Apparatus and vehicle equipped with the same for verifying software integrity, method and program for verifying software integrity

Abstract

To provide an apparatus for further reducing a possibility of unexpected vehicle control due to version incompatibility of software of multiple on-vehicle devices.SOLUTION: A device to be mounted on a vehicle includes: a first instruction unit which issues an instruction to switch software of a plurality of on-vehicle devices; an acquisition unit which acquires version information of the software of the on-vehicle devices switched in response to the switching instruction; a confirmation unit which confirms compatibility of the version of the software of the on-vehicle devices on the basis of the version information acquired by the acquisition unit; and a second instruction unit which issues an instruction to the on-vehicle devices to switch the software from the new software to the previous software when incompatibility is confirmed in the version of the software of the on-vehicle devices.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a device capable of verifying the integrity of software in an on-board device, a vehicle equipped with the same, and a method and program for verifying the integrity of software. [Background technology]

[0002] Patent Document 1 describes a system that updates an ECU program with an upgrade program transmitted from a server. In order to prevent malfunctions caused by version inconsistencies between ECU programs, the system of Patent Document 1 refers to dependency relationship information between the upgrade program of the ECU to be updated and programs of other ECUs before updating the program to determine whether or not to update the program. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2009-53920 A Summary of the Invention [Problem to be solved by the invention]

[0004] When there is a version inconsistency between programs in multiple on-board devices, unexpected vehicle control may occur. In the system of Patent Document 1, the dependency relationship with other programs is checked when a program is updated, but there is a possibility that unexpected vehicle control may not be sufficiently prevented by simply checking the dependency relationship when a program is updated.

[0005] Therefore, an object of the present invention is to provide an apparatus etc. that can further reduce the possibility of unexpected vehicle control being performed due to inconsistencies in software versions among multiple on-board devices. [Means for solving the problem]

[0006] An apparatus according to one embodiment of the present invention includes a first instruction unit that issues an instruction to switch software on a plurality of on-board devices, an acquisition unit that acquires version information of the software on the plurality of on-board devices after switching in response to the switching instruction, a confirmation unit that confirms that the versions of the software on the plurality of on-board devices are consistent based on the version information acquired by the acquisition unit, and a confirmation unit that, based on the confirmation that the versions of the software on the plurality of on-board devices are not consistent, a notification unit that notifies a user that the plurality of vehicle-mounted devices will revert from the switched software to the software before the switched software; Equipped with. Effect of the Invention

[0007] According to the present invention, it is possible to further reduce the possibility that unexpected vehicle control will be performed due to a mismatch in software versions among multiple on-board devices. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing a schematic configuration of a vehicle control system according to a first embodiment; [Diagram 2] Functional block diagram of the vehicle control system shown in Figure 1. [Diagram 3] FIG. 3 is a diagram showing an example of a matching table stored in a matching information storage unit shown in FIG. 2; [Figure 4] 1 is a flowchart showing an example of a consistency checking process executed by a representative vehicle-mounted device in a vehicle control system according to a first embodiment; [Diagram 5] Functional block diagram of a vehicle control system according to a second embodiment. [Figure 6] 11 is a flowchart showing an example of a consistency checking process executed by a representative vehicle-mounted device in a vehicle control system according to a second embodiment. [Figure 7] FIG. 11 is a schematic diagram for explaining the background of a vehicle control system according to a third embodiment; [Figure 8] Functional block diagram of a vehicle control system according to a third embodiment. [Figure 9] 13 is a flowchart showing an example of a software acquisition process executed by a representative vehicle-mounted device in a vehicle control system according to a third embodiment. [Figure 10] 13 is a flowchart showing an example of a consistency checking process executed by a representative vehicle-mounted device in a vehicle control system according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (overview) In the vehicle control system of the present invention, each time the vehicle is turned on, one of the multiple on-board devices that make up the vehicle control system checks the consistency of software versions, thereby reducing the possibility of unexpected vehicle control occurring due to a software version inconsistency.

[0010] (First embodiment) <Configuration> FIG. 1 is a block diagram showing a schematic configuration of a vehicle control system according to a first embodiment.

[0011] The vehicle control system 100 is a system that is composed of on-board devices A to D that can communicate with each other, and realizes a predetermined vehicle control by combining the functions of the on-board devices A to D. In the example of FIG. 1, the vehicle control system 100 is composed of four on-board devices A to D, but the number of on-board devices that make up the vehicle control system 100 is not limited to four. For example, the predetermined vehicle control that the vehicle control system 100 realizes can be automatic driving. The on-board devices A to D correspond to ECUs that control vehicle driving such as acceleration, deceleration, and steering, and ECUs that perform driving support by combining these ECUs that control vehicle driving. In addition, the on-board devices A to D can communicate with an external server 2 via a wireless communication device 1. In the following description, a specific on-board device A that is one of the multiple on-board devices A to D that make up the vehicle control system is called a "representative on-board device A."

[0012] FIG. 2 is a functional block diagram of the vehicle control system shown in FIG. 1, and FIG. 3 is a diagram showing an example of a consistency table stored in the consistency information storage unit shown in FIG.

[0013] [Representative onboard machine A] The representative vehicle-mounted unit A is one of the vehicle-mounted units that provide the control function of the vehicle control system 100, and functions as a master device in a process of checking the consistency of the software versions of the vehicle-mounted units A to D. When the vehicle is powered on, the representative vehicle-mounted unit A checks the consistency of the software versions of all the vehicle-mounted units A to D that constitute the vehicle control system 100. The representative vehicle-mounted unit A includes a software storage unit 10, a consistency information storage unit 11, a version acquisition unit 12, a determination unit 13, a transmission unit 14, a reception unit 15, a consistency information update unit 16, and an update instruction unit 17.

[0014] The software storage unit 10 stores software for operating the representative vehicle-mounted unit A. The representative vehicle-mounted unit A executes the software stored in the software storage unit 10 to realize a predetermined function for controlling the operation of the vehicle.

[0015] The compatibility information storage unit 11 preliminarily stores a compatibility table that defines combinations of the software versions of all the on-board devices A to D that constitute the vehicle control system 100. The combinations of the software versions of the on-board devices A to D defined in the compatibility table are The consistency table is a combination of versions that are confirmed to operate normally in the vehicle control system 100 and are permitted to be executed simultaneously, as shown in FIG. 3. For example, the consistency table may include a system number for identifying the vehicle control system 100 and the software versions of the vehicle control systems A to D. As the system number, an identifier for identifying the vehicle control system 100 may be used, or the version of the vehicle control system 100 may be used. In the example of the consistency table in FIG. 3, a single version is defined as the version of each vehicle-mounted device, but a range of versions of each vehicle-mounted device that can be combined may be defined. In addition, the consistency table may define multiple sets of combinations of versions (or version ranges) that are permitted to be executed simultaneously. When one vehicle-mounted device holds multiple software programs, the consistency table defines the permitted versions of each of the multiple software programs. The consistency table is used as consistency information (first consistency information) for the determination unit 13 described later to determine whether or not the versions of the software of the vehicle-mounted devices A to D are consistent.

[0016] Each time the vehicle is powered on, the version acquisition unit 12 acquires, through communication, the software versions of the other on-board devices B to D. If an on-board device among the on-board devices B to D holds multiple pieces of software, the version acquisition unit 12 acquires the versions of all of the software held by the on-board device.

[0017] Each time the version acquisition unit 12 acquires the software version from the other on-board units B to D, the determination unit 13 determines whether the software versions of all the on-board units A to D constituting the vehicle control system 100 are consistent. This determination is made by the determination unit 13 comparing the software version stored in the software storage unit 10 of the representative on-board unit A with the software versions acquired by the version acquisition unit 12 from the other on-board units B to D with the consistency information stored in the consistency information storage unit 11. When the determination unit 13 determines that the software versions of all the on-board units A to D constituting the vehicle control system 100 are consistent based on the consistency table stored in the consistency information storage unit 11, it permits the execution of a predetermined vehicle control realized by a combination of the functions of the on-board units A to D.

[0018] When the determination unit 13 determines that there is no consistency between the versions of the software of all the on-board units A to D constituting the vehicle control system 100, the transmission unit 14 transmits version information including the versions of the software of the on-board units A to D to the external server 2. The version information transmitted by the transmission unit 14 is used by the external server 2 to check again whether or not there is consistency between the versions of the software of the on-board units A to D.

[0019] The receiving unit 15 receives various types of information transmitted from the external server 2. One type of information that the receiving unit 15 receives from the external server 2 is judgment result information. The judgment result information is information that indicates whether or not the versions of the software in the in-vehicle devices A to D are consistent, and can be obtained by the external server 2 making a judgment based on the version information received from the transmitting unit 14.

[0020] The transmitting unit 14 and the receiving unit 15 communicate with the external server 2 via the wireless communication device 1 shown in FIG.

[0021] When the determination result information received by the receiving unit 15 indicates that the software versions of the on-board devices A to D are consistent, the consistency information update unit 16 updates the consistency information stored in the consistency information storage unit 11. The consistency information is updated by the consistency information update unit 16 replacing a combination of software versions included in a consistency table (first consistency information) stored in the consistency information storage unit 11 with a combination of the current software versions of the on-board devices A to D, or updating the consistency table stored in the consistency information storage unit 11 with the combination of the current software versions of the on-board devices A to D. This can be done by adding a combination of versions. The consistency information update unit 16 may obtain the updated consistency table from the external server 2 and replace the consistency table stored in the consistency information storage unit 11 with the consistency table obtained from the external server 2.

[0022] When the determination result information received by the receiving unit 15 indicates that the software versions of the vehicle-mounted units A to D are inconsistent, the update instruction unit 17 instructs the vehicle-mounted unit that holds software that is inconsistent with the permitted version combination to update its software.

[0023] [In-vehicle equipment B~D] Each of the vehicle-mounted devices B to D includes a software storage unit 20, a transmission unit 21, and a reception unit 22.

[0024] The software storage unit 20 stores software for operating each of the on-vehicle devices B to D. By executing the software stored in the software storage unit 10, each of the on-vehicle devices B to D realizes a predetermined function for controlling the operation of the vehicle.

[0025] The transmission unit 21 transmits the version of the software stored in the software storage unit 20 to the representative vehicle-mounted unit A. The transmission unit 21 may transmit the version of the software to the representative vehicle-mounted unit A when the vehicle is powered on, or may transmit the version of the software to the representative vehicle-mounted unit A in response to a request from the representative vehicle-mounted unit A transmitted when the vehicle is powered on.

[0026] The receiving unit 22 receives various information transmitted from the representative vehicle-mounted unit A or the external server 2.

[0027] [External Server 2] The external server 2 includes a consistency information storage unit 30, a determination unit 31, a transmission unit 32, and a reception unit 33.

[0028] The consistency information storage unit 30 prestores a consistency table that defines combinations of software versions of all the on-board devices A to D that constitute the vehicle control system 100. The combinations of software versions of the on-board devices A to D defined in the consistency table are combinations that have been confirmed to operate normally in the vehicle control system 100 and are permitted to be executed simultaneously. The consistency table stored in the consistency information storage unit 30 can include a system number that identifies the vehicle control system 100 and the software versions of each of the on-board devices A to D, as in the example shown in FIG. 3. The consistency table is used as consistency information (second consistency information) for the determination unit 31, described later, to determine whether or not the software versions of the on-board devices A to D are consistent.

[0029] The determination unit 31 determines whether the software versions of all the on-board units A to D constituting the vehicle control system 100 are consistent. This determination is made by the determination unit 31 by comparing the software versions of the on-board units A to D included in the version information received from the representative on-board unit A with the consistency table stored in the consistency information storage unit 30. The external server 2 can manage all versions of the software of the on-board units A to D. Therefore, the consistency table stored in the consistency information storage unit 30 can define more permitted combinations of the software versions of the on-board units A to D than the consistency table stored in the consistency information storage unit 11 of the representative on-board unit A. Therefore, even if the consistency of the software versions cannot be confirmed in the representative on-board unit A, the consistency of the software versions of the on-board units A to D can be accurately determined by making a determination again in the external server 2.

[0030] The transmitting unit 32 transmits to the representative vehicle-mounted unit A the determination result information indicating whether or not the software versions of the vehicle-mounted units A to D are consistent, which is the determination result of the determining unit 31.

[0031] The receiving unit 33 receives various information transmitted from the representative vehicle-mounted device A.

[0032] <Control processing> Hereinafter, the control process executed by the representative vehicle-mounted unit A will be described with reference to both FIG. 2 and FIG.

[0033] Fig. 4 is a flowchart showing an example of a consistency checking process executed by the representative vehicle-mounted device in the vehicle control system according to the first embodiment. The control process shown in Fig. 4 is executed when the power supply of the vehicle is turned on.

[0034] Step S1: The version acquisition unit 12 acquires the software versions of the other vehicle-mounted devices B to D. After that, the process proceeds to step S2.

[0035] Step S2: The determination unit 13 compares the software version of the representative vehicle-mounted unit A with the software versions acquired from the other vehicle-mounted units B to D against a consistency table stored in the consistency information storage unit 11, and determines whether or not there is consistency between the software versions of the vehicle-mounted units A to D. If the determination in step S2 is YES, the process proceeds to step S3, otherwise the process proceeds to step S4.

[0036] Step S3: The determination unit 13 permits the execution of vehicle control using a combination of the on-board units A to D. Then, the process ends.

[0037] Step S4: The transmission unit 14 transmits version information including the software version of the representative vehicle-mounted unit A and the software versions acquired from the other vehicle-mounted units B to D to the external server 2. After that, the process proceeds to step S5.

[0038] Step S5: The receiving unit 15 judges whether or not the determination result information has been received from the external server 2. If the judgment in step S5 is YES, the process proceeds to step S6, otherwise the process waits for a predetermined time and then makes the judgment in step S5 again. Note that in step S5, if the state in which the receiving unit 15 is unable to receive the determination result information from the external server 2 continues for a predetermined time (timeout time), the receiving unit 15 judges that a timeout has occurred, ends the process of step S5, and the process proceeds to step S6.

[0039] Step S6: The judgment unit 13 judges whether or not there is consistency between the software versions of the on-board units A to D based on the judgment result information received from the external server 2. If the judgment in step S6 is YES, the process proceeds to step S7, otherwise the process proceeds to step S9. Note that if the receiving unit 15 judges a timeout in step S5, it is judged in step S6 that there is no consistency between the software versions of the on-board units A to D.

[0040] Step S7: The determination unit 13 permits the execution of vehicle control using a combination of the on-board units A to D. After that, the process proceeds to step S8.

[0041] Step S8: The consistency information update unit 16 updates the consistency table stored in the consistency information storage unit 11. As described above, the consistency table may be updated using the version of the software used in the determination in step S2, or may be updated using the consistency table acquired from the external server 2 via the receiving unit 15. Then, the process ends.

[0042] Step S9: The determination unit 13 prohibits the execution of vehicle control using a combination of the on-board units A to D. After that, the process proceeds to step S10.

[0043] Step S10: The update instruction unit 17 instructs the vehicle-mounted device that holds the software version that is inconsistent with the consistency table stored in the consistency information storage unit 11 to update the software. Then, the process ends.

[0044] Furthermore, when the update instruction unit 17 instructs a software update, once the vehicle-mounted device to be updated has completed receiving the updated software from the server 2, the user may be prompted to turn off the vehicle's power once and then turn it back on again in order to switch the software to be executed from the current version of the software to the updated software.

[0045] Furthermore, when the software of any of the on-board devices is updated based on the update instruction in step S10, the consistency information update unit 16 may update the consistency table stored in the consistency information storage unit 11 as necessary.

[0046] <Effects, etc.> In the vehicle control system 100 according to this embodiment, when the vehicle is powered on, the representative vehicle-mounted unit A acquires the software versions of the vehicle-mounted units B to D, and determines whether or not there is consistency between the software versions of the vehicle-mounted units A to D based on a consistency table prepared in advance. Since the consistency of the software versions is checked every time the vehicle is powered on, it is possible to further reduce the possibility that unexpected vehicle control will be executed due to inconsistencies between the software versions of the vehicle-mounted units A to D.

[0047] Furthermore, in the vehicle control system 100 according to this embodiment, if the representative vehicle-mounted unit A determines that there is no consistency in the software version consistency check (primary check), the software versions of the vehicle-mounted units A to D are transmitted to the external server 2, and a consistency check of the software versions is performed again (secondary check) using a consistency table held by the external server 2. Even if consistency cannot be confirmed using the information held by the representative vehicle-mounted unit A, by performing a consistency check again using the information held by the external server 2, it is possible to more accurately determine whether the software versions of the vehicle-mounted units A to D are consistent.

[0048] In addition, in the vehicle control system 100 according to this embodiment, whether the software versions of the on-board devices A to D are consistent or not is determined by checking against a previously prepared consistency table, and as a result of the checking, it is possible to identify which on-board device has a software version that is inconsistent with the consistency table. Information identifying an on-board device that is inconsistent with the consistency table can be used for software updates or repairs of the on-board device, making it possible to quickly improve the state in which the software versions are inconsistent.

[0049] Furthermore, in the vehicle control system 100 according to this embodiment, if the representative vehicle-mounted unit A determines that the software versions of the vehicle-mounted units A to D are inconsistent and then the external server 2 determines that the software versions of the vehicle-mounted units A to D are consistent, it is possible to update the consistency table stored in the consistency information storage unit 11 of the representative vehicle-mounted unit A. If the consistency table stored in the consistency information storage unit 11 is updated, the consistency of the software versions can be confirmed only by the representative vehicle-mounted unit A the next time the vehicle is powered on, unless the software of the vehicle-mounted units A to D is changed, and therefore the time required for checking the consistency can be shortened.

[0050] It is also possible to configure the representative vehicle-mounted device A with only the software storage unit 10, the consistency information storage unit 11, the version acquisition unit 12, and the determination unit 13 among the functional blocks of the representative vehicle-mounted device A shown in Fig. 2, and to configure a simple vehicle control system capable of determining only the consistency of the software versions of the vehicle-mounted devices A to D when the vehicle power is turned on. A transmission unit 14 and a reception unit 15 may be further added to this configuration to configure a vehicle control system capable of performing a primary check in the representative vehicle-mounted device A and a secondary check in the external server 2. Also, a vehicle control system may be configured in which the consistency information update unit 16 or the update instruction unit 17 is omitted from the functional blocks of the representative vehicle-mounted device A shown in Fig. 2.

[0051] Second Embodiment <Configuration> FIG. 5 is a functional block diagram of a vehicle control system according to the second embodiment.

[0052] The vehicle control system 200 according to the second embodiment is characterized in that it can ensure the consistency of the software versions of the on-vehicle units A to D even when the representative on-vehicle unit A is unable to communicate with the external server 2 after the representative on-vehicle unit A has determined that there is an inconsistency in the software versions of the on-vehicle units A to D. The following mainly describes the differences between this embodiment and the first embodiment.

[0053] [Representative onboard machine A] The software storage unit 10 of the representative vehicle-mounted unit A stores a current version of the software Sa_cur and an old version of the software Sa_old as software for operating the representative vehicle-mounted unit A. The current version of the software Sa_cur and the old version of the software Sa_old are stored in different storage areas of the software storage unit 10, and when the software is updated, the old version of the software Sa_old is deleted, the current version of the software is held as the old version of the software, and the updated software is newly stored as the current version of the software.

[0054] A consistency table T_cur of the current version and a consistency table T_old of the old version are stored as consistency information in the consistency information storage unit 11. When the consistency information is updated, the consistency table T_old of the old version is deleted, the consistency table of the current version is held as the consistency table of the old version, and the updated consistency table is newly stored as the consistency table of the current version.

[0055] The representative vehicle-mounted unit A further includes a switching instruction unit 18 and a software switching unit 19.

[0056] When the determination unit 13 determines that there is no consistency between the software versions of the on-vehicle units A to D and the representative on-vehicle unit A is in a state where it cannot communicate with the external server 2, the switching instruction unit 18 instructs each of the on-vehicle units A to D to switch the software to be executed from the current version software to the older version software. When the switching instruction unit 18 instructs the on-vehicle units A to D to switch the software, the user may be notified by display on the display unit or by voice that the software will be switched to the older version.

[0057] When the switching instruction unit 18 issues a software switching instruction, the software switching unit 19 switches the software to be executed from the current version software Sa_cur to the old version software Sa_old, and also switches the consistency information used by the determination unit 13 from the consistency table T_cur of the current version to the consistency table T_old of the old version. Next, when the vehicle power is turned on, the process is executed before the process of checking the consistency of the software versions of the vehicle-mounted devices A to D.

[0058] When the switching instruction unit 18 issues an instruction to switch software, the next time the vehicle is powered on, the version acquisition unit 12 and the judgment unit 13 check the consistency of the software versions of the on-board units A to D. The processes executed by the version acquisition unit 12 and the judgment unit 13 are the same as those normally executed when the power is turned on, but as a result, the version acquisition unit 12 acquires the post-switching software versions from the other on-board units B to D, and the judgment unit 13 checks the consistency of the software versions by comparing the post-switching software version of the representative on-board unit A with the post-switching software versions acquired from the other on-board units B to D against a consistency table of old versions.

[0059] [In-vehicle equipment B~D] The software storage unit 20 of the vehicle-mounted devices B, C, and D stores current version software Sb_cur, Sc_cur, and Sd_cur, and old version software Sb_old, Sc_old, and Sd_old as software for operating the vehicle-mounted devices B, C, and D, respectively. In the vehicle-mounted devices B to D, the current version software and the old version software are also stored in different storage areas of the software storage unit 20, and when updating the software, the old version software is deleted, the updated software is newly stored as the current version software, and the current version software is held as the old version software. The old version software Sa_old to Sd_old is a combination of software that was used before the current version software Sa_cur to Sa_cur, and is a combination of software with version consistency.

[0060] Each of the in-vehicle devices B to D further includes a software switching unit 23. When a software switching instruction is given by the switching instruction unit 18, the software switching unit 23 switches the software to be executed from the current version software Sb_cur, Sc_cur, and Sd_cur to the old version software Sb_old, Sc_old, and Sd_old, respectively. The software switching by the software switching unit 23 is also triggered when the vehicle is next powered on, and is executed before the process of checking the consistency of the software versions of the in-vehicle devices A to D.

[0061] <Control processing> Hereinafter, the control process executed by the representative vehicle-mounted unit A will be described with reference to FIGS.

[0062] Fig. 6 is a flowchart showing an example of a consistency checking process executed by the representative vehicle-mounted device in the vehicle control system according to the second embodiment. The control process shown in Fig. 6 is executed when the power supply of the vehicle is turned on.

[0063] Step S21: The software switching unit 19 judges whether or not a software switching instruction has been issued before the vehicle power is turned on. This step S21 is a judgment required for switching the software when the first power is turned on after an instruction to switch the current version software of the vehicle-mounted devices A to D to the old version software is issued in step S28 described later. It can be judged by a flag or the like set in a non-volatile storage area that a software switching instruction has been issued before the vehicle power is turned on. If the judgment in step S21 is YES, the process proceeds to step S22, and otherwise the process proceeds to step S23.

[0064] Step S22: If it is determined in step S21 that there is an instruction to switch software, the software switching unit 19 switches the software to be executed from the current version software Sa_cur to the old version software Sa_old. Also, the software switching unit 19 switches the consistency information used by the determination unit 13 from the current consistency table T_cur to the old version consistency table T_old.

[0065] Although not shown in the figure, in the other vehicle-mounted units that have been instructed to switch software, the software switching unit 23 switches the software to be executed from the current version software to the old version software at the same time and in parallel with the software switching in the representative vehicle-mounted unit A.

[0066] Step S23: The version acquisition unit 12 acquires the software versions of the other vehicle-mounted devices B to D. After that, the process proceeds to step S24.

[0067] Step S24: The determination unit 13 compares the software version of the representative vehicle-mounted unit A with the software versions acquired from the other vehicle-mounted units B to D against a consistency table stored in the consistency information storage unit 11, and determines whether or not there is consistency between the software versions of the vehicle-mounted units A to D. If the determination in step S24 is YES, the process proceeds to step S25; otherwise, the process proceeds to step S26.

[0068] Step S25: The determination unit 13 permits the execution of vehicle control using a combination of the on-board units A to D. Then, the process ends.

[0069] Step S26: The transmitting unit 14 judges whether or not communication with the external server 2 is possible. Whether or not communication with the external server 2 is possible can be judged, for example, based on the signal strength of the wireless signal received by the receiving unit 15. If the judgment in step S26 is YES, the process proceeds to step S29, otherwise the process proceeds to step S27.

[0070] Step S27: The determination unit 13 prohibits the execution of vehicle control using a combination of the on-board units A to D. After that, the process proceeds to step S .

[0071] Step S28: The switching instruction unit 18 instructs the vehicle-mounted device that needs to switch from the current version software to the old version software to switch from the current version software to the old version software, and then ends the process.

[0072] When the switching instruction unit 18 instructs the vehicle-mounted units A to D to switch the software, the representative vehicle-mounted unit A may notify the user that the software will be switched. Furthermore, when the representative vehicle-mounted unit A is ready to switch the software, the representative vehicle-mounted unit A may prompt the user to turn the vehicle power off and then on again.

[0073] Step S29: The transmission unit 14 transmits version information including the software version of the representative vehicle-mounted unit A and the software versions acquired from the other vehicle-mounted units B to D to the external server 2. After that, the process proceeds to step S30.

[0074] Step S30: The receiving unit 15 judges whether or not it has received the judgment result information from the external server 2. If the judgment in step S30 is YES, the process proceeds to step S31, otherwise, it waits for a predetermined time and then makes the judgment in step S30 again. Note that in step S30, if the state in which the receiving unit 15 is unable to receive the judgment result information from the external server 2 continues for a predetermined time (timeout time), the receiving unit 15 judges that a timeout has occurred and ends the step. The process of step S30 ends, and the process proceeds to step S31.

[0075] Step S31: The determination unit 13 determines whether or not there is consistency between the software versions of the on-board units A to D based on the determination result information received from the external server 2. If the determination in step S31 is YES, the process proceeds to step S32, otherwise the process proceeds to step S34. Note that if the receiving unit 15 determines a timeout in step S30, it is determined in step S31 that there is no consistency between the software versions of the on-board units A to D.

[0076] Step S32: The determination unit 13 permits the execution of vehicle control using a combination of the on-vehicle units A to D. After that, the process proceeds to step S33.

[0077] Step S33: The consistency information update unit 16 updates the consistency information stored in the consistency information storage unit 11. Then, the process ends.

[0078] Step S34: The determination unit 13 prohibits the execution of vehicle control using a combination of the on-vehicle units A to D. After that, the process proceeds to step S35.

[0079] Step S35: The update instruction unit 17 instructs the vehicle-mounted device that holds the software version that is inconsistent with the consistency table stored in the consistency information storage unit 11 to update the software, and then ends the process.

[0080] Furthermore, when the update instruction unit 17 instructs a software update, once the vehicle-mounted device to be updated has completed receiving the updated software from the server 2, the user may be prompted to turn off the vehicle's power once and then turn it back on again in order to switch the software to be executed from the current version of the software to the updated software.

[0081] <Effects, etc.> In the vehicle control system 200 of this embodiment, as in the first embodiment, whether or not there is consistency between the software versions of the on-board units A to D is determined when the vehicle power is turned on, thereby further reducing the possibility of unexpected vehicle control being performed due to inconsistencies in the software versions of the on-board units A to D.

[0082] In addition, in the vehicle control system 200 according to this embodiment, each vehicle-mounted unit holds an old version of software, and the representative vehicle-mounted unit A holds a consistency table of the old version. Therefore, if the representative vehicle-mounted unit A determines that the software versions of the vehicle-mounted units A to D are inconsistent but the representative vehicle-mounted unit A is unable to communicate with the external server 2, the software can be switched to the old version. With this configuration, even if the latest software version is inconsistent and the representative vehicle-mounted unit A cannot communicate with the external server, it is possible to ensure consistency in the software versions of the vehicle-mounted units A to D.

[0083] Incidentally, a vehicle control system may be configured in which the consistency information update unit 16 or the update instruction unit 17 is omitted from the functional blocks of the representative vehicle-mounted unit A shown in FIG.

[0084] (Third embodiment) <Configuration> FIG. 7 is a schematic diagram for explaining the background of the vehicle control system according to the third embodiment.

[0085] The software versions Sa to Sd of the on-board units A to D constituting the vehicle control system 300 are in a consistent state when the vehicle is shipped (left column of FIG. 7). The consistency of the software versions of the on-board units A to D may be lost due to the replacement of the on-board units A to D or the replacement of components such as boards included in the on-board units A to D. For example, when the on-board unit C breaks down (center column of FIG. 7), and the broken on-board unit C is replaced with a new one, the version of the software Sc' of the new on-board unit C may be different from the version of the software Sc before the replacement (right column of FIG. 7). In this case, the software version Sc' of the new on-board unit C is not necessarily consistent with the software versions of the on-board units A, B, and D, and depending on the version of the software Sc', it may be possible that only the consistency check process by the representative on-board unit A cannot check the consistency of the software of the on-board units A to D. When a vehicle is used in a place where the wireless communication environment is not good, such as underground or in mountainous areas, it is not possible to check compatibility by communicating with an external server. This may result in limitations on the vehicle control functions realized by the combination of on-board units A to D, or software updates may take time, which may reduce user convenience.

[0086] In anticipation of such problems, the vehicle control system according to the third embodiment is characterized in that it can quickly ensure the consistency of the software versions of the on-vehicle devices A to D even when repair or replacement of the on-vehicle devices A to D is required. The following mainly describes the differences between this embodiment and the first embodiment.

[0087] FIG. 8 is a functional block diagram of a vehicle control system according to the third embodiment.

[0088] [Representative onboard machine A] The representative vehicle unit A includes a software acquisition unit 40 and a software update unit 41 in addition to the software memory unit 10, consistency information memory unit 11, version acquisition unit 12, judgment unit 13, transmission unit 14, and reception unit 15 described in the first embodiment.

[0089] When any of the other vehicle-mounted devices B to D breaks down and needs to be replaced or repaired, the software acquisition unit 40 receives and stores the current version of the software of the broken vehicle-mounted device from the external server 2 while communication with the external server 2 is possible. The software acquisition unit 40 can detect that a failure has occurred in any of the vehicle-mounted devices B to D from a failure notification output from the broken vehicle-mounted device. In Figs. 7 and 8, an example is shown in which the vehicle-mounted device C breaks down, and the software acquisition unit 40 acquires and stores the software Sc of the vehicle-mounted device C, which is consistent with the versions of the software Sa, Sb, and Sd of the vehicle-mounted devices A, B, and D, from the external server 2. The software version that the software acquisition unit 40 acquires from the external server 2 may be acquired from the broken vehicle-mounted device C by communication, or may be acquired from a consistency table stored in the consistency information storage unit 11.

[0090] When the determination unit 13 determines that the software versions of the on-board units A to D are inconsistent after a failed on-board unit is replaced or repaired, and the on-board unit that holds the software version determined to be inconsistent in the consistency table is the replaced or repaired on-board unit, the software update unit 41 writes the software stored by the software acquisition unit 40 to the software storage unit 20 of the replaced or repaired on-board unit. After that, the software update unit 41 instructs the replaced or repaired on-board unit to switch the software.

[0091] When the software update unit 41 issues a software switching instruction, the next time the vehicle is powered on, the version acquisition unit 12 and the determination unit 13 check the consistency of the software versions of the vehicle-mounted devices A to D. The processes executed by the version acquisition unit 12 and the determination unit 13 are the same as those executed normally when the power is turned on. .

[0092] [In-vehicle equipment B~D] Each of the vehicle-mounted devices B to D further includes a software switching unit 23 similar to that described in the second embodiment. When a software switching instruction is issued by the software update unit 41, the software switching unit 23 switches the software to be executed from the current version of the software to the software written by the software update unit 41. The software switching by the software switching unit 23 is triggered when the vehicle is next powered on, and is executed before the process of checking the consistency of the software versions of the vehicle-mounted devices A to D.

[0093] <Control processing> Hereinafter, the control process executed by the representative vehicle-mounted unit A will be described with reference to FIGS.

[0094] FIG. 9 is a flowchart showing an example of software acquisition processing executed by the representative vehicle-mounted unit in the vehicle control system according to the third embodiment.

[0095] Step S41: The receiving unit 15 judges whether or not a malfunction notification has been received from any of the other vehicle-mounted devices B to D. If the judgment in step S41 is YES, the process proceeds to step S42, otherwise the process ends.

[0096] Step S42: The software acquisition unit 40 acquires and stores the current version of the software of the failed vehicle-mounted unit from the external server 2. Then, the process ends.

[0097] Fig. 10 is a flowchart showing an example of a consistency checking process executed by the representative vehicle-mounted device in the vehicle control system according to the third embodiment. The control process shown in Fig. 10 is executed when the power supply of the vehicle is turned on.

[0098] Step S51: The version acquisition unit 12 acquires the software versions of the other vehicle-mounted devices B to D. After that, the process proceeds to step S52.

[0099] Step S52: The determination unit 13 compares the software version of the representative vehicle-mounted unit A with the software versions acquired from the other vehicle-mounted units B to D against a consistency table stored in the consistency information storage unit 11, and determines whether or not there is consistency between the software versions of the vehicle-mounted units A to D. If the determination in step S52 is YES, the process proceeds to step S54, otherwise the process proceeds to step S53.

[0100] Step S53: The determination unit 13 permits the execution of vehicle control using a combination of the on-board units A to D. Then, the process ends.

[0101] Step S54: The determination unit 13 determines whether the vehicle-mounted device having the software version that is not consistent with the consistency table is a replaced or repaired vehicle-mounted device. Whether the vehicle-mounted device has been replaced or repaired can be determined based on the failure notification received in step S41 of Fig. 9. If the determination in step S54 is YES, the process proceeds to step S55, and otherwise the process proceeds to step S56.

[0102] Step S55: The software update unit 41 writes the software stored in the software acquisition unit 40 to a predetermined area of ​​the software storage unit 20 of the replaced or repaired vehicle-mounted device. Then, the software update unit 41 writes the software to the replaced or repaired vehicle-mounted device. Then, the process ends.

[0103] Step S56: The determination unit 13 prohibits the execution of vehicle control using a combination of the on-board units A to D. Thereafter, the process ends.

[0104] When the software update unit 41 instructs to switch software, the user may be prompted to turn off the power supply of the vehicle once and then turn it on again in order to switch the software to be executed by the replaced or repaired on-board unit from the current version of the software to the updated software. Also, the representative on-board unit A may turn off the power supply of the on-board unit instructed by the software update unit 41 to switch software once and then turn it on again. When the on-board unit instructed by the software update unit 41 to switch software is next powered on, the software switching unit 23 switches the software to be executed to the software written in the software storage unit 20 by the software update unit 41.

[0105] <Effects, etc.> In the vehicle control system 300 of this embodiment, as in the first embodiment, whether or not there is consistency between the software versions of the on-board units A to D is determined when the vehicle power is turned on, thereby further reducing the possibility of unexpected vehicle control being performed due to inconsistencies in the software versions of the on-board units A to D.

[0106] In addition, in the vehicle control system 300 according to the present embodiment, when the replacement or repair of the on-board units B to D is required due to a failure, the representative on-board unit A acquires in advance from the external server 2 the software of the failed on-board unit, the consistency of which has been confirmed in advance. Then, after the replacement or repair of the failed on-board unit, if the software version of the replaced or repaired on-board unit is not consistent with the consistency table, the representative on-board unit A switches to the software acquired in advance from the external server 2. Therefore, even if the software versions of the on-board units A to D become inconsistent due to the replacement or repair of the on-board unit and the wireless communication environment of the vehicle is not in order, the on-board units A to D can be quickly restored to a consistent state. As a result, the limitations on the vehicle control function realized by the combination of the on-board units A to D can be quickly eliminated, improving the user's convenience.

[0107] The software compatibility check method according to the third embodiment may be combined with the vehicle control system 100 according to the first embodiment or the vehicle control system 200 according to the second embodiment. Specifically, the vehicle control system 100 according to the first embodiment or the vehicle control system 200 according to the second embodiment may be further provided with a software acquisition unit 40 and a software update unit 41, and the representative vehicle-mounted device A may be configured to be able to execute the processes of steps S41 and S42 shown in FIG. 9 and the processes of steps S54 and S55 shown in FIG. 10. The processes of steps S54 and S55 shown in FIG. 10 are preferably executed before the secondary check is executed in the external server 2 after the determination unit 13 determines that the software version is incompatible in the primary check. With this configuration, the determination of compatibility using information held by the representative vehicle-mounted device A is executed preferentially, and the secondary check is executed in the external server 2 when the determination cannot be made by the representative vehicle-mounted device A alone. Therefore, the software compatibility determination process can be efficiently performed without communication. If there is a step (S26 in FIG. 6) for determining whether communication between the vehicle and the external server 2 is possible, if the vehicle cannot communicate with the external server 2, the processes of steps S54 and S55 in FIG.

[0108] (Other variations, etc.) The control processes of FIGS. 4, 6, 9, and 10 may be realized by a dedicated circuit or may be realized by a device such as an ECU having a processor, a ROM, a RAM, a hard disk, etc. It may be realized by making a computer execute the processing of each step. When making a computer such as an ECU execute the control processes of Figures 4, 6, 9, and 10, a program in which these control processes are written so as to be executable may be stored in a storage device such as a ROM or a hard disk in advance, and the processor of the computer may read the program from the storage device and execute it.

[0109] In addition, in each of the above embodiments, an example has been described in which one of the onboard devices providing the control function of the vehicle control system acts as a representative onboard device to check the consistency of software versions, but the above control processing may also be performed by an onboard device dedicated to checking the consistency of software versions. [Industrial Applicability]

[0110] The present invention can be used in a vehicle control system that realizes a predetermined vehicle control function by combining a plurality of on-vehicle devices. [Explanation of symbols]

[0111] 2 External Server 10 Software memory unit 11 Consistency information storage unit 12 Version Acquisition Section 13 Judgment section 14 Transmitter 15 Receiving section 16 Consistency information update section 17 Update instruction section 18 Switching instruction section 19 Software switching section 20 Software memory section 30 Consistency information storage unit 31 Judgment section 32 Transmitter 33 Receiving section 40 Software Acquisition Department 41 Software Update Section 100, 200, 300 Vehicle Control System A Representative in-vehicle device B~D On-vehicle device

Claims

1. A device mounted on a vehicle, a first instruction unit that issues an instruction to switch software of a plurality of in-vehicle devices; an acquisition unit that acquires version information of software after switching of the plurality of vehicle-mounted devices in response to the switching instruction; a verification unit that verifies consistency between versions of software of the plurality of vehicle-mounted devices based on the version information acquired by the acquisition unit; a notification unit that notifies a user that the plurality of vehicle-mounted devices will revert from the switched software to the pre-switched software based on the confirmation that there is no consistency between the versions of the software of the plurality of vehicle-mounted devices; An apparatus comprising:

2. The device described in claim 1, wherein the notification unit notifies the user that the multiple in-vehicle devices will revert from the switched software to the pre-switched software by displaying on a display unit.

3. The device described in claim 1 or 2, further comprising a second instruction unit that instructs the multiple vehicle-mounted devices to revert from the post-switch software to the pre-switch software based on the confirmation that the software versions of the multiple vehicle-mounted devices are inconsistent.

4. a storage unit that stores an authorized combination of the software versions before the switch and an authorized combination of the software versions after the switch, After the second instruction unit issues an instruction to switch software, The acquisition unit acquires version information of software of the plurality of vehicle-mounted devices, The device according to claim 3 , wherein the confirmation unit checks whether the software versions of the multiple on-board devices are consistent by comparing the software version information acquired by the acquisition unit with an permitted combination of the software versions before the switch.

5. a transmission unit capable of transmitting the version information acquired by the acquisition unit to an external server, 4. The device according to claim 3, wherein when it is confirmed that there is an inconsistency in the versions of the software after the switch of the multiple vehicle-mounted devices and further when the transmission unit cannot communicate with the external server, the second instruction unit instructs the multiple vehicle-mounted devices to revert from the software after the switch to the software before the switch.

6. a receiving unit capable of receiving, from the external server, confirmation result information confirmed by the external server based on the version information transmitted by the transmitting unit, the confirmation result information indicating whether or not there is consistency between versions of software of the plurality of on-board devices; If it is confirmed that there is no consistency in the versions of the software after the switching of the plurality of on-board devices and the transmission unit is capable of communicating with the external server, The transmission unit transmits the version information acquired by the acquisition unit to the external server, The receiving unit receives the confirmation result information from the external server, The device according to claim 5 , wherein the verification unit verifies that the versions of the software of the plurality of vehicle-mounted devices are consistent based on the verification result information received by the receiving unit.

7. The device according to any one of claims 1 to 6, wherein the confirmation unit permits execution of a specified vehicle control realized by the multiple on-board devices when it confirms that the software versions of the multiple on-board devices are consistent.

8. A vehicle comprising the device according to claim 1.

9. A method executed by a computer included in a device mounted on a vehicle, comprising: issuing an instruction to switch software of a plurality of in-vehicle devices; acquiring version information of software after the switching of the plurality of vehicle-mounted devices in response to the switching instruction; confirming that the versions of the software of the plurality of on-board devices are consistent based on the acquired version information; and based on the confirmation that the software versions of the multiple on-board devices are inconsistent, notifying a user that the multiple on-board devices will revert from the switched software to the pre-switched software.

10. A method executed by a computer included in a device mounted on a vehicle, the method comprising: issuing an instruction to switch software of a plurality of in-vehicle devices; acquiring version information of software after the switching of the plurality of vehicle-mounted devices in response to the switching instruction; confirming that the versions of the software of the plurality of on-board devices are consistent based on the acquired version information; and a step of notifying a user that the multiple in-vehicle devices will revert from the switched software to the pre-switched software based on the confirmation that there is an inconsistency in the versions of the software of the multiple in-vehicle devices.

Images