Electronic control device for vehicle, electronic control system for vehicle, and program for determining configuration information after update

Abstract

To appropriately verify whether or not post-update configuration is qualified under a situation in which a communication connection with a center device cannot be established and before the contract conclusion of an OTA service.SOLUTION: A vehicular electronic control device 13 includes: an update data obtaining unit 34a that obtains, by wired communication, update data from a wired-connection tool that can be operated by a worker; a first post-update configuration information obtaining unit 34b that obtains, by wired communication, first post-update configuration information that is configuration information after update from the wired-connection tool; a software update unit 34c that updates the software of a node subjected to the update by writing the update data in the node subjected to the update; a second post-update configuration information obtaining unit 34b that obtains second post-update configuration information that is the configuration information after update from a node subjected to a management including the node subjected to the update; and a first compliance determining unit 34e that checks up the first post-update configuration information with the second post-update configuration information to determine the compliance of the post-update configuration information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle electronic control device, a vehicle electronic control system, and a post-update configuration information determination program. [Background technology]

[0002] In recent years, with the diversification of vehicle control such as driving assistance functions and autonomous driving functions, the scale of software including programs and data for vehicle control, diagnosis, etc. mounted on nodes such as vehicle electronic control devices (hereinafter referred to as ECUs (Electronic Control Units)) is increasing. In addition, with version upgrades for functional improvements, etc., the opportunities to update (reprogram) software required for node operation are also increasing. Meanwhile, with the development of communication networks, etc., connected car technology is also becoming widespread. In light of these circumstances, a technology has been proposed in which a vehicle electronic control device that functions as a gateway ECU is provided on the vehicle side, and the vehicle electronic control device distributes update data downloaded from a center device to the update target node, and updates the software of the update target node by OTA (Over The Air).

[0003] When the software of the node to be updated is updated, the configuration information including the version of the node's hardware and software is updated. Therefore, in order to determine whether the software of the node to be updated has been updated normally, it is necessary to verify whether the post-update configuration information, which is the configuration information after the update, is normal. For example, Patent Document 1 discloses a configuration in which a vehicle electronic control device acquires post-update configuration information from a managed node including the node to be updated and transmits it to a center device, and the center device compares the post-update configuration information stored in advance with the post-update configuration information received from the vehicle electronic control device to verify whether the post-update configuration information is normal. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-27623 A Summary of the Invention [Problem to be solved by the invention]

[0005] The above-mentioned configuration in which the center device verifies whether the updated configuration information is authentic is based on the premise that the vehicle electronic control device is in a state in which it can establish a communication connection with the center device after a contract for the OTA service is concluded. On the other hand, before a contract for the OTA service is concluded, the vehicle electronic control device is in a state in which it cannot establish a communication connection with the center device, and therefore the center device cannot verify whether the updated configuration information is authentic. Therefore, for example, when updating software of a node using a wired tool in a backyard or the like before a contract for the OTA service is concluded, it cannot verify whether the updated configuration information is authentic.

[0006] The present invention has been made in consideration of the above-mentioned circumstances, and aims to provide a vehicle electronic control device, a vehicle electronic control system, and a post-update configuration information determination program that can appropriately verify whether post-update configuration information is genuine even before a contract for an OTA service is concluded and a communication connection with a center device cannot be established. [Means for solving the problem]

[0007] According to the invention described in claim 1, the update data acquisition unit (34a) Before concluding a contract for the OTA service, in a situation where it is not possible to establish a communication connection with the center device that provides the OTA service, The first post-update configuration information acquiring unit (34b) acquires the update data from a wired tool that can be operated by an operator via wired communication. When communication with the Center device cannot be established,Post-update configuration information is obtained from the wired tool via wired communication as first post-update configuration information. A software update unit (34c) updates the software of the update target node by writing update data to the update target node. A second post-update configuration information acquisition unit (34d) obtains post-update configuration information from a managed node including the update target node as second post-update configuration information. A first consistency determination unit (34e) compares the first post-update configuration information with the second post-update configuration information to determine the consistency of the post-update configuration information.

[0008] When communication with the central device cannot be established The first post-update configuration information obtained from the wired tool is compared with the second post-update configuration information obtained from the managed nodes including the update target node after updating the software of the update target node to determine consistency. Even before a contract for the OTA service is concluded and in a situation where a communication connection with the center device cannot be established, it is possible to appropriately verify whether the post-update configuration information is authentic. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing the overall configuration of an embodiment. [Diagram 2] Diagram showing the electrical configuration of the CGW [Diagram 3] Diagram showing the electrical configuration of the ECU [Figure 4] CGW Functional Block Diagram [Diagram 5] A diagram showing updated configuration information transferred from the wired tool to the CGW [Figure 6] A diagram showing updated configuration information transferred from the wired tool to the CGW [Figure 7] Diagram showing configuration information transferred from the managed ECU to the CGW [Figure 8] RxSWIN diagram [Figure 9] Process flow diagram [Figure 10] Process flow diagram [Figure 11] Process flow diagram [Figure 12] Process flow diagram [Figure 13] flowchart DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] An embodiment will be described below with reference to the drawings. The vehicle electronic control system is a system capable of updating software for vehicle control, diagnosis, etc., mounted on an electronic control device (hereinafter referred to as ECU (Electronic Control Unit)) by OTA (Over The Air). The software includes programs and data for implementing functions such as vehicle control and diagnosis, and can also be expressed as an application. In this embodiment, a case where software for vehicle control, diagnosis, etc. is updated will be described, but the present invention can also be applied to a case where a map application or map data used in the map application is updated, for example.

[0011] 1, a vehicle electronic control system 1 includes a center device 3 on the communication network 2 side, and a vehicle-side system 4 and a display terminal 5 on the vehicle side. The communication network 2 includes a mobile communication network such as a 4G line, the Internet, WiFi (Wireless Fidelity) (registered trademark), and the like.

[0012] The display terminal 5 is a terminal having a function of receiving operation input from a user and a function of displaying various screens, and is, for example, a mobile terminal 6 such as a smartphone or tablet that can be carried by the user, or an in-vehicle display 7 arranged in the vehicle cabin. The mobile terminal 6 can perform data communication with the center device 3 via the communication network 2 as long as it is within the communication range of the mobile communication network. The in-vehicle display 7 is connected to the vehicle-side system 4, and may also have a navigation function. Furthermore, the in-vehicle display 7 may be an in-vehicle display ECU having the function of an ECU, or may have a function of controlling display on a center display, a meter display, etc.

[0013] When the user is outside the vehicle cabin and within the communication range of the mobile communication network, the user can perform procedures related to the software update by making operational inputs while checking various screens related to the software update on the mobile terminal 6. When the user is inside the vehicle cabin, the user can perform procedures related to the software update by making operational inputs while checking various screens related to the software update on the in-vehicle display 7. In other words, the user can perform procedures related to the software update by using the mobile terminal 6 and the in-vehicle display 7 appropriately when outside the vehicle cabin and when inside the vehicle cabin.

[0014] The center device 3 controls the software update function on the communication network 2 side in the vehicle electronic control system 1, and functions as an OTA center that provides OTA services. The center device 3 has a file server 8, a web server 9, and a management server 10, and the servers 8 to 10 are configured to be able to communicate data with each other. That is, the center device 3 includes multiple servers that are different for each function.

[0015] The file server 8 is a server that manages software files distributed from the center device 3 to the vehicle-side system 4. The file server 8 manages update data provided by a supplier or the like that is a provider of the software distributed from the center device 3 to the vehicle-side system 4, specification data provided by an OEM (Original Equipment Manufacturer), vehicle status acquired from the vehicle-side system 4, and the like. The file server 8 is capable of data communication with the vehicle-side system 4 via the communication network 2, and upon receiving a download request for package data from the vehicle-side system 4, transmits to the vehicle-side system 4 download data including package data in which the update data and the specification data are packaged into one file. The download data includes a compressed zip file. Note that the file server 8 may not transmit the update data and the specification data to the vehicle-side system 4 at the same time, but may transmit the specification data to the vehicle-side system 4 first, and then transmit the download data including package data in which the update data is packaged into one file to the vehicle-side system 4.

[0016] The web server 9 is a server that manages web information. The web server 9 transmits web data that it manages in response to a request from a web browser of the mobile terminal 6, etc. The management server 10 is a server that manages personal information of users who are registered for the software update service, software update history for each vehicle, etc.

[0017] The vehicle-side system 4 includes a vehicle master device 11. The vehicle master device 11 controls the updating function of the vehicle-side software in the vehicle electronic control system 1, and functions as an OTA master. The vehicle master device 11 includes a DCM (Data Communication Module) 12 and a CGW (Central Gate Way) 13. The DCM 12 performs data communication with the center device 3 via the communication network 2.

[0018] The CGW 13 functions as a gateway ECU and corresponds to a vehicle electronic control device. The DCM 12 and the CGW 13 are connected to each other via a first bus 14 so as to be able to communicate data with each other. In FIG. 1, the DCM 12 and the in-vehicle display 7 are connected to the same first bus 14, but the DCM 12 and the in-vehicle display 7 may be connected to different buses. The CGW 13 may have a part or all of the functions of the DCM 12, or the DCM 12 may have a part or all of the functions of the CGW 13. That is, in the vehicle master device 11, the functions of the DCM 12 and the CGW 13 may be divided in any manner. The vehicle master device 11 may be composed of two ECUs, the DCM 12 and the CGW 13, or may be composed of one integrated ECU having the functions of the DCM 12 and the CGW 13.

[0019] In addition to the first bus 14, a second bus 15, a third bus 16, a fourth bus 17, and a fifth bus 18 are connected to the CGW 13 as buses inside the vehicle, and various ECUs 19 are connected via the buses 15 to 17, and a power management ECU 20 is connected via the bus 18. The ECUs 19 correspond to nodes.

[0020] The second bus 15 is, for example, a bus for a body system network. The ECU 19 connected to the second bus 15 is an ECU that controls the body system. The ECUs that control the body system include, for example, a door ECU that controls locking / unlocking of doors, a meter ECU that controls display on a meter display, an air conditioner ECU that controls the operation of an air conditioner, a window ECU that controls opening and closing of windows, and a security ECU that operates to prevent theft of the vehicle.

[0021] The third bus 16 is, for example, a bus for a driving system network. The ECU 19 connected to the third bus 16 is an ECU that controls the driving system. The ECU that controls the driving system is, for example, an engine ECU that controls the operation of the engine, a brake ECU that controls the operation of the brakes, an ECT (Electronic Controlled Transmission) ECU that controls the operation of the automatic transmission, a power steering ECU that controls the operation of the power steering, etc.

[0022] The fourth bus 17 is, for example, a bus for a multimedia network. The ECU 19 connected to the fourth bus 17 is an ECU that controls the multimedia system. The ECU that controls the multimedia system is, for example, a navigation ECU for controlling a navigation system, an ETC ECU for controlling an electronic toll collection system (ETC (Electronic Toll Collection System, registered trademark)), etc. The buses 15 to 17 may be buses of a system other than a bus for a body system network, a bus for a driving system network, and a bus for a multimedia system network. Furthermore, the number of buses and the number of ECUs 19 are not limited to the configuration illustrated. The power supply management ECU 20 is an ECU that manages the power supplied to the DCM 12, the CGW 13, the various ECUs 19, and the like.

[0023] A sixth bus 21 is connected to the CGW 13 as a bus outside the vehicle. A DLC (Data Link Coupler) connector 22 to which a wired tool 23 is detachably connected is connected to the sixth bus 21. The wired tool 23 is detachably connected to a storage 24, and is capable of reading information stored in the storage 24 when the storage 24 is connected. The storage 24 is, for example, a Universal Serial Bus (USB) memory, a memory card, a flash memory storage device such as an SSD (Solid State Drive), or the like.

[0024] The vehicle inside buses 14-18 and the vehicle outside bus 21 are configured by, for example, a CAN (Controller Area Network, registered trademark) bus, and the CGW 13 performs data communication between the DCM 12, the ECU 19, and the wired tool 23 in accordance with the CAN data communication standard and the diagnostic communication standard (UDS (Unified Diagnosis Services): ISO14229). Note that the DCM 12 and the CGW 13 may be connected by Ethernet, and the DLC connector 22 and the CGW 13 may be connected by Ethernet.

[0025] When updating software wirelessly, the DCM 12 downloads download data from the file server 8 and transmits the downloaded download data to the CGW 13. When the CGW 13 receives the download data from the DCM 12, it unzips the received download data to obtain package data, and obtains update data and specification data from the obtained package data. The CGW 13 transmits the update data to the update target ECU 19 that is the target of the software update, and instructs the update target ECU 19 to install the obtained update data, on the condition that a condition for instructing installation to write the update data is satisfied. The conditions for instructing installation include that approval for installation has been obtained, that the vehicle state is in a state where installation is possible, that the update target ECU 19 is in a state where installation is possible, and that the reprogram data is normal data. When the update target ECU 19 is instructed to install the update data by the CGW 13, it installs the update data, on the condition that a condition for executing installation is satisfied.

[0026] When installation of the update data is completed in the update target ECU 19, the CGW 13 instructs the update target ECU 19 to activate, provided that conditions for instructing activation to make the software valid after the update are met. The conditions for instructing activation include that consent to activation has been obtained, the vehicle state is in a state in which activation is possible, the update target ECU 19 is in a state in which activation is possible, etc. When the update target ECU 19 receives the activation instruction from the CGW 13, the update target ECU 19 executes the activation, provided that conditions for executing the activation are met.

[0027] On the other hand, when updating software via a wired connection, when the wired tool 23 is connected to the DLC connector 22, the wired tool 23 transfers the update data to the CGW 13. When the update data is transferred from the wired tool 23, the CGW 13 transmits the update data to the update target ECU 19, on the condition that a condition for instructing installation to write the update data is satisfied, and instructs the update target ECU 19 to install the acquired update data. When the update target ECU 19 is instructed by the CGW 13 to install the update data, on the condition that a condition for executing the installation is satisfied, the update target ECU 19 installs the update data.

[0028] When installation of the update data is completed in the update target ECU 19, the CGW 13 instructs the update target ECU 19 to activate, provided that conditions for instructing activation to make the software valid after the update are satisfied. When the update target ECU 19 receives the activation instruction from the CGW 13, the update target ECU 19 executes the activation, provided that conditions for executing the activation are satisfied.

[0029] As shown in FIG. 2, the CGW 13 has, as electrical functional blocks, a microcomputer (hereinafter, referred to as a microcomputer) 25, a storage 26, a data transfer circuit 27, a power supply circuit 28, and a power supply detection circuit 29. The microcomputer 25 has a CPU (Central Processing Unit) 25a, a ROM (Read Only Memory) 25b, a RAM (Random Access Memory) 25c, and a flash memory 25d. The flash memory 25d includes a secure area in which information cannot be read from outside the CGW 13. The microcomputer 25 executes various control programs stored in a non-transitive substantial storage medium to perform various processes and control the operation of the CGW 13. In this embodiment, a configuration in which one microcomputer 25 is mounted on the CGW 13 is illustrated, but the number, specifications, and combination of microcomputers mounted on the CGW 13 are determined according to the processing power required for the CGW 13. That is, if a relatively high processing capability is required for the CGW 13, a microcomputer with relatively high specifications is used, or multiple microcomputers are used to realize distributed processing or parallel processing.

[0030] The storage 26 is, for example, an eMMC (embedded Multi Media Card) or NorFlash. The data transfer circuit 27 controls data communication between the buses 14 to 18, 21 in accordance with the CAN data communication standard and diagnostic communication standard. The power supply circuit 28 inputs the battery power supply, the accessory power supply, and the ignition power supply. The power supply detection circuit 29 detects the voltage value of the battery power supply, the accessory power supply, and the ignition power supply input by the power supply circuit 28, compares these detected voltage values ​​with a predetermined voltage threshold value, and outputs the comparison result to the microcomputers 25 to 26. The microcomputers 25 to 26 determine whether the battery power supply, the accessory power supply, and the ignition power supply supplied from the outside to the CGW 13 are normal or abnormal based on the comparison result input from the power supply detection circuit 29.

[0031] 3, the ECU 19 has, as electrical functional blocks, a microcomputer 30, a data transfer circuit 31, a power supply circuit 32, and a power supply detection circuit 33. The microcomputer 30 has a CPU 30a, a ROM 30b, a RAM 30c, and a flash memory 30d. The flash memory 30d includes a secure area in which information cannot be read from outside the ECU 19. The microcomputer 30 executes various control programs stored in a non-transient substantial storage medium to perform various processes and control the operation of the ECU 19.

[0032] The data transfer circuit 31 controls data communication between the buses 15 to 17 in accordance with the CAN data communication standard. The power supply circuit 32 inputs the battery power supply, the accessory power supply, and the ignition power supply. The power supply detection circuit 33 detects the voltage values ​​of the battery power supply, the accessory power supply, and the ignition power supply input by the power supply circuit 32, compares these detected voltage values ​​with a predetermined voltage threshold value, and outputs the comparison result to the microcomputer 30. The microcomputer 30 determines whether the battery power supply, the accessory power supply, and the ignition power supply supplied from the outside to the ECU 19 are normal or abnormal based on the comparison result input from the power supply detection circuit 27. The ECUs 19 are basically of the same configuration, although the loads connected to them, such as sensors and actuators, are different.

[0033] In the above-described configuration, after the contract for the OTA service is concluded, in a situation where the CGW 13 can establish a communication connection with the center device 3, it is possible to update the software either wirelessly or wired. On the other hand, before the contract for the OTA service is concluded, in a situation where the CGW 13 cannot establish a communication connection with the center device 3, it is not possible to update the software wirelessly, and the software can only be updated wired.

[0034] When the software of the ECU 19 to be updated is updated, the configuration information including the version of the hardware and the software of the node is updated. Therefore, in order to determine whether the software of the ECU 19 to be updated has been updated normally, it is necessary to verify whether the updated configuration information is regular or not. If the software update is subject to a legal requirement, the RxSWIN (Rx Software Identification Number) is also updated in addition to the configuration information, so it is necessary to verify whether the updated RxSWIN is also regular or not. The RxSWIN is an identifier for managing the software version of the related system for each Regulation No. in the Regulations on Automobile Structure and Equipment (UN Regulations), and corresponds to system software identification information. The software update being subject to a legal requirement means, for example, a software update including an ECU 19 involved in driving control such as an engine ECU in the ECU 19 to be updated. On the other hand, the software update not being subject to a legal requirement means a software update including only an ECU 19 not involved in driving control such as a navigation ECU in the ECU 19 to be updated, not including an ECU 19 involved in driving control in the ECU 19 to be updated.

[0035] After the OTA service contract is concluded, the CGW 13 is in a state in which a communication connection can be established with the center device 3, so the center device 3 can verify whether the updated configuration information and the updated RxSWIN are genuine. However, before the OTA service contract is concluded, the CGW 13 is in a state in which a communication connection cannot be established with the center device 3, so when updating software via a wired connection, the center device 3 cannot verify whether the updated configuration information and the updated RxSWIN are genuine. In this embodiment, by adopting the configuration described below, even if software is updated via a wired connection before the OTA service contract is concluded and the CGW 13 is in a state in which a communication connection cannot be established with the center device 3, it is possible to verify whether the updated configuration information and the updated RxSWIN are genuine.

[0036] As shown in FIG. 4, the CGW 13 includes, in a control unit 34 that controls its own operation, an update data acquisition unit 34a, a first post-update configuration information acquisition unit 34b, a software update unit 34c, a second post-update configuration information acquisition unit 34d, a first consistency determination unit 34e, a first post-update RxSWIN acquisition unit 34f, an RxSWIN holding unit 34g, a second post-update RxSWIN acquisition unit 34h, a second consistency determination unit 34i, a rollback implementation unit 34j, and a display control unit 34k. The first post-update RxSWIN acquisition unit 34f corresponds to a first post-update system software identification information acquisition unit. The RxSWIN holding unit 34g corresponds to a system software identification information holding unit. The second post-update RxSWIN acquisition unit 34h corresponds to a second post-update system software identification information acquisition unit. Each of these units 34a to 34k corresponds to a function executed by a post-update configuration information determination program. That is, the control unit 34 performs the functions of the respective units 34a to 34k by executing the post-update configuration information determination program.

[0037] The storage 24 stores update data and updated configuration information. When an operator performs a read operation while the storage 24 is connected to the wired tool 23, the update data and updated configuration information are transferred from the storage 24 to the wired tool 23 and stored therein. Thereafter, when an operator performs a transfer operation while the wired tool 23 is wired connected to the CGW 13 via the DLC connector 22, the update data and updated configuration information stored in the wired tool 23 are transferred to the CGW 13 and stored therein. At this time, the wired tool 23 is in a state in which it is unable to establish a communication connection with the center device 3. That is, the wired tool 23 transfers the update data and updated configuration information to the CGW 13 while it is unable to establish a communication connection with the center device 3.

[0038] The updated configuration information transferred from the storage 24 to the CGW 13 via the wired tool 23 and stored therein includes the components shown in Figures 5 and 6. The updated configuration information includes RxSWIN, target IDs indicating managed ECUs 19 including update target ECUs 19 and non-update target ECUs 19, ECU hardware IDs (ECU_HW_ID) indicating the hardware version of the managed ECUs 19, and ECU software IDs (ECU_SW_ID) indicating the software version of the managed ECUs 19. If the software update is subject to legal requirements, RxSWIN data exists, as shown in Figure 5. On the other hand, if the software update is not subject to legal requirements and is not subject to legal requirements, RxSWIN data does not exist, as shown in Figure 6.

[0039] When an operator performs a transfer operation using the wired tool 23, the update data acquisition unit 34a acquires the update data transferred from the wired tool 23.

[0040] When an operator performs a transfer operation using the wired tool 23 and updated configuration information is transferred from the wired tool 23, the first post-update configuration information acquisition unit 34b acquires the transferred updated configuration information as first post-update configuration information.

[0041] The software update unit 34c transmits update data to the ECU 19 to be updated, instructs the ECU 19 to be updated to install the acquired update data, and when installation of the update data is completed in the ECU 19 to be updated, instructs the ECU 19 to be updated to activate, thereby updating the software.

[0042] When the software update is completed in the update target ECU 19, the second post-update configuration information acquisition unit 34d transmits an information transmission request to the managed ECU 19 that is the management target. The managed ECU 19 includes the update target ECU 19 and the non-update target ECU 19 that is not a target of software update but is a non-update target and operates in cooperation with the update target ECU 19. That is, the non-update target ECU 19 is an ECU 19 that may be affected by the software update of the update target ECU 19. In this case, when the update target ECU 19 receives an information transmission request from the CGW 13, it transmits post-update configuration information to the CGW 13. When the non-update target ECU 19 receives an information transmission request from the CGW 13, it transmits configuration information that has not changed before and after the software update of the update target ECU 19 to the CGW 13 as post-update configuration information.

[0043] When the second post-update configuration information acquisition unit 34d receives the updated configuration information from the managed ECU 19, it acquires the received updated configuration information as the second post-update configuration information. The configuration information transferred from the managed ECU 19 to the CGW 13 includes the above-mentioned target ID, ECU hardware ID, and ECU software ID. After the software update, the second post-update configuration information acquisition unit 34d acquires the updated configuration information from the configuration information shown in Fig. 7 as the second post-update configuration information. Fig. 7 illustrates an example in which the ECU_SW_ID of ECU_A is updated from "SW_A1" to "SW_A2", and the ECU_SW_ID of ECU_B is updated from "SW_B1" to "SW_B2".

[0044] The first consistency determination unit 34e compares the first post-update configuration information with the second post-update configuration information to determine whether they match, and determines the consistency of the post-update configuration information. In this case, if the software update is completed normally, the first post-update configuration information and the second post-update configuration information match, and if the software update is not completed normally, the first post-update configuration information and the second post-update configuration information do not match. When the first consistency determination unit 34e determines that the first post-update configuration information and the second post-update configuration information match, the first consistency determination unit 34e determines that the post-update configuration information is consistent, that is, that the post-update configuration information is consistent. On the other hand, when the first consistency determination unit 34e determines that the first post-update configuration information and the second post-update configuration information do not match, the first consistency determination unit 34e determines that the post-update configuration information is inconsistent, that is, that the post-update configuration information is not consistent and is inconsistent.

[0045] When the post-update configuration information is acquired as the first post-update configuration information by the first post-update configuration information acquisition unit 34b, the first post-update RxSWIN acquisition unit 34f acquires the RxSWIN included in the post-update configuration information as the first post-update RxSWIN. That is, if the software update is subject to a legal requirement, the first post-update RxSWIN acquisition unit 34f acquires the first post-update RxSWIN since RxSWIN data exists. If the software update is not subject to a legal requirement, the first post-update RxSWIN acquisition unit 34f does not acquire the first post-update RxSWIN since RxSWIN data does not exist.

[0046] As shown in Fig. 8, the RxSWIN holding unit 34g holds the RxSWIN, and if the software update is subject to a legal requirement, it updates the RxSWIN held by it before and after the software update. For example, after activation is completed, the RxSWIN held in the RxSWIN holding unit 34g is updated to the RxSWIN acquired by the first post-update RxSWIN acquisition unit 34f. On the other hand, if the software update is not subject to a legal requirement, the RxSWIN holding unit 34g does not update the RxSWIN held by it before and after the software update. Fig. 8 illustrates an example in which the RxSWIN is updated from "01234" to "012345" when the software update is subject to a legal requirement.

[0047] The second post-update RxSWIN acquisition unit 34h acquires the RxSWIN obtained by updating the RxSWIN held in the RxSWIN holding unit 34g as the second post-update RxSWIN. That is, if the software update is subject to a legal requirement, the second post-update RxSWIN acquisition unit 34h acquires the second post-update RxSWIN because RxSWIN is updated before and after the software update. If the software update is not subject to a legal requirement, the second post-update RxSWIN acquisition unit 34h does not acquire the second post-update RxSWIN because RxSWIN is not updated before and after the software update.

[0048] The second consistency determination unit 34i compares the first updated RxSWIN with the second updated RxSWIN to determine whether they match, and determines the consistency of the updated RxSWIN. In this case, if the software update is subject to a legal requirement and the software update is completed normally, the first updated RxSWIN and the second updated RxSWIN match, and if the software update is not completed normally, the first updated RxSWIN and the second updated RxSWIN do not match. When the second consistency determination unit 34i determines that the first updated RxSWIN and the second updated RxSWIN match, it determines that the updated RxSWIN is consistent, that is, that the updated RxSWIN is consistent. On the other hand, when the second consistency determination unit 34i determines that the first updated RxSWIN and the second updated RxSWIN do not match, it determines that the updated RxSWIN is not consistent, that is, that the updated RxSWIN is not consistent and is inconsistent.

[0049] When the software update is subject to a legal requirement, the rollback implementation unit 34j determines whether at least one of the post-update RxSWIN and the post-update configuration information is consistent, and when it is determined that the software update has been abnormally completed, performs a rollback to return the software of the update target ECU 19 to the state before the update. When the software update is not subject to a legal requirement, the rollback implementation unit 34j determines whether the post-update configuration information is consistent, and when it is determined that the software update has been abnormally completed, performs a rollback to return the software of the update target ECU 19 to the state before the update. In this case, the rollback implementation unit 34j performs a rollback according to the memory configuration of the non-volatile memory mounted in the update target ECU 19.

[0050] When the software update is subject to a legal requirement, if the display control unit 34k determines that both the post-update RxSWIN and the post-update configuration information are consistent and determines that the software update has been completed successfully, the display control unit 34k transmits a successful completion notification to the in-vehicle display 7 and causes the in-vehicle display 7 to display that the software update has been completed successfully. When the software update is not subject to a legal requirement, if the display control unit 34k determines that the post-update configuration information is consistent and determines that the software update has been completed successfully, the display control unit 34k transmits a successful completion notification to the in-vehicle display 7 and causes the in-vehicle display 7 to display that the software update has been completed successfully.

[0051] Furthermore, when the software update is subject to a legal requirement, the display control unit 34k determines whether at least one of the post-update RxSWIN and the post-update configuration information is consistent, and when it is determined that the software update has been abnormally completed, sends an abnormal completion notification to the in-vehicle display 7 and causes the in-vehicle display 7 to display that the software update has not been normally completed. When the software update is not subject to a legal requirement, the display control unit 34k determines whether at least one of the post-update configuration information is consistent, and when it is determined that the software update has been abnormally completed, sends an abnormal completion notification to the in-vehicle display 7 and causes the in-vehicle display 7 to display that the software update has not been normally completed.

[0052] Next, the operation of the above-mentioned configuration will be described with reference to Figures 9 to 13. Here, it is assumed that software updates are subject to legal requirements, and that the update data, updated configuration information, and updated RxSWIN are transferred from the storage 24 to the wired tool 23 and stored therein.

[0053] When the operator performs a transfer operation using the wired tool 23, the wired tool 23 transfers the update data, the updated configuration information, and the updated RxSWIN to the CGW 13 via the DLC 22 (t1). In the CGW 13, when the update data, the updated configuration information, and the updated RxSWIN are transferred from the wired tool 23 via the DLC 22, the control unit 34 stores the transferred update data, stores the updated configuration information as first updated configuration information, and stores the updated RxSWIN as first updated RxSWIN (S1, corresponding to the update data acquisition procedure, the first updated configuration information acquisition procedure, and the first updated system software identification information acquisition procedure).

[0054] When an operator performs a software update operation using the wired tool 23, the wired tool 23 transfers an update execution instruction to the CGW 13 via the DLC 22 (t2). When the update execution instruction is transferred from the wired tool 23 via the DLC 22, the control unit 34 starts the update process (S2, which corresponds to the software update procedure). That is, the control unit 34 transmits update data to the update target ECU 19, provided that a condition enabling installation is satisfied, and transmits an installation instruction to the update target ECU 19 (t3). When the update target ECU 19 receives the installation instruction from the CGW 13, it installs the update data, provided that a condition enabling installation is satisfied. When the update target ECU 19 completes the installation of the update data, it transmits an installation completion notification to the CGW 13 (t4).

[0055] When the control unit 34 receives an installation completion notification from the update target ECU 19, it determines the completion of installation of the update data in the update target ECU 19, and transmits an activation instruction to the update target ECU 19 on the condition that a condition for instructing activation to make the software valid after the update is completed is satisfied (t5). When the update target ECU 19 receives the activation instruction from the CGW 13, it executes the activation on the condition that a condition for executing the activation is satisfied. When the update target ECU 19 completes the activation, it transmits an activation completion notification to the CGW 13 (t6). At this time, the update target ECU 19 has updated the configuration information by performing the update process.

[0056] When the control unit 34 receives an activation completion notification from the ECU 19 to be updated, it completes the update process (S3), updates the RxSWIN that it holds (S4), and saves the updated RxSWIN as a second post-update RxSWIN (S5, corresponding to the second post-update system software identification information acquisition procedure).

[0057] The control unit 34 transmits an approval display instruction to the in-vehicle display 7 serving as the HMI (t7). Upon receiving the approval display instruction from the CGW 13, the in-vehicle display 7 displays an information collection approval screen. The information collection approval screen is a screen on which the worker can select whether or not to approve the collection of updated configuration information. When the worker performs an operation to approve approval on the in-vehicle display 7, the in-vehicle display 7 transmits approval to the CGW 13 (t8).

[0058] When the control unit 34 receives the consent from the in-vehicle display 7, it specifies the consent for information collection (S6) and transmits an information collection instruction to the managed ECU 19 (t9). When the managed ECU 19 receives the information collection instruction from the CGW 13, it reads the updated configuration information and transmits the read updated configuration information to the CGW 13 (t10).

[0059] When the control unit 34 receives the updated configuration information from the managed ECU 19, the control unit 34 stores the received updated configuration information as second updated configuration information (S7, which corresponds to the second updated configuration information acquisition step).

[0060] The control unit 34 compares the first post-update RxSWIN with the second post-update RxSWIN (S8) and determines whether they match (S9, corresponding to the second consistency determination procedure). If the control unit 34 determines that they match and that the post-update RxSWIN is consistent (S9: YES), it compares the first post-update configuration information with the second post-update configuration information (S10) and determines whether they match (S11, corresponding to the first consistency determination procedure). If the control unit 34 determines that they match and that the post-update configuration information is consistent (S11: YES), it specifies that the software update has been completed successfully (S12) and transmits a successful completion notification to the in-vehicle display 7 (t11). When the in-vehicle display 7 receives the successful completion notification from the CGW 13, it displays that the software update has been completed successfully.

[0061] Specifically, ECU_A, ECU_B, and ECU_C shown in Fig. 5 correspond to the first update target node, the second update target node, and the non-update target node, respectively, shown in Fig. 9 to Fig. 12. When the control unit 34 determines that the RxSWIN included in the configuration information after the software update shown in Fig. 5 matches the RxSWIN after the software update shown in Fig. 7, and determines that the configuration information after the software update shown in Fig. 5 matches the configuration information after the software update shown in Fig. 8, it determines that the software update has been successfully completed.

[0062] On the other hand, when the control unit 34 determines that the first post-update RxSWIN and the second post-update RxSWIN do not match and determines that the post-update RxSWIN is inconsistent (S9: NO), or when the control unit 34 determines that the post-update RxSWIN is inconsistent but determines that the first post-update configuration information and the second post-update configuration information do not match and determines that the post-update configuration information is inconsistent (S11: NO), it starts a rollback process to return the software of the update target ECU 19 to the state before the update (S13). That is, the control unit 34 transmits rollback data to the update target ECU 19 and transmits an installation instruction to the update target ECU 19 (t14). When the update target ECU 19 receives the installation instruction from the CGW 13, it executes the installation of the rollback data on the condition that the condition for executing the installation is satisfied. When the update target ECU 19 completes the installation of the rollback data, it transmits an installation completion notification to the CGW 13 (t13).

[0063] When the control unit 34 receives an installation completion notification from the update target ECU 19, it determines the completion of installation of the rollback data in the update target ECU 19, and transmits an activation instruction to the update target ECU 19 on the condition that a condition for instructing activation that enables the software after the update is completed is satisfied (t14). When the update target ECU 19 receives the activation instruction from the CGW 13, it executes the activation on the condition that a condition for executing the activation is satisfied. When the update target ECU 19 completes the activation, it transmits an activation completion notification to the CGW 13 (t15).

[0064] When the control unit 34 receives an activation completion notification from the update target ECU 19, it completes the rollback process (S14), identifies the abnormal completion of the software update (S15), and transmits an abnormal completion notification to the in-vehicle display 7 (t16). When the in-vehicle display 7 receives the abnormal completion notification from the CGW 13, it displays that the software update was not completed normally.

[0065] The above has been described regarding the case in which the software update is subject to legal requirements in the control unit 34. However, if the software update is not subject to legal requirements, or if the updated RxSWIN is not transferred from the wired tool 23 to the CGW 13 via the DLC 22, the above-mentioned S4, S5, S8, and S9 are omitted, and the RxSWIN held by the control unit 34 is not updated, and the RxSWIN is not compared.

[0066] In addition, although the configuration in which the control unit 34 transmits an acceptance display instruction to the in-vehicle display 7 has been exemplified, the acceptance display instruction may be transmitted to the wired tool 23, or the consent permission may be received from the wired tool 23 when the worker performs an operation to permit acceptance in the wired tool 23. Furthermore, the control unit 34 may transmit an acceptance display instruction to both the in-vehicle display 7 and the wired tool 23, allowing the worker to perform an operation to permit acceptance in either the in-vehicle display 7 or the wired tool 23. Furthermore, the worker may be able to select the destination to which the acceptance display instruction is transmitted.

[0067] In addition, in the illustrated embodiment, the control unit 34 transmits a normal completion notification or an abnormal completion notification to the in-vehicle display 7, but the normal completion notification or the abnormal completion notification may be transmitted to the wired tool 23, or may be transmitted to both the in-vehicle display 7 and the wired tool 23. Furthermore, the operator may be able to select the destination to which the normal completion notification or the abnormal completion notification is transmitted.

[0068] In addition, an example has been given of the case in which the control unit 34 first compares the first post-update RxSWIN with the second post-update RxSWIN, and then compares the first post-update configuration information with the second post-update configuration information on the condition that the post-update RxSWIN is consistent, but it is also possible to first compare the first post-update configuration information with the second post-update configuration information, and then compare the first post-update RxSWIN with the second post-update RxSWIN on the condition that the post-update configuration information is consistent.

[0069] In addition, although an example has been given of the case where the wired tool 23 simultaneously transfers the update data, the updated configuration information, and the updated RxSWIN to the CGW 13, the timing of transferring the update data to the CGW 13 may be different from the timing of transferring the updated configuration information and the updated RxSWIN to the CGW 13. In addition, although an example has been given of the case where the updated RxSWIN is included as one of the components of the updated configuration information transferred to the CGW 13, the updated RxSWIN may be different from the updated configuration information, and the timing of transferring the updated RxSWIN to the CGW 13 may be different from the timing of transferring the updated configuration information to the CGW 13.

[0070] As described above, according to this embodiment, the following advantageous effects can be obtained. The CGW 13 is configured to compare the first post-update configuration information acquired from the wired tool 23 with the second post-update configuration information acquired from the managed ECU 19 including the update target ECU 19 after updating the software of the update target ECU 19, to determine the consistency of the post-update configuration information. Even before a contract for the OTA service is concluded and in a situation in which a communication connection with the center device cannot be established, it is possible to appropriately verify whether the post-update configuration information is authentic, and to appropriately ensure safety and security.

[0071] The CGW 13 compares the first updated RxSWIN obtained from the wired tool 23 with the second updated RxSWIN obtained by updating the RxSWIN held by the CGW 13 after a software update to determine the consistency of the updated RxSWIN. When software updates are subject to legal requirements, safety and security can be more appropriately guaranteed.

[0072] In CGW13, if it is determined that the post-update RxSWIN is inconsistent, or if it is determined that the post-update RxSWIN is inconsistent but the post-update configuration information is inconsistent, a rollback is performed. By performing a rollback, the software on the node to be updated can be returned to the state before the update.

[0073] Although the present disclosure has been described based on the embodiment, it is understood that the present disclosure is not limited to the embodiment or structure. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

[0074] When the update data, the updated configuration information, and the updated RxSWIN are transferred from the wired tool 23 via the DLC 22, the control unit 34 may determine whether or not a contract for the OTA service has not yet been concluded, and may determine whether or not a communication connection with the center device 3 can be established. That is, the control unit 34 may perform the above-mentioned step S1 and subsequent steps on the condition that it has determined that a contract for the OTA service has not yet been concluded, and that a communication connection with the center device 3 cannot be established. The control unit 34 may also perform the above-mentioned step S1 and subsequent steps on the condition that it has determined that a contract for the OTA service has already been concluded, but that a communication connection with the center device 3 cannot be established.

[0075] After the OTA service contract is concluded and in a situation where a communication connection with the center device 3 can be established, the updated configuration information and the updated RxSWIN may be collated by both the center device 3 and the CGW 13. In addition, for example, in normal times when a communication connection with the center device 3 can be established, the updated configuration information and the updated RxSWIN may be collated by the center device 3, and in emergency times when a communication connection with the center device 3 cannot be established, the updated configuration information and the updated RxSWIN may be collated by the CGW 13, and so on, depending on the situation.

[0076] The control unit and its pattern described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor and memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and its pattern described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and its pattern described in the present disclosure may be realized by one or more special-purpose computers configured by a combination of a processor and memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. [Explanation of symbols]

[0077] In the drawing, 1 is a vehicle electronic control system, 13 is a vehicle electronic control device, 19 is an ECU (node), 23 is a wired tool, 34 is a control unit, 34a is an update data acquisition unit, 34b is a first post-update configuration information acquisition unit, 34c is a software update unit, 34d is a second post-update configuration information acquisition unit, 34e is a first consistency judgment unit, 34f is a first post-update RxSWIN acquisition unit (first post-update system software identification information acquisition unit), 34g is an RxSWIN holding unit (system software identification information holding unit), 34h is a second post-update RxSWIN acquisition unit (second post-update system software identification information acquisition unit), 34i is a second consistency judgment unit, 34j is a rollback implementation unit, and 34k is a display control unit.

Claims

1. An update data acquisition unit (34a) that acquires update data from a wired tool that can be operated by an operator via wired communication in a situation where a communication connection with a center device that provides the OTA service cannot be established before a contract for the OTA service is concluded; a first post-update configuration information acquisition unit (34b) that acquires post-update configuration information as first post-update configuration information from the wired tool through wired communication in a situation in which a communication connection with the center device cannot be established; a software update unit (34c) that updates software of the update target node by writing the update data to the update target node; a second post-update configuration information acquisition unit (34d) for acquiring post-update configuration information from a managed node including the update target node as second post-update configuration information; a first consistency determination unit (34e) that compares the first post-update configuration information with the second post-update configuration information to determine consistency of the post-update configuration information.

2. 2. The vehicle electronic control device according to claim 1, wherein the configuration information includes identification information of the managed node, version information of the hardware of the managed node, and version information of the software of the managed node.

3. a first updated system software identification information acquiring unit (34f) for acquiring, via wired communication, the updated system software identification information from the wired tool as first updated system software identification information; a system software identification information storage unit (30g) for storing system software identification information; a second updated system software identification information acquiring unit (34h) for acquiring, as second updated system software identification information, system software identification information obtained by updating the system software identification information stored in the system software identification information storing unit after a software update; 3. The electronic control device for a vehicle as described in claim 1 or 2, further comprising a second consistency determination unit (34i) that compares the first post-update system software identification information with the second post-update system software identification information to determine the consistency of the post-update system software identification information.

4. 4. The electronic control device for a vehicle according to claim 3, wherein the system software identification information is represented as RxSWIN.

5. An electronic control device for a vehicle as described in any one of claims 1 to 4, further comprising a rollback implementation unit (34j) that performs a rollback to return the software of the node to be updated to its pre-update state when the first consistency determination unit determines that the post-update configuration information is consistent.

6. 5. An electronic control device for a vehicle as described in claim 3 or 4, further comprising a rollback implementation unit (34j) that implements a rollback to return the software of the node to be updated to its pre-update state when the first consistency determination unit determines that the post-update configuration information is consistent, or when the second consistency determination unit determines that the post-update system software identification information is consistent.

7. The electronic control device for a vehicle according to any one of claims 1 to 6, further comprising a display control unit (34k) that displays a determination result of the first consistency determination unit on at least one of a display terminal and the wired tool.

8. An electronic control device for a vehicle as described in any one of claims 3, 4 and 6, further comprising a display control unit (34k) that displays at least one of the judgment results of the first consistency judgment unit and the judgment results of the second consistency judgment unit on at least one of a display terminal and the wired tool.

9. a wired tool (23) operable by an operator; a vehicle electronic control device (13) capable of being wired to the wired tool, The vehicle electronic control device includes: an update data acquisition unit (34a) that acquires update data from the wired tool through wired communication in a situation where a contract for an OTA service has not yet been concluded and a communication connection with a center device that provides the OTA service cannot be established; a first post-update configuration information acquisition unit (34b) that acquires post-update configuration information as first post-update configuration information from the wired tool through wired communication in a situation in which a communication connection with the center device cannot be established; a software update unit (34c) that updates software of the update target node by writing the update data to the update target node; a second post-update configuration information acquisition unit (34d) for acquiring post-update configuration information from a managed node including the update target node as second post-update configuration information; A first consistency determination unit (34e) that compares the first post-update configuration information with the second post-update configuration information to determine consistency of the post-update configuration information.

10. The vehicle electronic control device includes: a first updated system software identification information acquiring unit (34f) for acquiring, via wired communication, the updated system software identification information from the wired tool as first updated system software identification information; a system software identification information storage unit (30g) for storing system software identification information; a second updated system software identification information acquiring unit (34h) for acquiring, as second updated system software identification information, system software identification information obtained by updating the system software identification information stored in the system software identification information storing unit after a software update; The electronic control system for a vehicle as described in claim 9, further comprising a second consistency determination unit (34i) that compares the first post-update system software identification information with the second post-update system software identification information to determine the consistency of the post-update system software identification information.

11. A control unit (34) of a vehicle electronic control device (13), an update data acquisition procedure for acquiring update data from a wired tool that can be operated by an operator in a situation where a contract for an OTA service has not been concluded and a communication connection with a center device that provides the OTA service cannot be established; a first post-update configuration information acquisition step of acquiring post-update configuration information as first post-update configuration information from the wired tool through wired communication in a situation in which a communication connection with the center device cannot be established; a software update procedure for updating software of an update target node by writing the update data to the update target node; a second post-update configuration information acquisition step of acquiring post-update configuration information from a managed node including the update target node as second post-update configuration information; a first consistency determination step of collating the first post-update configuration information with the second post-update configuration information to determine consistency of the post-update configuration information;

12. a first post-update system software identification information acquisition step of acquiring post-update system software identification information from the wired tool via wired communication as first post-update system software identification information; a second updated system software identification information obtaining step of obtaining, after updating the software, updated system software identification information obtained by updating the stored system software identification information as second updated system software identification information; The post-update configuration information determination program of claim 11, further comprising a second consistency determination procedure for determining the consistency of the post-update system software identification information by comparing the first post-update system software identification information with the second post-update system software identification information.

Images