle network 20, can be used. For example, when a display device is used as the output device in the consent request process, the OTA master 30 can cause the display device to display a consent request screen for requesting consent to the software update from the user or administrator, or cause the display device to display a notification that prompts a specific input operation such as pressing an consent button if the user or administrator consents. In addition, in the consent request process, the OTA master 30 can cause the display device to display a statement or an icon notifying that there is update data for the software of the electronic control units 40a to 40d, or cause the display device to display restrictions during the execution of the software update process. When the OTA master 30 receives input indicating consent from the user or administrator, it executes the above-mentioned installation and activation control process and updates the software of the target electronic control unit.

[0037] Here, if the installation and activation of the target electronic control unit are performed in succession, the consent request process for the software update is performed before the installation is performed. If the installation and activation of the target electronic control unit are not performed in succession, the consent request process for the software update is performed at least after the installation is performed and before the activation is performed.

[0038] The software update process consists of a phase in which the OTA master 30 downloads update data from the center 10 (download phase), a phase in which the OTA master 30 transfers the downloaded update data to the target electronic control unit and installs update software based on the update data in the storage area of ​​the target electronic control unit (installation phase), and a phase in which the target electronic control unit activates the installed update software (activation phase).

[0039] Downloading is a process in which the OTA master 30 receives update data for updating the software of the electronic control unit transmitted from the center 10 and stores it in the storage unit 37. In downloading, update data intended for an electronic control unit equipped with a dual bank memory and update data intended for an electronic control unit equipped with a single bank memory are downloaded using a predetermined distribution package. The download phase includes not only execution of the download, but also control of a series of processes related to the download, such as determining whether or not the download can be performed and verifying the update data.

[0040] The update data transmitted from the center 10 to the OTA master 30 may include update software for the electronic control unit (all data or difference data), compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may also include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The distribution package to be downloaded may include update data for only a single electronic control unit or update data for multiple electronic control units.

[0041] Installation is a process in which the OTA master 30 writes update software (updated programs) in a predetermined order to the non-volatile memories 43a and / or 43b of multiple target electronic control units based on update data downloaded from the center 10. Installation is controlled based on whether the update data is intended for an electronic control unit equipped with a dual bank memory or an electronic control unit equipped with a single bank memory. The installation phase not only executes the installation, but also includes control of a series of processes related to the installation, such as judging whether the installation can be executed, transferring the update data, and verifying the update software.

[0042] If the update data includes the update software itself (all data), the OTA master 30 transfers the update data (update software) to the target electronic control unit in the installation phase. If the update data includes compressed data, difference data, or divided data of the update software, the OTA master 30 may transfer the update data to the target electronic control unit and the target electronic control unit may generate the update software from the update data, or the OTA master 30 may generate the update software from the update data and then transfer the update software to the target electronic control unit. Here, the update software can be generated by decompressing the compressed data or assembling (integrating) the difference data or divided data.

[0043] The target electronic control unit can install the update software based on an installation request from the OTA master 30. Note that for a specific target electronic control unit that has received the update data, the installation may be performed autonomously without receiving an explicit instruction from the OTA master 30.

[0044] Activation is a process in which the target electronic control unit activates the update software installed in the non-volatile memory 43a and / or 43b. Activation is controlled based on whether the update data is intended for an electronic control unit equipped with a dual bank memory or an electronic control unit equipped with a single bank memory. The activation phase includes not only the execution of activation, but also a series of controls related to activation, such as a determination as to whether activation can be executed, a request for consent to activation from the vehicle user or administrator, and verification of the execution result.

[0045] The activation of the update software can be performed by the target electronic control unit based on an activation request from the OTA master 30. Note that, for a specific target electronic control unit that has received the update data, the activation may be performed autonomously after the installation is completed, without receiving an explicit instruction from the OTA master 30.

[0046] The software update process can be performed consecutively or in parallel for each of the multiple target electronic control units.

[0047] Furthermore, in this specification, the "software update process" includes not only a process in which download, installation, and activation are all performed consecutively, but also a process in which only some of the download, installation, and activation are performed.

[0048] [process] Next, with further reference to FIGS. 8, 9A, 9B, and 10, some specific examples of the software update process executed in the network system according to this embodiment will be described.

[0049] (1) Download Example 1 8 is a flowchart illustrating a process procedure according to a specific example 1 of downloading performed by the center 10 and the OTA master 30. The specific example 1 of downloading illustrated in FIG. 8 is started when the center 10 receives a download request for a distribution package from the OTA master 30.

[0050] (Step S801) The center 10 transmits a distribution package including update data for a target electronic control unit that is the subject of software update to the OTA master 30. This distribution package may contain a mixture of update data intended for an electronic control unit equipped with a first type of non-volatile memory (single bank memory) and update data intended for an electronic control unit equipped with a second type of non-volatile memory (dual bank memory). Once the distribution package is transmitted, the process proceeds to step S802.

[0051] (Step S802) The OTA master 30 receives the distribution package transmitted from the center 10. When the distribution package is received, the process proceeds to step S803.

[0052] (Step S803) The OTA master 30 stores the update data included in the distribution package received from the center 10 in the storage unit 37. This completes the download process.

[0053] (2) Installation and activation example 2 9A and 9B are flowcharts for explaining the procedure of installation and activation processing according to specific example 2 performed by the OTA master 30 and a target electronic control unit (hereinafter referred to as "target ECU"). The processing in FIG. 9A and the processing in FIG. 9B are connected by a connector X. Specific example 2 of installation and activation illustrated in FIG. 9A and 9B is started after downloading of update data is completed and predetermined conditions (installation can be executed, verification of update data is OK, etc.) are satisfied.

[0054] (Step S901) The OTA master 30 acquires the memory type (first type / second type) of the non-volatile memory mounted in the target ECU. This memory type can be acquired by referring to type information stored in the storage unit 37 when managed by the OTA master 30, or by referring to memory type information included in the distribution package and transmitted when managed by the center 10. When the memory type of the target ECU is acquired, the process proceeds to step S902.

[0055] (Step S902) The OTA master 30 transfers update data (second type update data) to a second type target ECU equipped with a second type non-volatile memory (dual bank memory) and executes installation, which is a process of writing update software to a storage area of ​​the ECU (first process). This installation is executed consecutively and / or in parallel for all the second type target ECUs. When installation for all the second type target ECUs is completed, the process proceeds to step S903.

[0056] (Step S903) The OTA master 30 transfers update data (first type update data) to a first type target ECU equipped with a first type non-volatile memory (single bank memory) and executes installation, which is a process of writing update software to a storage area of ​​the ECU (second process). This installation is executed consecutively and / or in parallel for all of the first type target ECUs. When installation for all of the first type target ECUs is completed, the process proceeds to step S904.

[0057] (Step S904) The OTA master 30 and the first type target ECU execute activation to make valid the update software written in the storage area of ​​the non-volatile memory of the first type target ECU (second process). This activation is performed simultaneously or in a predetermined order for all the first type target ECUs for which installation has been completed. When it is performed in a predetermined order, activation may be performed sequentially from the first type target ECUs for which installation has been completed, without waiting for the installation of all the first type target ECUs to be completed. When activation of the update software in the first type target ECUs is completed, the process proceeds to step S905.

[0058] (Step S905) The OTA master 30 and the second type target ECU execute activation to make the update software written in the storage area of ​​the non-volatile memory of the second type target ECU effective (third process). This activation is performed simultaneously or in a predetermined order for all the second type target ECUs for which the installation has been completed. When the activation of the update software in the second type target ECU is completed, this installation and activation process is completed.

[0059] According to the specific example 2 of the installation and activation, the installation of the second type target ECU, which has a relatively low probability of update failure, is performed first, and the activation of the second type target ECU is performed after the installation and activation of the first type target ECU. This allows the second type target ECU to be activated and started after the first type target ECU is normally updated, thereby shortening the time until the software update is completed. The order of installation and activation of the target ECUs based on the above-mentioned memory types may be stored in the storage unit 37 of the OTA master 30, or may be obtained by the OTA master 30 from the center 10 (for example, by transmitting it included in a distribution package).

[0060] (3) Installation and activation example 3 Fig. 10 is a flowchart for explaining the procedure of installation and activation processing according to concrete example 3 performed by the OTA master 30 and the target ECU. Concrete example 3 of installation and activation illustrated in Fig. 10 is started after download of update data is completed and predetermined conditions (installation can be executed, verification of update data is OK, etc.) are satisfied.

[0061] (Step S1001) The OTA master 30 acquires the memory type (first type / second type) of the non-volatile memory mounted in the target ECU. This memory type can be acquired by referring to type information stored in the storage unit 37 when managed by the OTA master 30, or by referring to memory type information included in the distribution package and transmitted when managed by the center 10. When the memory type of the target ECU is acquired, the process proceeds to step S1002.

[0062] (Step S1002) The OTA master 30 transfers update data (second type update data) to the second type target ECU and executes installation, which is a process of writing update software to the storage area of ​​the ECU (first process). This installation is executed consecutively and / or in parallel for all the second type target ECUs. When the installation for all the second type target ECUs is completed, the process proceeds to step S1003.

[0063] (Step S1003) The OTA master 30 and the second type target ECU execute activation to make valid the update software written in the storage area of ​​the non-volatile memory of the second type target ECU (first process). This activation is performed simultaneously or in a predetermined order for all the second type target ECUs for which installation has been completed. When it is performed in a predetermined order, activation may be performed sequentially from the second type target ECUs for which installation has been completed, without waiting for the installation of all the second type target ECUs to be completed. When activation of the update software in the second type target ECUs is completed, the process proceeds to step S1004.

[0064] (Step S1004) The OTA master 30 transfers update data (first type update data) to the first type target ECU and executes installation, which is a process of writing update software to the storage area of ​​the ECU (second process). This installation is executed consecutively and / or in parallel for all the first type target ECUs. When installation for all the first type target ECUs is completed, the process proceeds to step S1005.

[0065] (Step S1005) The OTA master 30 and the first type target ECU execute activation to make valid the update software written in the storage area of ​​the non-volatile memory of the first type target ECU (second process). This activation is performed simultaneously or in a predetermined order for all the first type target ECUs for which installation has been completed. When it is performed in a predetermined order, activation may be performed sequentially from the first type target ECUs for which installation has been completed, without waiting for the completion of installation for all the first type target ECUs. When activation of the update software in the first type target ECU is completed, this installation and activation process is completed.

[0066] The above-mentioned concrete example 3 of installation and activation is particularly useful when it is better to install and activate the second type target ECU before installing and activating the first type target ECU in order to shorten the time until the software update is completed. The above-mentioned order of installation and activation of the target ECU based on the memory type may be stored in the storage unit 37 of the OTA master 30, or may be acquired by the OTA master 30 from the center 10 (for example, by transmitting it included in a distribution package).

[0067] In the case of the specific example 3 of the installation and activation, the second type target ECU starts up before the first type target ECU. Therefore, if it is desirable to start the first type target ECU and the second type target ECU simultaneously (to achieve control synchronization), measures may be taken such as temporarily putting the start of the second type target ECU on hold (setting a stop flag) after the first process ends.

[0068] <Actions and Effects> As described above, according to a network system according to one embodiment of the present disclosure, the OTA master suitably controls the method of installing and activating update data intended for an electronic control unit equipped with a single bank memory (a first type of non-volatile memory) and update data intended for an electronic control unit equipped with a dual bank memory (a second type of non-volatile memory).

[0069] Specifically, the OTA master in this embodiment first installs a target electronic control unit equipped with a dual bank memory, which has a relatively low probability of update failure, and activates the target electronic control unit equipped with this dual bank memory after installing and activating a target electronic control unit equipped with a single bank memory.

[0070] With this process, even if the installation and activation of the target electronic control unit equipped with a single bank memory fails, after the target electronic control unit equipped with a single bank memory confirms final success, the target electronic control unit equipped with the installed dual bank memory simply needs to be activated and started up, thereby shortening the time required to complete the software update.

[0071] Alternatively, the OTA master of this embodiment installs and activates a target electronic control unit equipped with a dual bank memory, and then installs and activates a target electronic control unit equipped with a single bank memory.

[0072] This process may reduce the time required to complete the software update if it is better to install and activate the second type of target ECU before installing and activating the first type of target ECU in order to reduce the time required to complete the software update.

[0073] Although one embodiment of the disclosed technology has been described above, the present disclosure can be understood as not only an OTA master, but also a method executed by an OTA master having a processor and a memory, a program, a computer-readable non-transitory storage medium storing a program, a system including a center and an OTA master, or a vehicle including an OTA master. [Industrial Applicability]

[0074] The disclosed technique can be used in a network system for updating software in an electronic control unit. [Explanation of symbols]

[0075] 10 Center 11, 31, 41 CPUs 12, 32, 42 RAM 13, 34 Storage device 14, 36, 44 Communication equipment 16, 37 Memory section 17, 38 Communications Department 18, 39 Control section 20 In-vehicle network 30 OTA Master 33 ROM 35 Microcomputer 40a~40d Electronic control unit (ECU) 43a, 43b Non-volatile memory 45, 46a, 46b Storage area 50 Communication Module 60a~60c Bus 70 Network

Claims

1. An OTA master that controls software updates of an electronic control unit mounted on a vehicle, a communication unit that receives from a center first type update data, which is update data intended for the electronic control unit equipped with a first type nonvolatile memory having one storage area, and second type update data, which is update data intended for the electronic control unit equipped with a second type nonvolatile memory having two storage areas; a control unit that controls the transfer and activation of the first type update data and the second type update data to a target electronic control unit, which is the electronic control unit to be updated.

2. 2. The OTA master according to claim 1, wherein the control unit transfers the second type update data to the target electronic control unit, then transfers and activates the first type update data, and then activates the second type update data.

3. The OTA master according to claim 1 , wherein the control unit transfers and validates the second type update data to the target electronic control unit, and then transfers and validates the first type update data to the target electronic control unit.

4. A system including an OTA master that controls software updates of an electronic control unit mounted on a vehicle, and a center that can communicate with the OTA master, the center includes a first communication unit configured to transmit, to the OTA master, first type update data, which is update data intended for the electronic control unit equipped with a first type nonvolatile memory having one storage area, and second type update data, which is update data intended for the electronic control unit equipped with a second type nonvolatile memory having two storage areas; The OTA master includes: A second communication unit that receives the update data transmitted by the center; a control unit that controls the transfer and activation of the first type update data and the second type update data to a target electronic control unit, which is the electronic control unit to be updated.

5. 5. The system according to claim 4, wherein the control unit of the OTA master transfers the second type update data to the target electronic control unit, then transfers and activates the first type update data, and then activates the second type update data.

6. The system according to claim 4 , wherein the control unit of the OTA master transfers and validates the second type update data to the target electronic control unit, and then transfers and validates the first type update data to the target electronic control unit.

7. 1. A method performed by an OTA master for controlling software updates of an electronic control unit installed in a vehicle, comprising: receiving, from a center, update data intended for the electronic control unit equipped with a first type of nonvolatile memory having one storage area, and update data intended for the electronic control unit equipped with a second type of nonvolatile memory having two storage areas; and controlling the transfer and activation of the update data to the electronic control units to be updated.

8. A program executed by a computer of an OTA master that controls software updates of an electronic control unit mounted in a vehicle, receiving, from a center, update data intended for the electronic control unit equipped with a first type of nonvolatile memory having one storage area, and update data intended for the electronic control unit equipped with a second type of nonvolatile memory having two storage areas; and controlling the transfer and activation of the update data to the electronic control unit to be updated.

9. A vehicle equipped with the OTA master according to any one of claims 1 to 3.

Images