Center, control method, and control program

Abstract

To provide a center capable of executing software updates by efficiently transmitting distribution packages without overburdening communication bands.SOLUTION: Provides is a center that is configured to communicate with an OTA master that controls software update for an electronic control unit mounted on a vehicle. The center includes: a first determination unit configured to determine, in response to a software update inquiry from the OTA master having update data, availability of a permission frame that is defined in the number of permissions for update processing; a first control unit configured to allocate, when there is any available permission frame, the permission frame to the OTA master from which the inquiry has been received; a second determination unit configured to determine, in response to a distribution package transmission request from the OTA master to which the permission frame has been allocated, availability of a multiplex frame that is defined in the number of permissions for parallel transmission of distribution packages; and a second control unit configured to allocate, when there is any available multiplex frame, the multiplex frame to the OTA master to which the permission frame is allocated and control transmission of the distribution packages.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a center for controlling software updates of electronic control units. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units for controlling the operation of the vehicle. Each electronic control unit includes a processor, a temporary storage unit such as a RAM, and a non-volatile memory that is a non-volatile storage unit such as a flash ROM. The processor executes software stored in the non-volatile memory to realize the control function of the electronic control unit. The software stored in each electronic control unit is rewritable, and by updating the software to a newer version, the function of each electronic control unit can be improved or a new vehicle control function can be added.

[0003] As a technology for updating software of an electronic control unit, there is known an OTA (Over The Air) technology in which an in-vehicle communication device connected to an in-vehicle network is wirelessly connected to a communication network such as the Internet, and a device in charge of updating the software of the vehicle downloads software from a server via wireless communication and installs the downloaded software in the electronic control unit, thereby updating or adding software to the electronic control unit. For example, see Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2004-326689 A Summary of the Invention [Problem to be solved by the invention]

[0005] When providing an OTA service, there is a demand that the communication bandwidth must not be overwhelmed, thereby affecting other services provided to the vehicle. For this reason, the communication bandwidth available for OTA services is limited. On the other hand, when performing software updates, there is also a demand that all updates of the target electronic control units must be completed within a specified period. To meet these two demands, it is necessary to provide OTA services such as software updates by efficiently using the limited communication bandwidth.

[0006] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a center or the like that can perform software updates by efficiently sending distribution packages without straining the communication bandwidth. [Means for solving the problem]

[0007] In order to solve the above problems, one aspect of the disclosed technology is a center capable of communicating with an OTA master that controls software updates of an electronic control unit installed in a vehicle, the center including: a first determination unit that, when an inquiry about a software update is made from an OTA master that has update data, determines the availability of a permission slot that defines the number of times update processing is permitted; and a first control unit that, when there is an available permission slot, assigns the permission slot to the OTA master that made the inquiry and permits the update processing; a second determination unit that, when there is a request to send a distribution package from the OTA master to which the permission slot is assigned, determines the availability of a multiplex slot that defines the number of times parallel transmission of a distribution package is permitted; and a second control unit that, when there is an available multiplex slot, assigns the multiplex slot to the OTA master to which the permission slot is assigned and controls the transmission of the distribution package. Effect of the Invention

[0008] According to the center of the present disclosure, software updates can be performed by efficiently transmitting distribution packages without straining the communication bandwidth. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing the overall configuration of a network system according to an embodiment of the present invention; [Diagram 2] Block diagram showing the general configuration of the center [Diagram 3] Center functional block diagram [Figure 4A] An example of permission frame information stored in the center [Figure 4B] An example of multiple frame information stored by the center [Diagram 5] Block diagram showing the schematic configuration of the OTA master [Figure 6] OTA Master Functional Block Diagram [Figure 7A] Flowchart of update control process executed by the center [Figure 7B] Flowchart of update control process executed by the center [Figure 8] Flowchart of software update control process executed by OTA master DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The center of the present disclosure uses the permission slot to control the number of OTA masters that can update software, and uses the multiple slots to control the number of distribution packages that can be transmitted simultaneously. This process makes it possible to perform software updates by transmitting distribution packages efficiently without straining the communication band. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0011] <Embodiment> [composition] Fig. 1 is a block diagram showing an overall configuration of a network system according to an embodiment of the present disclosure. The network system shown in Fig. 1 is a system for updating software of a plurality of electronic control units 40a to 40d mounted on a vehicle, and includes a center 10 located outside the vehicle and an in-vehicle network 20 built inside the vehicle.

[0012] (1) Center The center 10 is capable of communicating with an OTA master 30 (described later) provided in the in-vehicle network 20 via the network 70. The center 10 can control and manage software updates of the multiple electronic control units 40a-40d connected to the OTA master 30 by transmitting update data for the software of the electronic control units 40a-40d and receiving notifications indicating the progress of the software update process between the center 10 and the OTA master 30. The center 10 functions as a so-called server.

[0013] FIG. 2 is a block diagram showing a schematic configuration of the center 10 in FIG. 1. As shown in FIG. 2, the center 10 includes a central processing unit (CPU) 11, a random access memory (RAM) 12, a storage device 13, and a communication device 14. The storage device 13 is a device including a readable and writable storage medium such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a program for performing software update management, information used for software update control and update management, and software update data for each electronic control unit. The center 10 may include a plurality of CPUs 11, RAMs 12, and storage devices 13. In the center 10, one or more CPUs 11 execute a program read from one or more storage devices 13 by using one or more RAMs 12 as a working area, thereby performing a predetermined process related to software update. The communication device 14 is a device for communicating with the OTA master 30 via the network 70.

[0014] Fig. 3 is a functional block diagram of the center 10 shown in Fig. 2. The center 10 shown in Fig. 3 includes a determination unit 15, a storage unit 16, a communication unit 17, and a control unit 18. The storage unit 16 is realized by the storage device 13 shown in Fig. 2. The determination unit 15, the communication unit 17, and the control unit 18 are realized by one or more CPUs 11 shown in Fig. 2 executing programs stored in one or more storage devices 13 using one or more RAMs 12.

[0015] The storage unit 16 stores information related to software update processing of one or more electronic control units mounted on the vehicle. As information related to the software update processing, the storage unit 16 stores at least update management information in which information indicating software available in the electronic control units 40a-40d is associated with each vehicle identification information (vehicle ID) that identifies the vehicle, and update data for the software of the electronic control units 40a-40d. As the information indicating the software available in the electronic control units 40a-40d, for example, a combination of the latest version information of each piece of software in the electronic control units 40a-40d is defined.

[0016] As information related to software update processing, the storage unit 16 stores information (usage and availability status) related to the status of a permission slot (ticket slot) that defines the number of software update processing permitted, and information (usage and availability status) related to the status of a multiplex slot (slot slot) that defines the number of parallel transmissions of distribution packages permitted. FIG. 4A shows an example of permission slot information stored in the storage unit 16, and FIG. 4B shows an example of multiplex slot information stored in the storage unit 16. The permission slot information and multiplex slot information illustrated in FIG. 4A and FIG. 4B store the usage status (used / free) of each slot (T01, T02, T03, ..., S01, S02, S03, ...) and, if used, the information of the assigned vehicle (vehicle ID, etc.). The number of permission slots and the number of multiplex slots can be arbitrarily set based on the number of vehicles to be subject to software update, the communication band available for update, etc.

[0017] In addition, as information related to the software update process, the storage unit 16 can store an update status indicating the update state of the software being implemented in the vehicle. Furthermore, the storage unit 16 can store information related to the type of non-volatile memory mounted in each of the multiple electronic control units 40a to 40d.

[0018] The communication unit 17 transmits and receives data, information, requests, and the like to and from the OTA master 30. The communication unit 17 receives a software update confirmation request from the OTA master 30. The update confirmation request is information transmitted from the OTA master 30 to the center 10 when, for example, the power or ignition is turned on in the vehicle (hereinafter referred to as "power ON"), and is information for requesting the center 10 to confirm whether or not there is update data for the electronic control units 40a to 40d based on the vehicle configuration information. Furthermore, when the communication unit 17 receives an update confirmation request from the OTA master 30, the communication unit 17 transmits information indicating the presence or absence of update data to the OTA master 30 based on the allocation state of the permission slot. Furthermore, the communication unit 17 receives a transmission request (download request) for a distribution package from the OTA master 30. Furthermore, when the communication unit 17 receives a download request for a distribution package, the communication unit 17 transmits a distribution package including software update data for the electronic control units 40a to 40d to the OTA master 30 based on the allocation state of the multiple slots.

[0019] When the communication unit 17 receives an update check request from the OTA master 30, the determination unit 15 determines whether or not there is software update data for the electronic control units 40a to 40d mounted on the vehicle identified by the vehicle ID included in the update check request, based on the update management information (such as the version of the electronic control unit) stored in the storage unit 16, and if there is update data, determines whether or not there is a vacancy in the permission slot, based on the permission slot information stored in the storage unit 16 (first determination). Then, based on the result of the first determination, the determination unit 15 transmits to the OTA master 30 whether or not there is update data, using the communication unit 17. Also, when the communication unit 17 receives a transmission request for a distribution package from the OTA master 30, the determination unit 15 determines whether or not there is a vacancy in the multiplex slot, based on the multiplex slot information stored in the storage unit 16 (second determination). Then, based on the result of the second determination, the determination unit 15 transmits the distribution package to the OTA master 30 using the communication unit 17.

[0020] When the determination unit 15 determines that there is update data for the software of the electronic control units 40a-40d and that there is a vacant slot, the control unit 18 allocates a new permission slot to the OTA master 30 that has requested the update and permits the software update, and when the determination unit 15 determines that there is update data for the software of the electronic control units 40a-40d but that there is no vacant slot, the control unit 18 notifies the OTA master 30 that has requested the update that there is no update (first control). Also, when the determination unit 15 determines that there is a vacant slot in the multiplex slot, the control unit 18 allocates a new multiplex slot to the OTA master 30 that has requested the transmission of the distribution package, and generates and transmits a distribution package including the update data, and when the determination unit 15 determines that there is no vacant slot in the multiplex slot, the control unit 18 notifies the OTA master 30 that has requested the transmission of the distribution package that the transmission of the distribution package is waiting (second control).

[0021] (2) In-vehicle network The in-vehicle network 20 includes an OTA master 30, a plurality of electronic control units 40a to 40d, and a communication module 50. The OTA master 30 and the communication module 50 are connected via a bus 60a. The OTA master 30 and the electronic control units 40a and 40b are connected via a bus 60b. The OTA master 30 and the electronic control units 40c and 40d are connected via a bus 60c.

[0022] The OTA master 30 can wirelessly communicate with the center 10 via the bus 60a and the communication module 50 and the network 70. The OTA master 30 is a device having a function of managing an OTA state, controlling an update sequence, which is a flow of a software update process, and performing a software update of an electronic control unit to be updated (hereinafter referred to as a "target electronic control unit"). The OTA master 30 controls software updates of the target electronic control units among the electronic control units 40a to 40d based on update data acquired from the center 10, etc. The OTA master 30 is sometimes referred to as a central gateway (CGW).

[0023] 5 is a block diagram showing a schematic configuration of the OTA master 30 in FIG. 1. As shown in FIG. 5, the OTA master 30 includes a CPU 31, a RAM 32, a ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, the RAM 32, the ROM 33, and the storage device 34 constitute a microcomputer 35. In the OTA master 30, the CPU 31 executes a program read from the ROM 33 by using the RAM 32 as a working area, thereby executing a predetermined process related to software update. The communication device 36 is a device for communicating with the communication module 50 and the electronic control units 40a to 40d, respectively, via the buses 60a to 60c shown in FIG. 1.

[0024] Fig. 6 is a functional block diagram of the OTA master 30 shown in Fig. 5. The OTA master 30 shown in Fig. 6 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is realized by the storage device 34 shown in Fig. 5. The communication unit 38 and the control unit 39 are realized by the CPU 31 shown in Fig. 5 executing a program stored in the ROM 33 using the RAM 32.

[0025] The storage unit 37 stores a program for executing software updates of the multiple electronic control units 40a to 40d (a control program for the OTA master 30), various data used when executing software updates, and software update data downloaded from the center 10. The storage unit 37 can also store information regarding the type of non-volatile memory mounted in each of the multiple electronic control units 40a to 40d.

[0026] The communication unit 38 transmits and receives data, information, requests, and the like to and from the center 10. The communication unit 38 transmits a software update check request to the center 10, for example, when the power supply of the vehicle is turned on. The update check request includes, for example, a vehicle ID for identifying the vehicle and version information on the current version of the software of the electronic control units 40a to 40d connected to the in-vehicle network 20. The update check request may also include information on the type of the electronic control units 40a to 40d connected to the in-vehicle network 20. The vehicle ID and the current version of the software of the electronic control units 40a to 40d are used to determine whether or not there is update data for the software of the electronic control units 40a to 40d by comparing them with the latest version of the software held by the center 10 for each vehicle ID. The communication unit 38 also receives a notification indicating the presence or absence of update data from the center 10 as a response to the update check request. When there is update data for the software of the electronic control units 40a to 40d, the communication unit 38 transmits a download request for a distribution package of the software update data to the center 10, and receives (downloads) the distribution package transmitted from the center 10 under the control of the control unit 39. In addition, the communication unit 38 transmits to the center 10 the update status of the software transmitted by the electronic control units 40a to 40d.

[0027] The control unit 39 judges whether or not there is update data for the software of the electronic control units 40a to 40d based on a response from the center 10 to the update confirmation request received by the communication unit 38. The control unit 39 also performs decryption and verification of authenticity of the distribution package that the communication unit 38 receives (downloads) from the center 10 and stores in the storage unit 37 based on its own control. The control unit 39 also controls software update processing (various verifications, installation, activation, etc.) of the electronic control units 40a to 40d using the update data received (downloaded) from the center 10. Specifically, the control unit 39 transfers one or more pieces of update data downloaded in the distribution package to the target electronic control unit, and causes the target electronic control unit to install update software based on the update data. After the installation is completed, the control unit 39 instructs the target electronic control unit to activate the installed update software. During this software update process, the control unit 39 appropriately controls procedures such as various verifications, installations, and activations in the multiple electronic control units 40a to 40d.

[0028] The electronic control units 40a to 40d are devices (ECUs: Electronic Control Units) for controlling the operation of each part of the vehicle. In FIG. 1, an example is shown in which the in-vehicle network 20 includes four electronic control units 40a to 40d, but the number of electronic control units is not particularly limited. For example, a display device (HMI) for performing various displays, such as a display that there is update data during software update processing of the electronic control units 40a to 40d, a display of a consent request screen for requesting consent to the software update from the vehicle user or administrator, and a display of the result of the software update, may be connected to the OTA master 30. A car navigation system or the like can be used as the display device. In addition, the number of buses connecting the electronic control units to the OTA master 30 is not particularly limited. For example, the above-mentioned display device may be connected to the OTA master 30 by a bus other than the buses 60a to 60c.

[0029] The communication module 50 is a unit having a function of controlling communication between the center 10 and the vehicle, and is a communication device for connecting the in-vehicle network 20 to the center 10. The communication module 50 is wirelessly connected to the center 10 via the network 70, and performs vehicle authentication by the OTA master 30, downloading update data, etc. Note that the communication module 50 may be configured as part of the OTA master 30.

[0030] [Software Updates Process Overview] The OTA master 30 transmits a software update check request to the center 10, for example, when the power supply of the vehicle is turned on. The update check request includes at least a vehicle ID for identifying the vehicle and vehicle configuration information, which is information on the state (system configuration) of the electronic control units 40a to 40d connected to the in-vehicle network 20, such as the current versions of the hardware and software of the electronic control units 40a to 40d. The vehicle configuration information can be created by acquiring the identification numbers (ECU_ID) of the electronic control units and the identification numbers (ECU_Software_ID) of the software versions of the electronic control units from the electronic control units 40a to 40d connected to the in-vehicle network 20. The vehicle ID and the current versions of the software of the electronic control units 40a to 40d are used to determine whether or not there is update data for the software of the electronic control units 40a to 40d by comparing them with the latest version of the software held by the center 10 for each vehicle ID. In response to the update check request received from the OTA master 30, the center 10 transmits a notification indicating the presence or absence of update data to the OTA master 30 based on the allocation status of the permission slot. The OTA master 30 to which the permission slot is allocated transmits a download request for a distribution package to the center 10. The center 10 transmits a distribution package including update data to the OTA master 30 that received the download request based on the allocation status of multiple slots. In addition to the update data, the distribution package may include information specifying the encryption method applied to the distribution package, verification data for verifying the authenticity of the update data, the number and type of update data, various control information used when updating the software, and the like.

[0031] The OTA master 30 determines whether there is update data for the software of the electronic control units 40a to 40d based on the permission frame allocated by the center 10. The OTA master 30 also performs decryption and verification of authenticity of the distribution package received from the center 10 and stored in the storage device 13. The OTA master 30 also transfers one or more pieces of update data downloaded in the distribution package to the target electronic control unit, and causes the target electronic control unit to install the update data. After the installation is completed, the OTA master 30 instructs the target electronic control unit to activate the installed updated software to make it valid.

[0032] In addition, in the consent request process, the OTA master 30 causes the output device to output a notification that consent is required for the software update or a notification that prompts input that the software update has been consented to. As the output device, a display device (not shown) that provides a notification by display and an audio output device (not shown) that provides a notification by audio, which are provided in the in-vehicle network 20, can be used. For example, when a display device is used as the output device in the consent request process, the OTA master 30 can cause the display device to display a consent request screen for requesting consent to the software update from the user or administrator, or cause the display device to display a notification that prompts a specific input operation such as pressing an consent button if the user or administrator consents. In addition, in the consent request process, the OTA master 30 can cause the display device to display a statement or an icon notifying that there is update data for the software of the electronic control units 40a to 40d, or cause the display device to display restrictions during the execution of the software update process. When the OTA master 30 receives input indicating consent from the user or administrator, it executes the above-mentioned installation and activation control process and updates the software of the target electronic control unit.

[0033] The software update process consists of a phase in which the OTA master 30 downloads update data from the center 10 (download phase), a phase in which the OTA master 30 transfers the downloaded update data to the target electronic control unit and installs update software based on the update data in the storage area of ​​the target electronic control unit (installation phase), and a phase in which the target electronic control unit activates the installed update software (activation phase).

[0034] Downloading is a process in which the OTA master 30 receives update data for updating the software of the electronic control unit transmitted from the center 10 and stores it in the storage unit 37. In downloading, update data is downloaded using a distribution package encrypted according to a predetermined security level. The download phase not only executes the download, but also includes control of a series of processes related to the download, such as judging whether the download can be executed, decrypting the distribution package, and verifying the update data.

[0035] The update data transmitted from the center 10 to the OTA master 30 may include update software for the electronic control unit (all data or difference data), compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may also include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The distribution package to be downloaded may include update data for only a single electronic control unit or update data for multiple electronic control units.

[0036] The installation is a process in which the OTA master 30 writes update software (updated programs) in a specified order to the non-volatile memories of multiple target electronic control units based on the update data downloaded from the center 10. The installation phase not only executes the installation, but also includes control of a series of processes related to the installation, such as judging whether the installation can be executed, transferring the update data, and verifying the update software.

[0037] If the update data includes the update software itself (all data), the OTA master 30 transfers the update data (update software) to the target electronic control unit in the installation phase. If the update data includes compressed data, difference data, or divided data of the update software, the OTA master 30 may transfer the update data to the target electronic control unit and the target electronic control unit may generate the update software from the update data, or the OTA master 30 may generate the update software from the update data and then transfer the update software to the target electronic control unit. Here, the update software can be generated by decompressing the compressed data or assembling (integrating) the difference data or divided data.

[0038] The target electronic control unit can install the update software based on an installation request from the OTA master 30. Note that for a specific target electronic control unit that has received the update data, the installation may be performed autonomously without receiving an explicit instruction from the OTA master 30.

[0039] Activation is a process in which the target electronic control unit activates the update software installed in the non-volatile memory. The activation phase includes not only the execution of activation, but also a series of controls related to activation, such as judging whether activation can be executed, requesting the vehicle user or administrator to consent to activation, and verifying the execution result.

[0040] The activation of the update software can be performed by the target electronic control unit based on an activation request from the OTA master 30. Note that, for a specific target electronic control unit that has received the update data, the activation may be performed autonomously after the installation is completed, without receiving an explicit instruction from the OTA master 30.

[0041] The software update process can be performed consecutively or in parallel for each of the multiple target electronic control units.

[0042] Furthermore, in this specification, the "software update process" includes not only a process in which download, installation, and activation are all performed consecutively, but also a process in which only some of the download, installation, and activation are performed.

[0043] [control] Next, with further reference to FIGS. 7A, 7B, and 8, the control executed in the network system according to this embodiment will be described.

[0044] (1) Center control 7A and 7B are flowcharts illustrating the procedure of software update control processing executed by each component of the center 10. The processing in FIG. 7A and the processing in FIG.

[0045] (Step S701) The communication unit 17 judges whether or not there is a software update confirmation request as an inquiry about a software update from the OTA master 30. If the communication unit 17 judges that there is an update confirmation request (step S701, Yes), the process proceeds to step S702, and if it judges that there is no update confirmation request (step S701, No), the judgment of the presence or absence of an update confirmation request is repeatedly performed.

[0046] (Step S702) The determination unit 15 determines whether or not there is software update data for the electronic control units 40a to 40d of the vehicle equipped with the OTA master 30 that has made the update check request. This determination can be made based on the update management information (such as the version of the electronic control unit) stored in the storage unit 16 and the vehicle ID included in the update check request. If the determination unit 15 determines that there is update data (step S702, Yes), the process proceeds to step S703, and if it determines that there is no update data (step S702, No), the process proceeds to step S706.

[0047] (Step S703) The determination unit 15 checks the status of the permission frame (ticket frame). This check is performed based on the permission frame information stored in the storage unit 16. After the determination unit 15 checks the permission frame status, the process proceeds to step S704.

[0048] (Step S704) The determination unit 15 determines whether or not there is a vacant permission slot as a result of the status check. An available permission slot is a state in which the permission slot is not assigned to any OTA master 30. If the determination unit 15 determines that there is a vacant permission slot (step S704, Yes), the process proceeds to step S705, and if the determination unit 15 determines that there is no vacant permission slot (step S704, No), the process proceeds to step S706.

[0049] (Step S705) The control unit 18 notifies the OTA master 30, which has requested the software update confirmation in the above step S701, that "an update is available." When the control unit 18 notifies the OTA master 30 that an update is available, the process proceeds to step S707.

[0050] (Step S706) The control unit 18 notifies the OTA master 30, which has requested the software update confirmation in the above step S701, of "no update". In this process, even if there is actually update data, if there is no space in the permission frame, it is notified that there is no update. When the control unit 18 notifies that there is no update, the process proceeds to step S701.

[0051] (Step S707) The control unit 18 allocates an available permission frame to the OTA master 30 that has requested the software update confirmation. This rewrites the permission frame information stored in the storage unit 16. After the permission frame is allocated by the control unit 18, the process proceeds to step S708.

[0052] (Step S708) The communication unit 17 judges whether or not there is a download request from the OTA master 30 to which a permission slot has been allocated. The download requests judged here are requests from all OTA masters 30 to which a permission slot has already been allocated, including the OTA master 30 to which a new permission slot has been allocated in the above step S707. Basically, the center 10 processes the download requests in the order in which they are received. If the communication unit 17 judges that there is a download request (step S708, Yes), the process proceeds to step S709, and if it judges that there is no download request (step S701, No), the judgment of the presence or absence of a download request is repeated.

[0053] (Step S709) The determination unit 15 checks the state of the multiplex frame (slot frame). This check is performed based on the multiplex frame information stored in the storage unit 16. When the determination unit 15 checks the state of the multiplex frame, the process proceeds to step S710.

[0054] (Step S710) The determination unit 15 determines whether or not there is a vacant multiplex slot based on the result of the status check. An available multiplex slot means that the multiplex slot is not being used to transmit a distribution package. If the determination unit 15 determines that there is a vacant multiplex slot (step S710, Yes), the process proceeds to step S711, and if it determines that there is no vacant multiplex slot (step S710, No), the process proceeds to step S713.

[0055] (Step S711) The control unit 18 allocates an available multiplex slot for transmitting the distribution package to the OTA master 30 that has made the download request. This rewrites the multiplex slot information stored in the storage unit 16. Note that the multiplex slots allocated to one download request may be one or more depending on the availability and the progress of the download. Once the multiplex slot allocation has been completed by the control unit 18, the process proceeds to step S712.

[0056] (Step S712) The control unit 18 transmits a distribution package to the OTA master 30 to which the multiplexing slot is assigned via the communication unit 17. The distribution package to be transmitted may include all update data, or may be divided into multiple pieces of data. When the distribution package is transmitted by the control unit 18, the process proceeds to step S713.

[0057] (Step S713) The control unit 18 notifies the OTA master 30 that has made the download request that the transmission of the distribution package is being waited for because the distribution package cannot be sent immediately (transmission wait notification). The wait time may be determined by the control unit 18 or by the OTA master 30 that has received the notification. When the control unit 18 notifies the OTA master 30 of the transmission wait, the process proceeds to step S708.

[0058] (Step S714) After completing the transmission of the distribution package, the control unit 18 releases the multiplexing slot used for that transmission for other transmissions (deallocation). This rewrites the multiplexing slot information stored in the storage unit 16. When the multiplexing slot is released by the control unit 18, the process proceeds to step S715.

[0059] (Step S715) The control unit 18 judges whether or not there is an OTA master 30 that has completed all of the download of update data among the OTA masters 30 to which the permission slot has been allocated. Completion of all of the download of update data can be judged based on a download completion notice transmitted from the OTA master 30. If the control unit 18 judges that there is an OTA master 30 that has completed all of the download of update data (step S715, Yes), the process proceeds to step S716, and if it is judged that there is no OTA master 30 that has completed all of the download of update data (step S715, No), the process proceeds to step S708.

[0060] (Step S716) The control unit 18 releases (de-allocates) the permission frame allocated to the OTA master 30 that has completed downloading all update data, for another OTA master 30. This rewrites the permission frame information stored in the storage unit 16. When the permission frame is released by the control unit 18, the process proceeds to step S701.

[0061] In the above embodiment, the software update process is performed on the assumption that the user of the vehicle agrees to the process, but the vehicle user may be asked to agree to each process as necessary. In this case, if the vehicle user does not agree, the allocated permission slot or multiple slots may be released.

[0062] (2) OTA master control Fig. 8 is a flowchart illustrating the procedure of the software update control process executed by each component of the OTA master 30. The software update control shown in Fig. 8 is executed, for example, when the power supply of the vehicle is turned on.

[0063] (Step S801) The communication unit 38 transmits a confirmation request to the center 10 as to whether or not there is update data for the software of the electronic control units 40a to 40d. This confirmation request includes the vehicle ID and the current version of the software of the electronic control units 40a to 40d. When the confirmation request is transmitted to the center 10 by the communication unit 38, the process proceeds to step S802.

[0064] (Step S802) The communication unit 38 receives the confirmation result (update, no update) in response to the confirmation request for the updated data from the center 10. When the confirmation result is received by the communication unit 38, the process proceeds to step S803.

[0065] (Step S803) The control unit 39 determines whether or not there is software update data for at least one of the electronic control units 40a to 40d, based on the confirmation result received by the communication unit 38. If the control unit 39 determines that there is at least one piece of software update data (step S803, Yes), the process proceeds to step S804, and if it determines that there is no software update data at all (step S803, No), the software update control ends.

[0066] (Step S804) The control unit 39 downloads the update data. Specifically, the communication unit 38 transmits a download request for a distribution package including the update data to the center 10, and receives the distribution package transmitted from the center 10 in response to the download request. The communication unit 38 stores the received distribution package in the storage unit 37 of the OTA master 30. Once the update data has been downloaded by the control unit 39, the process proceeds to step S805.

[0067] (Step S805) The control unit 39 executes the installation of software based on the update data in the target electronic control unit. Specifically, the control unit 39 transfers the update data included in the distribution package to the target electronic control unit and instructs the installation of the update software. The target electronic control unit writes the update data received from the OTA master 30 to a data storage area. When the installation of the update software is executed by the control unit 39, the process proceeds to step S806.

[0068] (Step S806) The control unit 39 activates the update software installed in the target electronic control unit. Specifically, the control unit 39 instructs the target electronic control unit, which has written the update software into its data storage area, to activate the update software. The target electronic control unit restarts when a specific input operation, such as turning the power off, is performed, and executes the update software. When the control unit 39 executes the process of activating the update software, this software update control ends.

[0069] <Effects> As described above, according to the network system according to an embodiment of the present disclosure, when an OTA master with update data inquires about the presence or absence of a software update, the center permits the update process of that OTA master only if there is a vacant ticket slot. If there is no vacant ticket slot, the center postpones the update process by notifying the OTA master that there is no update even if there is update data. This process makes it possible to narrow down the vehicles that undergo software updates in parallel, thereby avoiding the occurrence of multiple requests at the same time.

[0070] Furthermore, according to a network system according to an embodiment of the present disclosure, when a transmission request for a distribution package is received from an OTA master of a vehicle that has been permitted to perform an update process by allocating a permission slot, the center transmits the distribution package within an allocable range of multiple slots (slot slots). If there is no vacant multiple slot, the center waits to transmit the distribution package. This process makes it possible to perform software updates by transmitting the distribution package efficiently without putting pressure on the limited communication band.

[0071] The above describes one embodiment of the disclosed technology, but the present disclosure can be understood not only as a center, but also as a method and program executed by a center equipped with a processor and memory, or a computer-readable non-transitory storage medium storing a program. [Industrial Applicability]

[0072] The disclosed technique can be used in a network system for updating software in an electronic control unit. [Explanation of symbols]

[0073] 10 Center 11, 31 CPU 12,32 RAM 13, 34 Storage device 14, 36 Communication equipment 15 Judgment section 16, 37 Memory section 17, 38 Communications Department 18, 39 Control section 20 In-vehicle network 30 OTA Master 33 ROM 35 Microcomputer 40a~40d Electronic control unit (ECU) 50 Communication Module 60a~60c Bus 70 Network

Claims

1. A center capable of communicating with an OTA master that controls software updates of an electronic control unit mounted on a vehicle, a first determination unit that, when receiving an inquiry about a software update from the OTA master having update data, determines an availability of a permission frame that defines the number of OTA masters that are permitted to perform an update process; If there is a vacancy in the permission frame, a first control unit allocates the permission frame to the OTA master that has received the inquiry and permits the update process; a second determination unit that, when a transmission request for a distribution package is received from an OTA master to which the permission slot is assigned, determines an availability of a multiplexing slot that defines the number of parallel transmissions of the distribution package that are permitted; a second control unit that, when there is a vacancy in the multiplexing slot, allocates the multiplexing slot to the OTA master to which the permission slot is allocated, and controls transmission of the distribution package; When there is no vacancy in the permission frame, the first control unit notifies the OTA master that has been inquired that there is no update.

2. 2. The center according to claim 1, wherein, when there is no vacancy in the multiplexing slot, the second control unit notifies the OTA master to which the permission slot is assigned of a transmission standby of the distribution package.

3. 2. The center according to claim 1, wherein the second control unit releases the multiplex slot when the OTA master that allocated the multiplex slot completes transmission of the distribution package.

4. The center according to claim 1 , wherein the first control unit releases the permission slot when the software update is completed in the OTA master that allocated the permission slot.

5. 5. The center according to claim 3, further comprising a storage unit for storing the status of said approved slots and the status of said overlapping slots.

6. the first control unit rewrites a state of the permission slot stored in the storage unit in response to the allocation and release of the permission slot; 6. The center according to claim 5, wherein the second control unit rewrites the state of the multiplex slot stored in the storage unit in response to the allocation and release of the multiplex slot.

7. A control method executed by a center that includes a processor and a memory and is capable of communicating with an OTA master that controls software updates of an electronic control unit mounted in a vehicle, the method comprising: When an inquiry about a software update is received from the OTA master having update data, a step of determining an availability of a permission frame that defines the number of OTA masters that are permitted to perform update processing; If there is a vacancy in the permission frame, allocating the permission frame to the OTA master that has made the inquiry and permitting the update process; If there is no vacancy in the permission frame, notifying the OTA master that has been inquired that there is no update; When a transmission request for a distribution package is received from an OTA master to which the permission slot is assigned, determining whether there is a vacancy in a multiplexing slot that defines the number of parallel transmissions of the distribution package that are permitted; and if there is a vacancy in the multiplex slot, allocating the multiplex slot to the OTA master to which the permission slot is allocated, thereby controlling transmission of the distribution package.

8. A control program executed by a center computer having a processor and a memory and capable of communicating with an OTA master that controls software updates of an electronic control unit mounted on a vehicle, When there is a software update inquiry from the OTA master that has the update data, A step of determining an availability of a permission frame that defines the number of OTA masters that are permitted to perform update processing; If there is a vacancy in the permission frame, allocating the permission frame to the OTA master that has made the inquiry and permitting the update process; If there is no vacancy in the permission frame, notifying the OTA master that has been inquired that there is no update; When a transmission request for a distribution package is received from an OTA master to which the permission slot is assigned, determining whether there is a vacancy in a multiplexing slot that defines the number of parallel transmissions of the distribution package that are permitted; and if there is a vacancy in the multiplexing slot, allocating the multiplexing slot to the OTA master to which the permission slot is allocated, thereby controlling transmission of the distribution package.

Images