Control device, control method, and program

Abstract

This makes it easier to understand the user's situation when software updates for in-vehicle devices are discontinued. [Solution] In a software update where the software update process for an in-vehicle device is executed in response to a predetermined operation of turning off the power of the in-vehicle device, if a situation occurs that prevents the execution of the update process when the predetermined operation is performed, the OTA master 11 displays abort information on the HMI 18 indicating that the update process has not been executed. The user can understand that the update process has been aborted from the abort information displayed on the HMI 18.

Description

Technical Field

[0006] , ,

[0001] The present invention relates to a control device, a control method, and a program for controlling a display unit that displays information regarding software updates of in-vehicle devices mounted on a vehicle.

Background Art

[0002] Various in-vehicle devices that operate by executing software are mounted on a vehicle. As disclosed in Patent Document 1, there is known an OTA (Over The Air) technology for adding or changing the functions of a vehicle by updating the software of an in-vehicle device with software downloaded from outside the vehicle via wireless communication.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] There may be a case where a software update process is executed after the vehicle's power-off operation. On the other hand, the software update process may be aborted due to various factors. If the update process is aborted while the vehicle user is getting off the vehicle, the user may be confused and unable to grasp the situation when getting on the vehicle next time. <00岁00026>

Means for Solving the Problems

[0005] The control device for solving the above problems is a control device that controls a display unit that displays information regarding software updates of in-vehicle devices mounted on a vehicle, and in a software update in which an update process of the software of the in-vehicle device is executed, when the execution of the update process is aborted, the display unit is caused to display abort information indicating that the update process has not been executed.

[0006] A control method to solve the above problem is a control method for a display unit that displays information regarding software updates of in-vehicle equipment installed in a vehicle, wherein when the execution of the update process is canceled during a software update in which the software update process of the in-vehicle equipment is performed, the display unit displays cancellation information indicating that the update process was not performed.

[0007] A program to solve the above problem is a program executed by a control device that controls a display unit that displays information regarding software updates of in-vehicle equipment installed in a vehicle, wherein, in a software update in which the software update process of the in-vehicle equipment is executed, when the execution of the update process is canceled, the control device is instructed to display cancellation information on the display unit indicating that the update process was not executed. [Effects of the Invention]

[0008] The above-described control device, control method, and program have the effect of making it easier to understand the user's situation when software updates for in-vehicle equipment are discontinued. [Brief explanation of the drawing]

[0009] [Figure 1] This diagram schematically shows the configuration of the control device and vehicle according to the first embodiment. [Figure 2] This is a flowchart of the display control routine executed by the control device of the first embodiment. [Figure 3] This figure shows an example of an image that displays guidance information while an update is being performed. [Figure 4] This figure shows an example of an image that displays notification information indicating that the update is complete. [Figure 5] This figure shows an example of an image that displays cancellation information. [Figure 6] This is a sequence diagram showing the processing flow related to the display control of information during the update process in the second embodiment. [Figure 7] This figure shows an example of an image that displays guidance information when an update process can be resumed after being interrupted. [Modes for carrying out the invention]

[0010] (First Embodiment) The first embodiment of the control device, vehicle, control method, and program will be described in detail below with reference to Figures 1 to 5.

[0011] <Control device and vehicle configuration> First, the configuration of the control device and vehicle in this embodiment will be described with reference to Figure 1. As shown in Figure 1, the vehicle 10 is equipped with in-vehicle devices such as an OTA master 11, DCM 12, ADAS 13, PCU 14, engine ECU 15, transmission ECU 16, brake ECU 17, and HMI 18. These in-vehicle devices are connected to each other so as to be able to communicate with one another via an in-vehicle network 19. The OTA master 11 is responsible for managing software updates for the in-vehicle devices, including itself. The DCM 12 is a data communication module that provides wireless communication functionality with the outside of the vehicle via a mobile communication network 20. In this embodiment, the DCM 12 is responsible for recording the results of self-diagnosis performed by each in-vehicle device in the vehicle 10 and transmitting them to an external data center or the like. The ADAS 13 is an advanced driving assistance system that provides advanced driver assistance functions such as an automatic braking system and a sudden acceleration prevention system. The PCU 14 is a power control unit that controls power inside the vehicle. The engine ECU 15 is an electronic control unit for engine control. The transmission ECU 16 is an electronic control unit for transmission control. The brake ECU 17 is an electronic control unit for brake control. The HMI 18 is a human-machine interface. The HMI 18 includes an input device that accepts operations from the occupant and a display device that displays information to the occupant using images and sound. The HMI 18 may also be configured to include a navigation function that guides the driver along a driving route and an entertainment function that plays music and videos. Each of these in-vehicle devices has a storage module 21 that stores software and a processor 22 that executes the software. The OTA master 11 further has a data storage 23 that stores update software acquired from outside the vehicle.

[0012] Vehicle 10 has multiple power modes. These multiple power modes include a power mode for driving and a power mode for parking. For each power mode, it is determined which in-vehicle devices will be powered on. When the driving power mode is set, the power to the in-vehicle devices necessary for driving Vehicle 10 and providing services while driving is turned on. In this embodiment, when the driving power mode is set, the power to all in-vehicle devices shown in Figure 1 is turned on. When the parking power mode is set, only the in-vehicle devices that need to operate even when Vehicle 10 is parked are powered on. The in-vehicle devices that are powered on in each power mode can be changed depending on the environment and user settings.

[0013] Vehicle 10 is equipped with a power switch 24 for switching between a driving power mode and a parking power mode. Switching from the driving power mode to the parking power mode is performed by switching the power switch 24 from on to off. Switching from the parking power mode to the driving power mode is performed by switching the power switch 24 from off to on. In conventional vehicles that use only the engine as a power source, the power switch 24 is sometimes called the ignition switch. In vehicles capable of electric driving, such as BEVs and PHEVs, the power switch 24 is sometimes called the Ready switch.

[0014] Furthermore, vehicle 10 is equipped with a power switch 24 for switching between powering vehicle 10 on and powering it off. The drive system of vehicle 10 starts when the power is switched from off to on and stops when the power is switched from on to off.

[0015] Vehicle 10 is connected to OTA server 30 via mobile communication network 20. OTA server 30 is a server device that distributes update software for in-vehicle equipment. OTA server 30 has a storage device 31 that stores programs and data for distributing the update software, and a processor 32 that executes the distribution programs.

[0016] The OTA server 30 can communicate with the information terminal 40 of the user of the vehicle 10 via the mobile communication network 20. Examples of the information terminal 40 include smartphones. The information terminal 40 may be a tablet terminal or a PC terminal. The information terminal 40 includes a storage device 41, a processor 42, and an HMI 43. The processor 42 reads and executes the software stored in the storage device 41. The HMI 43 includes an input device that receives the user's operations and a display device that displays information to the user. The software stored in the storage device 41 includes software that provides functions such as information confirmation and remote operation of the vehicle 10 owned by the user.

[0017] <Overview of Software Update> Next, an overview of the software update of the in-vehicle devices in the vehicle 10 will be described. The in-vehicle devices to be updated include the OTA master 11, DCM 12, ADAS 13, PCU 14, engine ECU 15, transmission ECU 16, brake ECU 17, and HMI 18. The software update is performed through a download phase, an installation phase, and an activation phase.

[0018] In the download phase, the updated software is transmitted from the OTA server 30 to the vehicle 10. The OTA master 11 stores the updated software received from the OTA server 30 in the data storage 23. The download phase includes a series of processes related to downloading, such as determining whether to execute the download and verifying the update data. The transmission of the updated software from the OTA server 30 to the OTA master 11 may be performed by transmitting compressed data obtained by compressing the updated software or by transmitting divided data obtained by dividing the updated software or the compressed data. Also, the updated software of multiple in-vehicle devices may be transmitted together.

[0019] In the installation phase, the update software is installed on the in-vehicle device to be updated. In the installation phase, the OTA master 11 installs the update software in the storage module 21 of the in-vehicle device to be updated based on the update data downloaded to the data storage 23. The installation phase includes a series of processes related to installation, such as determining whether installation can be executed, transferring update data, and verifying the update software. When the update data includes the update software itself, in the installation phase, the OTA master 11 transfers the update data to the in-vehicle device to be updated. When the update data includes compressed data, differential data, or split data of the update software, a generation process of the update software from the update data is performed. The generation process may be performed by the OTA master 11 or by the in-vehicle device to be updated. The update software can be generated by decompressing the compressed data or assembling the differential data or split data. Note that at the end of the installation phase, the update software is invalidated.

[0020] In the activation phase, in the in-vehicle device to be updated, activation of the update software, that is, validation of the update software, is performed. The activation phase includes a series of processes related to activation, such as determining whether activation can be executed, checking the integrity of the update software, and verifying the execution result of activation.

[0021] Depending on the hardware configuration and software type of the in-vehicle device, etc., the software update process may be executed in response to the power-off operation of the vehicle 10. In the case of this embodiment, the update process includes the processes of both the installation phase and the activation phase. The update process may be a process that includes only one of the installation phase and the activation phase.

[0022] Once the download phase is complete, the OTA master 11 asks the user via the HMI 18 whether or not to perform the update process after the next power-off operation. If the user authorizes the execution of the update process in response to this inquiry, the OTA master 11 will start the update process when the vehicle 10 is subsequently powered off. The in-vehicle device that starts the update process here is the in-vehicle device that turns off its power in response to the operation of turning off the vehicle 10. In this embodiment, the operation of turning off the vehicle 10 corresponds to a predetermined operation of turning off the power of the in-vehicle device on which the software update is performed.

[0023] In some situations, the update process may be prevented when the vehicle 10 is powered off. Situations in which the update process is prevented include, for example, when the power to the in-vehicle equipment to be updated cannot be turned off even after the vehicle 10 has been powered off. Specific examples of such situations include the following situations (A) to (C).

[0024] Situation (A) is a situation in which the execution of the software update process is prevented in relation to the roll suppression control of vehicle 10 while it is stopped on a slope. When vehicle 10 is stopped on a steep slope, the vehicle 10 may roll backward due to insufficient effectiveness of the parking brake, etc. Some vehicles 10 have a control system that suppresses the roll backward by activating the hydraulic brake or steering when it detects that vehicle 10 is moving while stopped on a slope. Roll suppression control is executed when vehicle 10 is stopped on a slope that meets predetermined conditions. An example of a predetermined condition is that the slope gradient of the slope on which vehicle 10 is stopped is greater than or equal to a predetermined value. When roll suppression control is being executed, the in-vehicle equipment involved in its execution continues to operate even after the vehicle 10 is powered off. When roll suppression control is being executed, the software update process for the in-vehicle equipment involved in its execution may not be able to be executed. In addition, to complete the installation and activation during the update process, it is necessary to turn off the power to the in-vehicle equipment and then restart the in-vehicle equipment. On the other hand, when the sliding suppression control is performed, the power to the in-vehicle equipment related to the sliding suppression control cannot be turned off even after the vehicle 10 is powered off, and therefore the update process may not be able to be performed. The in-vehicle equipment related to the execution of sliding suppression includes in-vehicle equipment that monitors the movement of the stationary vehicle 10, and in-vehicle equipment that brakes or steers the vehicle 10. In the case of Figure 1, the ADAS 13 and brake ECU 17 are the in-vehicle equipment related to the execution of sliding suppression control.

[0025] Situation (B) is a situation in which the update process is prevented from being executed in relation to the emergency call system of vehicle 10. The emergency call system is a system that monitors the parked vehicle 10 and notifies the outside of the vehicle if an abnormality occurs. While the emergency call system is active, the in-vehicle equipment related to the operation of the system continues to operate even after the power of vehicle 10 is turned off, and therefore the power cannot be turned off, making it impossible to perform the software update. In the case of Figure 1, DCM12 and ADAS13 are the in-vehicle equipment related to the operation of the emergency call system. Note that the user can switch whether or not to activate the emergency call system.

[0026] Situation (C) is a situation in which the execution of the update process is prevented due to the power setting of the HMI 18 during the period when the vehicle 10 is powered off. The HMI 18 is configured to switch between the following first and second states in its power setting after the vehicle 10 is powered off. The first state is a sleep state in which, after the vehicle 10 is powered off, the screen goes dark, but some functions continue to operate, and it is possible to display information in response to external commands, etc. The second state is a shutdown state in which the HMI 18's own power is also turned off in response to the vehicle 10 being powered off, and it is impossible to display information. The HMI 18 is configured to allow the user to switch between these power settings. In this embodiment, when the software update process is performed in response to the vehicle 10 being powered off, information related to the update is displayed on the HMI 18. If the power setting of the HMI 18 is in the second state (shutdown state), it becomes impossible to display information during the update process. Therefore, when the power setting of the HMI 18 is in the second state, the update process in response to the vehicle 10 being powered off is not executed.

[0027] <Information display control based on update processing> The OTA master 11 controls the display of information shown on the HMI 18 during the update process. The details of the display control are described below.

[0028] Figure 2 shows the processing procedure of the display control routine executed by the OTA master 11 to control the display of information in response to the update process. The OTA master 11 starts this routine when the user authorizes the execution of the update process.

[0029] After the start of this routine, the OTA master 11 waits until the vehicle 10 is powered off and the update process begins (S10). When the update process begins (S10:YES), the OTA master 11 displays information on the HMI 18 indicating that the update process is in progress (S11). After that, when the update process is complete (S13:YES), the OTA master 11 displays information on the HMI 18 indicating that the update process is complete (S14), and then terminates the processing of this routine.

[0030] In contrast, if the execution of the update process is interrupted due to a situation that prevents the execution of the update process as described above (S12:YES), the OTA master 11 displays interruption information on the HMI 18 indicating that the update process is not being executed (S15). The OTA master 11 then waits for the above situation to be resolved and the update process to resume (S16). When the update process resumes (S16:YES), the OTA master 11 returns the process to S11. In this case, the OTA master 11 displays guidance information on the HMI 18 in S11 of Figure 2, indicating that the update process is being executed. The user can understand that the interrupted update process has become executable by viewing this guidance information after viewing the interruption information. Thus, in this embodiment, if the situation preventing the execution of the update process is resolved after the display of the interruption information, the information displayed on the HMI 18 is changed from interruption information to guidance information indicating that the update process is executable.

[0031] In some cases, a situation may already exist that prevents the update process from being executed when the vehicle 10 is turned off. In such cases, the OTA master 11 will display cancellation information on the HMI 18 without starting the update process.

[0032] Figure 3 shows an example of an image displaying guidance information indicating that an update process is underway. The image in Figure 3 displays guidance information indicating that the update process is underway, along with information showing the progress of the update process. The image in Figure 3 also displays information to alert the user that the vehicle 10 cannot be powered on until the update process is complete.

[0033] Figure 4 shows an example of an image displaying guidance information indicating that the update process is complete. The image in Figure 4 displays guidance information indicating that the update process is complete, as well as information notifying that the updated functions of the in-vehicle equipment are now available. Furthermore, the image in Figure 4 displays operation buttons for checking detailed information about the software update.

[0034] Figure 5 shows an example of an image displaying cancellation information indicating that the update process is not being executed. The image in Figure 5 shows operation buttons to display more detailed information along with the cancellation information. When these operation buttons are operated, more detailed cancellation information is displayed on the HMI18. The information displayed at this time includes information indicating the reason for the cancellation of the update process and information indicating the user action required to resume the update process. For example, in situation (A), the HMI18 displays detailed cancellation information indicating that the update process is being prevented from being executed because the vehicle 10 is stopped on a steep slope, and that the update process can be resumed by stopping the vehicle 10 on a flat surface. In situation (B), the HMI18 displays detailed cancellation information indicating that the update process is being prevented from being executed because the emergency call system is activated, and that the update process can be resumed by stopping the emergency call system. In situation (C), the HMI18 displays detailed cancellation information indicating that the update process is being prevented from being executed because the power setting of the HMI18 is in the shutdown state, and that the update process can be resumed by switching the power setting to the hibernation state.

[0035] <Operation and Effects of the Embodiment> The operation and effects of this embodiment will now be described. The OTA master 11 initiates the update process in response to the vehicle 10 being powered off. Once the OTA master 11 has started the update process, it displays guidance information on the HMI 18 indicating that the update process is in progress. Furthermore, once the update process is complete, the OTA master 11 displays guidance information on the HMI 18 indicating that the update process is complete.

[0036] The update process may be aborted if circumstances prevent its execution. In this case, the OTA master 11 displays abort information on the HMI 18 indicating that the update process is not running. The user can confirm that the update process has been aborted from this display. Furthermore, if the update process is aborted, the OTA master 11 displays information on the HMI 18 indicating the reason for the abortion and the user actions required to resume the update process. The user can resume the update process by performing the actions according to the displayed information.

[0037] According to this embodiment, the following effects can be achieved. (1) The OTA master 11 performs a software update on the in-vehicle device in response to a predetermined operation of turning off the power to the in-vehicle device. If a situation occurs that prevents the execution of the update process when the predetermined operation is performed, the OTA master 11 displays abort information on the HMI 18 indicating that the update process has not been executed. This makes it easier for the user to understand the situation when the software update of the in-vehicle device is aborted.

[0038] (2) When the situation preventing the execution of the update process is resolved after the display of the cancellation information, the OTA master 11 changes the information displayed on the HMI 18 from cancellation information to guidance information indicating that the update process can be executed. This makes it easier to understand the user's situation when an update process that was initially canceled becomes executable again.

[0039] (3) The detailed cancellation information displayed by the OTA master 11 on the HMI 18 includes information indicating the nature of the situation that is preventing the execution of the update process, and information indicating how to resolve the situation. This makes it easier for the user to resume the update process.

[0040] (Second Embodiment) Next, a second embodiment of the control device, control method, and program will be described in detail with reference to Figure 6. In this embodiment, components common to the above embodiment are denoted by the same reference numerals, and their detailed descriptions are omitted.

[0041] In the first embodiment, the OTA master 11 displayed information regarding the update process on the HMI 18 installed in the vehicle 10. In this embodiment, the information regarding the update process is displayed on the HMI 43 of the user-owned information terminal 40 in the vehicle 10. The display control is performed by the OTA server 30 in the data center.

[0042] Figure 6 shows the processing flow related to the display control of information regarding the update process in this embodiment. In the case of Figure 6, the update process of the in-vehicle equipment is started in response to the power off operation of the vehicle 10 (S20). The vehicle 10 notifies the OTA server 30 that the update process has started (S21). In response to the notification, the OTA server 30 instructs the information terminal 40 to display guidance information indicating that the update process is in progress (S22). In response to the instruction, the information terminal 40 starts displaying the guidance information (S23). At this time, an image similar to that in Figure 3 is displayed on the information terminal 40.

[0043] In the case of Figure 6, a situation subsequently occurs in vehicle 10 that prevents the execution of the update process, and the update process is canceled. At this time, vehicle 10 notifies the OTA server 30 that the update process has been canceled (S24). In response to the notification, the OTA server 30 instructs the information terminal 40 to display the cancellation information (S25). In response to the instruction, the information terminal 40 switches the information displayed from the guidance information to the cancellation information (S26). As a result, an image similar to that in Figure 5 is displayed on the information terminal 40.

[0044] Subsequently, the update process is resumed in vehicle 10 (S28). At this time, vehicle 10 notifies the OTA server 30 of the resumption of the update process (S27). In response to the notification, the OTA server 30 instructs the information terminal 40 to display information indicating that the update process is in progress (S29). In response to the instruction, the information terminal 40 switches the information it displays from cancellation information to guidance information indicating that the update process is in progress (S30).

[0045] In the case of Figure 6, the update process continues until it is completed. Once the update process is complete, the vehicle 10 notifies the OTA server 30 of the completion of the update process (S31). In response to the notification, the OTA server 30 instructs the information terminal 40 to display guidance information indicating the completion of the update process (S32). In response to the instruction, the information terminal 40 switches the information it displays to guidance information indicating the completion of the update process (S33).

[0046] In this embodiment, the user can check information related to the update process on the information terminal 40. In this embodiment as well, the same functions and effects as in the first embodiment can be achieved. The display control of information on the information terminal 40 in this embodiment may be performed together with the display control of information on the HMI 18 of the vehicle 10 in the first embodiment.

[0047] (Other embodiments) The above embodiment can be implemented with the following modifications. The above embodiment and the following modifications can be combined with each other to the extent that they do not contradict each other technically.

[0048] • When resuming an interrupted update process, user permission may be requested. In this case, when the circumstances preventing the execution of the update process are resolved, an image such as the one shown in Figure 7 may be displayed on the HMI18 or information terminal 40 to ask the user whether or not to resume the update process. The user can confirm that the interrupted update process is now executable upon seeing such an image. Therefore, the image that asks the user whether or not to resume the update process should include guidance information indicating that the update process is executable.

[0049] The display examples shown in Figures 3-5 and Figure 7 were configured to display information using text. These images may also be configured to display information using non-textual representations such as still images or videos.

[0050] The cancellation information does not need to include information indicating the nature of the situation preventing the update process from being executed, or information indicating a method to resolve that situation, or both. The cancellation information only needs to include information indicating that the update process was not executed.

[0051] The OTA master 11, which manages software updates, controlled the display of information related to software updates. Alternatively, software update management and the display control of information related to software updates may be performed by separate in-vehicle devices. For example, the display control of information on the HMI 18 in the first embodiment may be performed by the in-vehicle device that is the target of the software update.

[0052] The above embodiment describes a case where the power supply of an in-vehicle device that performs software update processing is configured to turn off in conjunction with the off operation of the power switch 24 of the vehicle 10. However, the in-vehicle device may be configured to turn off in response to other operations. For example, the vehicle 10 may have three power modes corresponding to the following IG (ignition) on state, ACC (accessory power) on state, and vehicle power off state. The IG on state is a state in which the vehicle's engine is running and the power supply of multiple ECUs is on. The ACC on state is a state in which the power supply of only some of the ECUs is on compared to the IG on state. The vehicle power off state is a state in which almost all ECUs are powered off. In this case, it is conceivable to start the software update processing of an in-vehicle device whose power supply is turned off in response to a switching operation from the IG on state to the ACC on state in response to the same switching operation. Displaying cancellation information even when a situation occurs that prevents the execution of the update processing when a switching operation from the IG on state to the ACC on state is performed will have the effect of making it easier for the user to understand the situation. Thus, the display of cancellation information in the above embodiment may be performed in the following cases. In other words, this refers to a situation where, in a software update process for an in-vehicle device, which is performed in response to a predetermined operation of turning off the power to the in-vehicle device, a situation occurs where the execution of the update process is prevented when the predetermined operation is performed.

[0053] The control device may be configured as a circuit including one or more processors that operate according to a computer program, one or more dedicated hardware circuits that perform at least some of the various processes, or a combination thereof. Examples of dedicated hardware include application-specific integrated circuits (ASICs). The processor includes a CPU and memory such as RAM and ROM, where memory stores program code or instructions configured to cause the CPU to perform processes. Memory, or storage medium, includes any available medium that can be accessed by a general-purpose or dedicated computer.

[0054] (Additional notes) [Note 1] A control device for controlling a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle, wherein in a software update in which a software update process for the in-vehicle equipment is executed in response to a predetermined operation to turn off the power of the in-vehicle equipment, if a situation occurs that prevents the execution of the update process when the predetermined operation is performed, the control device displays cancellation information on the display unit indicating that the update process has not been executed.

[0055] [Note 2] The control device described in Note 1, wherein the predetermined operation is the operation of turning off the power to the vehicle. [Note 3] The control device according to Note 1 or Note 2, which, if the situation is resolved after the cancellation information is displayed on the display unit, changes the information to be displayed on the display unit from the cancellation information to guidance information indicating that the update process can be executed.

[0056] [Note 4] The control device described in any of Notes 1 to 3, wherein the situation is such that the power to the in-vehicle device cannot be turned off even after the predetermined operation has been performed. [Note 5] The control device described in any of Notes 1 to 4, wherein the situation is that the vehicle is stopped on a slope that satisfies the specified conditions.

[0057] [Note 6] The control device described in Note 5, wherein the on-board equipment is an electronic control unit for brake control that performs a process related to brake operation after the predetermined operation is performed while the vehicle is stopped on a slope that satisfies the predetermined conditions.

[0058] [Note 7] The control device described in any of Notes 1 to 6, wherein the situation is that the vehicle's emergency call system is activated. [Note 8] The control device according to any one of Notes 1 to 7, wherein the display unit is configured to switch between a first state in which the display can be performed even after the predetermined operation and a second state in which the display cannot be performed after the predetermined operation, and the state is the state in which the display unit is set to the second state.

[0059] [Note 9] The control device described in Note 8, wherein the display unit is configured to allow the user of the vehicle to switch between the first state and the second state. [Note 10] The control device according to any one of Notes 1 to 9, wherein the cancellation information includes information indicating the content of the situation.

[0060] [Note 11] The control device according to any one of Notes 1 to 10, wherein the termination information includes information indicating a method for resolving the situation. [Note 12] A control method for a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle, wherein in a software update in which a software update process for the in-vehicle equipment is executed in response to a predetermined operation to turn off the power of the in-vehicle equipment, if a situation occurs when the predetermined operation is performed that prevents the execution of the update process, the control method causes the display unit to display cancellation information indicating that the update process has not been executed.

[0061] [Note 13] The control method described in Note 12, wherein the predetermined operation is the operation of turning off the power to the vehicle. [Note 14] The control method according to Note 13, wherein if the situation is resolved after the cancellation information is displayed on the display unit, the information to be displayed on the display unit is changed from the cancellation information to guidance information indicating that the update process can be executed.

[0062] [Note 15] The control method according to any one of Notes 12 to 14, wherein the situation is one in which the power to the in-vehicle device cannot be turned off even after the predetermined operation has been performed. [Note 16] The control method described in any of Notes 12 to 15, wherein the situation is that the vehicle is stopped on a slope that satisfies the predetermined conditions.

[0063] [Note 17] The control method according to Note 16, wherein the on-board equipment is an electronic control unit for brake control that performs a process related to brake operation after the predetermined operation is performed while the vehicle is stopped on a slope that satisfies the predetermined conditions.

[0064] [Note 18] The control method described in any of Notes 12 to 17, wherein the situation is that the vehicle's emergency call system is activated. [Note 19] The control method according to any one of Notes 12 to 18, wherein the display unit is configured to switch between a first state in which the display can be performed even after the predetermined operation and a second state in which the display cannot be performed after the predetermined operation, and the state is the state in which the display unit is set to the second state.

[0065] [Note 20] The control method according to Note 19, wherein the display unit is configured to allow the user of the vehicle to switch between the first state and the second state. [Note 21] The control method according to any one of Notes 12 to 20, wherein the cancellation information includes information indicating the content of the situation.

[0066] [Note 22] The control method according to any one of Notes 12 to 21, wherein the termination information includes information indicating a method for resolving the situation. [Note 23] A program executed by a control device that controls a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle, wherein in a software update in which a software update process for the in-vehicle equipment is executed in response to a predetermined operation to turn off the power of the in-vehicle equipment, if a situation occurs when the predetermined operation is performed that prevents the execution of the update process, the program causes the control device to display cancellation information on the display unit indicating that the update process has not been executed.

[0067] [Note 24] The predetermined operation is the program described in Note 23, which is the operation to turn off the power to the vehicle. [Note 25] The program described in Note 23 or Note 24, which causes the control device to change the information displayed on the display unit from the cancellation information to guidance information indicating that the update process can be executed, if the situation is resolved after the cancellation information is displayed on the display unit.

[0068] [Note 26] The above situation is a situation in which the power to the in-vehicle device cannot be turned off even after the predetermined operation has been performed, as described in any of the programs in Notes 23 to 26. [Note 27] The situation is that the vehicle is stopped on a slope that meets the specified conditions, as described in any of the programs in Notes 23 to 26.

[0069] [Note 28] The in-vehicle device is the program described in Note 27, which is an electronic control unit for brake control that executes a process related to brake operation after the predetermined operation is performed while the vehicle is stopped on a slope that satisfies the predetermined conditions.

[0070] [Note 29] The above situation is a situation in which the vehicle's emergency call system is activated, as described in any of the programs in Notes 23 to 28. [Note 30] The program described in any of Notes 23 to 29, wherein the display unit is configured to switch between a first state in which the display can be performed even after the predetermined operation and a second state in which the display cannot be performed after the predetermined operation, and the state is the state in which the display unit is set to the second state.

[0071] [Note 31] The display unit is configured to allow the user of the vehicle to switch between the first state and the second state, according to the program described in Note 30. [Note 32] The cancellation information includes a program described in any of Notes 23 to 31 that contains information indicating the content of the situation.

[0072] [Note 33] The program described in any of Notes 23 to 32 includes information indicating a method for resolving the aforementioned situation in the termination information. [Note 34] A storage medium containing the program described in any of Notes 23 to 33. [Explanation of Symbols]

[0073] 10 vehicles 11 OTA Master 12 DCM 13 ADAS 14 PCU 15 Engine ECU 16. Transmission ECU 17 Brake ECU 18 HMI 19 In-vehicle network 20 Mobile communications network 21 Memory Modules 22 processors 30 OTA servers 31 Storage device 32 processors 40 Information terminals 41 Storage device 42 processors 43 HMI

Claims

1. A control device for controlling a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle, In a software update in which a software update process for the in-vehicle device is performed, if the execution of the update process is canceled, the display unit will display cancellation information indicating that the update process was not performed. Control device.

2. The control device according to claim 1, wherein the execution of the update process is terminated if a situation occurs that prevents the execution of the update process.

3. The control device according to claim 2, wherein if the situation is resolved after the cancellation information is displayed on the display unit, the information to be displayed on the display unit is changed from the cancellation information to guidance information indicating that the update process can be executed.

4. The control device according to claim 2, wherein the aforementioned situation is a situation in which the vehicle is stopped on a slope that satisfies predetermined conditions.

5. The control device according to claim 4, wherein the in-vehicle equipment is an electronic control unit for brake control that performs a process related to brake operation after a predetermined operation is performed to turn off the power to the in-vehicle equipment while the vehicle is stopped on a slope that satisfies the predetermined conditions.

6. The control device according to claim 2, wherein the aforementioned situation is a situation in which the vehicle's emergency call system is activated.

7. The control device according to claim 2, wherein the cancellation information includes information indicating the content of the situation.

8. The control device according to claim 2, wherein the termination information includes information indicating a method for resolving the situation.

9. The control device according to claim 1, wherein when the execution of the update process is canceled after the execution of the update process has started, the cancellation information is displayed on the display unit.

10. The control device according to claim 1, wherein if the execution of the update process is canceled before the execution of the update process is started, the cancellation information is displayed on the display unit.

11. A control method for a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle, In a software update in which a software update process for the in-vehicle device is performed, if the execution of the update process is canceled, the display unit will display cancellation information indicating that the update process was not performed. Control method.

12. A program executed by a control device that controls a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle, In a software update in which the software update process of the in-vehicle device is performed, if the execution of the update process is canceled, the control device is instructed to display cancellation information on the display unit indicating that the update process was not performed. program.

Images