Software update device, OTA master, method, program, and vehicle

Abstract

To provide a software update apparatus capable of maintaining vehicle functions even while updating software of an electronic control unit (ECU).SOLUTION: A software update apparatus comprises: a first control unit for executing control of writing (installing) or writing and enabling (activating) update software to one or more target ECUs among a plurality of ECUs connected via an in-vehicle network, based on update data downloaded from the center; and a second control unit for controlling the execution of an alternative function corresponding to the function of the target ECU if an operation of the target ECU is restricted in the execution of the write or enable control. The first control unit determines whether the target ECU to be controlled is a single bank (SB) or a dual bank (DB). The second control unit starts the execution of the alternative function before writing if the target ECU to be controlled is the SB, and starts the execution of the alternative function before it is enabled after writing is completed if the target ECU to be controlled is the DB.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a software update device or the like included in a network system mounted on a vehicle or the like. [Background technology]

[0002] Vehicles are equipped with a network system consisting of multiple on-board devices called ECUs (Electronic Control Units) connected to each other via communication lines. Each on-board device sends and receives messages to each other and shares and executes each function of the vehicle.

[0003] An in-vehicle device typically includes a processor and a temporary storage unit such as a RAM or a non-volatile storage unit such as a flash ROM. The programs (software) executed by the processor are stored in the non-volatile storage unit. By updating the programs with newer versions, the functions of the in-vehicle device can be improved and enhanced.

[0004] Program updates include the steps of downloading, in which update data is received from an external device (center) via wireless communication or the like, and installing, in which an update program (update software) is written into the storage unit of the in-vehicle device based on the downloaded data. Depending on the specifications of the in-vehicle device, installation can be performed in two ways: overwrite installation, in which the downloaded update program is written by overwriting the current program (old program) into one area (first side: single bank) of the storage unit that is designated as an area for program storage, and dual-side installation, in which the downloaded update program is written into the area (other side) that is not the area (one side) where the current program (old program) is stored, out of two areas (two sides: dual banks) that are designated as areas for program storage.

[0005] In the case of a multi-faceted installation, in addition to the download and installation steps, the program update step includes an activation step that configures the settings of the update program, such as the start address, so that the installed update program can be executed.

[0006] In relation to updating a program in an ECU, Patent Document 1 discloses that a specific ECU functions as a master ECU, communicates with a server, and updates the programs of the master ECU itself and other slave ECUs. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2011-148398 A Summary of the Invention [Problem to be solved by the invention]

[0008] During a program update, for example, while a program is being overwritten or while an installed program is being activated, the in-vehicle device cannot execute the program and therefore cannot operate, which may limit the functionality of the vehicle.

[0009] As such, program updates involve the execution of processes that may limit the vehicle's functionality, and so a measure has been proposed that prohibits the vehicle from being driven during periods that include the execution of such processes.

[0010] However, for the sake of convenience, it is desirable to maintain the functionality of the vehicle as much as possible even during a program update.

[0011] In the past, even during program updates, there was not enough consideration given to maintaining vehicle functionality as much as possible and avoiding a loss of convenience.

[0012] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a software update device etc. that can maintain the functionality of the vehicle even while a program for an in-vehicle device is being updated. [Means for solving the problem]

[0013] In order to solve the above problem, one aspect of the disclosed technology is a software update device comprising: a first control unit that executes control to install or install and activate update software in one or more target electronic control units among a plurality of electronic control units connected via an in-vehicle network based on update data downloaded from a center; and a second control unit that controls the execution of an alternative function corresponding to the function of the target electronic control unit if the operation of the target electronic control unit is restricted when the control to install or activate is executed, wherein the first control unit determines whether the target electronic control unit that it controls is single bank or dual bank, and the second control unit starts the execution of the alternative function before installation if the target electronic control unit that it controls is single bank, and starts the execution of the alternative function after completing the installation and before activation if the target electronic control unit that it controls is dual bank. Effect of the Invention

[0014] According to the disclosed technique, even if the operation of an in-vehicle device is restricted in order to update a program, the software update device controls an alternative function, so that the functionality of the vehicle can be maintained. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a configuration diagram of a network system according to an embodiment; [Diagram 2] A functional block diagram of a second control unit of the software update device according to an embodiment. [Diagram 3] Flowchart showing a process according to an embodiment DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] (Embodiment) <Configuration> FIG. 1 shows a configuration example of a network system 1 according to this embodiment. The network system 1 is mounted on a vehicle. The network system 1 includes a software update device (OTA master) 50. A plurality of buses 10, 20, 30, etc. are connected to the software update device 50. A plurality of in-vehicle devices (electronic control units) 11, 12, etc. are connected to the bus 10. A plurality of in-vehicle devices 21, 22, etc. are connected to the bus 20. A plurality of actuators 31, 32, etc. are connected to the bus 30. In FIG. 1 and the following description, the buses 10, 20, and 30 are exemplified as buses, and the in-vehicle devices 11, 12, 21, and 22 and the actuators 31 and 32 are exemplified as in-vehicle devices, but the numbers of buses, in-vehicle devices, and actuators are not limited.

[0017] The software update device 50 includes a communication unit (communication module) 51 capable of communicating with an external device 100 (center) installed outside the vehicle, a memory unit (storage) 53 for storing various data, a second control unit 60, and a first control unit 52 for controlling these. The first control unit 52 also controls and relays communication between the external device 100 and each of the in-vehicle devices 11, 12, 21, 22, communication between each of the in-vehicle devices 11, 12, 21, 22, and communication between each of the in-vehicle devices 11, 12, 21, 22 and each of the actuators 31, 32 via each of the buses 10, 20, 30. In this way, the software update device 50 also functions as a relay device for relaying communication.

[0018] The in-vehicle devices 11, 12, 21, and 22 communicate with each other and perform various processes for controlling the vehicle. These in-vehicle devices include a non-volatile storage unit (storage) such as a flash ROM, a control unit (processor) that performs various processes by reading and executing a program (software) from the non-volatile storage unit, and a temporary storage unit such as a RAM that stores a part of the program and data. The software update device 50 also stores a program for the software update device 50 in a storage unit 53, and a first control unit (processor) 52 reads and executes the program to perform processing. Each of the in-vehicle devices 11, 12, 21, and 22 and the software update device 50 can be implemented as a computer including a processor in this manner.

[0019] The actuators 31 and 32 are devices that generate mechanical effects on the vehicle or its parts, such as a brake, an engine, or a power steering device, and operate based on instructions from the on-vehicle devices 11, 12, 21, and 22.

[0020] The first control unit 52 of the software update device 50 can update the programs stored in the storage units of the in-vehicle devices 11, 12, 21, and 22. That is, the software update device 50 receives (downloads) and stores update data (distribution package) for updating the program of any of the in-vehicle devices 11, 12, 21, and 22 transmitted from the external device 100. The software update device 50 also performs control to write (install) an updated version of the program (update software) into the storage unit of the in-vehicle device to be updated based on the downloaded update data. Alternatively, the software update device 50 also performs control to validate (activate) the updated version of the program. The download sequence includes a determination of whether or not downloading can be performed, execution of the download, verification of the update data, etc. The install sequence includes a determination of whether or not installation can be performed, execution of the installation, transfer of the update data, verification of the updated version of the program, etc. The activate sequence includes a determination of whether or not activation can be performed, execution of the activation, verification of the execution result, etc. Such program update processing can be performed consecutively or in parallel for each of a plurality of vehicle-mounted devices.

[0021] 2 shows functional blocks of the second control unit 60. The second control unit 60 includes an identification unit 61 and an alternative function control unit 62. During a program update, the identification unit 61 identifies an in-vehicle device (target electronic control unit) whose operation is restricted by the installation or activation process because it is an in-vehicle device targeted for program update among the in-vehicle devices 11, 12, 21, and 22. The alternative function control unit 62 controls the execution of an alternative function that is equivalent to some or all of the functions of the in-vehicle device identified by the identification unit 61 while the operation of the in-vehicle device is restricted. The functions of the respective units of the second control unit 60 may be realized by the first control unit 52.

[0022] <Processing> An example of the process according to this embodiment will be described below. A flowchart showing this process is shown in Fig. 3. This process is started when the first control unit 52 inquires of the external device 100 whether there is an update to the program of one or more in-vehicle devices, and requests a download if there is an update.

[0023] (Step S101) The communication unit 51 receives update data for one or more in-vehicle devices from the external device 100, and the storage unit 53 stores (downloads) the update data. The update data is data used to generate an update program, and the content and format are not limited, and includes, for example, the update program itself, difference data for generating the update program, or compressed data or divided data thereof. The update data may also include an identifier (ECU ID) of the in-vehicle device (target electronic control unit) whose program is to be updated, and an identifier (WCU Software ID) of the version of the program before the update.

[0024] (Step S102) The first control unit 52 identifies the in-vehicle devices that are to be program-updated based on the downloaded update data, and selects one of the in-vehicle devices that has not been subjected to the process in the following steps S105, S107, or S109.

[0025] (Step S103) The first control unit 52 determines the type of program update method of the selected in-vehicle device (the above-mentioned single bank (overwrite installation) type or dual bank (multiple-sided installation) type). The type may be inquired of the in-vehicle device, or may be stored in advance in the software update device 50. If it is the single bank type, proceed to step S104, and if it is the dual bank type, proceed to step S107.

[0026] (Step S104) The alternative function control unit 62 starts control to execute an alternative function of the selected in-vehicle device. An alternative function means a function equivalent to some or all of the functions of the in-vehicle device whose operation is restricted. Note that, depending on the functions of the in-vehicle device, execution of an alternative function may not be necessary. In such a case, the alternative function control unit 62 does not perform any particular process. Note that the determination of whether or not to execute an alternative function is made by the identification unit 61. For example, if the selected in-vehicle device is an in-vehicle device that is predetermined as an in-vehicle device that requires execution of an alternative function, the identification unit 61 identifies the in-vehicle device as an in-vehicle device whose operation is restricted in order to update the program of the device itself.

[0027] The alternative function control unit 62 causes another in-vehicle device capable of executing an alternative function to execute the alternative function, instead of restricting the operation of the selected in-vehicle device. For example, the alternative function control unit 62 can specify an in-vehicle device to execute the alternative function based on a predetermined correspondence between the in-vehicle device to be restricted in operation and the other in-vehicle device capable of executing the alternative function. Examples of the alternative function will be described later.

[0028] (Step S105) The first control unit 52 causes the selected in-vehicle device to perform the above-mentioned overwrite installation. The in-vehicle device has no executable programs during the overwrite installation, so its operation is restricted. In the overwrite installation process, if the update data includes the update program itself, the first control unit 52 transmits the update program to the in-vehicle device. In addition, if the update data includes compressed data, difference data, or divided data of the update program, the first control unit 52 may extract or assemble the update data to generate an update program and transmit it to the in-vehicle device, or the first control unit 52 may transmit the update data to the in-vehicle device, and the in-vehicle device may extract or assemble the update data to generate an update program. The same applies to the other-side installation described later.

[0029] (Step S106) When the alternative function control unit 62 starts the execution control of the alternative function in step S104, it ends the execution control. Note that the alternative function control unit 62 preferably ends the execution control of the alternative function after confirming that the in-vehicle device whose operation has been restricted is operating normally. After this execution control step, the process proceeds to step S111.

[0030] (Step S107) The first control unit 52 transmits data representing the update program for the selected in-vehicle device to the in-vehicle device and causes the in-vehicle device to perform the above-mentioned other-side installation. Note that the current program remains in the in-vehicle device even during the other-side installation process without being erased, and the in-vehicle device can continue to operate by executing this program.

[0031] (Step S108) In the same manner as in step S104, execution control of the alternative function is started.

[0032] (Step S109) The first control unit 52 causes the selected in-vehicle device to execute the above-mentioned activation. During the activation process, the in-vehicle device is in the process of being configured to switch the program to be executed, and therefore the operation of the in-vehicle device is restricted.

[0033] (Step S110) In the same manner as in step S106, the execution control of the alternative function is ended.

[0034] (Step S111) If there is any in-vehicle device among the in-vehicle devices targeted for program update identified in step S102 that has not been subjected to the process of step S105, S107, or S109, the process proceeds to step S102; if there is no in-vehicle device, the process ends.

[0035] The above process is an example, and can be changed as appropriate. In addition, when there is no in-vehicle device having an alternative function for the in-vehicle device whose function is limited, the software update device 50 stores such in-vehicle device, and performs overwrite installation (in the case of single bank) or activation (in the case of dual bank) of the in-vehicle device when the vehicle is not running, for example, when the ignition (power) is turned off, or when the ignition (power) is turned on after being turned off once. Note that the external device 100 and the software update device 50 may explicitly instruct the in-vehicle device to perform installation or activation, and the in-vehicle device may perform these processes based on the instructions, or the in-vehicle device that has received the update data (or update program) may autonomously perform these processes even without explicit instructions.

[0036] An example of the alternative function will be described below. For example, when the operation of an in-vehicle device that controls the parking brake to keep the vehicle stopped is restricted, the alternative function control unit 62 can cause the in-vehicle device that controls the service brake to control the service brake as an alternative function to keep the vehicle stopped. This makes it possible to update the program of the in-vehicle device that controls the parking brake even if the specifications require that the vehicle be kept stopped during a program update.

[0037] In addition, in a hybrid vehicle, when the operation of the in-vehicle device that controls the engine is restricted, the alternative function control unit 62 can cause the in-vehicle device that controls the motor to generate driving force by the motor as an alternative function to the generation of driving force by the engine. This makes it possible to update the program of the in-vehicle device that controls the engine without stopping the vehicle.

[0038] In addition, when the operation of the in-vehicle device that controls the power steering is restricted, the alternative function control unit 62 can cause the in-vehicle device that controls the power output distribution to the left and right wheels to steer using the power difference between the left and right wheels as an alternative function to steering by the power steering. This makes it possible to update the program of the in-vehicle device that controls the power steering without stopping the vehicle.

[0039] In this way, when the vehicle includes two or more in-vehicle devices having driving, braking, or steering functions, and the in-vehicle device to be restricted in operation is an in-vehicle device that controls one of the driving, braking, or steering functions of the vehicle, the alternative function control unit 62 can cause another in-vehicle device having the same function to execute that function as an alternative function. This allows the program update of the in-vehicle device having the minimum functions necessary for the vehicle to travel without stopping the vehicle.

[0040] In addition, when the vehicle includes two or more in-vehicle devices having various driving assistance functions such as advanced safety functions, and the in-vehicle device to be restricted in operation is an in-vehicle device having such a driving assistance function, the alternative function control unit 62 can cause another in-vehicle device having an equivalent function to execute that function as an alternative function. This allows the in-vehicle device having the driving assistance function to perform a program update without stopping the vehicle. For example, with regard to the suppression of lane departure, the LDA (Lane Departure Alert) function can be an alternative function to the LKA (Lane Keep Assist) function. Also, with regard to the suppression of collision, the automatic driving function can be an alternative function to the PCS (Pre-Crash Safety System) function.

[0041] In addition, if the vehicle includes two or more in-vehicle devices having a function of monitoring the surroundings of the vehicle, and the in-vehicle device to be restricted in operation is an in-vehicle device having such a function of monitoring the surroundings, the alternative function control unit 62 can cause another in-vehicle device having an equivalent function to execute the function as an alternative function. This allows the program update of the in-vehicle device having the function of monitoring the surroundings to be performed without stopping the vehicle. For example, the function of a camera can be made an alternative function for the function of LiDAR (remote sensing using light).

[0042] For example, a basic function of an in-vehicle device that is equipped as standard in a vehicle and an expanded function added by an in-vehicle device retrofitted to the vehicle can be combined and used as an alternative function to each other.

[0043] Note that the performance of the alternative function may be limited more than the performance of the function it replaces, so the alternative function may be executed only in an emergency. For example, the alternative function control unit 62 may acquire information indicating that the user has performed a predetermined operation indicating an emergency from a sensor or an in-vehicle device equipped in the vehicle, and execute the alternative function based on this information. The predetermined operation is not particularly limited, but may be, for example, an operation of turning the steering wheel by a predetermined angle or more while the vehicle is stopped.

[0044] In the above example, the alternative function control unit 62 causes another in-vehicle device capable of executing an alternative function to execute the alternative function instead of the in-vehicle device whose operation is restricted. As another example, the second control unit 60 may be provided in advance with some or all of the functions of the in-vehicle device whose operation is restricted as a function of a software update device, and the alternative function control unit 62 itself may execute the function as an alternative function for some or all of the functions of the in-vehicle device whose operation is restricted, and issue instructions to the actuator.

[0045] For example, the alternative function control unit 62 may be capable of executing predetermined functions, such as minimum functions related to driving, braking, and steering, in advance, by storing a program for executing such functions in the storage unit 53, and by the alternative function control unit 62 executing the program when the operation of an in-vehicle device having such functions is restricted.

[0046] Alternatively, the alternative function control unit 62 may obtain an identifier of the in-vehicle equipment whose operation is restricted from the first control unit 52, and before the overwrite installation or activation is started, copy the current program (the program before the update) stored in the in-vehicle equipment to the memory unit 53, and execute the copied program.

[0047] Alternatively, the alternative function control unit 62 may generate and execute an updated program with operation restriction based on update data downloaded from the external device 100 and stored in the storage unit 53. The alternative function control unit 62 does not need to control the execution of alternative functions for all functions of the in-vehicle devices. Controlling the execution of alternative functions is highly effective in maintaining convenience even for limited functions such as the minimum functions necessary for the vehicle to run as described above.

[0048] After this step, the process proceeds to step S101. When the program update of the in-vehicle device that has been restricted is completed, the restriction on the operation is lifted. In step S101, the alternative function control unit 62 stops controlling the alternative function of the in-vehicle device whose restriction on the operation has been lifted. Thereafter, the above-mentioned process is repeated.

[0049] In the above embodiment, the second control unit 60 is provided in the software update device 50, but it may be provided in any of the other in-vehicle devices 11, 12, 21, 22, or may be provided as an independent in-vehicle device.

[0050] <Effects> In this embodiment, it is possible to execute alternative functions to those of in-vehicle equipment whose operation is restricted due to program updates, and it is possible to maintain the functionality of the vehicle as much as possible even during program updates, thereby minimizing loss of convenience of the vehicle.

[0051] Furthermore, if the software update device itself is capable of executing alternative functions, there is no need to identify the in-vehicle devices having alternative functions among the in-vehicle devices included in the network system 1, so the alternative functions can be controlled without depending on the in-vehicle device configuration of the network system 1, making it easier to design and implement the software update device.

[0052] The present disclosure can be understood not only as a software update device, but also as a network system including a software update device, a method executed by a computer equipped in the software update device, a program and a computer-readable non-transitory storage medium storing the program, a vehicle equipped with a software update device, etc. The present disclosure can also be applied to network systems other than network systems mounted on vehicles. [Industrial Applicability]

[0053] The disclosed technology is useful for network systems mounted on vehicles and the like. [Explanation of symbols]

[0054] 1 Network System 10, 20, 30 Bus 11, 12, 21, 22 Automotive equipment 31, 32 Actuator 50 Software update device 51 Communications Department 52 First Control Section 53 Storage section 60 Second Control Section 61 Specific part 62 Alternative function control section 100 External device

Claims

1. a first control unit that executes control to install or install and activate update software in one or more target electronic control units among a plurality of electronic control units connected via an in-vehicle network based on update data downloaded from the center; a second control unit that controls execution of an alternative function corresponding to the function of the target electronic control unit when the operation of the target electronic control unit is restricted during execution of the control to be installed or activated; The first control unit determines whether the target electronic control unit that performs the control is a single bank or a dual bank, The second control unit is When there is an electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, If the target electronic control unit performing the control is a single bank, the execution of the alternative function is started before the installation is performed, and the execution of the alternative function is ended after the installation is completed; When the target electronic control unit performing the control is a dual bank, after completing the installation and before performing the activation, starting the execution of the alternative function, and after completing the activation, ending the execution of the alternative function; A software update device that, if there is no electronic control unit capable of performing the alternative function other than the target electronic control unit that performs the control, does not perform the alternative function and performs the installation and activation for the target electronic control unit when the vehicle is not running.

2. The plurality of electronic control units include two or more electronic control units each having a function of driving, braking, and steering the vehicle, When the target electronic control unit that performs the control is an electronic control unit that controls any one of the functions of driving, braking, and steering of a vehicle, and there is an electronic control unit that can perform the alternative function other than the target electronic control unit that performs the control, The software update device according to claim 1 , wherein the second control unit causes the electronic control unit other than the target electronic control unit that performs the control to execute the function as the alternative function.

3. The software update device according to claim 2 , wherein the second control unit causes an electronic control unit other than the target electronic control unit performing the control to execute the function as the alternative function, on condition that a predetermined operation is received from a user.

4. When the target electronic control unit that performs the control is an in-vehicle device that controls a parking brake to maintain a vehicle stopped state, and there is an electronic control unit that can perform the alternative function other than the target electronic control unit that performs the control, The software update device according to claim 2 , wherein the second control unit causes an electronic control unit that controls a service brake to control the service brake to maintain a vehicle stopped state.

5. The plurality of electronic control units include two or more electronic control units having a driving assistance function, When the target electronic control unit that performs the control is an electronic control unit that controls a driving assistance function, and there is an electronic control unit that can execute the alternative function other than the target electronic control unit that performs the control, The software update device according to claim 1 , wherein the second control unit causes the electronic control unit other than the target electronic control unit that performs the control to execute the driving assistance function as the alternative function.

6. The plurality of electronic control units include two or more electronic control units having a periphery monitoring function, When the target electronic control unit that performs the control is an electronic control unit that controls a function of peripheral monitoring, and there is an electronic control unit that can perform the alternative function other than the target electronic control unit that performs the control, The software update device according to claim 1 , wherein the second control unit causes the electronic control unit other than the target electronic control unit performing the control to execute the periphery monitoring function as the alternative function.

7. The software updating device according to claim 1 , wherein the second control unit executes the alternative function by executing a function that is provided in advance as a function of the software updating device.

8. The software update device according to claim 1 , wherein the second control unit acquires pre-update software from the target electronic control unit that performs the control, and executes the acquired software to execute the alternative function.

9. A step of executing control to install or install and activate update software in one or more target electronic control units among the multiple electronic control units connected via the in-vehicle network based on the update data downloaded from the center; and controlling execution of an alternative function corresponding to the function of the target electronic control unit when the operation of the target electronic control unit is restricted upon execution of the control to be installed or activated; In the step of executing the control, it is determined whether the target electronic control unit that performs the control is a single bank or a dual bank electronic control unit; In the step of controlling the execution, When there is an electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, If the target electronic control unit performing the control is a single bank, the execution of the alternative function is started before the installation is performed, and the execution of the alternative function is ended after the installation is completed; When the target electronic control unit performing the control is a dual bank, after completing the installation and before performing the activation, starting the execution of the alternative function, and after completing the activation, ending the execution of the alternative function; A software update method executed by a computer of a software update device, in which, if there is no electronic control unit capable of performing the alternative function other than the target electronic control unit that performs the control, the alternative function is not executed, and the installation and activation are performed on the target electronic control unit when the vehicle is not running.

10. A step of executing control to install or install and activate update software in one or more target electronic control units among the multiple electronic control units connected via the in-vehicle network based on the update data downloaded from the center; and controlling execution of an alternative function corresponding to the function of the target electronic control unit when the operation of the target electronic control unit is restricted upon execution of the control to be installed or activated; In the step of executing the control, it is determined whether the target electronic control unit that performs the control is a single bank or a dual bank electronic control unit; In the step of controlling the execution, When there is an electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, If the target electronic control unit performing the control is a single bank, the execution of the alternative function is started before the installation is performed, and the execution of the alternative function is ended after the installation is completed; When the target electronic control unit performing the control is a dual bank, after completing the installation and before performing the activation, starting the execution of the alternative function, and after completing the activation, ending the execution of the alternative function; A software update program executed by a computer of a software update device, which does not execute the alternative function when there is no electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, and performs the installation and activation on the target electronic control unit when the vehicle is not running.

11. A vehicle comprising the software update device according to any one of claims 1 to 8.

12. a first control unit that executes control to install or install and activate update software in one or more target electronic control units among a plurality of electronic control units connected via an in-vehicle network based on update data downloaded from the center; a second control unit that controls execution of an alternative function corresponding to the function of the target electronic control unit when the operation of the target electronic control unit is restricted during execution of the control to be installed or activated; The first control unit determines whether the target electronic control unit that performs the control is a single bank or a dual bank, The second control unit is When there is an electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, If the target electronic control unit performing the control is a single bank, the execution of the alternative function is started before the installation is performed, and the execution of the alternative function is ended after the installation is completed; When the target electronic control unit performing the control is a dual bank, after completing the installation and before performing the activation, starting the execution of the alternative function, and after completing the activation, ending the execution of the alternative function; If there is no electronic control unit capable of performing the alternative function other than the target electronic control unit that performs the control, the OTA master does not perform the alternative function and performs the installation and activation on the target electronic control unit when the vehicle is not running.

13. A step of executing control to install or install and activate update software in one or more target electronic control units among the multiple electronic control units connected via the in-vehicle network based on the update data downloaded from the center; and controlling execution of an alternative function corresponding to the function of the target electronic control unit when the operation of the target electronic control unit is restricted upon execution of the control to be installed or activated; In the step of executing the control, it is determined whether the target electronic control unit that performs the control is a single bank or a dual bank electronic control unit; In the step of controlling the execution, When there is an electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, If the target electronic control unit performing the control is a single bank, the execution of the alternative function is started before the installation is performed, and the execution of the alternative function is ended after the installation is completed; When the target electronic control unit performing the control is a dual bank, after completing the installation and before performing the activation, starting the execution of the alternative function, and after completing the activation, ending the execution of the alternative function; A software update method executed by an OTA master computer, in which, if there is no electronic control unit capable of performing the alternative function other than the target electronic control unit that performs the control, the alternative function is not executed, and the installation and activation are performed on the target electronic control unit when the vehicle is not running.

14. A step of executing control to install or install and activate update software in one or more target electronic control units among the multiple electronic control units connected via the in-vehicle network based on the update data downloaded from the center; and controlling execution of an alternative function corresponding to the function of the target electronic control unit when the operation of the target electronic control unit is restricted upon execution of the control to be installed or activated; In the step of executing the control, it is determined whether the target electronic control unit that performs the control is a single bank or a dual bank electronic control unit; In the step of controlling the execution, When there is an electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, If the target electronic control unit performing the control is a single bank, the execution of the alternative function is started before the installation is performed, and the execution of the alternative function is ended after the installation is completed; When the target electronic control unit performing the control is a dual bank, after completing the installation and before performing the activation, starting the execution of the alternative function, and after completing the activation, ending the execution of the alternative function; A software update program to be executed by an OTA master computer, which does not execute the alternative function when there is no electronic control unit capable of executing the alternative function other than the target electronic control unit that performs the control, and which performs the installation and activation on the target electronic control unit when the vehicle is not running.

Images