PROGRAM MANAGEMENT DEVICE, PROGRAM MANAGEMENT METHOD, AND RECORDING MEDIUM

Abstract

To ease restrictions on timing to update a program of a vehicle.SOLUTION: A program management apparatus includes: a communication unit which communicates with an external device located outside a vehicle; a control unit which executes a vehicle control program for controlling the vehicle; a program storage first region for storing a vehicle control program; a program storage second region for storing a vehicle control program; a program storage third region for storing an irrelevant program for performing a control that is irrelevant to driving the vehicle; and a program update unit configured to execute: first processing that causes at least one of the program storage first region and the program storage second region to store a vehicle control update program to be used for updating the vehicle control program, the vehicle control update program being received by the communication unit; and second processing that causes the program storage third region to store a non-control update program which is used for updating the irrelevant program, the non-control update program being received by the communication unit.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a program management device, a program management method, and a recording medium. [Background technology]

[0002] In recent years, the functions of software that controls vehicles have been enhanced with the aim of improving traffic safety and reducing CO2 emissions. A technology for updating a program executed by an ECU (Electronic Control Unit) mounted on a vehicle has been proposed. For example, Patent Document 1 discloses a configuration in which a storage unit that stores a program includes a vehicle control program storage area that stores a control program, and a second program storage area that stores an update program that is an update version of the control program. With this configuration, it is possible to store the update program in the storage unit even while the control program is being executed, and it is said that this reduces constraints on the timing of program updates. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-144669 A Summary of the Invention [Problem to be solved by the invention]

[0004] As described in Patent Document 1, a configuration in which multiple storage areas for storing programs are provided requires a large storage capacity compared to the size of the programs. With the advancement of vehicle control technology and infotainment, the number and complexity of programs used in vehicles are increasing. For this reason, there was a problem that a large-capacity storage device must be installed in the vehicle in order to provide multiple storage areas for storing programs. Even if a large-capacity storage device were adopted, there was a possibility that the storage capacity would be insufficient when updating a program. The present invention has been made in consideration of the above background, and aims to reduce constraints on the timing of updating programs used in vehicles by extremely increasing the capacity of memory space or by using a method that is less likely to cause a shortage of memory space. [Means for solving the problem]

[0005] According to one aspect of the present invention, there is provided a vehicle control system including: a communication unit that communicates with an external device located outside the vehicle; The regulation a control unit that executes a vehicle control program for controlling a vehicle that is not involved in driving the vehicle; a first program storage area that stores the vehicle control program; a second program storage area that stores the vehicle control program; and a third program storage area that stores a non-involved program for performing control not involved in driving the vehicle. A program update unit that executes a first process of storing a vehicle control update program received by the communication unit and used for updating the vehicle control program in at least one of the first program storage area or the second program storage area, and a second process of storing the non-control update program received by the communication unit and used for updating the non-involved program in the third program storage area. When the storage capacity of the first program storage area or the second program storage area is insufficient in the first process, the program update unit forms an extension area using the third program storage area and stores at least a part of the vehicle control update program in the extension area. It is a program management device. Another aspect for achieving the above object is a program management device including a communication unit that communicates with an external device outside the vehicle, a control unit that executes a vehicle control program for controlling the vehicle, a first program storage area that stores the vehicle control program, a second program storage area that stores the vehicle control program, and a third program storage area that stores a non-involved program for performing control that is not involved in driving the vehicle. A program update unit that executes a first process of storing a vehicle control update program received by the communication unit and used to update the vehicle control program in at least one of the first program storage area or the second program storage area, and a second process of storing a non-control update program received by the communication unit and used to update the non-involved program in the third program storage area, wherein the program update unit stores the vehicle control update program received from the communication unit in the first program storage area or the second program storage area based on an operation of a first user registered in the vehicle, and stores the vehicle control update program received from the communication unit in the third program storage area based on an operation of a second user different from the first user. Effect of the Invention

[0006] According to the above configuration, since the vehicle control program is held in an area that is not affected by the update while the vehicle control program is being updated, restrictions on the timing of updating the program can be reduced. Since the third program storage area that stores the non-controlled update program is not duplicated, an increase in the capacity of the storage area can be suppressed. Therefore, an increase in the capacity of the storage area for storing the vehicle program can be suppressed, and a shortage of storage area for storing the program can be avoided. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram of a vehicle control system. [Diagram 2] FIG. 2 is a diagram showing a schematic configuration of the program management system. [Diagram 3] FIG. 3 is a block diagram showing the configuration of a main part of the control system. [Figure 4] FIG. 4 is a schematic diagram illustrating an example of the configuration of the data storage unit. [Diagram 5] FIG. 5 is a sequence diagram showing the operation of the program management system. [Figure 6] FIG. 6 is a flow chart showing the operation of the control system. [Figure 7] FIG. 7 is a flowchart showing the operation of the control system. [Figure 8] FIG. 8 is a flow chart showing the operation of the control system. [Figure 9] FIG. 9 is a flowchart showing the operation of the control system. [Figure 10] FIG. 10 is a timing chart showing an example of transition of the state of the vehicle. [Figure 11] FIG. 11 is a flowchart showing the operation of the control system in the modified example. [Figure 12] FIG. 12 is a flowchart showing the operation of the control system in the modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] FIG. 1 is a diagram showing a control system 1 for a vehicle. The control system 1 includes a central ECU 2 that performs overall control of the vehicle and performs information processing. Hereinafter, the vehicle equipped with the control system 1 is referred to as the vehicle itself. Specifically, the vehicle itself is a vehicle V, which will be described later. The central ECU 2 is connected to communication lines including communication lines 4a, 4b, and 4c. The central ECU 2 realizes a gateway function that manages the transmission and reception of communication data between these communication lines. In addition, a TCU (Telematics Control Unit) 12, which is a wireless device that complies with the communication standard of a mobile communication system, is connected to the central ECU 2. The central ECU 2 executes OTA (Over The Air) management using the TCU 12. The OTA management includes control related to a process of downloading an update program for an in-vehicle device provided in the vehicle from a server outside the vehicle, and a process of applying the downloaded update program to the in-vehicle device.

[0009] The first zone ECU 20a, the second zone ECU 20b, and the third zone ECU 20c are connected to the communication lines 4a, 4b, and 4c, respectively. The first zone ECU 20a is connected to ECUs 30a, 30b, and 30c, and the second zone ECU 20b is connected to ECUs 30d, 30e, and 30f. The third zone ECU 20c is connected to ECUs 30g, 30h, and 30i.

[0010] Hereinafter, the first zone ECU 20a, the second zone ECU 20b, and the third zone ECU 20c will be collectively referred to as zone ECUs 20, and the ECUs 30a, 30b, 30c, 30d, 30e, 30f, 30g, 30h, and 30i will be collectively referred to as ECUs 30.

[0011] The ECU 30 may include, for example, an MPU (Map Positioning Unit), an MVC-ECU (MVC; Multi View Camera), a PKS-ECU (PKS; Parking Support), and / or an ADAS-ECU (ADAS; Advanced Driver-Assistance System), as well as other ECUs that control the operation of various devices and sensors included in the vehicle. Such devices and sensors may include a driving motor that drives the vehicle, a steering device such as an accelerator and a brake, a VSA device (VSA; Vehicle Stability Assist), a battery, a light body such as a headlamp, a window motor that drives a door window, an actuator that drives a door lock mechanism, a door lock sensor, a door opening / closing sensor, a temperature sensor, an exterior camera, an interior camera, and the like.

[0012] Each zone ECU 20 is connected to a plurality of ECUs 30 arranged in the same section of the vehicle body space of the host vehicle, or a plurality of ECUs 30 that control the operation of devices and sensors arranged in the same section.

[0013] In addition to the zone ECU 20, other control devices and devices may be connected to the central ECU 2. Such control devices and devices may include an infotainment control box (ICB), a speaker, a microphone, a meter panel, a steering switch, a Global Navigation Satellite System (GNSS) sensor, a touch panel, and the like.

[0014] In this embodiment, the communication lines 4a, 4b, and 4c are configured by, for example, a CAN bus that performs communication in compliance with the CAN communication standard. Hereinafter, the communication lines 4a, 4b, and 4c are collectively referred to as the communication lines 4. Hereinafter, the communication lines 4 correspond to the in-vehicle network in the present disclosure. In addition, the zone ECUs 20 connected to the communication lines 4 correspond to the multiple electronic control devices in the present disclosure.

[0015] The zone ECUs 20 connected to the communication line 4 transmit data to be transmitted in one frame or as a sequence of frames according to the CAN communication standard, according to the prior art. According to the CAN communication standard, each transmitted frame contains an identification code (ID), and each zone ECU 20 that receives a frame determines whether the frame was addressed to itself or not, based on the ID contained in the frame.

[0016] FIG. 2 is a diagram showing a schematic configuration of the program management system 100. As shown in FIG. The program management system 100 is a system that enables updating of programs executed by various ECUs that constitute the control system 1. The program management system 100 includes a server 110 and a vehicle diagnosis device 120.

[0017] The server 110 is connected to the control system 1 via a communication network N. The communication network N includes, for example, a cellular communication network, a Wi-Fi (registered trademark) network, Bluetooth (registered trademark), the Internet, a Wide Area Network (WAN), a Local Area Network (LAN), a public line, a provider device, a dedicated line, a base station, etc., and a base station B is illustrated in Fig. 2. The TCU 12 included in the control system 1 executes cellular communication with the base station B, thereby executing data communication with an external device through the communication network N.

[0018] The control system 1 can download update data for updating programs executed by various ECUs of the control system 1 from the server 110 by communicating with the server 110 via the TCU 12. The means by which the control system 1 downloads update data from the server 110 and updates the programs corresponds to the above-mentioned OTA. The server 110 corresponds to an example of an external device of the control system 1. The TCU 12 corresponds to an example of a communication unit.

[0019] The vehicle diagnosis device 120 is a device installed in a dealer or a repair shop that handles the vehicle V on which the control system 1 is mounted. The vehicle diagnosis device 120 is connected by a cable to a DLC (Data Link Connector) (not shown) of the control system 1. The control system 1 can perform updates of the programs executed by the control system 1 by communicating with the vehicle diagnosis device 120.

[0020] Here, updating an ECU program refers to rewriting a program executed by an ECU with a different version of the program. Updating an ECU program may include rewriting data referenced when an ECU executes a program and / or data generated or changed by execution of the program together with the program. Updating an ECU program may include rewriting a program executed by an ECU with the same version of the program.

[0021] Fig. 3 is a block diagram showing the configuration of the main parts of the control system 1. Fig. 3 shows part of the configuration related to program updates in the control system 1, and does not prevent the control system 1 from being provided with configurations not shown in Fig. 3.

[0022] In the control system 1, each ECU including the central ECU 2, the zone ECU 20, and the ECU 30 includes a processor and a storage unit. The processor is, for example, configured with a CPU (Central Processing Unit), an MCU (Micro Controller Unit), and an MPU (Micro Processor Unit). The storage unit stores the programs executed by the processor and the data processed by the processor in a non-volatile manner. The storage unit is, for example, a ROM (Read Only Memory). The ECU may also include a RAM (Random Access Memory) that forms a work area for temporarily storing the programs and data. The ECU may be configured as an integrated circuit that integrally includes the processor, the ROM, and the RAM. The ECU may also be configured to include the processor, the ROM, and the RAM as independent hardware.

[0023] The central ECU 2 includes an update control unit 201 and a data processing unit 211 as functional units related to updating a program. The update control unit 201 and the data processing unit 211 may be hardware included in the central ECU 2. Moreover, the update control unit 201 and the data processing unit 211 may be functional units realized by cooperation between software and hardware as a result of a processor of the central ECU 2 executing a program.

[0024] The update control unit 201 includes an update data receiving unit 202 and an update data control unit 203. The update data receiving unit 202 controls the TCU 12 to receive update data for updating a program from the server 110. The update data control unit 203 uses the update data received by the update data receiving unit 202 to control a process in which various ECUs including the central ECU 2 update programs.

[0025] 3 illustrates the central ECU 2, the first zone ECU 20a, the second zone ECU 20b, and the ECU 30d as targets of control by the update control unit 201, but this is just an example. There is no limit to the number of ECUs that are targets of control by the update control unit 201. The update control unit 201 controls the update of programs executed by at least some of the ECUs included in the control system 1. The update control unit 201 may control the update of programs by all ECUs included in the control system 1 or almost all ECUs.

[0026] The data processing unit 211 includes an update execution unit 212 and a data storage unit 213. The data storage unit 213 corresponds to the storage unit described above. The data storage unit 213 stores the program executed by the central ECU 2 and data related to the program. The update execution unit 212 updates the program stored in the data storage unit 213. The update execution unit 212 corresponds to an example of a program update unit.

[0027] The first zone ECU 20a includes an update execution unit 51a and a data storage unit 52a. The data storage unit 52a stores programs executed by the first zone ECU 20a and data related to these programs. The update execution unit 51a updates the programs stored in the data storage unit 52a. The second zone ECU 20b includes an update execution unit 51b and a data storage unit 52b. The data storage unit 52b stores programs executed by the second zone ECU 20b and data related to these programs. The update execution unit 51b updates the programs stored in the data storage unit 52b.

[0028] A specific example of the ECU 30d is an entry ECU. The entry ECU is connected to an LF / RF antenna (not shown) that performs wireless communication with an electronic key of the vehicle. The electronic key is an electronic device having a wireless communication function, and is called a smart key or FOB key. The entry ECU works in conjunction with other in-vehicle ECUs to process user access to the control system 1 from outside the vehicle, and realizes the so-called smart entry operation.

[0029] The ECU 30d includes an update execution unit 51c and a data storage unit 52c. The data storage unit 52c stores programs executed by the ECU 30d and data related to these programs. The update execution unit 51c updates the programs stored in the data storage unit 52c.

[0030] Here, when there is no need to distinguish between the update execution units 51a, 51b, and 51c, they are referred to as the update execution unit 51. The update execution unit 51 may include an update execution unit provided in an ECU not shown in FIG. 3, in addition to the update execution units 51a, 51b, and 51c. Similarly, when there is no need to distinguish between the data storage units 52a, 52b, and 52c, they are referred to as the data storage unit 52. The data storage unit 52 may include a data storage unit 52 provided in an ECU not shown in FIG. 3, in addition to the data storage units 52a, 52b, and 52c. The update execution unit 51 corresponds to an example of a program update unit.

[0031] FIG. 3 shows ECU 30a and ECU 30b as examples of ECU 30 connected to the first zone ECU 20a. In this embodiment, ECU 30a is an ECU that controls driving of the vehicle and can be called a drive device. In this embodiment, ECU 30a is an ECU that receives operations of a drive source of the vehicle and includes a shift device 25a and a drive source 25b. ECU 30b can be called a steering operation device. ECU 30b includes a start-stop switch (SSSW) 27a and a shift switch (SWitch) 27b. SSSW 27a and shift SW 27b are provided at positions where they can be operated by a user who drives the vehicle V.

[0032] The driving source 25b is a power source that drives the vehicle V, and is a motor, an internal combustion engine, or a combination of a motor and an internal combustion engine. The shift device 25a controls a transmission mechanism that transmits the output of the driving source 25b to the driving wheels of the vehicle V in accordance with the operation of the shift SW 27b. When the driving source 25b is composed of only a motor, the shift device 25a does not have to be a device that controls the transmission mechanism. For example, the shift device 25a may be a circuit that supplies current to the driving source 25b or a circuit that controls the rotation of the driving source 25b.

[0033] 4 is a schematic diagram showing an example of the configuration of the data storage unit 213. The data storage unit 52 can have the same configuration as the data storage unit 213.

[0034] The data storage unit 213 corresponds to the above-mentioned storage unit and has a non-volatile storage area. The data storage unit 213 stores programs and data in a rewritable storage area. The data storage unit 213 is configured, for example, by a semiconductor storage device or a magnetic recording device. As a specific example, the data storage unit 213 is configured by a flash ROM or an EEPROM (Electrically Erasable Programmable ROM). In the following description, the programs and data stored in the data storage unit 213 and the data storage unit 52 are referred to as programs. That is, the programs referred to in the following description include data that is referenced, generated, or processed when the processor executes the programs. The entirety of these programs and data can be referred to as software. That is, the program management system 100 has a function of managing and updating the software of the control system 1 mounted on the vehicle V.

[0035] The storage area of ​​the data storage unit 213 is logically divided into a plurality of areas. Each area of ​​the data storage unit 213 and each program stored in the data storage unit 213 are identified by an address of the data storage unit 213.

[0036] The data storage unit 213 is provided with a boot sector 61, an A-side boot image storage area 62, a B-side boot image storage area 63, a common area 64, a spare area 65, a check area 66, a first program storage area 70, and a second program storage area 75. The common area 64 corresponds to an example of a third program storage area.

[0037] As described above, the data storage unit 52 is configured in the same manner as the data storage unit 213. That is, the data storage unit 52 includes a boot sector 61, an A-side boot image storage area 62, a B-side boot image storage area 63, a common area 64, a spare area 65, a check area 66, a first program storage area 70, and a second program storage area 75. Here, as an example, the use of the data storage unit 213 by the central ECU 2 will be described. The use of the data storage unit 52a by the first zone ECU 20a, the use of the data storage unit 52b by the second zone ECU 20b, and the use of the data storage unit 52c by the ECU 30d are executed in the same manner as the use of the data storage unit 213. The use of the data storage unit 52 by the other ECUs is also similar.

[0038] The storage area of ​​the data storage unit 213 is classified into side A and side B. Side A includes side A boot image storage area 62 and first program storage area 70. Side B includes side B boot image storage area 63 and second program storage area 75. Boot sector 61, common area 64, spare area 65, and check area 66 do not belong to either side A or side B.

[0039] The memory area on side A and the memory area on side B store programs independently of each other. The central ECU 2 can execute various operations required of the central ECU 2 by using the programs stored in either the memory area on side A or side B. In other words, the central ECU 2 can execute the operations of the central ECU 2 as long as the programs are normally stored in either the side A or side B of the data storage unit 213.

[0040] When updating a program stored in the data storage unit 213, the update execution unit 212 selects either the A side or the B side. As an example, a case where the update execution unit 212 selects the A side and updates the program will be described. In this example, the update execution unit 212 executes a process of writing a new program to the program storage first area 70, and then executes a process of confirming that the program has been written normally. Here, if writing the program to the program storage first area 70 fails, the update execution unit 212 needs to redo the program update. The central ECU 2 cannot execute the program written in the program storage first area 70 to control the vehicle V until the update of the program in the program storage first area 70 is completed normally. However, the central ECU 2 can control the vehicle V by executing the program stored in the program storage second area 75. The same is true when the update execution unit 212 selects the B side. In this way, when the data storage unit 213 updates the program on either the A side or the B side, an executable program is stored in the other side, so that the success or failure of the program update does not have a significant effect on the control of the vehicle V. Therefore, the constraints on the timing of updating the program are relaxed, and it is not impossible to update the program while the vehicle V is running, for example.

[0041] The boot sector 61 stores a boot loader. The boot loader is a program that is executed first by the processor of the central ECU 2 when the central ECU 2 starts up. The processor executes the boot loader to execute processes required for basic operations of the central ECU 2. The boot sector 61 stores active program designation data 61a. The active program designation data 61a is included in the boot loader or is stored in an area referenced by the boot loader. The active program designation data 61a is data that designates whether the program executed by the central ECU 2 following the boot loader is an A-side program or a B-side program. Specifically, the active program designation data 61a is the address of a boot image stored in the A-side boot image storage area 62 or the address of a boot image stored in the B-side boot image storage area 63.

[0042] The boot image is a basic control program that the processor of the central ECU 2 executes following the boot loader. The A-side boot image storage area 62 stores a boot image used when executing a program stored in the program storage first area 70. The A-side boot image storage area 62 stores a start address 62a. The start address 62a is, for example, the start address of a program stored in the A-side program area 71 included in the program storage first area 70. The B-side boot image storage area 63 stores a boot image used when executing a program stored in the program storage second area 75. The B-side boot image storage area 63 stores a start address 63a. The start address 63a is, for example, the start address of a program stored in the B-side program area 76 included in the program storage second area 75.

[0043] The program storage first area 70 includes an A side program area 71, a spare area 72, an A side user area 73, and a spare area 74. The A side program area 71 and the A side user area 73 store programs.

[0044] The A-side program area 71 and the A-side user area 73 are areas for storing programs for the ECU to control the vehicle V. The A-side user area 73 may store programs executed by the ECU that are not directly related to the control of the vehicle V.

[0045] The reserve area 72 is used to expand the storage capacity of the A side program area 71. In a process in which the update execution unit 212 stores a program in the A side program area 71, if the storage capacity of the A side program area 71 is insufficient, the reserve area 72 becomes an expansion area for the A side program area 71. In this case, the update execution unit 212 stores programs in the A side program area 71 and the reserve area 72. The reserve area 74 is used to expand the storage capacity of the A side user area 73. In a process in which the update execution unit 212 stores a program in the A side user area 73, if the storage capacity of the A side user area 73 is insufficient, the reserve area 74 becomes an expansion area for the A side user area 73. In this case, the update execution unit 212 stores programs in the A side user area 73 and the reserve area 74. The reserve areas 72 and 74 correspond to an example of a first program reserve storage area.

[0046] The program storage second area 75 includes a B side program area 76, a spare area 77, a B side user area 78, and a spare area 79. The B side program area 76 and the B side user area 78 store programs.

[0047] The B-side program area 76 and the B-side user area 78 are areas for storing programs for the ECU to control the vehicle V. The B-side user area 78 may store programs executed by the ECU that are not directly related to the control of the vehicle V.

[0048] The reserve area 77 is used to expand the storage capacity of the B side program area 76. In a process in which the update execution unit 212 stores a program in the B side program area 76, if the storage capacity of the B side program area 76 is insufficient, the reserve area 77 becomes an expansion area of ​​the B side program area 76. In this case, the update execution unit 212 stores programs in the B side program area 76 and the reserve area 77. The reserve area 79 is used to expand the storage capacity of the B side user area 78. In a process in which the update execution unit 212 stores a program in the B side user area 78, if the storage capacity of the B side user area 78 is insufficient, the reserve area 79 becomes an expansion area of ​​the B side user area 78. In this case, the update execution unit 212 stores programs in the B side user area 78 and the reserve area 79. The reserve areas 77 and 79 correspond to an example of a first program reserve storage area.

[0049] The common area 64 is a storage area for storing programs that are not involved in the control of the vehicle V. The spare area 65 is used to expand the storage capacity of the common area 64. In the process in which the update execution unit 212 stores a program in the common area 64, common area 64 When the storage capacity of the common area 64 is insufficient, the spare area 65 becomes an extension area of ​​the common area 64. The check area 66 stores data for detecting errors in the programs stored in the data storage unit 213. The spare area 65 corresponds to an example of a third program spare storage area.

[0050] The programs stored in the A-side program area 71, the A-side user area 73, the B-side program area 76, and the B-side user area 78 are programs for controlling the vehicle V. These are called vehicle control programs. The vehicle control programs are involved in control of the running of the vehicle V and control essential for the running of the vehicle V. The subjects that execute the vehicle control programs are the central ECU 2, the first zone ECU 20a, the second zone ECU 20b, the ECU 30d, and other ECUs, which correspond to an example of a control unit. For example, a program for the central ECU 2 to execute the operations described with reference to Figs. 5 to 9 is included in the vehicle control program. Therefore, the data storage unit 213 corresponds to an example of a recording medium of the present invention. Among the programs that the control system 1 downloads from the server 110, the program and data for updating the vehicle control program are called vehicle control update programs. The control system 1 having a configuration that stores these programs corresponds to an example of a program management device.

[0051] The programs stored in the common area 64 are called non-involved programs. The non-involved programs are not involved in the control related to the running of the vehicle V and the control essential for the running of the vehicle V among the processes executed by the control system 1. Of the programs that the control system 1 downloads from the server 110, the programs and data for updating the non-participant programs are called non-controlled update programs.

[0052] Here, the control related to the traveling of the vehicle V includes control related to the acceleration, deceleration, stopping, and steering of the vehicle V. For example, the control related to the traveling of the vehicle V includes controlling the vehicle V based on an operation performed by a user to steer or drive the vehicle V. The control related to the traveling of the vehicle V also includes control executed by the ADAS function or the PKS function without being based on the user's operation. The control essential for the traveling of the vehicle V also includes control for operating the auxiliary equipment necessary for the traveling of the vehicle V. The auxiliary equipment includes, for example, the meter panel, the lamps of the vehicle V, wipers, window washers, air conditioning equipment, etc. The control essential for the traveling of the vehicle V includes controlling a camera or a radar device to execute the ADAS function or the PKS function.

[0053] The non-participant programs stored in the common area 64 include, for example, programs related to the infotainment function provided by the control system 1. The programs related to the infotainment function refer to, for example, application programs related to entertainment. Specifically, the infotainment functions include music playback, receiving and listening to radio broadcasts, sending and receiving e-mail, receiving and watching television broadcasts, information search using a network such as the Internet, playing video games, and other entertainment-related functions. In addition, for example, the non-participant programs include a program related to a function of placing an order or making a reservation with an external service provider by communicating with a server outside the vehicle V based on the operation of a touch panel mounted on the vehicle V. The external service provider is, for example, a provider that provides sales of goods including food and beverages, delivery of goods including food and beverages, car wash services, cleaning services, ticket sales or ticket reservation services, and other services.

[0054] The programs stored in the A-side user area 73 and the B-side user area 78 are programs that are installed in accordance with instructions from a user who is in the vehicle V. For example, when the user operates the touch panel to specify a program that he or she wishes to install and issues an instruction to install the specified program, the update data receiving unit 202 downloads the specified program from the server 110. The update data control unit 203 transfers the program downloaded by the update data receiving unit 202 to the ECU equipped with the program that executes the program. A The data is stored in the A side user area 73 or the B side user area 78.

[0055] The programs stored in the A-side user area 73 and the B-side user area 78 are particularly programs designated by the manufacturer of the vehicle V or the seller of the vehicle V. This type of program is, for example, a program that has been officially approved or reviewed for installation in the vehicle V by the manufacturer of the vehicle V or the seller of the vehicle V.

[0056] The programs stored in the A side user area 73 and the B side user area 78 may include non-involved programs. That is, the A side user area 73 and the B side user area 78 store, among the vehicle control programs and non-involved programs, those programs designated by the manufacturer of the vehicle V or the seller of the vehicle V. On the other hand, programs not designated by the manufacturer of the vehicle V or the seller of the vehicle V are not stored in the A side user area 73 and the B side user area 78. Such programs are called third-party programs. Third-party programs are stored in the common area 64. The common area 64 can be said to be an area for storing third-party non-involved programs.

[0057] FIG. 5 is a sequence diagram showing the operation of the program management system 100. As shown in FIG. Steps SA11 to SA20 show the operation of the control system 1, and steps SB11 to SB14 show the operation of the server 110. Figures 6, 7, 8 and 9 are flowcharts showing in detail the operation of the control system 1 in step SA20 in Figure 5. 5 to 9 show processes related to the operation of the control system 1 for updating a program.

[0058] In Fig. 5, steps SA11 to SA19 are executed by the update data receiving unit 202. The control system 1 acquires vehicle information of the vehicle V (step SA11). The vehicle information is information that enables the server 110 to identify the type of program and the version of the program that are compatible with the control system 1. The vehicle information includes, for example, the vehicle identification number of the vehicle V, the type of ECU that the control system 1 has, and the version of the program installed in the ECU. The control system 1 acquires information that the control system 1 has and information that an ECU connected to the control system 1 has, and compiles the information into a single set of vehicle information.

[0059] The control system 1 requests the server 110 for program update information (step SA12). The program update information is information related to programs already stored in the control system 1. In detail, the program update information includes the names and versions of programs that can be updated among the programs already stored in the control system 1. 、 The program update information may include information about programs that are usable by the control system 1 but are not stored in the control system 1. In this case, the program update information includes information indicating the names of programs usable by the control system 1 and an overview of the programs. In step SA12, when requesting the program update information, the control system 1 transmits the vehicle information acquired in step SA11 to the server 110. The request for the program update information and the vehicle information of the vehicle V are received by the server 110.

[0060] The server 110 searches a database (not shown) for a program corresponding to the vehicle V based on the request transmitted by the control system 1 and the vehicle information of the vehicle V (step SB11). In this database, the server 110 stores programs corresponding to a plurality of vehicles including the vehicle V. This database may be provided in the server 110, or may be a database server connected to the server 110 via the communication network N.

[0061] The server 110 generates program update information based on the results of searching the database (step SB 12 ), and transmits the program update information to the control system 1 (step SB 13 ). This program update information is received by the control system 1.

[0062] The control system 1 updates the receivable list based on the program update information received from the server 110 (step SA13). The receivable list is a list of programs that the control system 1 can download from the server 110. The receivable list is a list including updatable programs among programs already stored in the control system 1, and programs that can be used by the control system 1 but are not stored in the control system 1. The receivable list includes the name of the program and the type or overview of the program.

[0063] The control system 1 and the server 110 repeatedly execute the operations of steps SA11 to SA13 and steps SB11 to SB13 at a preset cycle. This allows the control system 1 to maintain a state in which it holds the latest receivable list related to the programs corresponding to the vehicle V.

[0064] A program update in the control system 1 is started by a user operating a touch panel or the like. When a user performs an operation related to a program update, the control system 1 accepts the user's operation (step SA14). In response to the user's operation, the control system 1 displays a receivable list, for example, on a display mounted on the vehicle V (step SA15). The control system 1 then determines whether or not the user has instructed to download a program (step SA16). The user selects a program to be downloaded, for example, by operating a touch panel, and instructs to download the selected program. While a program download is not instructed (step SA16; NO), the control system 1 waits in step SA16.

[0065] If a command to download a program is issued (step SA16; YES), the control system 1 identifies a program to be downloaded based on the user's command (step SA17). The control system 1 requests the server 110 to download the identified program (step SA18). The download request from the control system 1 is received by the server 110.

[0066] The server 110 transmits the program requested by the control system 1 to the control system 1 (step SB14). The program transmitted by the server 110 includes at least one of a vehicle control update program for updating or newly installing the vehicle control program and a non-control update program for updating or newly installing the non-involved program. The control system 1 downloads the program transmitted by the server 110 (step SA19). Then, the control system 1 executes an installation process (step SA20). The installation process includes storing the program downloaded in step SA19 in the data storage unit 52 or the data storage unit 213. The installation process also includes a process of making the vehicle control program and / or the non-involved program executable by the ECU by executing the vehicle control update program and / or the non-control update program. After the installation, the program is stored in the data storage unit 52 or the data storage unit 213 in a state executable by the ECU.

[0067] Details of the installation process are shown in Figures 6 and 7. In Figures 6 and 7, a first process and a second process described below are executed by the update execution unit 212 or the update execution unit 51, and other operations are executed by the update data control unit 203. In the following explanation, an example will be given in which the update execution unit 212 executes the first process and the second process, but the update execution unit 51 can also execute similar operations.

[0068] The update data control unit 203 determines whether or not there are multiple programs to be installed in the control system 1 (step SA31). For example, if there are multiple programs downloaded in step SA19, the update data control unit 203 determines that there are multiple programs to be installed (step SA31; YES). In this case, the update data control unit 203 proceeds to step SA51, which will be described later.

[0069] When it is determined that there is one program to be installed (step SA31; NO), the update data control unit 203 determines whether the program to be installed is a non-controlled update program (step SA32). When the program to be installed is not a non-controlled update program (step SA32; NO), the update data control unit 203 specifies the ECU to which the program is to be installed (step SA33). In step SA33, the update data control unit 203 selects an ECU to which the program is to be installed from among the central ECU 2, the first zone ECU 20a, the second zone ECU 20b, the ECU 30d, and other ECUs. Then, the ECU specified by the update data control unit 203 executes a first process (step SA34) to install the vehicle control update program. Details of the first process will be described later with reference to FIG. 8. After executing the first process, the control system 1 ends this process.

[0070] On the other hand, if the program to be installed is a non-controlled update program (step SA32; YES), the update data control unit 203 identifies the ECU in which the program is to be installed (step SA35). The operation of step SA35 is the same as that of step SA33. The update data control unit 203 transitions to a standby state waiting for the second process to be performed by the ECU identified in step SA35 (step SA36). The second process is a process in which the update execution unit 212 or the update execution unit 51 installs a non-controlled update program. In the standby state, the update data control unit 203 determines whether an operation has been performed to put the vehicle V into an ignition-off (IG_OFF) state (step SA37).

[0071] The ignition off state of the vehicle V refers to a state in which the driving source 25b of the vehicle V is stopped. For example, if the driving source 25b includes an internal combustion engine, the ignition off state refers to a state in which the internal combustion engine stops operating. Also, for example, if the driving source 25b includes a motor, the ignition off state refers to a state in which the power supply to the motor is stopped and the control of the driving state of the motor is stopped. The ignition off state can be rephrased as a power off state.

[0072] In contrast, the ignition on state is a state other than the ignition off state, and refers to a state in which the drive source 25b of the vehicle V is operating or operable. For example, if the drive source 25b includes an internal combustion engine, the ignition on state refers to a state in which the internal combustion engine is operating. Also, for example, if the drive source 25b includes a motor, the ignition on state refers to a state in which power is being supplied to the motor or the drive state of the motor is being controlled. The operations in Figures 5, 6, and 7 are started when the vehicle V is in the ignition on state. The operation of putting the vehicle V into the ignition off state when the ignition is on, and the operation of putting the vehicle V into the ignition on state when the ignition is off, are, for example, the operation of the SSSW 27a by the user. The ignition on state can be rephrased as a power on state.

[0073] If an operation to turn off the ignition of the vehicle V is not performed (step SA37; NO), the update data control unit 203 waits. If an operation to turn off the ignition of the vehicle V is performed (step SA37; YES), the update data control unit 203 executes a notification to the user (step SA38). The notification in step SA38 informs the user that the ignition of the vehicle V will not be turned on until the installation of the program is complete. In step SA38, the update data control unit 203 performs the notification, for example, by displaying text or images on a display mounted on the vehicle V. Alternatively, in step SA38, the update data control unit 203 may perform the notification by outputting sound from a speaker mounted on the vehicle V.

[0074] After the notification, the update data control unit 203 judges whether or not an operation to turn the vehicle V into an ignition-off state has been performed (step SA39). If an operation to turn the vehicle V into an ignition-off state has not been performed (step SA39; NO), the update data control unit 203 waits. If an operation to turn the vehicle V into an ignition-off state has been performed (step SA39; YES), the update data control unit 203 sets an ignition-on (IG_ON) restriction (step SA40). The ignition-on restriction is a restriction that prevents the vehicle V from being in an ignition-on state until the second processing is completed. When the central ECU 2 sets the ignition-on restriction, the control system 1 maintains the ignition-off state even if the SSSW 27a is operated. When the ignition-on restriction is not set, the control system 1 transitions to an ignition-on state when the SSSW 27a is operated in the ignition-off state.

[0075] Next, the second process (step SA41) is executed by the ECU identified by the update data control unit 203 in step SA35 to install the non-controlled update program. Details of the second process will be described later with reference to FIG. 9. After the second process is completed, the update data control unit 203 releases the ignition-on restriction (step SA42). Based on the operation of the SSSW 27a, the update data control unit 203 determines whether the vehicle V has transitioned to an ignition-on state under the control of the first zone ECU 20a (step SA43). If the vehicle V has not transitioned to an ignition-on state (step SA43; NO), the update data control unit 203 waits. If the vehicle V has transitioned to an ignition-on state (step SA43; YES), the update data control unit 203 ends this process.

[0076] Furthermore, if it is determined that there are multiple programs to be installed (step SA31; YES), the update data control unit 203 determines whether or not the programs to be installed include a non-controlled update program (step SA51). If the programs to be installed do not include a non-controlled update program (step SA51; NO), the update data control unit 203 selects one vehicle control update program to be processed from the one or more vehicle control update programs to be installed (step SA52). The update data control unit 203 identifies the ECU to which the program selected in step SA52 is to be installed (step SA 53 ). The process of step SA54 is the same as that of step SA33. Next, a first process (step SA54) for installing the vehicle control update program is executed by the ECU identified by the update data control unit 203. The first process is the same as that of step SA34, and its details will be described later with reference to FIG. 8. After execution of the first process, the update data control unit 203 judges whether or not the installation of all downloaded programs has been completed (step SA55). If it is judged that the installation of all programs has been completed (step SA55; YES), the control system 1 ends this process. If it is judged that there is a program that has not yet been installed (step SA55; NO), the update data control unit 203 returns to step SA52.

[0077] Furthermore, if the program to be installed includes an uncontrolled update program (step SA51; YES), the update data control unit 203 transitions to a standby state in which it waits for a second process (step SA56). The second process is a process in which the update execution unit 212 or the update execution unit 51 installs an uncontrolled update program. In the standby state, the update data control unit 203 determines whether or not an operation has been performed to put the vehicle V into an ignition off state (step SA57).

[0078] If the operation to turn off the ignition of the vehicle V is not performed (step SA57; NO), the update data control unit 203 waits. If the operation to turn off the ignition of the vehicle V is performed (step SA57; YES), the update data control unit 203 executes a notification to the user (step SA58). The notification in step SA58 is the same as in step SA38.

[0079] After making the notification, the update data control unit 203 determines whether or not an operation to turn off the ignition of the vehicle V has been performed (step SA59). If an operation to turn off the ignition of the vehicle V has not been performed (step SA59; NO), the update data control unit 203 waits. If an operation to turn off the ignition of the vehicle V has been performed (step SA59; YES), the update data control unit 203 sets an ignition-on restriction (step SA60).

[0080] The update data control unit 203 selects one program to be processed from among one or more uncontrolled update programs to be installed (step SA61). The update data control unit 203 identifies an ECU to which the selected uncontrolled update program is to be installed (step SA62). The process of step SA62 is similar to that of step SA35. Then, a second process (step SA63) for installing the uncontrolled update program is executed by the ECU identified by the update data control unit 203. The second process is the same as that of step SA41, and its details will be described later with reference to FIG. 9.

[0081] After the second process, the update data control unit 203 determines whether or not installation of all downloaded uncontrolled update programs is complete (step SA64). If there are uncontrolled update programs that have not yet been installed, the update data control unit 203 determines that installation of all uncontrolled update programs is not complete (step SA64; NO). In this case, the update data control unit 203 returns to step SA61.

[0082] When it is determined that the installation of all non-controlled update programs is completed (step SA64; YES), the update data control unit 203 releases the ignition-on restriction (step SA65). Based on the operation of the SSSW 27a, the update data control unit 203 determines whether the vehicle V has transitioned to the ignition-on state under the control of the first zone ECU 20a (step SA66). When the vehicle V has not transitioned to the ignition-on state (step SA66; NO), the update data control unit 203 waits. When the vehicle V has transitioned to the ignition-on state (step SA66; YES), the update data control unit 203 starts the installation of the vehicle control update program.

[0083] The update data control unit 203 selects one vehicle control update program to be processed from among one or more vehicle control update programs to be installed (step SA67). The update data control unit 203 identifies an ECU to which the program selected in step SA67 is to be installed (step SA68). The process of step SA68 is the same as that of step SA33. Then, a first process (step SA69) for installing the vehicle control update program is executed by the ECU identified by the update data control unit 203. The first process is the same as that of step SA34. After executing the first process, the update data control unit 203 determines whether or not the installation of all the downloaded vehicle control update programs is completed (step SA70). If it is determined that the installation of all the vehicle control update programs is completed (step SA70; YES), the control system 1 ends this process. If it is determined that there is a vehicle control update program that has not yet been installed (step SA70; NO), the update data control unit 203 returns to step SA67.

[0084] In the processes of FIGS. 6 and 7, if there are multiple programs to be installed and the vehicle control update program is not included therein, the update execution unit 212 skips steps SA67 to SA70 after executing step SA66.

[0085] 8 is a flowchart showing details of the first process. The first process is executed by the update execution section 212 and the update execution section 51, and here, an example in which the update execution section 212 executes the process will be described.

[0086] The update execution unit 212 selects an area into which the vehicle control update program is to be installed from among the program storage first area 70 and the program storage second area 75 (step SA101). In step SA101, the update execution unit 212 selects either the A side or the B side of the data storage unit 213. Furthermore, the update execution unit 212 selects either the program area or the user area. That is, in step SA101, the update execution unit 212 selects one of the A side program area 71, the A side user area 73, the B side program area 76, and the B side user area 78.

[0087] In step SA101, the update execution unit 212 first selects either the first program storage area 70 or the second program storage area 75. If the update execution unit 212 selects the first program storage area 70, it further selects either the A-side program area 71 or the A-side user area 73 based on the type of program to be installed. If the update execution unit 212 selects the B-side program area 76, it further selects either the B-side program area 76 or the B-side user area 78 based on the type of program to be installed.

[0088] In step SA101, when the program stored in the first program storage area 70 and the program stored in the second program storage area 75 are the same, the update execution unit 212 selects either side A or side B according to a preset setting. This operation is performed when the first program storage area 70 and the second program storage area 75 store the same version of the same program and both programs are normal. When there is a problem with the program stored in either the first program storage area 70 or the second program storage area 75, the update execution unit 212 selects the area storing the problematic program in step SA101. In addition, when the program stored in the first program storage area 70 and the program stored in the second program storage area 75 are different versions, the update execution unit 212 selects the area storing the old version of the program in step SA101.

[0089] Update execution unit 212 compares the storage capacity of the area selected in step SA101 with the size of the vehicle control update program to be installed (step SA102). The storage capacity of the area selected in step SA101 is, for example, the total storage capacity of the area that can be overwritten in the selected area and the free space in the selected area. The size of the program is, for example, the data amount of the program, or the storage capacity that the program occupies when stored in data storage unit 213.

[0090] The update execution unit 212 judges whether or not the storage capacity is insufficient based on the result of the comparison in step SA102 (step SA103). If the storage capacity of the area selected in step SA101 is not insufficient (step SA103; NO), the update execution unit 212 proceeds to step SA107 described later.

[0091] When it is determined that the storage capacity of the area selected in step SA101 is insufficient (step SA103; YES), update execution unit 212 uses a spare area corresponding to the selected area to expand the storage capacity of the area selected in step SA101 (step SA104). For example, when update execution unit 212 selects A side program area 71 in step SA101, it expands the storage capacity of A side program area 71 by determining to use spare area 72 for installing the vehicle control update program.

[0092] The update execution unit 212 compares the area after the storage capacity is expanded in step SA104 with the size of the program, and determines whether the storage capacity is insufficient (step SA105). If the storage capacity is not insufficient (step SA105; NO), the update execution unit 212 proceeds to step SA107, which will be described later.

[0093] When it is determined that the storage capacity is insufficient (step SA105; YES), the update execution unit 212 divides the common area 64 and expands the program storage first area 70 and the program storage second area 75 by using the divided areas (step SA106). In step SA106, the update execution unit 212 divides the common area 64 into two divided areas. The update execution unit 212 sets one of the two divided areas as an expansion area for expanding the A-side program area 71 or the A-side user area 73 of the program storage first area 70. In addition, the update execution unit 212 sets one of the two divided areas as an expansion area for expanding the B-side program area 76 or the B-side user area 78 of the program storage second area 75. Furthermore, the update execution unit 212 expands the area selected in step SA101 by using one of the divided areas divided in step SA106. As a result, the storage capacity of the area in which the program is installed is expanded by using the reserve area and the expansion area. After that, the update execution section 212 proceeds to step SA107.

[0094] In step SA107, the update execution unit 212 executes installation of the program (step SA107). Specifically, the update execution unit 212 stores the program in the area selected in step SA101 or in the entire area obtained by expanding the selected area.

[0095] Next, the update execution unit 212 performs a process to confirm that the installation has been completed normally (step SA108). In step SA108, the update execution unit 212 confirms that the installed program is in a state in which it can be executed normally by the central ECU 2. For example, the update execution unit 212 confirms the identity of the program and data written in the data storage unit 213 by calculating and comparing a hash value. In step SA108, the update execution unit 212 may update the error detection data stored in the check area 66.

[0096] The update execution unit 212 executes activation of the installed program (step SA109). Activation is a process of setting the control system 1 to execute the installed program. For example, the update execution unit 212 rewrites the active program designation data 61a in step SA109. The update execution unit 212 rewrites the active program designation data 61a so that the latest vehicle control program written in the data storage unit 213 by the processes of steps SA101-SA107 is executed by the central ECU 2. Specifically, the active program designation data 61a is rewritten to content that designates the side selected in step SA101 out of the A side and the B side of the data storage unit 213.

[0097] 9 is a flowchart showing details of the second process. The second process is executed by the update execution section 212 and the update execution section 51, and here, an example in which the update execution section 212 executes the process will be described.

[0098] The area into which the update execution unit 212 installs the uncontrolled update program is the common area 64. The update execution unit 212 compares the storage capacity of the common area 64 with the size of the uncontrolled update program to be installed (step SA111). The storage capacity of the common area 64 is, for example, the total storage capacity of the area that can be overwritten in the common area 64 and the free space in the common area 64. The size of the uncontrolled update program is, for example, the data amount of the uncontrolled update program, or the storage capacity that the uncontrolled update program will occupy if stored in the data storage unit 213.

[0099] The update execution unit 212 judges whether or not the storage capacity is insufficient based on the result of the comparison in step SA111 (step SA112). If the storage capacity is not insufficient (step SA112; NO), the update execution unit 212 proceeds to step SA114 described later.

[0100] If it is determined that the storage capacity of the shared area 64 is insufficient (step SA112; YES), the update execution unit 212 uses the reserve area 65 to expand the storage capacity of the shared area 64 (step SA113).

[0101] In step SA114, the update execution section 212 executes the installation of the uncontrolled update program (step SA114). Specifically, the update execution section 212 stores the uncontrolled update program in the shared area 64.

[0102] Next, the update execution unit 212 performs a process to confirm that the installation has been completed normally (step SA115). In step SA115, the update execution unit 212 confirms that the installed uncontrolled update program is in a state in which it can be executed normally by the central ECU 2. For example, the update execution unit 212 confirms the identity of the uncontrolled update program and data written to the data storage unit 213 by calculating and comparing a hash value. In step SA115, the update execution unit 212 may update the error detection data stored in the check area 66.

[0103] The update execution unit 212 executes activation of the installed program (step SA116). Activation is a process for setting the uncontrolled update program installed by the control system 1 so as to be executed.

[0104] FIG. 10 shows an example of the transition of the state of the vehicle V when the operations shown in FIGS. 5 to 9 are performed. Ta 10 is a timing chart. In the timing chart of FIG. 10, symbol (a) indicates the operation state of the SSSW 27a. Symbol (b) indicates the OTA execution state. OTA refers to the operation of the control system 1 to download and install an uncontrolled update program. Symbol (c) indicates the power supply state of the vehicle V. Symbol (d) indicates the control state of the vehicle V. In the diagram, symbol T indicates time, and the horizontal axis corresponds to the passage of time.

[0105] Time T0 is the time point when the control system 1 starts downloading the uncontrolled update program. While the control system 1 is downloading the uncontrolled update program, the ignition of the vehicle V is on. The vehicle V may be running or may be stopped.

[0106] When the download is completed at time T1, the control system 1 waits for the ignition to be turned off. Here, when the user operates the SSSW 27a at time T2-T3, the control system 1 executes a notification in response to this operation. The operation of the SSSW 27a includes the user pressing the SSSW 27a and the user stopping pressing the SSSW 27a. Therefore, the control system 1 detects the completion of the operation of the SSSW 27a when the user stops pressing the SSSW 27a at time T3. Since the SSSW 27a is an operation to stop the functions of the vehicle V, the vehicle V is stopped at time T2.

[0107] The notification by the control system 1 corresponds to the processing of steps SA38 and SA58. After issuing the notification, the control system 1 waits for a further operation of the SSSW 27a.

[0108] When the user operates the SSSW 27a at time T4-T5, the completion of the operation of the SSSW 27a triggers the transition of the vehicle V to an ignition-off state. After the transition to the ignition-off state at time T5, the control system 1 starts the ECU in the ignition-off state. Time T6 at which the ECU starts may be slightly later than time T5. The control system 1 may transition the vehicle V to the ignition-off state at time T5 while keeping the ECU in the started state.

[0109] After the ECU is started at time T6, the control system 1 sets an ignition-on restriction. Therefore, after time T6, the vehicle V is unable to run. This state is shown as a vehicle load state in FIG.

[0110] From time T6, the control system 1 executes the installation of the uncontrolled update program. After the installation of the uncontrolled update program, the control system 1 executes activation from time T7. After the activation is completed, the control system 1 waits for the operation of the SSSW 27a. When the SSSW 27a is operated at time T8-T9, the control system 1 transitions to an ignition-on state. By entering the ignition-on state, the vehicle V is able to travel. The vehicle V may travel or may remain stopped.

[0111] There is no limit to the length of time T6-T8. For example, the user may operate the SSSW 27a at time T5 and then get off the vehicle V. In this case, the user may operate the SSSW 27a after a long time has passed since time T5.

[0112] In FIG. 6, FIG. 7, and FIG. 10, an example was described in which the trigger for the control system 1 to give a notification is the operation of the SSSW 27a. Specifically, an example was described in which the control system 1 determines whether or not the SSSW 27a has been operated in steps SA37 and SA57, and gives a notification in steps SA38 and SA58 when the SSSW 27a has been operated. This is an example, and the trigger for giving a notification is not limited to the operation of the SSSW 27a. For example, the trigger for the control system 1 to give a notification may be an alighting preparation operation. The alighting preparation operation is an operation that causes the user to estimate that he or she will alight from the vehicle V. For example, the alighting preparation operation is the operation of the shift SW 27b to enter the P position, the operation of the parking brake, and the opening and closing of the door. In this case, the control system 1 determines whether or not the alighting preparation operation has been performed in steps SA37 and SA57, and executes the notification in steps SA38 and SA58 when the alighting preparation operation has been performed. In this case, the operations at times T2 to T3 in FIG. 10 are omitted.

[0113] The above embodiment shows a specific example to which the present invention is applied, and does not limit the form to which the invention is applied.

[0114] In the above embodiment, the control system 1 installs the non-controlled update program in the common area 64 among the programs downloaded from the server 110. This is just one example, and the control system 1 may install the non-controlled update program in the common area 64 by installing ... do not have The control system 1 may be configured to distinguish between a program downloaded based on the operation of a borrowing user and a program downloaded based on the operation of a user who is the owner or user of the vehicle V. The control system 1 stores the vehicle control update program downloaded based on the operation of the borrowing user in the first program storage area 70 or the second program storage area 75. The control system 1 installs the program downloaded based on the operation of the borrowing user in the common area 64, regardless of whether it is a vehicle control update program or a non-controlled update program. The owner or user corresponds to an example of a first user. The borrowing user corresponds to an example of a second user.

[0115] Furthermore, the control system 1 installs the uncontrolled update program downloaded based on the operation of the user who is the owner or user of the vehicle V, in the common area 64. The control system 1 installs the uncontrolled update program downloaded based on the operation of the borrowing user, in a visitor common area provided in the common area 64. In other words, a visitor common area is formed by utilizing a part of the common area 64. The uncontrolled update program downloaded based on the operation of the user who is the owner or user of the vehicle V is installed in an area of ​​the common area 64 other than the visitor common area.

[0116] In this case, the control system 1 is configured to be able to determine whether the user operating the vehicle V is the owner or user of the vehicle V. For example, the control system 1 can register the owner or user of the vehicle V in advance, and can execute a process to determine whether the user operating the vehicle V is the registered owner or user. A borrowing user refers to a user who does not fall under either the owner or user registered for the vehicle V. For example, a borrowing user is a user who borrows the vehicle V from the owner or user of the vehicle V. When the vehicle V is used for car sharing between individuals, the car sharing user corresponds to the borrowing user.

[0117] The operation of the control system 1 in this case will be described as a modified example. Figures 11 and 12 are flowcharts showing the operation of the control system 1 in the modified example. Figure 11 shows a first process, and Figure 12 shows a second process. In Figure 11, processes common to Figure 8 are given the same step numbers as in Figure 8, and descriptions thereof will be omitted. Also, in Figure 12, processes common to Figure 9 are given the same step numbers as in Figure 9, and descriptions thereof will be omitted.

[0118] In the first process shown in FIG. 11, the update execution unit 212 determines whether the vehicle control update program to be installed is a program downloaded in response to an operation by a user who is the owner or user of the vehicle V (step SA131). Here, the operation is, for example, an operation on a touch panel mounted on the vehicle V. If the vehicle control update program is downloaded in response to an operation by a user who is the owner or user of the vehicle V (step SA131; YES), the update execution unit 212 proceeds to step SA101. On the other hand, if the vehicle control update program is downloaded in response to an operation by a borrowing user (step SA131; NO), the update execution unit 212 sets the area to be installed to the common area 64, and proceeds to step SA107.

[0119] 12, the update execution unit 212 determines whether the uncontrolled update program to be downloaded is a program downloaded in response to an operation of a user who is the owner or user of the vehicle V (step SA141). If it is an uncontrolled update program downloaded in response to an operation of a user who is the owner or user of the vehicle V (step SA141; YES), the update execution unit 212 proceeds to step SA142. In step SA142, the update execution unit 212 selects an area in the common area 64 other than the visitor common area, i.e., the owner memory area, as the area to install. After that, the update execution unit 212 proceeds to step SA111.

[0120] On the other hand, if the program is an uncontrolled update program downloaded in response to the operation of the borrowing user (step SA141; NO), the update execution unit 212 sets the area to be installed to the visitor common area provided in the common area 64 (step SA143). After that, the update execution unit 212 proceeds to step SA114.

[0121] In this modification, a program installed at the will of the owner or user of the vehicle V and a program installed at the will of the borrowing user are installed in different storage areas in the data storage unit 213. Therefore, the programs can be distinguished depending on whether the user who instructed the installation is the owner or user. For example, it is possible to delete a program or restrict the execution of a program only for a program installed at the will of the borrowing user. In addition, for example, it is possible to assign a spare area to a storage area that stores a program installed at the will of the owner or user of the vehicle V. Therefore, a program installed by a borrowing user in a vehicle V lent for car sharing between individuals can be managed at the will of the owner or user of the vehicle V.

[0122] In the above embodiment and modified example, a configuration has been described in which a vehicle control update program or a non-controlled update program is downloaded from server 110 to control system 1 by a user operating a touch panel or the like. This is just one example, and, for example, a configuration may be adopted in which control system 1 downloads a vehicle control update program from server 110 without the need for user operation. Also, a configuration may be adopted in which control system 1 downloads a non-controlled update program from server 110 without the need for user operation. In these cases, control system 1 may be configured to install the downloaded vehicle control update program and / or non-controlled update program based on a user operation. Also, control system 1 may install the vehicle control update program without a user operation.

[0123] In the above embodiment and modified example, an example has been described in which the control system 1 operates as a program management device. In detail, the control system 1 includes data storage units 52, 213 that store the vehicle control program and the non-involved program, and manages updates to the vehicle control program and the non-involved program. This is just one example, and for example, the program management device may be configured as a part of the control system 1, or an external device connected to the control system 1 may function as the program management device.

[0124] Furthermore, the configuration of the control system 1 shown in the above embodiment is just an example, and the type of ECU included in the control system 1, the number of ECUs, and the configuration of the devices controlled by the ECUs can be modified in various ways.

[0125] 1 and 3 are diagrams showing the schematic configuration of the functional configuration of each device in the program management system 100, divided according to the main processing content, in order to facilitate understanding of the present invention, and are not intended to limit the configuration of the devices. Each process shown in Figs. 5 to 9 and Figs. 11 to 12 may be executed by one program or multiple programs.

[0126] The above embodiment supports the following configurations.

[0127] (Configuration 1) A program management device comprising: a communication unit that communicates with an external device outside a vehicle; a control unit that executes a vehicle control program for controlling the vehicle; a first program storage area that stores the vehicle control program; a second program storage area that stores the vehicle control program; a third program storage area that stores a non-involved program for performing control not involved in driving the vehicle; and a program update unit that executes a first process of storing a vehicle control update program received by the communication unit and used to update the vehicle control program in at least one of the first program storage area or the second program storage area, and a second process of storing a non-control update program received by the communication unit and used to update the non-involved program in the third program storage area. According to the program management device of the configuration 1, by duplicating the area for storing the vehicle control program for controlling the vehicle, the vehicle control program can be held in an area that is not affected by the update while the vehicle control program is being updated. Therefore, there is no need to limit the timing of updating the program in preparation for a problem with the program update. Therefore, the constraints on the timing of updating the program can be reduced. Also, by not duplicating the program storage third area for storing the non-controlled update program, the increase in the capacity of the storage area can be suppressed. Furthermore, by making the program storage third area an area different from the program storage first area and the program storage second area, the area for storing the vehicle control program does not run out of capacity due to the storage of the non-controlled update program. Therefore, the increase in the capacity of the storage area for storing the vehicle program can be suppressed, and a shortage of the storage area for storing the program can be avoided.

[0128] (Configuration 2) The program management device according to configuration 1, wherein the first program storage area includes a first program reserve storage area, and the second program storage area includes a second program reserve storage area. According to the program management device of configuration 2, it is possible to deal with a shortage of storage capacity of the storage area for storing the vehicle control update program.

[0129] (Configuration 3) The program management device described in Configuration 2, wherein the program update unit stores at least a portion of the vehicle control update program in the program spare memory first area or the program spare memory second area when the storage capacity of the program storage first area or the program storage second area is insufficient during the first processing. According to the program management device of configuration 3, when the storage capacity of the storage area for storing the vehicle control update program is insufficient, the vehicle control update program can be stored by using the first program spare storage area or the second program spare storage area, thereby making it possible to avoid a situation in which the vehicle control program cannot be updated due to insufficient storage capacity.

[0130] (Configuration 4) The program management device according to any one of configurations 1 to 3, wherein the third program storage area includes a third program spare storage area. According to the program management device of configuration 4, it is possible to deal with a shortage of storage capacity of the storage area for storing uncontrolled update programs.

[0131] (Configuration 5) The program management device according to Configuration 4, wherein the program update unit stores at least a portion of the uncontrolled update program in the program spare storage third area when the storage capacity of the program storage third area is insufficient during the second process. According to the program management device of configuration 5, when the storage capacity of the storage area for storing the non-controlled update program is insufficient, the non-controlled update program can be stored by utilizing the third program spare storage area. This makes it possible to avoid a situation where the non-involved program cannot be updated due to insufficient storage capacity.

[0132] (Configuration 6) A program management device described in any one of configurations 1 to 5, wherein the program update unit, when capable of executing the first process and the second process, executes the first process after the second process is completed. According to the program management device of configuration 6, by processing the non-controlled update program before the vehicle controlled update program, if a problem occurs in updating a program that uses the non-controlled update program, it is possible to prevent the vehicle control program related to the control of the vehicle from being affected.

[0133] (Configuration 7) A program management device described in any one of configurations 1 to 6, wherein the control unit is capable of setting the power supply state of the vehicle between a power on state in which the vehicle's driving source can be controlled and a power off state in which the driving source is not controlled, and when the program update unit executes the second processing, sets the power supply state not to be switched to the power on state until the second processing is completed. According to the program management device of configuration 7, the vehicle is kept in a power-off state until the second process is completed. This prevents the vehicle from executing the second program while the non-involved program is being updated by the non-controlled update program, and makes it possible to more reliably update the non-involved program.

[0134] (Configuration 8) The program management device described in Configuration 7, wherein the control unit notifies that there is a period during which the power cannot be switched to the power on state when the program update unit is in a state capable of starting the second process and the power can be switched from the power on state to the power off state. According to the program management device of configuration 8, the impact on user convenience associated with program updates can be kept to a minimum by notifying the user of a period during which the vehicle will not be usable before that period occurs.

[0135] (Configuration 9) A program management device according to any one of configurations 1 to 8, wherein the program update unit forms an extension area using the program storage third area when the storage capacity of the program storage first area or the program storage second area is insufficient during the first processing, and stores at least a portion of the vehicle control update program in the extension area. According to the program management device of configuration 9, it is possible to avoid a situation in which the vehicle control program cannot be updated due to a lack of storage capacity.

[0136] (Configuration 10) The program update unit of the program management device described in Configuration 9 divides the program memory third area into two divided areas, one of the divided areas being the extended area corresponding to the program memory first area, and the other divided area being the extended area corresponding to the program memory second area. According to the program management device of configuration 10, the storage area can be expanded so that the difference in storage capacity between the first program storage area and the second program storage area does not increase. Therefore, the storage area for storing the vehicle control program can be maintained in an appropriately duplicated state.

[0137] (Configuration 11) A program management device described in any one of configurations 1 to 10, wherein the program update unit stores the vehicle control update program received from the communication unit based on operation of a first user registered in the vehicle in the program memory first area or the program memory second area, and stores the vehicle control update program received from the communication unit based on operation of a second user different from the first user in the program memory third area. According to the program management device of configuration 11, the processing of the vehicle control update program can be made different depending on whether the download of the vehicle control update program is executed at the will of a first user or at the will of a second user. This makes it possible to perform different processing on the downloaded vehicle control update program depending on who is the user who instructed the download, and facilitates maintenance and management of the program.

[0138] (Configuration 12) The program update unit stores the uncontrolled update program received from the communication unit based on the operation of the first user and the uncontrolled update program received from the communication unit based on the operation of the second user in different memory areas in the program storage third area. According to the program management device of configuration 12, different processes can be performed on a downloaded uncontrolled update program depending on who the user who instructed the download is, making it easy to maintain and manage programs.

[0139] (Configuration 13) The program management device described in Configuration 12, wherein the program update unit stores at least a portion of the vehicle control update program in an area in the program storage third area that stores the non-control update program received by the communication unit based on the operation of the second user when the storage capacity of the program storage first area or the program storage second area is insufficient during the first processing. According to the program management device of configuration 13, a storage capacity can be allocated to a vehicle control update program downloaded based on an instruction from a registered first user, with priority given to a non-controlled update program downloaded based on an instruction from a second user. This makes it possible to more reliably download and install a vehicle control update program of higher importance.

[0140] (Configuration 14) A program management method that utilizes a program management device having a communication unit that communicates with an external device outside the vehicle and a memory unit, wherein the memory unit is provided with a first program storage area that stores a vehicle control program for controlling the vehicle, a second program storage area that stores the vehicle control program, and a third program storage area that stores a non-involved program for performing control that is not involved in driving the vehicle, and the program management method executes a first process of storing a vehicle control update program received by the communication unit and used to update the vehicle control program in at least one of the first program storage area or the second program storage area, and a second process of storing a non-control update program received by the communication unit and used to update the non-involved program in the third program storage area. According to the program management method of configuration 14, since the area for storing the vehicle control program for controlling the vehicle is duplicated, the vehicle control program can be held in an area that is not affected by the update while the vehicle control program is being updated. Therefore, there is no need to limit the timing of updating the program in preparation for a problem with the program update. Therefore, the constraints on the timing of updating the program can be reduced. Also, by not duplicating the program storage third area for storing the non-controlled update program, the increase in the capacity of the storage area can be suppressed. Furthermore, by making the program storage third area an area different from the program storage first area and the program storage second area, the area for storing the vehicle control program does not run out of capacity due to the storage of the non-controlled update program. Therefore, the increase in the capacity of the storage area for storing the vehicle program can be suppressed, and a shortage of the storage area for storing the program can be avoided.

[0141] (Configuration 15) A recording medium storing a program executed by a computer that controls a program management device having a communication unit that communicates with an external device outside a vehicle and a memory unit, wherein the memory unit is provided with a first program storage area that stores a vehicle control program for controlling the vehicle, a second program storage area that stores the vehicle control program, and a third program storage area that stores a non-involved program for performing control that is not involved in driving the vehicle, and the recording medium stores a program that causes the computer to execute a first process of storing a vehicle control update program received by the communication unit and used to update the vehicle control program in at least one of the first program storage area or the second program storage area, and a second process of storing a non-control update program received by the communication unit and used to update the non-involved program in the third program storage area. According to the program stored in the recording medium of configuration 15, the area for storing the vehicle control program for controlling the vehicle is duplicated, so that the vehicle control program can be held in an area that is not affected by the update while the vehicle control program is being updated. Therefore, there is no need to limit the timing of updating the program in preparation for a problem with the program update. Therefore, the constraints on the timing of updating the program can be reduced. Also, by not duplicating the program storage third area for storing the non-controlled update program, the increase in the capacity of the storage area can be suppressed. Furthermore, by making the program storage third area an area different from the program storage first area and the program storage second area, the area for storing the vehicle control program does not run out of capacity due to the storage of the non-controlled update program. Therefore, the increase in the capacity of the storage area for storing the vehicle program can be suppressed, and a shortage of the storage area for storing the program can be avoided. [Explanation of symbols]

[0142] 1...control system (program management device), 2...central ECU (control unit), 12...TCU (communication unit), 20...zone ECU (control unit), 20a...first zone ECU (control unit), 20b...second zone ECU (control unit), 20c...third zone ECU (control unit), 25a...shift device, 25b...driving source, 27a...SSSW, 27b...shift SW, 30, 30a, 30b, 30c, 30e, 30f, 30g, 30h, 30i...ECU, 30d...ECU (control unit), 51, 51a, 51b, 51c, 212...update execution unit (program update unit), 52, 52a, 52b, 52c, 213...data storage unit, 61...boot sector, 62...A-side boot image storage area, 63...B side boot image memory area, 64...common area (third program memory area), 65...reserve area (third program reserve memory area), 66...check area, 70...first program memory area, 71...A side program area, 72, 74...reserve area (first program reserve memory area), 73...A side user area, 75...second program memory area, 76...B side program area, 77, 79...reserve area (second program reserve memory area), 78...B side user area, 100...program management system, 110...server, 120...vehicle diagnosis device, 201...update control unit, 202...update data receiving unit, 203...update data control unit, 211...data processing unit, V...vehicle.

Claims

1. A communication unit that communicates with an external device located outside the vehicle; a control unit that executes a vehicle control program for controlling the vehicle; a first program storage area for storing the vehicle control program; a second program storage area for storing the vehicle control program; a third program storage area for storing a non-involved program for performing control not involved in driving the vehicle; a program update unit that executes a first process of storing a vehicle control update program used to update the vehicle control program received by the communication unit in at least one of the program storage first area and the program storage second area, and a second process of storing a non-control update program used to update the non-involved program received by the communication unit in the program storage third area; Equipped with When the storage capacity of the first program storage area or the second program storage area is insufficient in the first process, the program update unit forms an extension area using the third program storage area and stores at least a part of the vehicle control update program in the extension area. Program management device.

2. 2. The program management device of claim 1, wherein the program update unit divides the third program memory area into two divided areas, one of the divided areas being the extended area corresponding to the first program memory area, and the other divided area being the extended area corresponding to the second program memory area.

3. A communication unit that communicates with an external device located outside the vehicle; a control unit that executes a vehicle control program for controlling the vehicle; a first program storage area for storing the vehicle control program; a second program storage area for storing the vehicle control program; a third program storage area for storing a non-involved program for performing control not involved in driving the vehicle; a program update unit that executes a first process of storing a vehicle control update program used to update the vehicle control program received by the communication unit in at least one of the program storage first area and the program storage second area, and a second process of storing a non-control update program used to update the non-involved program received by the communication unit in the program storage third area; Equipped with The program update unit stores the vehicle control update program received from the communication unit based on an operation of a first user registered in the vehicle in the first program storage area or the second program storage area, and stores the vehicle control update program received from the communication unit based on an operation of a second user different from the first user in the third program storage area. Program management device.

4. 4. The program management device of claim 3, wherein the program update unit stores the uncontrolled update program received from the communication unit based on the operation of the first user and the uncontrolled update program received from the communication unit based on the operation of the second user in different memory areas in the program storage third area.

5. 5. The program management device according to claim 4, wherein when the storage capacity of the first program storage area or the second program storage area is insufficient during the first process, the program update unit stores at least a portion of the vehicle control update program in an area in the third program storage area that stores the non-control update program received by the communication unit based on the operation of the second user.

6. A program management method using a program management device including a communication unit that communicates with an external device located outside a vehicle and a storage unit, The storage unit, a program storage first area for storing a vehicle control program for controlling the vehicle; a second program storage area for storing the vehicle control program; a third program storage area for storing a non-involved program for performing control not involved in driving the vehicle; Established executes a first process of storing a vehicle control update program received by the communication unit and used to update the vehicle control program in at least one of the first program storage area or the second program storage area, and executes a second process of storing a non-control update program received by the communication unit and used to update the non-involved program in the third program storage area; forming an extension area using the program storage third area when a storage capacity of the program storage first area or the program storage second area is insufficient in the first process, and storing at least a part of the vehicle control update program in the extension area; Program management methods.

7. A program management method using a program management device including a communication unit that communicates with an external device located outside a vehicle and a storage unit, The storage unit, a program storage first area for storing a vehicle control program for controlling the vehicle; a second program storage area for storing the vehicle control program; a third program storage area for storing a non-involved program for performing control not involved in driving the vehicle; Established executes a first process of storing a vehicle control update program received by the communication unit and used to update the vehicle control program in at least one of the first program storage area or the second program storage area, and executes a second process of storing a non-control update program received by the communication unit and used to update the non-involved program in the third program storage area; storing the vehicle control update program received from the communication unit based on an operation of a first user registered in the vehicle in the first program storage area or the second program storage area, and storing the vehicle control update program received from the communication unit based on an operation of a second user different from the first user in the third program storage area; Program management methods.

8. A recording medium storing a program executed by a computer that controls a program management device including a communication unit that communicates with an external device located outside a vehicle and a storage unit, The storage unit includes: a program storage first area for storing a vehicle control program for controlling the vehicle; a second program storage area for storing the vehicle control program; a third program storage area for storing a non-involved program for performing control not involved in driving the vehicle; is established, The computer is caused to execute a first process of storing a vehicle control update program used to update the vehicle control program, which is received by the communication unit, in at least one of the program storage first area or the program storage second area, and a second process of storing a non-control update program used to update the non-involved program, which is received by the communication unit, in the program storage third area, and, when the storage capacity of the program storage first area or the program storage second area is insufficient in the first process, to form an extension area using the program storage third area and to store at least a part of the vehicle control update program in the extension area. Recording medium.

9. A recording medium storing a program executed by a computer that controls a program management device including a communication unit that communicates with an external device located outside a vehicle and a storage unit, The storage unit includes: a program storage first area for storing a vehicle control program for controlling the vehicle; a second program storage area for storing the vehicle control program; a third program storage area for storing a non-involved program for performing control not involved in driving the vehicle; is established, The computer is caused to execute a first process of storing a vehicle control update program used to update the vehicle control program received by the communication unit in at least one of the first program storage area or the second program storage area, and a second process of storing a non-control update program used to update the non-involved program received by the communication unit in the third program storage area, and stores the vehicle control update program received from the communication unit based on an operation of a first user registered in the vehicle in the first program storage area or the second program storage area, and stores the vehicle control update program received from the communication unit based on an operation of a second user different from the first user in the third program storage area. Recording medium.

Images