Device management system and program management method thereof

Abstract

A device management system according to an embodiment of the present invention is a device management system that cooperates with a device to manage the device, and includes at least one processor; and a memory that stores a device management program including at least one instruction executed through the at least one processor. Here, the memory can store a first program related to the functional safety of the device and a second program unrelated to the functional safety of the device in independently partitioned areas in the memory.

Description

[Technical field]

[0001] This application claims the benefit of the filing date of Korean Patent Application No. 10-2022-0164431, filed with the Korean Intellectual Property Office on November 30, 2022, and all of the contents disclosed in the documents of that Korean patent application are incorporated herein by reference.

[0002] The present invention relates to a device management system and a program management method thereof, and more particularly to a device management system including a partitioned memory and a program management method for managing a device management program using the memory. [Background technology]

[0003] An energy storage system (ESS) is a system that connects renewable energy, batteries that store power, and existing grid power. In recent years, smart grids and new renewable energy have become more widespread, and as the efficiency and safety of the power system are emphasized, the demand for energy storage systems is increasing to regulate power supply and demand and improve power quality. Depending on the purpose of use, energy storage systems may have different outputs and capacities. Multiple battery systems can be connected together to form a large-capacity energy storage system.

[0004] For example, an energy storage system applied to a photovoltaic (PV) power generation system may include a battery section consisting of a number of batteries, a battery management system (BMS) for managing the batteries, a power conversion system (PCS), an energy management system (EMS), a DC-DC converter, etc.

[0005] Among these, the battery management system is the core component for managing batteries. It collects status information of the batteries included in the battery system, diagnoses whether there is a malfunction based on the status information, and controls the operating status of the batteries through linkage with a higher-level control device.

[0006] The battery management system may perform predefined operations through a management program (e.g., firmware) stored in a memory. During operation of the battery system, updates to the management program may be performed to change or add specific functions.

[0007] Battery management systems are subject to certification for functional safety in accordance with relevant laws and regulations, and additional certification is required when the management program is updated. In this case, even when functions unrelated to functional safety items are updated, the certification procedure for functional safety must be carried out, resulting in unnecessary time and costs. Summary of the Invention [Problem to be solved by the invention]

[0008] SUMMARY OF THE PRESENT EMBODIMENT In order to solve the above problems, an object of the present invention is to provide a device management system that manages a device management program using a partitioned memory.

[0009] Another object of the present invention to solve the above problems is to provide a program management method for the device management system. [Means for solving the problem]

[0010] To achieve the above objective, one embodiment of the present invention provides a device management system that works in conjunction with a device to manage the device, and may include at least one processor; and a memory that stores a device management program including at least one instruction that is executed through the at least one processor.

[0011] Here, at least one processor can store a first program related to the functional safety of the device and a second program unrelated to the functional safety of the device in independently partitioned areas within the memory.

[0012] The at least one processor may store version information regarding the first program and version information regarding the second program separately from each other in the memory.

[0013] When any one of the first program and the second program is updated, the at least one processor may independently update only the version information of the updated program.

[0014] When entering the update mode of the device management program, the at least one processor can update only one of the first program and the second program, or can sequentially update the first program and the second program.

[0015] The memory may include a first area in which the first program is stored; and a second area in which the second program is stored.

[0016] Here, the first area can be defined so as to be allocated to a fixed specific location in the memory.

[0017] Each of the first area and the second area may include a verification information storage area in which verification information for verifying whether the data stored in each area has been modified is stored; a code storage area in which control logic related to the device is stored; and a data storage area in which data necessary for managing or controlling the device is stored.

[0018] Here, a first code storage area included in the first area can store diagnostic logic related to the functional safety of the device, and a first data storage area included in the first area can store setting values ​​related to the diagnostic logic.

[0019] The at least one processor can update verification information stored in a first verification information storage area of ​​the first area when data stored in at least one of the first code storage area and the first data storage area is changed.

[0020] The memory may be a non-volatile memory.

[0021] The device management system may correspond to a battery management system located within a battery system.

[0022] To achieve the above-mentioned another object, a program management method according to one embodiment of the present invention is a program management method for a device management system including at least one processor and a memory for storing a device management program, and includes a step in which the processor partitions and stores a first program related to the functional safety of the device and a second program unrelated to the functional safety of the device in independently partitioned areas in the memory; and a step in which the processor partitions and stores version information regarding the first program and version information regarding the second program in the memory.

[0023] The method may further include, when any one of the first program and the second program is updated, independently updating only version information of the updated program.

[0024] The method may further include a step of determining, upon entering an update mode of the device management program, one of the first program and the second program as a program to be updated; and a step of independently updating the determined program to be updated.

[0025] The step of dividing and storing the first program into independently partitioned areas may further include the step of allocating an area in which the first program is stored to a fixed specific location in the memory.

[0026] The memory may include a first area in which the first program is stored, and a second area in which the second program is stored. Here, each of the first area and the second area may include a verification information storage area in which verification information for verifying whether data stored in each area has been changed is stored, a code storage area in which control logic related to the device is stored, and a data storage area in which data required for managing or controlling the device is stored.

[0027] The step of dividing and storing into the independently partitioned areas may include the steps of storing diagnostic logic related to functional safety of the device in a first code storage area included in the first area, and storing setting values ​​related to the diagnostic logic in a first data storage area included in the first area.

[0028] The program management method may further include a step of updating verification information stored in a first verification information storage area of ​​the first area when data stored in at least one of the first code storage area and the first data storage area is changed. Effect of the Invention

[0029] According to the embodiment of the present invention as described above, by dividing the device management program into functional safety-related programs and general programs and managing them independently, when updating the device management program, it is possible to independently update only the parts of the functions that require change, thereby improving the efficiency of program management.

[0030] In addition, according to an embodiment of the present invention, unnecessary certification procedures can be minimized by performing functional safety certification procedures only when a functional safety-related program included in a device management program is updated. [Brief description of the drawings]

[0031] [Figure 1] FIG. 1 is a block diagram of an energy storage system to which the present invention can be applied. [Diagram 2] FIG. 1 is a block diagram of a memory configured in a conventional battery management system. [Diagram 3] 1 is a block diagram of a device management system according to an embodiment of the present invention. [Figure 4] 2 is a block diagram of a memory included in a device management system according to an embodiment of the present invention. [Diagram 5] 3 illustrates partitioned regions of a memory according to an embodiment of the present invention. [Figure 6] 1 illustrates an example of a memory according to an embodiment of the present invention. [Figure 7] 2 is a flowchart of a program management method according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0032] Since the present invention can be modified in various ways and has various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, it is understood that this is not intended to limit the present invention to the specific embodiment, but includes all modifications, equivalents, and alternatives within the spirit and technical scope of the present invention. Similar reference numerals are used for similar components while describing each drawing.

[0033] Terms such as first, second, A, B, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only to distinguish one component from another. For example, a first component may be named a second component, and similarly, a second component may be named a first component, without departing from the scope of the present invention. The term "and / or" includes a combination of multiple associated listed items or any of multiple associated listed items.

[0034] When an element is referred to as being "coupled" or "connected" to another element, it is understood that the element may be directly connected or connected to the other element, but there may also be other elements in between. In contrast, when an element is referred to as being "directly coupled" or "directly connected" to another element, it is understood that there are no other elements in between.

[0035] The terms used in this application are merely used to describe certain embodiments and are not intended to limit the present invention. A singular expression includes a plural expression unless the context clearly indicates otherwise. In this application, the terms "include" or "have" are intended to specify the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, and are not intended to preclude the presence or additional possibility of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0036] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the present invention belongs. Terms as defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning they have in the context of the relevant art, and should not be interpreted as having an ideal or overly formal meaning unless expressly defined in this application.

[0037] Some terms used in this specification are defined as follows:

[0038] Nominal capacity (Nominal Capa.) refers to the set capacity [Ah] of a battery that is set by the battery manufacturer at the time of development.

[0039] SOC (State of Charge) is the current charged state of the battery expressed as a percentage [%], and SOH (State of Health) is the current deterioration state of the battery expressed as a percentage [%].

[0040] A battery rack is a system with a minimum structure that can connect pack units set by the battery manufacturer in series / parallel and can be monitored and controlled through a BMS. It can consist of multiple battery modules and one BPU or protection device.

[0041] A battery bank can refer to a large-scale collection of battery rack systems consisting of multiple racks connected in parallel. The battery bank BMS can monitor and control the rack BMS (RBMS) for each battery rack.

[0042] A BSC (Battery Section Controller) is a device that performs top-level control of a battery system including a bank-based battery system, and can also be used as a control device in a battery system having a multi-bank level structure.

[0043] FIG. 1 is a block diagram of an energy storage system to which the present invention can be applied.

[0044] FIG. 1 shows an example of a DC coupled system in which an output terminal of a PV (Photovoltaic) system 7 is connected to an output terminal of a DC / DC converter 5 and an input terminal of a PCS 4 .

[0045] Batteries that serve to store power in an energy storage system may be embodied in a form in which a plurality of battery modules constitute a battery rack, and a plurality of battery racks constitute a battery bank. Here, depending on the device or system in which the battery is used, the battery rack may also be called a battery pack. Battery #1, battery #2, ..., battery #N shown in FIG. 1 may be in the form of a battery pack or a battery rack.

[0046] In this case, each battery 1 may be provided with a Battery Management System (BMS). The BMS may monitor the current, voltage, and temperature of each battery rack (or pack) under its management, calculate a Status Of Charge (SOC) based on the monitoring results, and control charging and discharging. In the system of FIG. 1, if each battery is a battery rack, the BMS may be a rack BMS (RBMS).

[0047] Each battery section, which is made up of a large number of batteries and peripheral circuits, devices, etc., is provided with a Battery Section Controller (BSC) 2, which can monitor and control control items such as voltage, current, temperature, and circuit breakers.

[0048] In addition, a power conversion / conditioning system (PCS) 4 provided for each battery section controls power supplied from the outside and power supplied from the battery section to the outside, and may include a DC / AC inverter. In addition, the output of the DC / DC converter 5 may be connected to the PCS 4, and the PCS 4 may be connected to a grid 6. The PCS 4 usually operates in a constant power mode. A power management system (PMS) / Energy Management System (EMS) 3 connected to the PCS 4 may control the output of the PCS based on the results of monitoring and control of the BMS or BSC.

[0049] On the other hand, communication using a Controller Area Network (CAN) or Ethernet (shown by dashed lines in FIG. 1) can be performed between the BMS, BSC 2, PMS 3, and PCS 4.

[0050] FIG. 2 is a block diagram of a memory included in a conventional battery management system.

[0051] Among the components included in the energy storage system, the battery management system (BMS) is the core component that manages the batteries. It collects status information of the batteries included in the battery system, diagnoses faults based on the status information, and controls the operating status of the batteries in conjunction with a higher-level control device.

[0052] The battery management system can perform predefined operations through a management program (eg, firmware) stored in a memory.

[0053] 2, a memory configured in the battery management system may include a header area 10 and an application area 20. The header area 10 may store verification information (e.g., a checksum value) for verifying whether data stored in the application area 20 has been modified, and the application area 20 may store control logic for battery management and data required for control. The battery management system may operate according to a management program stored in the memory.

[0054] Battery management systems must be certified to ensure they meet the requirements for functional safety in accordance with relevant laws and regulations. If the management program of the battery management system is updated during the operation of the energy storage system, additional certification is also required.

[0055] As shown in Figure 2, in the case of conventional battery management systems, the management program was not divided by function in memory, so even when an item unrelated to functional safety was updated, the functional safety certification procedure had to be carried out. Since the certification procedure had to be carried out every time the management program was updated, there was a problem of unnecessary time and expense.

[0056] The present invention has been devised to solve the problems of the conventional technology, and aims to propose a device management system and a program management method thereof that can improve program management efficiency and at the same time minimize unnecessary authentication procedures.

[0057] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0058] FIG. 3 is a block diagram of a device management system according to an embodiment of the present invention.

[0059] The device management system according to the embodiment of the present invention may be a battery management system (BMS) located in a battery system included in an energy storage system. However, the scope of the present invention is not limited to such an object, and any device that cooperates with a specific device and manages the device using a device management program stored in a memory should be interpreted as the device management system according to the present invention.

[0060] The device management system may include at least one processor 100, a memory 200 for storing a device management program including at least one instruction executed through the at least one processor, and a transceiver 300 connected to a network for communication.

[0061] The device management program may include a first program related to the functional safety of the device, and a second program unrelated to the functional safety of the device. For example, the first program may include a status diagnosis program that diagnoses the status of the battery through measurement of the voltage, current, and temperature of the battery.

[0062] The at least one instruction executed by the at least one processor may include instructions to store the first program and the second program in independently partitioned areas of a memory.

[0063] The instructions may further include an instruction to allocate an area in which the first program is stored to a fixed specific location in the memory.

[0064] The at least one instruction may further include an instruction to store version information regarding the first program and version information regarding the second program separately from each other in the memory.

[0065] The at least one instruction may further include: an instruction for determining, when entering an update mode of the device management program, one of the first program and the second program as a program to be updated; and an instruction for independently updating the determined program to be updated.

[0066] The at least one instruction may further include an instruction for independently updating only version information of an updated program when any one of the first program and the second program is updated.

[0067] The device management system may further include an input interface unit 400, an output interface unit 500, a storage unit 600, etc. Each component included in the device management system is connected by a bus 700 to communicate with each other.

[0068] The processor 100 can execute program commands stored in at least one of the memory 200 and the storage device 600. Here, the processor can refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which the method according to the embodiment of the present invention is performed. The memory (or storage device) can be composed of at least one of a volatile storage medium and a non-volatile storage medium. For example, the memory can be composed of at least one of a read only memory (ROM) and a random access memory (RAM).

[0069] In an embodiment, the device management program according to the present invention may be stored and managed in a non-volatile memory, for example, the device management program may be stored and managed in a read-only memory (ROM).

[0070] FIG. 4 is a block diagram of a memory included in a device management system according to an embodiment of the present invention.

[0071] 4, the memory 200 may include a first region 210 and a second region 220. Here, the first and second regions may correspond to specific regions in the memory that are independently partitioned.

[0072] The device management program according to the present invention can be configured to include a first program related to the functional safety of the device, and a second program unrelated to the functional safety of the device. Here, the processor can store the first program in the first area 210 and the second program in the second area 220 separately. That is, the device management program according to the present invention can be configured to be separated into a safety-related program and a general program, and the device management system can be configured to store and manage these programs independently.

[0073] In an embodiment, the first region 210 may be defined to be fixedly allocated to a specific location in memory. For example, a safety-related program may be defined to be stored in a fixed location in a ROM.

[0074] The version information for the first program and the version information for the second program may be stored separately from each other in the memory 200. In an embodiment, the version information for the first program may be stored in the first area 210, and the version information for the second program may be stored in the second area 220. Thus, even if one of the version information for the first and second programs is changed, the version information for the other programs whose versions are not changed may be maintained.

[0075] The first and second programs may be updated independently of each other, i.e., the first and second programs may not be updated simultaneously, but may be updated one by one or may be updated sequentially.

[0076] For example, when the device management system enters an update mode of the device management program, the processor may determine one of the first and second programs as a program to be updated. Here, the program to be updated may be determined based on an identifier included in an input update file. Thereafter, the processor may independently update only the determined program to be updated.

[0077] When either the first program or the second program is updated, only the version information of the updated program can be updated independently. For example, when the second program, which is unrelated to functional safety, is updated, the processor can change only the version information of the second program (from V1 to V2). In this case, the version information of the first program, which is a functional safety-related program, is maintained, so that a separate functional safety certification procedure for the device does not need to be performed.

[0078] FIG. 5 shows partitioned regions of a memory according to an embodiment of the present invention, and FIG. 6 shows an example of a memory according to an embodiment of the present invention.

[0079] The memory 200 can be configured to include a first area and a second area, where the first area can be configured to store a first program related to the functional safety of the device, and the second area can be configured to store a second program unrelated to the functional safety.

[0080] Referring to Figure 5, the first area may be configured to include a first verification information storage area 211, a first code storage area 212, and a first data storage area 213, and the second area may be configured to include a second verification information storage area 221, a second code storage area 222, and a second data storage area 223.

[0081] The verification information storage area may store verification information for verifying whether data stored in other areas has been modified, for example, a checksum value for a Cyclic Redundancy Check (CRC) may be stored in the verification information storage area.

[0082] The code storage area may store logic for managing or controlling a device, for example, the code storage area may store code for monitoring, diagnosing, or controlling a device.

[0083] The data storage area can store data necessary for managing or controlling the device.

[0084] The first verification information storage area 211 and the second verification information storage area 221 can be configured to be included in the header area of ​​the memory 200, and the first code storage area 212, the first data storage area 213, the second code storage area 222 and the second data storage area 223 can be configured to be included in the application area of ​​the memory 200.

[0085] The first code storage area 212 stores diagnostic logic related to the functional safety of the device, and the first data storage area 213 can store setting values ​​related to the diagnostic logic stored in the first code storage area 212. For example, when the device management system according to the present invention is a battery management system located in a battery system, the first code storage area 212 can store voltage, current, and temperature measurement logic for battery state diagnosis, and state diagnosis logic based on the measured values. Also, the first data storage area 213 can store diagnostic setting values ​​(e.g., reference threshold values, etc.) for battery state diagnosis.

[0086] Referring to FIG. 6, the memory 200 according to an embodiment of the present invention may be configured such that the header area includes a first verification information storage area 211 and a second verification information storage area 221, and the application area includes a first code storage area 212, a first data storage area 213, a second code storage area 222, and a second data storage area 223.

[0087] The first verification information storage area 211 can store verification information (e.g., [Safety CRC (Code + Data)]) for verifying whether or not the first program stored in the first areas 212 and 213 has been altered. Specifically, for example, the first verification information storage area 211 can store a checksum value for a cyclic redundancy check (CRC).

[0088] Furthermore, the second verification information storage area 221 can store verification information (for example, [CRC (Code + Data)]) for verifying whether the second program stored in the second areas 222 and 223 has been altered.

[0089] The first code storage area 212 stores diagnostic logic related to the functional safety of the device (e.g., [.satety_functions(TEXT)]), and the first data storage area 213 can store setting values ​​related to the diagnostic logic stored in the first code storage area 212 (e.g., [.satety_data(TEXT)]).

[0090] In addition, the second code storage area 222 can store control logic unrelated to the functional safety of the device (e.g., [.startup], [.core_excetions_table], [.core_excetions], [.kernelFunc(TEXT)], [.text_vle(TEXT)], [.sdata]), and the second data storage area 223 can store data related to the control logic stored in the second code storage area 222 (e.g., [.kerne_data(DATA)], [.ramcode(TEXT)], [.data(DATA)]).

[0091] 5 and 6, a first program according to the present invention is stored in a first area 211, 212, 213, and a second program is stored in a second area 221, 222, 223, and can be managed independently.

[0092] When data stored in at least one of the first code storage area 212 and the first data storage area 213 is changed, the processor can update the verification information stored in the first verification information storage area 211 of the first area. For example, when the data stored in the first code storage area 212 and the first data storage area 213 is changed due to an update of the first program, the processor can create a new checksum value stored in the first verification information storage area 211 based on the changed data and update the version information of the first program.

[0093] Furthermore, when data stored in at least one of the second code storage area 222 and the second data storage area 223 is changed, the processor can update the verification information stored in the second verification information storage area 221 of the second area. For example, when the data stored in the second code storage area 222 and the second data storage area 223 is changed due to an update of the second program, the processor can create a new checksum value stored in the second verification information storage area 221 based on the changed data and update the version information of the second program.

[0094] FIG. 7 is a flowchart illustrating the operation of a program management method according to an embodiment of the present invention.

[0095] The processor partitions the memory so that the memory is divided into a first region and a second region (S710). Here, the first region may be defined so as to be fixedly allocated to a specific location on the non-volatile memory.

[0096] The processor stores a first program related to the functional safety of the device in a first area, and stores a second program unrelated to the functional safety of the device in a second area (S720). Here, the processor can store version information on the first program and version information on the second program in the first area and the second area, respectively.

[0097] The processor may independently update the first and second programs (S730). For example, when the device management system enters an update mode for the device management program, the processor may determine one of the first and second programs as a program to be updated based on an identifier included in an input update file. Thereafter, the processor may independently update only the determined program to be updated.

[0098] When either the first program or the second program is updated, the processor may independently update only the version information of the updated program (S740). For example, when the second program unrelated to functional safety is updated, the processor may change only the version information of the second program (from V1 to V2). In this case, the version information of the first program, which is a functional safety-related program, is maintained, so that a separate functional safety certification procedure for the device does not need to be performed.

[0099] The operation of the method according to the embodiment of the present invention can be embodied as a computer readable program or code in a computer readable recording medium. The computer readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. In addition, the computer readable recording medium can be distributed to computer systems connected via a network, and the computer readable program or code can be stored and executed in a distributed manner.

[0100] Some aspects of the invention have been described in the context of an apparatus, but it may also be presented in terms of a corresponding method, where a block or apparatus corresponds to a method step or a feature of a method step. Similarly, aspects described in the context of a method may be presented in terms of a corresponding block or item or feature of a corresponding apparatus. Some or all of the method steps may be performed by (or using) a hardware apparatus, such as, for example, a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, one or more of the most important method steps may be performed by such an apparatus.

[0101] Although the present invention has been described with reference to preferred embodiments thereof, those skilled in the art will understand that various modifications and variations of the present invention can be made without departing from the spirit and scope of the present invention as set forth in the following claims. [Explanation of symbols]

[0102] 100: Processor 200: Memory 210: First Area 211: First verification information storage area 212: First code storage area 213: First data storage area 220: Second Area 221: Second verification information storage area 222: Second code storage area 223: Second data storage area 300: Transmitting and receiving equipment 400: Input interface device 500: Output interface device 600: Storage device 700: Bus

Claims

1. A device management system that cooperates with a device to manage the device, At least one processor; and a memory for storing a device management program, the device management program including at least one instruction executed by the at least one processor; The at least one processor: A first program related to the functional safety of the device and a second program unrelated to the functional safety of the device are stored in separate partitioned areas in a memory; Device management system.

2. The at least one processor: storing the version information regarding the first program and the version information regarding the second program separately from each other in the memory; The device management system of claim 1 .

3. The at least one processor: When any one of the first program and the second program is updated, only version information of the updated program is independently updated. The device management system of claim 2 .

4. When you enter the update mode of the device management program, The at least one processor: updating only one of the first program and the second program, or sequentially updating the first program and the second program; The device management system of claim 1 .

5. The memory includes: a first area in which the first program is stored; and a second area in which the second program is stored. The device management system of claim 1 .

6. The first region includes: defined to be allocated to a fixed, specific location in said memory; The device management system of claim 5 .

7. Each of the first region and the second region is A verification information storage area in which verification information for verifying whether or not data stored in each area has been changed is stored; A code storage area storing control logic for the device; and A data storage area for storing data necessary for managing or controlling the device; The device management system of claim 5 .

8. a first code storage area included in the first area stores diagnostic logic related to functional safety of the device; a first data storage area included in the first area stores a setting value related to the diagnostic logic; The device management system of claim 7.

9. The at least one processor: When data stored in at least one of the first code storage area and the first data storage area is changed, updating the verification information stored in a first verification information storage area of ​​the first area; The device management system of claim 8.

10. The memory is a non-volatile memory. The device management system of claim 1 .

11. The device management system includes: A battery management system located within the battery system. The device management system of claim 1 .

12. 1. A program management method for a device management system, comprising at least one processor and a memory for storing a device management program, comprising: The processor stores a first program related to the functional safety of the device and a second program unrelated to the functional safety of the device in separate partitioned areas in the memory; and The processor stores version information regarding the first program and version information regarding the second program in the memory in a manner that is separate from each other. Program management methods.

13. When any one of the first program and the second program is updated, the processor may further include a step of independently updating only the version information of the updated program. The program management method according to claim 12.

14. When entering an update mode of the device management program, determining one of the first program and the second program as a program to be updated; and independently updating the determined update target program; The program management method according to claim 12.

15. The step of dividing and storing the data into the independently partitioned areas includes: A step of allocating an area in which the first program is stored to a fixed specific location in the memory; The program management method according to claim 12.

16. The memory includes: a first area in which the first program is stored; and a second area in which the second program is stored, Each of the first region and the second region is A verification information storage area in which verification information for verifying whether or not data stored in each area has been changed is stored; A code storage area storing control logic for the device; and A data storage area for storing data necessary for managing or controlling the device; The program management method according to claim 12.

17. The step of dividing and storing the data into the independently partitioned areas includes: storing diagnostic logic related to functional safety of the device in a first code storage area included in the first area, and storing a setting value related to the diagnostic logic in a first data storage area included in the first area; 17. The program management method according to claim 16.

18. When data stored in at least one of the first code storage area and the first data storage area is changed, The method further includes updating the verification information stored in a first verification information storage area of ​​the first area.

20. The program management method according to claim 17.

Images