Software update device, update control method, update control program, and OTA master

Abstract

To provide a software update device, an update control method, an update control program, and an OTA master that can update software by OTA even if software for OTA in a server is changed.SOLUTION: A software update device according to the present disclosure controls software update of an electronic control unit mounted on a vehicle. The software update device includes a communication section that receives, from a server, software information that specifies software used in the server to distribute update data for the electronic control unit and receives, from the server, software that corresponds to the software of the server specified by the received software information; and a control section that downloads the update data from the server by executing the software corresponding to the software of the server specified by the received software information.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to a software update device, an update control method, an update control program, and an OTA master for controlling software updates of an electronic control unit. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units (ECUs) for controlling the operation of the vehicle. The ECU includes a processor, a temporary storage unit such as RAM, and a non-volatile storage unit such as flash ROM, and the processor executes software stored in the non-volatile storage unit to realize the control functions of the ECU. The software stored in each ECU is rewritable, and by updating the software to a newer version, it is possible to improve the functions of each ECU or add new vehicle control functions.

[0003] One known technology for updating ECU software is Over The Air (OTA) technology, which wirelessly connects an in-vehicle communication device connected to an in-vehicle network to a communication network such as the Internet, downloads software from a server via wireless communication, and installs the downloaded software to update or add programs to the ECU (see, for example, Patent Document 1).

[0004] The server at the center is equipped with a software distribution function by installing OTA software, while the software update device installed in the vehicle uses client software compatible with the OTA software executed by the server to request confirmation of update data from the server and to download the update data. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2004-326689 A Summary of the Invention [Problem to be solved by the invention]

[0006] There is a possibility that the OTA software used on the server will change during the period of use of the vehicle. If the OTA software used on the server changes and the OTA software vendors on the server and the vehicle are different, software updates via OTA will not be possible unless there is software compatibility between the vendors.

[0007] Therefore, an object of the present disclosure is to provide a software update device, an update control method, an update control program, and an OTA master that enable software update by OTA even if the OTA software in the server is changed. [Means for solving the problem]

[0008] The software update device of the present disclosure includes a communication unit that receives software information from the server identifying the software used in the server to distribute update data for an electronic control unit, and receives software from the server corresponding to the server software identified by the received software information, and a control unit that downloads the update data from the server by executing the software corresponding to the server software identified by the received software information.

[0009] The update control method disclosed herein is a method executed by a computer having a processor, a memory, and a storage device to control software updates of an electronic control unit installed in a vehicle, and includes the steps of receiving from the server software information identifying software used in the server to distribute update data for the electronic control unit, receiving from the server software corresponding to the server software identified by the received software information, and downloading the update data from the server by executing the software corresponding to the server software identified by the received software information.

[0010] The update control program according to the present disclosure includes a computer having a processor, a memory, and a storage device. The computer controls software updates for the electronic control unit installed in the vehicle. A program for executing the program on a server, the program being useful for distributing update data for an electronic control unit. receiving software information from a server that identifies software being used; Software corresponding to the server software identified by the received software information receiving software from a server; and By running the software that corresponds to the software, the update data is downloaded from the server. Steps to download Have your computer run do. Effect of the Invention

[0011] According to the present disclosure, it is possible to provide a software update device, an update control method, an update control program, and an OTA master that are capable of updating software by OTA even if the OTA software in the server is changed. [Brief description of the drawings]

[0012] [Figure 1]FIG. 1 is a block diagram showing an overall configuration of a network system according to an embodiment; [Diagram 2] A block diagram showing the schematic configuration of the server shown in FIG. 1. [Diagram 3] FIG. 2 is a block diagram showing a schematic configuration of the software update device shown in FIG. 1. [Figure 4] Functional block diagram of a server according to the first embodiment [Diagram 5] Functional block diagram of a software update device according to a first embodiment. [Figure 6A] FIG. 1 is a schematic diagram illustrating an overview of software switching in a first embodiment; [Figure 6B] FIG. 1 is a schematic diagram illustrating an overview of software switching in a first embodiment; [Figure 6C] FIG. 1 is a schematic diagram illustrating an overview of software switching in a first embodiment; [Figure 7] 1 is a flowchart showing an example of a control process executed by a server according to the first embodiment; [Figure 8] 1 is a flowchart showing an example of a control process executed by the software update device according to the first embodiment. [Figure 9] Functional block diagram of a server according to a second embodiment [Figure 10] Functional block diagram of a software update device according to a second embodiment. [Figure 11A] FIG. 13 is a schematic diagram showing an overview of software selection in a second embodiment; [Figure 11B] FIG. 13 is a schematic diagram showing an overview of software selection in a second embodiment; [Figure 12A] FIG. 13 is a schematic diagram showing an overview of software addition in a second embodiment; [Figure 12B] FIG. 13 is a schematic diagram showing an overview of software addition in a second embodiment; [Figure 12C] FIG. 13 is a schematic diagram showing an overview of software addition in a second embodiment; [Figure 13] 11 is a flowchart showing an example of a control process executed by a server according to the second embodiment. [Figure 14]11 is a flowchart showing an example of a control process executed by the software update device according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] (Configuration common to the first and second embodiments) FIG. 1 is a block diagram showing the overall configuration of a network system according to an embodiment, FIG. 2 is a block diagram showing a schematic configuration of a server shown in FIG. 1, and FIG. 3 is a block diagram showing a schematic configuration of a software update device shown in FIG. 1.

[0014] The network system shown in FIG. 1 is a system for updating software of electronic control units 13a to 13d mounted on vehicles, and includes a server 1 (center) and an in-vehicle network 2 mounted on the vehicles.

[0015] The server 1 is capable of communicating with a software update device 11 mounted on the vehicle via a network 5, and manages software updates for electronic control units 13a to 13d mounted on the vehicle.

[0016] 2, the server 1 includes a CPU 21, a RAM 22, a storage device 23, and a communication device 24. The storage device 23 includes a readable / writable storage medium such as a hard disk or SSD, and stores a program for performing software update management, information used in the update management, and update data for the electronic control unit. In the server 1, the CPU 21 executes a program read from the storage device 23 by using the RAM 22 as a working area, thereby executing a control process, which will be described later. The communication device 24 is a device that communicates with the software update device 11 via a network.

[0017] The in-vehicle network 2 includes a software update device 11 (OTA master), a communication module 12, a plurality of electronic control units 13a to 13d, and a display device 14. The software update device 11 is connected to the communication module 12 via a bus 15a, to the electronic control units 13a and 13b via a bus 15b, to the electronic control units 13c and 13d via a bus 15c, and to the display device 14 via a bus 15d. The software update device 11 can wirelessly communicate with the server 1 via the communication module 12. The software update device 11 controls software update of an electronic control unit (target ECU) to be updated among the electronic control units 13a to 13d based on update data acquired from the server 1. The software update device 11 may also be referred to as a central gateway. The communication module 12 is a communication device that connects the in-vehicle network 2 and the server 1. The electronic control units 13a to 13d control the operation of each part of the vehicle. The display device 14 (HMI) is used to display various information during software update processing of the electronic control units 13a to 13d, such as displaying the presence of update data, displaying a consent request screen for requesting consent to the software update from the user or administrator, and displaying the update result. The display device 14 can typically be a display device of a car navigation system, but is not particularly limited as long as it can display information required during program update processing. Although four electronic control units 13a to 13d are illustrated in FIG. 1, the number of electronic control units is not particularly limited. Moreover, an electronic control unit other than the display device 14 may be further connected to the bus 15d shown in FIG. 1.

[0018] The electronic control units 13a to 13d each include a CPU, a RAM, a non-volatile memory (storage), and a communication device. The CPU executes software (programs) read from the non-volatile memory using the RAM as a working area to realize the functions of each electronic control unit. Here, the electronic control units include those having one data storage area (bank) for storing software, and those having two data storage areas (banks) for storing software. In addition to software for realizing the functions of the electronic control unit, the data storage area of ​​the electronic control unit may store version information, parameter data, a boot program for startup, a program for software update, and the like. In an electronic control unit having one data storage area, installing update data in the data storage area affects the software of the electronic control unit. On the other hand, in an electronic unit having two data storage areas, one of the two data storage areas is set as the storage area (operational side) to be read, and the software stored in the storage area to be read is executed. In the other storage area (non-operational side) that is not the target to be read, update data can be written in the background while the program in the storage area (operational side) to be read is being executed. At the time of activation in the software update process, the updated software can be made valid by switching the storage area from which the CPU 41 reads the program.

[0019] In this disclosure, an electronic control unit having two data storage areas includes an electronic control unit equipped with a memory configuration called "single-sided suspend memory" in which one side of a data storage area of ​​a non-volatile memory is partitioned into two sides, making it possible to write a program to one side while a program is being executed on the other side, and an electronic control unit that has a non-volatile memory having one side of a data storage area, as well as an extended non-volatile memory having one side of a data storage area, and in which these two non-volatile memories can be used as the operational side and the non-operational side.

[0020] 3, the software update device 11 includes a microcomputer 35 having a CPU 31, a RAM 32, a ROM 33, and a storage device 34, and a communication device 36. In the software update device 11, the CPU 31 of the microcomputer 35 executes a program read from the ROM 33 or the storage device 34 by using the RAM 32 as a working area, thereby performing a control process described below. The communication device 36 is a device that communicates with the communication module 12, the electronic control units 13a to 13d, and the display device 14 via the buses 15a to 15d shown in FIG. 1.

[0021] Here, the software update process consists of a phase of downloading update data from server 1, a phase of transferring the downloaded update data to the electronic control unit to be updated and installing the update data in the memory area of ​​the electronic control unit to be updated, and an activation phase of enabling the updated version of the software installed in the electronic control unit to be updated.

[0022] Downloading is a process of receiving update data for updating the software of the electronic control unit from the server 1 and storing it. The downloading phase includes not only receiving the update data but also controlling a series of processes related to the download, such as judging whether the download can be performed and verifying the update data. Installing is a process of writing an updated version of the program (update software) to the storage unit of the in-vehicle device in the electronic control unit to be updated based on the downloaded update data. The installing phase includes not only executing the installation but also controlling a series of processes related to the installation, such as judging whether the installation can be performed, transferring the update data and verifying the updated version of the program. Activating is a process of making the installed updated version of the program valid (activating). The control of activating includes not only executing the activation but also controlling a series of processes related to activation, such as judging whether the activation can be performed and verifying the execution results.

[0023] The update data transmitted from the server 1 to the software update device 11 may include update software for the electronic control unit, compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may also include an identifier (ECU ID) for identifying the electronic control unit to be updated, and an identifier (ECU software ID) for identifying the software before the update. The update data is downloaded as the above-mentioned distribution package, and the distribution package includes update data for a single or multiple electronic control units.

[0024] If the update data includes the update software itself, in the installation phase, the software update device transfers the update data (update software) to the electronic control unit to be updated. Also, if the update data includes compressed data, difference data, or divided data of the update software, the software update device 11 may transfer the update data to the electronic control unit to be updated, and the electronic control unit to be updated may generate the update software from the update data, or the software update device 11 may generate the update software from the update data and then transfer the update software to the electronic control unit to be updated. Here, the update software can be generated by decompressing the compressed data and assembling the difference data or divided data.

[0025] The update software can be installed by the electronic control unit to be updated based on an installation request from the software update device 11. Alternatively, the electronic control unit to be updated that has received the update data may autonomously install the software without receiving an explicit instruction from the software update device 11.

[0026] The activation of the updated software can be performed by the electronic control unit to be updated based on an activation request from the software updating device 11. Alternatively, the electronic control unit to be updated that has received the update data may autonomously activate the software without receiving an explicit instruction from the software updating device 11.

[0027] The software update process can be performed consecutively or in parallel for each of the multiple electronic control units.

[0028] In addition, the "program update process" in this specification includes not only a process in which all download, installation, and activation are performed in succession, but also a process in which only part of the download, installation, and activation is performed.

[0029] (First embodiment) FIG. 4 is a functional block diagram of the server according to the first embodiment.

[0030] The server 1 includes a storage unit 26, a first communication unit 27, and a control unit .

[0031] The storage unit 26 stores the first software for OTA, update management information used to manage updates of the software of the electronic control unit, and update data of the software of the electronic control unit. The storage unit 26 is realized by the storage device 23 shown in Fig. 2. The first software is server-side software (program) executable by the CPU 21 shown in Fig. 2, and is software that realizes a function of performing wireless communication with the software update device 11 mounted on the vehicle and distributing update data of the software of the electronic control unit via wireless communication. The first communication unit 27 and the control unit 28 described later are realized by the CPU 21 shown in Fig. 2 executing the first software.

[0032] The update management information stored in the storage unit 26 is information that associates, for each vehicle identification information (vehicle ID) that identifies the vehicle, information indicating software available in one or more electronic control units mounted on the vehicle. As information indicating software available in an electronic control unit, for example, a combination of the latest version information of each of the software in a plurality of electronic control units is defined. The update management information and update data are stored in the storage unit 26 when a campaign for updating the software of the electronic control unit is registered.

[0033] The first communication unit 27 can receive a software update confirmation request from the software update device 11. The update confirmation request is information transmitted from the software update device 11 to the server 1 when, for example, the power or ignition is turned on in the vehicle, and is information for requesting the server 1 to confirm whether or not there is update data for the electronic control unit. In response to the update confirmation request received from the software update device 11, the first communication unit 27 transmits information indicating the presence or absence of update data to the software update device 11. Furthermore, the first communication unit 27 can receive a transmission request (download request) for a distribution package from the software update device 11. When the first communication unit 27 receives a download request for a distribution package, it transmits a distribution package including update data for the software of the electronic control unit to the software update device 11.

[0034] When the first communication unit 27 receives an update check request, the control unit 28 determines whether or not there is update data for the software of the vehicle identified by the vehicle ID included in the update check request, based on the update management information stored in the storage unit 26. The determination result by the control unit 28 as to whether or not there is update data is transmitted to the software update device 11 by the first communication unit 27. When the control unit 28 determines that there is update data for the electronic control unit, upon receiving a download request for a distribution package from the software update device 11, it generates a distribution package including the update data to be stored in the storage unit 26. This distribution package is transmitted to the software update device 11 by the first communication unit 27.

[0035] FIG. 5 is a functional block diagram of the software updating device shown in FIG.

[0036] The software updating device 11 includes a storage unit 37 and a control unit 38. The storage unit 37 is realized by the storage device 34 shown in Fig. 3, and the control unit 38 is realized by the CPU 31 shown in Fig. 3 executing a program (a program for controlling the software updating device 11) stored in the ROM 33 using the RAM 32.

[0037] The storage unit 37 stores the first software for OTA and the second software for OTA. The storage unit 26 is realized by the storage device 34 shown in FIG. 3. The first software and the second software are both client-side software (programs) that can be executed by the CPU 31 shown in FIG. 3, and are software that performs wireless communication with the server 1 and realizes a function of downloading update data for the software of the electronic control unit through wireless communication. The first software and the second software have in common the download of update data and various functions associated therewith (for example, a function of checking the presence or absence of update data for the server 1, a function of notifying the server 1 after the download is completed, a function of sending error information to the server 1 when an error occurs, etc.), but the specific process for realizing this function and the communication procedure with the server-side software are different. The difference in the specific process and communication procedure, etc. of the first software and the second software may occur due to the difference in the vendors and the version of the first software and the second software. The server-side OTA software and the client-side OTA software have a combination that can realize the update data download function, and the first software and the second software are executed in combination with the server-side software corresponding to each software.

[0038] The storage unit 37 also stores software update data downloaded from the server 1, in addition to programs for executing software updates for the electronic control units 13a to 13d and various data used when executing the software updates.

[0039] The control unit 38 performs various processes for controlling software updates of the electronic control units. More specifically, the control unit 38 downloads update data by executing either the first software or the second software. The control unit 38 transmits a software update check request to the server 1 when the power supply or ignition of the vehicle is turned on, for example. The update check request includes, for example, a vehicle ID for identifying the vehicle and the software versions of the electronic control units 13a to 13d connected to the in-vehicle network 2. The vehicle ID and the software versions of the electronic control units 13a to 13d are used to determine whether or not there is update data for the software of the electronic control units by comparing them with the latest software version held by the server 1 for each vehicle ID. In addition, the control unit 38 receives a check result indicating the presence or absence of update data from the server 1 as a response to the update check request, and determines the presence or absence of update data based on the check result. If there is update data for the software of any of the electronic control units, the control unit 38 transmits a download request for a distribution package to the server 1 and receives the distribution package transmitted from the server 1. In addition to the update data, the distribution package may include verification data for verifying the authenticity of the update data, the number of update data, the installation order, various control information used during software update, etc. When the control unit 38 receives a distribution package including update data from the server 1, it verifies the authenticity of the received distribution package.

[0040] Furthermore, when the control unit 38 downloads a distribution package including update data, the control unit 38 performs an installation process, an activation process, and an approval request process when the installation process or activation process of the update data is executed. When the software update is executed, the control unit 38 performs the approval request process by outputting a notification that approval is required for the software update or a notification that prompts input that the software update has been approved to the output device, and by accepting an operation input from the user. As the output device, the display device 14 provided in the in-vehicle network 2, an audio output device that notifies by audio, and the like can be used. For example, in the approval request process, when the display device 14 is used as the output device, the control unit 38 causes the display device 14 to display an approval request screen for requesting approval of the software update, and causes the display device 14 to display a notification that prompts a specific input operation, such as pressing an approval button, when the user or administrator approves the software update. In addition, during the consent request process, the control unit 38 causes the display device 14 to display, for example, text or an icon notifying the user that update data for the electronic control unit software is available, and causes the display device 14 to display, for example, restrictions that may exist during the software update process.

[0041] 6A to 6C are schematic diagrams showing an overview of software switching in the first embodiment. In the following description, it is assumed that a combination of a first software on the server side and a first software on the client side, and a combination of a second software on the server side and a second software on the client side are combinations from which update data can be downloaded, and update data cannot be downloaded for other software combinations.

[0042] First, as shown in Fig. 6A, it is assumed that the first software is running as OTA software in the server 1. The first software used by default and the spare second software are installed in the storage unit 37 of the software update device 11 as client-side OTA software. The first software executed by default in the software update device 11 corresponds to the first software running in the server 1. Therefore, in this case, the control unit 38 can request the server 1 to confirm or download update data by executing the first software.

[0043] Next, as shown in Fig. 6B, a case is assumed in which the OTA software running on the server 1 is changed to the second software. An example of the second software on the server side is software developed by a vendor different from the first software and incompatible with the first software. Another example of the second software is software developed by the same vendor as the first software, but updated in response to a change in the type of server OS or an upgrade, resulting in at least partial loss of compatibility with the first software.

[0044] The first software executed by default in the software update device 11 does not correspond to the second software running on the server 1. Therefore, in this case, the control unit 38 cannot request the server 1 to confirm or download update data by executing the first software.

[0045] In this case, as shown in Fig. 6C, the control unit 38 switches the software to be executed from the default first software to the backup second software. The second software after the switch corresponds to the second software running on the server 1. Therefore, in this case, the control unit 38 can request the server 1 to confirm and download update data by executing the second software.

[0046] Fig. 7 is a flowchart showing an example of a control process executed by the server according to the embodiment 1. The control process shown in Fig. 7 is executed repeatedly at predetermined time intervals, for example.

[0047] In step S1, the first communication section 27 determines whether or not an update confirmation request has been received from the software updating device 11. If the determination in step S1 is YES, the process proceeds to step S2, and otherwise the process proceeds to step S3.

[0048] In step S2, the first communication unit 27 transmits information indicating whether or not there is update data for the software of the electronic control unit to the vehicle that transmitted the update check request. The presence or absence of update data can be determined, for example, by the control unit 28 comparing the combination of software versions stored in the update management information in association with the vehicle ID included in the update check request with the combination of current software versions included in the update check request, and determining that there is update data if the combination of current software versions included in the update check request is older than the combination of versions stored in the update management information. Then, the process proceeds to step S3.

[0049] In step S3, the first communication unit 27 determines whether or not a download request for update data (distribution package) has been received from the software update device 11. If the determination in step S3 is YES, the process proceeds to step S4; otherwise, the process proceeds to step S1.

[0050] In step S4, the first communication unit 27 transmits the distribution package including the software update data generated by the control unit 28 to the software update device 11. After that, the process proceeds to step S1.

[0051] Fig. 8 is a flowchart showing an example of a control process executed by the software update device according to the first embodiment. The control process shown in Fig. 8 is executed, for example, when the power supply or ignition of the vehicle is turned on.

[0052] In step S11, the control unit 38 executes the first software for OTA and requests the server 1 to confirm whether or not there is update data for the software of the electronic control unit. The first software is software executed by the control unit 38 as a default, and is installed in correspondence with the OTA software running on the server 1 when the OTA software update function is added to the vehicle at the time of manufacture of the vehicle or after its sale. In order to confirm whether or not there is update data, the control unit 38 transmits an update confirmation request including a combination of the vehicle ID and the version of the software of the electronic control unit to the server 1. Then, the process proceeds to step S12.

[0053] In step S12, the control unit 38 judges whether or not data can be downloaded from the server 1. The state in which data can be downloaded means that the control unit 38 can transmit and receive messages and data via communication with the OTA software running on the server 1 according to a procedure defined by the OTA software, and can download update data from the server 1 using the function of the running software. The control unit 38 can judge that the download is not possible when it detects one or more of the following events: a link with the server 1 cannot be established, a timeout has occurred in communication with the server 1, and an error has occurred in the OTA software. If the judgment in step S12 is YES, the process proceeds to step S15; otherwise, the process proceeds to step S13.

[0054] In step S13, the control unit 38 executes the second software for OTA and requests the server 1 to confirm whether or not there is update data for the software of the electronic control unit. The second software is spare software that is installed when the vehicle is manufactured or after it is sold, but is not compatible with the OTA software that initially runs on the server 1. To confirm whether or not there is update data, the control unit 38 transmits an update confirmation request including a combination of the vehicle ID and the version of the software of the electronic control unit to the server 1. Thereafter, the process proceeds to step S14. Note that in step S13, it is preferable that the control unit 38 terminates the first software before executing the second software.

[0055] In step S14, the control unit 38 judges whether or not data can be downloaded from the server 1. The judgment process in step S14 is the same as the judgment process in step S12. If the judgment in step S14 is YES, the process proceeds to step S15, otherwise the process ends. Note that if the judgment in step S14 is NO, there is no software corresponding to the OTA software running on the server 1, and software updating by OTA is not possible, so it is preferable to notify the user of an error or a notification to prompt a dealer, repair shop, or the like to take action.

[0056] In step S15, the control unit 38 receives a confirmation result in response to the update confirmation request from the server 1. After that, the process proceeds to step S16.

[0057] In step S16, the control unit 38 determines whether or not there is update data for the software of any of the electronic control units 13a to 13d based on the confirmation result received in step S15. If the determination in step S16 is YES, the process proceeds to step S17, and otherwise the process proceeds to step S18.

[0058] In step S17, the control unit 38 executes a download process using the function of the OTA software. More specifically, the control unit 38 transmits a download request for a distribution package to the server 1, receives the distribution package transmitted in response to the download request, and stores the received distribution package in the storage unit 37. The control unit 38 verifies the authenticity of the update data contained in the received distribution package. In step S17, the control unit 38 may determine whether or not the download can be performed, and may notify the server 1 that the download has been completed. After that, the process proceeds to step S19.

[0059] In step S18, the control unit 38 judges whether or not an instruction to execute the software update process has been received. The software update process is not necessarily executed continuously, and may be interrupted, for example, when the download or installation is completed, and the subsequent update process may be executed later. In this embodiment, therefore, when it is judged in step S16 that there is no update data, the judgment in step S18 is provided, thereby making it possible to resume the interrupted software update process. The judgment in step S18 may be performed, for example, by displaying a message or an icon notifying that there is an interrupted software update process on the display device 14, and then by checking whether or not a specific operation input using an input button or the like has been received. If the judgment in step S18 is YES, the process proceeds to step S19, and otherwise the process is terminated.

[0060] In step S19, the control unit 38 executes installation processing and activation processing for the electronic control unit to be updated (target ECU). More specifically, the control unit 38 transfers update data to the electronic control unit to be updated and instructs installation. The electronic control unit to be updated writes the update data received from the software update device 11 to a data storage area. Next, the control unit 38 instructs the electronic control unit to be updated to activate the updated software. The electronic control unit to be updated restarts when a specific operation is performed, such as by turning off the power or ignition, and executes the updated software. This completes the software update (function update) of the electronic control unit. After the installation processing or activation processing is completed, the processing of FIG. 8 ends.

[0061] If the electronic control unit to be updated has one data storage area, the software of the electronic control unit is affected when the update data is installed in the data storage area, so it is preferable to perform installation and activation consecutively. In this case, if the electronic control unit to be updated has one data storage area, a consent request process for installation and activation may be performed before installation, and the consent request process before activation may be omitted.

[0062] In addition, before the installation is performed, the control unit 38 preferably performs a process of determining whether or not the installation can be performed and a process of requesting consent to the installation. As the process of requesting consent to the installation, the control unit 38 displays, for example, a display indicating that the software update of the electronic control unit will be started, a display indicating that consent to the software update by the user is requested, and, if necessary, a display indicating the time required for installing the update data and restrictions and precautions during the installation on the display device 14, and accepts an operation input by the user using an input means such as a touch panel or an operation button. Thereafter, the control unit 38 judges whether or not an operation input indicating consent to the software update (installation) has been made. The operation input indicating consent to the installation can be determined based on, for example, whether or not a button such as "Agree" or "Start Update" displayed on the display device 14 has been pressed. In addition, if the user does not immediately consent to the start of the software update (installation) and wishes to start the software update (installation) later, the user can accept the request by pressing a button such as "Later".

[0063] Similarly, before the activation is performed, the control unit 38 preferably performs a process of determining whether or not the activation can be performed and a process of requesting consent to the activation. As the process of requesting consent to the installation, the control unit 38 displays, for example, a display indicating that the software update of the electronic control unit is ready and that the program will be updated by performing a specific operation such as turning off the power or the ignition, and, if necessary, a display indicating the time required for activation and restrictions and precautions during activation on the display device 14, and accepts an operation input by the user using an input means such as a touch panel or an operation button. After that, the control unit 38 judges whether or not an operation input indicating consent to the software update (activation) has been performed. The operation input indicating consent to the activation can be determined based on, for example, whether or not a button such as "Agree" or "Update" displayed on the display device 14 has been pressed. In addition, if the user does not immediately consent to the software update (activation) and wishes to perform the software update later, the user can accept the consent by pressing a button such as "Later".

[0064] The software update device 11 according to this embodiment has mutually different first and second software in the storage unit 37 as OTA software, and executes either of the software to download update data from the server 1. Therefore, the software update device 11 according to this embodiment can correspond to both a server on which server-side software corresponding to the first software runs, and a server on which server-side software corresponding to the second software runs.

[0065] Also, during the life cycle of the vehicle, there may be a case where the OTA software running on the server 1 is changed, and the changed software is no longer compatible with the software that was originally running on the server 1. When the software update device 11 according to this embodiment is in a state in which update data cannot be downloaded using the function of the first software for OTA, it executes the second software stored in the storage unit 37. With this configuration, when update data cannot be received using the first software, the software to be executed is switched to the second software, making it possible to download the update data.

[0066] Second embodiment FIG. 9 is a functional block diagram of a server according to the second embodiment.

[0067] The server 1 according to the second embodiment is obtained by adding a second communication unit 29 to the configuration of the first embodiment. The second communication unit 29 communicates with the software update device without the intervention of the OTA software. Specifically, the second communication unit 29 can receive a transmission request for software information from the software update device 11, and transmits the software information to the software update device 11 in response to the transmission request. The software information is information that identifies the OTA software used in the server 1 to distribute update data. In addition, the second communication unit 29 can receive a transmission request for OTA software from the software update device 11, and transmits client-side software corresponding to the OTA software running on the server 1 to the software update device 11 in response to the transmission request.

[0068] FIG. 10 is a functional block diagram of a software updating device according to the second embodiment.

[0069] The software update device 11 according to the second embodiment is obtained by adding a communication unit 39 to the configuration of the first embodiment. The communication unit 39 can communicate with the second communication unit 29 of the server without using the OTA software. The communication unit 39 transmits a transmission request for the above-mentioned software information to the server 1, and receives the software information transmitted from the server 1 as a response to the transmission request. The received software information is information that the control unit 38 refers to in order to determine whether or not software corresponding to the OTA software running on the server 1 is stored in the storage unit 37. When the control unit 38 determines that software corresponding to the OTA software running on the server 1 is not stored in the storage unit 37, the communication unit 39 requests the server 1 to transmit software corresponding to the OTA software running on the server 1, and downloads the software. The communication unit 39 stores the downloaded new OTA software in the storage unit 37.

[0070] 11A and 11B are schematic diagrams showing an overview of software selection in the second embodiment.

[0071] It is assumed that the second software is running as OTA software in the server 1. In the storage unit 37 of the software update device 11, the first software and the second software are installed as OTA software on the client side.

[0072] First, as shown in Fig. 11A, the communication unit 39 of the software updating device 11 receives software information from the server 1. Next, as shown in Fig. 11B, the control unit 38 executes the client-side second software corresponding to the server-side second software identified by the received software information. In this way, when software corresponding to the server-side software identified by the software information received from the server 1 is stored in the storage unit 37, the control unit 38 can select appropriate software based on the software information received from the server 1 and can make a confirmation request for update data to the server 1 and download the update data.

[0073] 12A to 12C are schematic diagrams showing an outline of software addition in the second embodiment. The third software shown in Fig. 12B and Fig. 12C is different from both the first software and the second software, and the combination of the third software on the server side and the third software on the client side is the one that can download update data, and update data cannot be downloaded with any other software combination.

[0074] Assume that the third software is running as OTA software in the server 1. The first software and the second software are installed in the storage unit 37 of the software update device 11 as client-side OTA software. Neither the first software nor the second software can download update data from the third software running in the server 1.

[0075] First, as shown in Fig. 12A, the communication unit 39 of the software updating device 11 receives software information from the server 1. However, software corresponding to the server-side third software specified by the software information is not stored in the storage unit 37. Therefore, as shown in Fig. 12B, the communication unit 39 receives the client-side third software corresponding to the third software running on the server 1. Then, as shown in Fig. 12C, the control unit 38 executes the received third software, thereby becoming able to request confirmation of and download update data from the server 1.

[0076] Fig. 13 is a flowchart showing an example of a control process executed by a server according to the second embodiment. The server according to the second embodiment also executes the control process shown in Fig. 7, but a repeated explanation will be omitted. The control process shown in Fig. 13 is executed repeatedly at a predetermined time interval, for example, in parallel with the control process shown in Fig. 7.

[0077] In step S5, the second communication unit 29 determines whether or not a transmission request for software information has been received from the software update device 11. If the determination in step S5 is YES, the process proceeds to step S6, and otherwise the process proceeds to step S7.

[0078] In step S6, the second communication unit 29 transmits the software information to the vehicle that transmitted the transmission request for the software information. After that, the process proceeds to step S7.

[0079] In step S7, the second communication unit 29 determines whether or not a transmission request for the OTA software (client side) has been received. If the determination in step S7 is YES, the process proceeds to step S8, otherwise the process proceeds to step S5.

[0080] In step S8, the second communication unit 29 transmits the OTA software (client side) to the vehicle that transmitted the OTA software transmission request. After that, the process proceeds to step S5.

[0081] Fig. 14 is a flowchart showing an example of a control process executed by the software update device according to the second embodiment. The control process shown in Fig. 14 is executed, for example, when the power supply or ignition of the vehicle is turned on.

[0082] In step S20, the communication unit 39 transmits a request to transmit the software information to the server 1. After that, the process proceeds to step S21.

[0083] In step S21, the communication unit 39 receives the software information from the server 1. After that, the process proceeds to step S22.

[0084] In step S22, the control unit 38 determines whether or not software corresponding to the server-side software identified by the received software information is stored in the storage unit 37. If the determination in step S22 is YES, the process proceeds to step S23; otherwise, the process proceeds to step S24.

[0085] In step S23, the control unit 38 executes software corresponding to the server-side software specified by the software information, and requests the server 1 to confirm whether or not there is update data for the software of the electronic control unit. After that, the process proceeds to step S15.

[0086] In step S24, the communication section 39 transmits a transmission request for the client-side software corresponding to the server-side software specified by the software information to the server 1. After that, the process proceeds to step S25.

[0087] In step S25, the communication unit 39 receives, from the server 1, the client-side software corresponding to the server-side software specified by the software information, and stores the received software in the storage unit 37. Thereafter, the process proceeds to step S23. Note that, if the communication unit 39 receives the OTA software from the server 1 in step S25, in step S23, the control unit 38 executes the software received in step S25.

[0088] Incidentally, the processes in steps S15 to S19 shown in FIG. 14 are the same as those described in FIG. 8, and therefore will not be described repeatedly.

[0089] Furthermore, the transmission request and reception of software information in steps S20 and S21, and the transmission request and reception of OTA software in steps S24 and S25 are processes that can be executed without the intervention of the OTA software.

[0090] The software update device 11 according to this embodiment has a first software and a second software, which are different from each other, in a storage unit 37 as OTA software, and selects and executes software corresponding to the server-side software based on software information received from the server 1. Even if the OTA software running on the server 1 is changed, it is possible to execute the software corresponding to the server side and download update data.

[0091] Furthermore, if there is no software corresponding to the server-side software, the software can be downloaded from the server 1, and the downloaded software can be used to download update data.

[0092] In the above second embodiment, an example was described in which the software information is information that identifies the OTA software running on the server 1, but the software information may also be information that specifies the OTA software to be executed in the software update device 11.

[0093] In the above second embodiment, an example was described in which a request to send and receive software information and a request to send and receive OTA software are performed without going through the functions of the OTA software stored in memory unit 37. However, the procedures related to a request to send and receive software information and a request to send and receive OTA software may be standardized and implemented in all OTA software (server side and client side).

[0094] (Other variations) The functions of the server 1 exemplified in each of the above embodiments can be realized as an update management method executed by a computer having a processor (CPU), memory, and storage device, or as an update management program executed by the computer, or as a computer-readable non-transient storage medium storing the update management program. Similarly, the functions of the software update device 11 exemplified in each of the embodiments can be realized as an update control method executed by a computer mounted on a vehicle having a processor (CPU), memory, and storage device, or as an update control program executed by the computer mounted on the vehicle, or as a computer-readable non-transient storage medium storing the update control program.

[0095] In each of the above embodiments, an example has been described in which the software update device 11 provided in the in-vehicle network on the vehicle side controls program updates of all the electronic control units 13a to 13d as a master device, but instead of providing the software update device 11, any one of the electronic control units 13a to 13d may have the update control function shown in Fig. 8 or Fig. 14 and control program updates of the other electronic control units. Also, instead of providing the software update device 11, it is also possible to provide the update control function shown in Fig. 8 or Fig. 14 in an external device that can be connected to the in-vehicle network 2 by wire, and use this external device to perform program update processing of the electronic control units 13a to 13d. [Industrial Applicability]

[0096] The disclosed technique can be used in a network system for updating programs in electronic control units. [Explanation of symbols]

[0097] 1 Server 2. In-vehicle network 5. Network 11 Software update device 13a~13d Electronic control unit 26 Memory section 27 First Communications Department 28 Control Unit 29 2nd Communications Department 37 Memory section 38 Control Unit 39 Communications Department

Claims

1. A software update device that controls software updates of an electronic control unit mounted on a vehicle, a communication unit that receives software information from the server that identifies software used in the server to distribute update data for the electronic control unit, and receives software from the server that corresponds to the software of the server identified by the received software information; a control unit that downloads the update data from the server by executing software corresponding to the software of the server specified by the received software information.

2. a storage unit that stores first software for downloading update data for the electronic control unit from the server; When the software corresponding to the software of the server identified by the received software information is the first software, the control unit executes the first software to download the update data from the server; The software update device according to claim 1, wherein when the software corresponding to the software of the server identified by the received software information is not the first software, the communication unit receives from the server the software corresponding to the software of the server identified by the received software information.

3. a storage unit that stores software for downloading update data for the electronic control unit from the server; the control unit determines whether software corresponding to the software of the server identified by the received software information is stored in the storage unit; The software update device of claim 1, wherein when the control unit determines that software corresponding to the software of the server identified by the received software information is not stored in the memory unit, the communication unit receives from the server software corresponding to the software of the server identified by the received software information.

4. An update control method executed by a computer having a processor, a memory, and a storage device to control software update of an electronic control unit mounted on a vehicle, comprising: receiving, from the server, software information that identifies software used in the server to distribute update data for the electronic control unit; receiving, from the server, software corresponding to the software of the server identified by the received software information; downloading the update data from the server by executing software corresponding to the software of the server specified by the received software information.

5. An update control program executed by a computer having a processor, a memory, and a storage device to control software update of an electronic control unit mounted on a vehicle, comprising: receiving, from the server, software information that identifies software used in the server to distribute update data for the electronic control unit; receiving, from the server, software corresponding to the software of the server identified by the received software information; and downloading the update data from the server by executing software corresponding to the software of the server specified by the received software information.

6. An OTA master that controls software updates of an electronic control unit mounted on a vehicle, a communication unit that receives software information from a center that identifies software used in the distribution of update data for the electronic control unit at the center, and receives software from the center that corresponds to the software at the center identified by the received software information; a control unit that downloads the update data from the center by executing software corresponding to the software of the center specified by the received software information.

Images