Server for distributing update data, method and program for distributing update data, and software update system

Abstract

To provide a server enabling update of software of an electronic control unit even when the server and a vehicle cannot communicate with each other, a software update system, a distribution method and a distribution program of update data.SOLUTION: A server is configured to distribute update data of software of an electronic control unit mounted on a vehicle, and includes: a storage unit configured to store priority information indicating which of a communication module mounted on the vehicle and a mobile terminal configured to communicate with the vehicle has a higher priority; and a transmission unit for transmitting the update data to the communication module when a terminal with high priority is the communication module and transmitting the update data to the mobile terminal when the terminal with high priority is the mobile terminal, based on the priority information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a server that distributes update data for software of an electronic control unit, a method and program for distributing update data, and a software update system. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units (ECUs) for controlling the operation of the vehicle. The ECU includes a processor, a temporary storage unit such as RAM, and a non-volatile storage unit such as flash ROM, and the processor executes software stored in the non-volatile storage unit to realize the control functions of the ECU. The software stored in each ECU is rewritable, and by updating the software to a newer version, it is possible to improve the functions of each ECU or add new vehicle control functions.

[0003] One known technology for updating ECU software is OTA (Over the Air) technology, which wirelessly connects an in-vehicle communication device connected to an in-vehicle network to a communication network such as the Internet, downloads software from a server via wireless communication, and installs the downloaded software to update or add programs to the ECU (see, for example, Patent Document 1).

[0004] OTA software updates can be initiated when the vehicle's ignition or power is turned on, and the update control device installed in the vehicle transmits version information of the program of the in-vehicle device to a server (update confirmation) via a communication device installed in the vehicle (see, for example, Patent Document 1). When the update control device downloads update data from the server, it notifies the user that update data is available by displaying the information on a display device or the like inside the vehicle, and installs and activates the update data when the user gives consent by operating an input device such as a button. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2018-181377 A Summary of the Invention [Problem to be solved by the invention]

[0006] There may be cases where the communication module installed in the vehicle cannot communicate with the server due to radio wave conditions, malfunctions, etc. In addition, depending on the vehicle model and vehicle use, the vehicle may not even be equipped with a communication module for communicating with the server. In these cases, the program in the electronic control unit cannot be updated by OTA, leaving room for improvement.

[0007] Therefore, an object of the present disclosure is to provide a server, an update data distribution method and distribution program, and a software update system that enable updating of software in an electronic control unit even when communication between the server and the vehicle is not possible. [Means for solving the problem]

[0008] The server according to the present disclosure distributes update data for software of an electronic control unit mounted in a vehicle, and includes a memory unit that stores priority information indicating which has a higher priority: a communication module mounted in the vehicle or a mobile terminal configured to communicate with the vehicle, and a transmission unit that, based on the priority information, transmits the update data to the communication module if the higher priority terminal is the communication module, and transmits the update data to the mobile terminal if the higher priority terminal is a mobile terminal.

[0009] The update data distribution method according to the present invention is a method for distributing software update data for an electronic control unit mounted in a vehicle, and includes: The serverand storing the update data in the communication module based on the priority information, if the terminal with the higher priority is the communication module. The server and transmitting the update data to the mobile terminal based on the priority information if the terminal with the higher priority is a mobile terminal. The server and a transmitting step.

[0010] The update data distribution program of the present invention is a program for distributing update data for software of an electronic control unit installed in a vehicle, and causes the electronic control unit to execute the steps of: storing priority information indicating which of a communication module installed in the vehicle and a mobile terminal configured to communicate with the vehicle has a higher priority; transmitting the update data to the communication module if the terminal with the higher priority is the communication module based on the priority information; and transmitting the update data to the mobile terminal if the terminal with the higher priority is a mobile terminal based on the priority information.

[0011] The software update system of the present invention includes a vehicle, a server that distributes update data for software of an electronic control unit installed in the vehicle, and a mobile terminal configured to communicate with the vehicle, and the server includes a memory unit that stores priority information indicating which of the communication module installed in the vehicle and the mobile terminal has a higher priority, and a transmission unit that, based on the priority information, transmits the update data to the communication module if the terminal with the higher priority is the communication module, and transmits the update data to the mobile terminal if the terminal with the higher priority is a mobile terminal. Effect of the Invention

[0012] According to the present disclosure, it is possible to provide a server, an update data distribution method, and a distribution program software update system that enable software updates of an electronic control unit even when communication between the server and a vehicle is not possible. [Brief description of the drawings]

[0013] [Figure 1]FIG. 1 is a block diagram showing an overall configuration of a network system according to an embodiment; [Diagram 2] A block diagram showing the schematic configuration of the server shown in FIG. 1. [Diagram 3] FIG. 2 is a block diagram showing a schematic configuration of the software update device shown in FIG. 1. [Figure 4] FIG. 2 is a block diagram showing a schematic configuration of the mobile terminal shown in FIG. [Diagram 5] Functional block diagram of a server according to the first embodiment [Figure 6] FIG. 13 is a diagram showing an example of device identification information stored in a server; [Figure 7] FIG. 13 is a diagram showing an example of update management information stored in a server; [Figure 8] Functional block diagram of a software update device according to a first embodiment. [Figure 9] Functional block diagram of a mobile terminal according to a first embodiment. [Figure 10] 1 is a flowchart showing an example of a control process executed by a server according to the first embodiment; [Figure 11] 1 is a flowchart showing an example of an update data distribution process executed by a server according to a first embodiment; [Figure 12] A flowchart showing an example of a software update process executed by the software update device. [Figure 13] FIG. 11 is a sequence diagram illustrating another example of the software update process executed by the software update device. [Figure 14] FIG. 11 is a diagram showing an example of device identification information stored in a server according to a second embodiment; [Figure 15] 11 is a flowchart showing an example of a control process performed by a server according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] (Configuration common to the first and second embodiments) FIG. 1 is a block diagram showing the overall configuration of a network system relating to an embodiment, FIG. 2 is a block diagram showing the general configuration of a server shown in FIG. 1, FIG. 3 is a block diagram showing the general configuration of a software update device shown in FIG. 1, and FIG. 4 is a block diagram showing the general configuration of a mobile terminal shown in FIG. 1.

[0015] The network system shown in FIG. 1 is a system for updating software of electronic control units 13a to 13d mounted on vehicles, and includes a server 1 (center) and an in-vehicle network 2 mounted on the vehicles.

[0016] The server 1 is capable of communicating with a software update device 11 mounted on the vehicle via a network 5, and manages software updates for electronic control units 13a to 13d mounted on the vehicle.

[0017] 2, the server 1 includes a CPU 21, a RAM 22, a storage device 23, and a communication device 24. The storage device 23 includes a readable / writable storage medium such as a hard disk or SSD, and stores a program for performing software update management, information used in the update management, and update data for the electronic control unit. In the server 1, the CPU 21 executes a program read from the storage device 23 by using the RAM 22 as a working area, thereby executing a control process, which will be described later. The communication device 24 is a device that communicates with the software update device 11 via a network.

[0018] The in-vehicle network 2 includes a software update device 11 (OTA master), a communication module 12, a plurality of electronic control units 13a to 13d, and a display device 14. The software update device 11 is connected to the communication module 12 via a bus 15a, to the electronic control units 13a and 13b via a bus 15b, to the electronic control units 13c and 13d via a bus 15c, and to the display device 14 via a bus 15d. The software update device 11 can wirelessly communicate with the server 1 via the communication module 12. The software update device 11 can also wirelessly communicate with a mobile terminal 3 such as a smartphone or an electronic key. The software update device 11 controls software update of an electronic control unit (target ECU) to be updated among the electronic control units 13a to 13d based on update data distributed from the server 1. The software update device 11 may also be referred to as a central gateway. The communication module 12 is a communication device that connects the in-vehicle network 2 and the server 1. The electronic control units 13a to 13d control the operation of each part of the vehicle. During software update processing of the display device 13d, the display device 14 is used to display various information such as the presence of update data, a consent request screen for requesting consent to the software update from the user or administrator, and the update result. A display device of a car navigation system can typically be used as the display device 14, but is not particularly limited as long as it can display information required during program update processing. Although four electronic control units 13a to 13d are illustrated in FIG. 1, the number of electronic control units is not particularly limited. An electronic control unit other than the display device 14 may be further connected to the bus 15d shown in FIG. 1.

[0019] The electronic control units 13a to 13d each include a CPU, a RAM, a non-volatile memory (storage), and a communication device. The CPU executes software (programs) read from the non-volatile memory using the RAM as a working area to realize the functions of each electronic control unit. Here, the electronic control units include those having one data storage area (bank) for storing software, and those having two data storage areas (banks) for storing software. In addition to software for realizing the functions of the electronic control unit, the data storage area of ​​the electronic control unit may store version information, parameter data, a boot program for startup, a program for software update, and the like. In an electronic control unit having one data storage area, installing update data in the data storage area affects the software of the electronic control unit. On the other hand, in an electronic unit having two data storage areas, one of the two data storage areas is set as the storage area (operational side) to be read, and the software stored in the storage area to be read is executed. In the other storage area (non-operational side) that is not the target to be read, update data can be written in the background while the program in the storage area (operational side) to be read is being executed. When activating in a software update process, the updated software can be made valid by switching the storage area from which the CPU reads the program.

[0020] In this disclosure, an electronic control unit having two data storage areas includes an electronic control unit equipped with a memory configuration called "single-sided suspend memory" in which one side of a data storage area of ​​a non-volatile memory is partitioned into two sides, making it possible to write a program to one side while a program is being executed on the other side, and an electronic control unit that has a non-volatile memory having one side of a data storage area, as well as an extended non-volatile memory having one side of a data storage area, and in which these two non-volatile memories can be used as the operational side and the non-operational side.

[0021] As shown in FIG. 3, the software update device 11 includes a CPU 31, a RAM 32, a ROM 33, a storage device 34, and communication devices 35 and 36. In the software update device 11, the CPU 31 executes a program read from the ROM 33 or the storage device 34, using the RAM 32 as a working area, thereby performing a control process, which will be described later. The communication device 35 is a device that communicates with the communication module 12, the electronic control units 13a to 13d, and the display device 14 via the buses 15a to 15d shown in FIG. 1. The communication device 36 is a device that wirelessly communicates with the mobile terminal 3, and is, for example, a device that communicates with BLE (Bluetooth (registered trademark) Communication is performed using communication methods such as Wi-Fi (registered trademark), Low Energy (registered trademark), and RF / LF communication. is possible.

[0022] Here, the software update process consists of a phase of downloading the update data, a phase of transferring the downloaded update data to the electronic control unit to be updated and installing the update data in the memory area of ​​the electronic control unit to be updated, and an activation phase of enabling the updated version of the software installed in the electronic control unit to be updated.

[0023] Downloading is a process of receiving update data for updating the software of the electronic control unit from the server 1 and storing it. The downloading phase includes not only receiving the update data but also controlling a series of processes related to the download, such as judging whether the download can be performed and verifying the update data. Installing is a process of writing an updated version of the program (update software) to the storage unit of the in-vehicle device in the electronic control unit to be updated based on the downloaded update data. The installing phase includes not only executing the installation but also controlling a series of processes related to the installation, such as judging whether the installation can be performed, transferring the update data and verifying the updated version of the program. Activating is a process of making the installed updated version of the program valid (activating). The control of activating includes not only executing the activation but also controlling a series of processes related to activation, such as judging whether the activation can be performed and verifying the execution results.

[0024] The update data may include update software for the electronic control unit, compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may include an identifier (ECU) for identifying the electronic control unit to be updated. The update data may include an identifier for identifying the software before the update (ECU software ID) and an identifier for identifying the software before the update (ECU software ID). The update data is downloaded as the above-mentioned distribution package, and the distribution package includes update data for a single or multiple electronic control units.

[0025] If the update data includes the update software itself, in the installation phase, the software update device transfers the update data (update software) to the electronic control unit to be updated. Also, if the update data includes compressed data, difference data, or divided data of the update software, the software update device 11 may transfer the update data to the electronic control unit to be updated, and the electronic control unit to be updated may generate the update software from the update data, or the software update device 11 may generate the update software from the update data and then transfer the update software to the electronic control unit to be updated. Here, the update software can be generated by decompressing the compressed data and assembling the difference data or divided data.

[0026] The update software can be installed by the electronic control unit to be updated based on an installation request from the software update device 11. Alternatively, the electronic control unit to be updated that has received the update data may autonomously install the software without receiving an explicit instruction from the software update device 11.

[0027] The activation of the updated software can be performed by the electronic control unit to be updated based on an activation request from the software updating device 11. Alternatively, the electronic control unit to be updated that has received the update data may autonomously activate the software without receiving an explicit instruction from the software updating device 11.

[0028] The software update process can be performed consecutively or in parallel for each of the multiple electronic control units.

[0029] In addition, the "software update process" in this specification includes not only a process in which all of the download, installation, and activation steps are performed in succession, but also a process in which only part of the download, installation, and activation steps are performed.

[0030] As shown in Fig. 4, the mobile terminal 3 includes a CPU 41, a RAM 42, a storage device (storage) 43 such as a non-volatile memory, and a communication device 44. The CPU 41 executes software (programs) read from the storage device 43 using the RAM 42 as a working area, thereby realizing various functions. In this embodiment, the mobile terminal 3 includes the server 1 and The mobile terminal 3 is a terminal device capable of communicating with the software update device 11, and is, for example, a mobile device (wireless key) used as a vehicle key, a smartphone, etc. The communication method between the mobile terminal 3 and the electronic control unit 13e is not particularly limited, and BLE (Bluetooth (registered trademark) Low Energy), Wi-Fi (registered trademark), RF / LF communication, etc. can be used.

[0031] (First embodiment) FIG. 5 is a functional block diagram of a server according to the first embodiment, FIG. 6 is a diagram showing an example of device identification information stored in the server, and FIG. 7 is a diagram showing an example of update management information stored in the server.

[0032] The server 1 includes a first storage unit 25, a second storage unit 26, a communication unit 27, and a control unit 28. The first storage unit 25 and the second storage unit 26 are realized by the storage device 23 shown in Fig. 2, and the communication unit 27 and the control unit 28 are realized by the CPU 21 shown in Fig. 2 executing a program (a program for controlling the software update device 11) stored in the storage device 23 using the RAM 22.

[0033] The first storage unit 25 stores device identification information and update management information.

[0034] As shown in FIG. 6, the device identification information is information that associates, for each vehicle identification information (vehicle ID) that identifies the vehicle, information that identifies the communication module 12 mounted on the vehicle and information that identifies the mobile terminal 3 that can communicate with the software update device 11. The information that identifies the communication module 12 and the information that identifies the mobile terminal 3 are, for example, information that allows the server 1 to uniquely specify a destination to which data is to be transmitted, and are, for example, addresses on a network such as an IP address. The device identification information is used by the server 1 to acquire a second destination to which update data is to be transmitted when the server 1 cannot transmit update data for the software of the electronic control unit by communication with the vehicle via the communication module 12. In the example of FIG. 6, the addresses of the communication module 12 and the mobile terminal are registered in the vehicles identified by the vehicle IDs "VID_1001" and "VID_1002", and the address of the mobile terminal is registered in the vehicle identified by the vehicle ID "VID_1003".

[0035] As shown in FIG. 7, the update management information is information that associates, for each vehicle identification information (vehicle ID) that identifies a vehicle, information indicating whether software updates via wireless communication are possible (OTA possible or not) with information indicating software available in one or more electronic control units mounted on the vehicle. As information indicating software available in an electronic control unit, for example, a combination of the latest version information of each of the software in multiple electronic control units is defined. As shown in FIG. 6, the vehicle identified by the vehicle ID "VID_1003" is not equipped with a communication module that can communicate with the server 1, so "not possible" is set as the information indicating whether OTA is possible or not.

[0036] The second storage unit 26 stores update data for the electronic control unit. As described above, the update data may include update software for the electronic control unit, compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data.

[0037] The communication unit 27 is capable of receiving a software update confirmation request from the software update device 11. The update confirmation request is information transmitted from the software update device 11 to the server 1 when, for example, the power or ignition is turned on in the vehicle, and is information for requesting the server 1 to confirm whether or not there is update data for the electronic control unit. In response to the update confirmation request received from the software update device 11, the communication unit 27 transmits information indicating the presence or absence of update data to the software update device 11. The communication unit 27 also transmits information indicating the presence or absence of update data to the software update device 11. The communication unit 27 can receive a transmission request (download request) for a distribution package from the software update device 11. When the communication unit 27 receives a download request for a distribution package, it transmits a distribution package including update data for the software of the electronic control unit to the software update device 11 that made the download request. Furthermore, when communication between the server 1 and the software update device 11 is not possible, the communication unit 27 transmits a notification indicating that update data for the electronic control unit is available to the mobile terminal 3 associated with the software update device 11 in the device identification information. In this case, when the communication unit 27 receives a download request from the mobile terminal 3, it transmits a distribution package including update data for the software of the electronic control unit to the mobile terminal 3 that made the download request.

[0038] When the communication unit 27 receives an update check request, the control unit 28 determines whether or not there is update data for the software of the vehicle identified by the vehicle ID included in the update check request, based on the update management information stored in the first storage unit 25. The determination result by the control unit 28 as to whether or not there is update data is transmitted to the software update device 11 by the communication unit 27. When the control unit 28 determines that there is update data for the electronic control unit, upon receiving a download request for a distribution package from the software update device 11, the control unit 28 generates a distribution package including the update data to be stored in the second storage unit 26. This distribution package is transmitted to the software update device 11 by the communication unit 27.

[0039] The control unit 28 also determines whether or not communication between the server 1 and the software update device 11 is possible. When communication between the server 1 and the software update device is interrupted, or when the vehicle equipped with the software update device 11 does not have an in-vehicle device required for software update, the control unit 28 determines that communication between the server 1 and the software update device 11 (vehicle) is not possible. When communication between the server 1 and the software update device 11 (communication related to OTA or other communication) between the server 1 and the software update device 11 is not performed for a predetermined period based on the communication log of the communication unit 27, the control unit 28 can determine that communication between the server 1 and the software update device 11 is not possible. Alternatively, the control unit 28 may determine that communication between the server 1 and the software update device 11 is not possible when the difference between the software version of each electronic control unit recorded in the update management information and the latest software version is equal to or greater than a predetermined value, or when software updates of the electronic control units have not been recorded for a certain period in the software update history of the electronic control units. Whether or not the vehicle has an in-vehicle device required for software update is installed can be determined based on the device identification information shown in FIG. 6 or the update management information shown in FIG. 7. Examples of in-vehicle equipment required for software updates include the above-mentioned communication module 12, as well as equipment equipped with a display device such as a car navigation system that is used for performing approval processing by the user.

[0040] FIG. 8 is a functional block diagram of the software updating device according to the first embodiment.

[0041] The software updating device 11 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is realized by the storage device 34 shown in Fig. 3, and the communication unit 38 and the control unit 39 are realized by the CPU 31 shown in Fig. 3 executing a program (a program for controlling the software updating device 11) stored in the ROM 33 using the RAM 32.

[0042] The storage unit 37 stores programs for executing software updates for the electronic control units 13a to 13d, various data used when executing the software updates, and software update data downloaded from the server 1.

[0043] The communication unit 38 transmits a software update check request to the server 1 when the power supply or ignition of the vehicle is turned on. The update check request includes, for example, a vehicle ID for identifying the vehicle and the software update information of the electronic control units 13a to 13a connected to the in-vehicle network 2. The vehicle ID and the software version of the electronic control units 13a to 13d are used to determine whether or not there is update data for the software of the electronic control units by comparing them with the latest software version that the server 1 holds for each vehicle ID. The control unit 39 also receives a confirmation result indicating the presence or absence of update data from the server 1 as a response to the update confirmation request, and determines the presence or absence of update data based on the confirmation result. If there is update data for the software of any of the electronic control units, the control unit 39 transmits a download request for the distribution package to the server 1 and receives the distribution package transmitted from the server 1. In addition to the update data, the distribution package may include verification data for verifying the authenticity of the update data, the number of update data, the installation order, various control information used when updating the software, and the like. When the control unit 39 receives a distribution package including update data from the server 1, it verifies the authenticity of the received distribution package.

[0044] After the distribution package including the update data is downloaded, the control unit 39 performs an installation process, an activation process, and an approval request process for the installation process or activation process of the update data. When the software update is executed, the control unit 39 performs approval request processing, which includes a process of outputting a notification that approval is required for the software update or a notification prompting an input that the software update has been approved, to the output device, and a process of accepting an operation input from the user. As the output device, the display device 14 provided in the in-vehicle network 2, an audio output device that notifies by audio, and the like can be used. For example, in the approval request processing, when the display device 14 is used as the output device, the control unit 39 causes the display device 14 to display an approval request screen for requesting approval of the software update, and causes the display device 14 to display a notification that prompts a specific input operation, such as pressing an approval button, when the user or administrator approves the software update. In addition, during the consent request process, the control unit 39 causes the display device 14 to display, for example, text or an icon notifying the user that update data for the software of the electronic control unit is available, and causes the display device 14 to display, for example, restrictions that may exist during the software update process.

[0045] FIG. 9 is a functional block diagram of the mobile terminal according to the first embodiment.

[0046] The mobile terminal 3 includes a storage unit 46, a communication unit 47, a control unit 48, and a display unit 49. The storage unit 46 is realized by the storage device 43 shown in Fig. 4, and the communication unit 47 and the control unit 48 are realized by the CPU 41 shown in Fig. 4 executing a program stored in the storage device 43 using the RAM 42.

[0047] The storage unit 46 stores programs for executing software updates for the electronic control units 13a to 13d, various data used when executing the software updates, and software update data downloaded from the server 1.

[0048] The communication unit 47 can wirelessly communicate with the server 1 and the software update device 11. The communication unit 47 receives a notification from the server 1 indicating that update data for the software of the electronic control unit is available. This notification is transmitted from the server 1 when communication between the server 1 and the software update device 11 is not possible. When the communication unit 47 receives a notification indicating that update data for the software of the electronic control unit is available, the communication unit 47 transmits a download request for the distribution package to the server 1 and can receive the distribution package transmitted from the server 1. The communication unit 47 may transmit the download request for the distribution package to the server 1 based on an explicit instruction from the user, or may transmit the request automatically in response to the notification from the server 1. As described above, the distribution package may include, in addition to the update data, verification data for verifying the authenticity of the update data, the number of update data, the installation order, various control information used during software update, and the like. When updating the software of the electronic control unit through communication between the mobile terminal 3 and the software update device 11, the communication unit 47 receives a download request for the distribution package from the server 1 and can receive the distribution package transmitted from the server 1. The update data downloaded from the download server 11 is transferred to the software update device 11.

[0049] After the distribution package including the update data is downloaded, the control unit 48 performs a process of updating the software of the electronic control unit by wireless communication with the software update device 11 using the downloaded update data. The software update process executed by the mobile terminal 3 includes an installation process of the update data, an activation process, and a process of requesting consent to the installation or activation. In the installation process, the control unit 48 instructs the software update device 11 to install. In the activation process, the control unit 48 instructs the software update device 11 to activate the updated software. In addition, as a consent request process, the control unit 48 causes the display unit 49 to output a notification that consent is required for the software update or a notification prompting input that the software update has been consented to, and performs a process of requesting consent from the user and a process of accepting consent to the software update. In addition to the display unit 49, the control unit 48 may cause a notification to be output to an audio output device or the like provided in the mobile terminal 3. For example, in the consent request process, the control unit 48 causes the display unit 49 to display an consent request screen for requesting consent to the software update, and causes the display unit 49 to display a notification prompting a specific input operation such as pressing an consent button when the user or administrator consents. Also, in the consent request process, the control unit 48 causes the display unit 49 to display wording, images, etc. notifying that update data for the software of the electronic control unit is available, and causes the display unit 49 to display restrictions, etc. during the execution of the software update process.

[0050] The display unit 49 has a display screen, and displays various display contents accompanying the control unit 48 executing software (applications).

[0051] Fig. 10 is a flowchart showing an example of a control process executed by the server according to the first embodiment, and more specifically, shows an example of a process for determining whether or not communication between the server and the software update device is possible. The process of Fig. 10 can be executed periodically at regular intervals, for example.

[0052] In step S11, the control unit 28 checks the software update status of each vehicle. Specifically, the control unit 28 refers to the update management information (FIG. 7) stored in the first storage unit 25, and extracts records of vehicles that require software updates of their electronic control units based on a comparison between the software version of the electronic control units recorded in the update management information and the latest software version. For example, in the example of FIG. 7, if the latest software versions of ECU1, ECU2, ECU3, and ECU4 are 2.0, 2.0, 1.4, and 1.0, the vehicle identified by the vehicle ID "VID_1001" does not require software updates since it has the latest software, but the vehicles identified by the vehicle IDs "VID_1002" and "VID_1003" require software updates. For the sake of simplicity, it is assumed that the three vehicles shown in FIG. 7 are of the same model and are equipped with the same electronic control units. The control unit 28 extracts the records of the vehicles identified by the vehicle IDs "VID_1002" and "VID_1003" as records of vehicles that require software updates. In the following description, the vehicles that require software updates extracted in step S11 are referred to as "target vehicles." Then, the process proceeds to step S12.

[0053] In step S12, the control unit 28 determines whether or not there is a vehicle that requires a software update. If a record of a vehicle that requires a software update is extracted in step S11, the control unit 28 determines YES. If the determination in step S12 is YES, the process proceeds to step S13, and otherwise the process ends.

[0054] In step S13, the control unit 28 determines whether or not the target vehicle identified in step S11 is a vehicle for which software updating via wireless communication (OTA) is possible. In step S13, the control unit 28 selects one record from the records of the target vehicle extracted in step S11. The control unit 28 determines whether or not software updating by OTA is possible based on information indicating whether OTA is possible or not included in the selected record. If the determination in step S13 is YES, the process proceeds to step S14, and otherwise the process proceeds to step S15.

[0055] In step S14, the control unit 28 determines whether or not communication has occurred between the server 1 and the vehicle (software update device 11) within a predetermined period of time. The determination in step S14 can be made based on the communication log of the communication unit 27. If the determination in step S14 is YES, the process proceeds to step S17, and otherwise the process proceeds to step S15.

[0056] In step S15, the control unit 28 determines whether or not the mobile terminal is registered. More specifically, the control unit 15 refers to the device identification information (FIG. 6) and determines whether or not information on the mobile terminal associated with the vehicle ID of the record selected in step S13 is registered. If the determination in step S15 is YES, the process proceeds to step S15; otherwise, the process proceeds to step S17.

[0057] In step S16, the communication unit 27 transmits a notification indicating that the software update of the electronic control unit is necessary to the mobile terminal associated with the vehicle ID of the record selected in step S13. After that, the process proceeds to step S17.

[0058] In step S17, the control unit 28 determines whether or not the records of all the target vehicles extracted in step S11 have been processed (whether or not the processes in steps S13 to S16 have been performed). If the process in step S17 is YES, the process ends, otherwise the process proceeds to step S13.

[0059] Fig. 11 is a flowchart showing an example of an update data distribution process executed by the server according to the first embodiment. The control process shown in Fig. 11 is executed repeatedly at a predetermined time interval, for example. Note that the device identification information, update management information, and update data are registered in advance in the storage unit (first storage unit 25, second storage unit 26) before the control process of Fig. 11 is executed.

[0060] In step S21, the communication section 27 determines whether or not an update confirmation request has been received from the software updating device 11. If the determination in step S21 is YES, the process proceeds to step S22, and otherwise the process proceeds to step S23.

[0061] In step S22, the communication unit 27 transmits information indicating whether or not there is update data for the software of the electronic control unit to the vehicle that transmitted the update check request. The presence or absence of update data can be determined by, for example, the control unit 28 comparing the combination of software versions stored in the update management information in association with the vehicle ID included in the update check request with the combination of current software versions included in the update check request, and determining that there is update data if the combination of current software versions included in the update check request is older than the combination of versions stored in the update management information. Then, the process proceeds to step S23.

[0062] In step S23, the communication unit 27 determines whether or not a download request for update data (distribution package) has been received. If the determination in step S23 is YES, the process proceeds to step S24, and otherwise the process proceeds to step S21.

[0063] In step S24, the control unit 28 determines whether the source of the download request received in step S23 is the vehicle (the software update device 11) or the mobile terminal 3. If the sender of the download request is a vehicle, the process proceeds to step S25, and if the sender of the download request is a mobile terminal 3, the process proceeds to step S26.

[0064] In step S25, the communication unit 27 transmits the distribution package including the software update data generated by the control unit 28 to the software update device 11. After that, the process proceeds to step S21.

[0065] In step S26, the communication unit 27 transmits the distribution package including the software update data generated by the control unit 28 to the mobile terminal 3. After that, the process proceeds to step S21.

[0066] Incidentally, the processing of step S25 shown in FIG. 11 is an update data distribution processing executed when the server 1 and the software update device 11 are capable of communicating with each other, and the processing of step S26 is an update data distribution processing executed when the server 1 and the software update device are not capable of communicating with each other.

[0067] Fig. 12 is a flow chart showing an example of a software update process executed by the software update device. The control process shown in Fig. 12 is a process in which the software update device 11 updates the software of the electronic control unit by communicating with the server 1, and is executed, for example, when the power supply or ignition of the vehicle is turned on.

[0068] In step S31, the communication unit 38 transmits an update check request including the vehicle ID and a combination of the software versions of the electronic control units 13a to 13d to the server 1. After that, the process proceeds to step S32.

[0069] In step S32, the communication unit 38 receives the confirmation result of the update data from the server 1. After that, the process proceeds to step S33.

[0070] In step S33, the control unit 39 determines whether or not there is update data for the software of the electronic control units 13a to 13d, based on the confirmation result received from the server 1. If the process in step S33 is YES, the process proceeds to step S34, and otherwise the process ends.

[0071] In step S34, the communication unit 38 executes a download process. More specifically, the communication unit 38 transmits a download request for a distribution package to the server 1, receives the distribution package transmitted in response to the download request, and stores the received distribution package in the storage unit 37. The communication unit 38 verifies the authenticity of the update data contained in the received distribution package. In step S34, the communication unit 38 may determine whether or not the download can be performed, and may notify the server 1 that the download has been completed. After that, the process proceeds to step S35.

[0072] In step S5, the control unit 39 executes an installation process for the electronic control unit to be updated. The installation process in step S35 includes a determination as to whether installation can be executed, a process of requesting the user to consent to the installation and receiving input of consent, a transfer of update data from the software update device 11 to the electronic control unit to be updated, a request for installation in the electronic control unit to be updated, and a request for verification of installation in the electronic control unit to be updated. The electronic control unit to be updated installs the updated software in the storage area using the update data received from the software update device 11. Then, the process proceeds to step S36.

[0073] In step S36, the control unit 39 executes activation processing for the electronic control unit to be updated. The activation processing in step S26 includes judging whether activation can be executed, requesting the user to consent to activation and accepting input of consent, and issuing an activation request to the electronic control unit to be updated. The electronic control unit to be updated switches the software to be executed to the software of the update board, thereby enabling and starting the updated software. Then, the processing ends.

[0074] Fig. 13 is a sequence diagram showing another example of the software update process executed by the software update device. The control process shown in Fig. 13 is a process in which the software update device 11 updates the software of the electronic control unit by communicating with the mobile terminal 3, and is executed, for example, in response to an instruction from a user input to the mobile terminal 3 or the software update device 11.

[0075] In step S41, the communication unit 47 of the mobile terminal 3 transmits a connection request to the software update device 11. The connection request in step S41 is transmitted, for example, in response to an instruction input from the user. After that, the process proceeds to step S42.

[0076] In step S42, the control unit 39 of the software update device 11 performs an authentication process to authenticate the portable terminal that has transmitted the connection request. The method of the authentication process is not particularly limited, and any known authentication process can be adopted. In the authentication process, the software update device 11 may communicate with the portable terminal multiple times. Note that the authentication process in step S42 may be performed by an electronic control unit that performs authentication when unlocking or starting the vehicle, instead of by the software update device 11. In this case, the software update of the electronic control unit is performed using the portable terminal 3 used as the electronic key of the vehicle, thereby improving security. The process then proceeds to step S43.

[0077] In step S43, the communication unit 38 of the software update device 11 transmits the authentication result to the mobile terminal 3. In the example of Fig. 13, it is assumed that the software update device 11 transmits the authentication result indicating that the authentication was successful in step S43. After that, the process proceeds to step S44.

[0078] In step S44, the control unit 48 of the mobile terminal 3 causes the display unit 49 to display a permission request screen for requesting permission for downloading the update data. After that, the process proceeds to step S45.

[0079] In step S45, the control unit 48 of the mobile terminal 3 accepts an input indicating that the user has authorized the download. When the control unit 48 detects that the user has authorized the download through a touch panel or button operation, the process proceeds to step S46.

[0080] In step S46, the communication unit 47 of the mobile terminal 3 transfers the update data stored in the storage unit 46 to the software update device 11. After that, the process proceeds to step S47.

[0081] In step S47, the control unit 39 of the software updating device 11 checks the authenticity of the update data received from the mobile terminal 3. After that, the process proceeds to step S48.

[0082] In step S48, the communication unit 38 of the software updating device 11 transmits the check result of the authenticity of the update data to the mobile terminal 3. In the example of Fig. 13, it is assumed that the software updating device 11 transmits the check result indicating that the update data is authentic in step S47. After that, the process proceeds to step S49.

[0083] In step S49, the control unit 48 of the mobile terminal 3 causes the display unit 49 to display a permission request screen for requesting permission for installation of the update data. The control unit 48 causes the display unit 49 to display, for example, a message indicating that software update of the electronic control unit will start, and, if necessary, a time required for installation and restrictions and precautions during installation. Thereafter, the process proceeds to step S50.

[0084] In step S50, the control unit 48 of the mobile terminal 3 accepts an operation input by the user using an input means such as a touch panel or an operation button. The operation input to consent to the installation can be determined based on whether or not a button such as "Accept" or "Start Update" displayed on the display unit 49 is pressed. In addition, if the user does not immediately consent to the start of the software update (installation) and wishes to start the software update (installation) later, the user can accept this by pressing a button such as "Later". When the control unit 48 detects that an input to consent has been made by operating the touch panel or buttons, the process proceeds to step S51.

[0085] In step S51, the communication section 47 of the mobile terminal transmits an instruction to install update data to the software updating device 11. After that, the process proceeds to step S52.

[0086] In step S52, the control unit 39 of the software update device 11 executes an installation process for the electronic control unit to be updated. The installation process in step S52 includes a determination as to whether installation can be performed, a transfer of update data from the software update device 11 to the electronic control unit to be updated, an installation request to the electronic control unit to be updated, and a verification request for installation to the electronic control unit to be updated. The electronic control unit to be updated installs the updated software in the storage area using the update data received from the software update device 11. Then, the process proceeds to step S53.

[0087] In step S53, the communication unit 38 of the software updating device 11 transmits an installation completion notification indicating that the installation has been completed to the mobile terminal 3. After that, the process proceeds to step S54.

[0088] In step S54, the control unit 48 of the mobile terminal 3 causes the display unit 49 to display a permission request screen for requesting permission for activation of the updated software. The control unit 48 causes the display unit 49 to display, for example, a message that the software update of the electronic control unit is ready and that the program will be updated by performing a specific operation such as turning off the power or the ignition, and, if necessary, a message indicating the time required for activation and any restrictions or precautions during activation. After that, the process proceeds to step S55.

[0089] In step S55, the control unit 48 of the mobile terminal 3 accepts an operation input to the effect that the activation is accepted using an input means such as a touch panel or an operation button. The operation input to the effect that the activation is accepted can be determined based on whether or not a button such as "Accept" or "Update" displayed on the display unit 49 is pressed. Also, if the user does not accept the software update (activation) immediately and wishes to perform the software update later, the user can accept this by pressing a button such as "Later". When the control unit 48 detects that an input to the effect that the acceptance is accepted has been made using the touch panel, button operation, or the like, the process proceeds to step S56.

[0090] In step S56, the communication unit 47 of the mobile terminal transmits an instruction to activate the updated software to the software update device 11. After that, the process proceeds to step S57.

[0091] In step S57, the control unit 39 of the software update device 11 executes activation processing for the electronic control unit to be updated. The activation processing in step S57 includes judging whether activation can be executed, processing for accepting input of consent, and an activation request to the electronic control unit to be updated. The electronic control unit to be updated switches the software to be executed to the software of the update board, thereby enabling and starting the updated version of the software. Then, the processing ends.

[0092] If the electronic control unit to be updated has one data storage area, the software of the electronic control unit is affected when the update data is installed in the data storage area, so it is preferable to perform installation and activation consecutively. In this case, if the electronic control unit to be updated has one data storage area, a consent request process for installation and activation may be performed before installation, and the consent request process before activation may be omitted.

[0093] As described above, the server 1 according to this embodiment holds information (such as addresses) of the software update device 11 mounted on the vehicle and the mobile terminal (smartphone, smart key) capable of communicating with the software update device 11 as device identification information. When software update cannot be performed by communication between the server 1 and the software update device 11, the server 1 can execute software update of the electronic control unit via the mobile terminal 3 capable of communicating with the software update device 11 of the target vehicle. Therefore, even when the server 1 cannot communicate with the vehicle, it is possible to update the software of the electronic control unit in a timely manner. In addition, when the server 1 cannot execute software update by communication with the software update device, it can selectively transmit update data to the mobile terminal 3 to instruct execution of update processing, so that software update by communication between the server 1 and the vehicle and software update via the mobile terminal are not executed in parallel, and duplication or inconsistency of software updates can be prevented.

[0094] In addition, when the server 1 according to this embodiment is not equipped with on-board equipment required for software updates, such as the communication module 12 and the display device 14, it is possible to perform software updates using the communication function and display screen of the mobile terminal 3.

[0095] Second Embodiment The server according to the second embodiment will be described, focusing on the differences from the first embodiment.

[0096] FIG. 14 is a diagram illustrating an example of device identification information stored in the server according to the second embodiment.

[0097] The device identification information shown in FIG. 14 is information in which, for each vehicle identification information (vehicle ID) that identifies a vehicle, information for identifying the communication module 12 mounted on the vehicle and information for identifying the mobile terminal 3 that can communicate with the software update device 11 are associated in order of priority. As in the first embodiment, the information for identifying the software update device 11 and the information for identifying the mobile terminal 3 are, for example, information that allows the server 1 to uniquely specify a destination of data transmission, and are, for example, addresses on a network such as an IP address. The device identification information according to this embodiment is used by the server 1 to obtain a destination of transmission of update data for the software of the electronic control unit. In the example of FIG. 14, the addresses of the communication module 12 and the mobile terminal 3 are registered in order of priority for the vehicle identified by the vehicle ID "VID_1001", and the addresses of the mobile terminal 3 and the communication module 12 are registered in order of priority for the vehicle identified by the vehicle ID "VID_1002". In addition, the addresses of the communication module 12 and the mobile terminal 3 are registered in order of priority for the vehicles identified by the vehicle IDs "VID_1003" and "VID_1004", respectively. In the example of FIG. 14, information on two terminals is registered for one vehicle ID, but three or more terminals may be registered in order of priority.

[0098] FIG. 15 is a flowchart illustrating an example of a control process performed by the server according to the second embodiment.

[0099] In step S61, the control unit 28 checks the software update status of each vehicle. Specifically, the control unit 28 refers to the update management information (FIG. 7) stored in the first storage unit 25, and extracts records of vehicles that require software updates for their electronic control units based on a comparison between the software version of the electronic control units recorded in the update management information and the latest software version. In the following description, the vehicles that require software updates extracted in step S11 are referred to as "target vehicles." After that, the process proceeds to step S62.

[0100] In step S62, the control unit 28 determines whether or not there is a vehicle that requires software update. If a record of a vehicle that requires software update is extracted in step S61, the control unit 28 determines YES. If the determination in step S12 is YES, the process proceeds to step S13, and otherwise the process ends.

[0101] In step S63, the control unit 28 selects one record from the records of the target vehicle extracted in step S61, and refers to the device identification information to determine whether the terminal with the highest priority associated with the vehicle ID of the selected record is the mobile terminal 3. If the determination in step S63 is YES, the process proceeds to step S64, and otherwise the process proceeds to step S65.

[0102] In step S64, the communication unit 27 transmits a notification indicating that the software update of the electronic control unit is necessary to the mobile terminal 3 referenced in step S64. After that, the process proceeds to step S65.

[0103] In step S65, the control unit 28 determines whether or not the records of all the target vehicles extracted in step S61 have been processed (whether or not the processes in steps S63 to S656 have been performed). If the process in step S65 is YES, the process ends, otherwise the process proceeds to step S63.

[0104] When the device identification information according to this embodiment is used, if communication with the primary terminal (terminal with high priority) is not possible, a secondary terminal (terminal with low priority) can be selected as the second transmission destination of the update data. Therefore, even if the server 1 cannot communicate with the primary terminal, it is possible to update the software of the electronic control unit in a timely manner by utilizing communication with the secondary terminal. In addition, the server 1 can selectively transmit update data to either the primary terminal or the secondary terminal to instruct the execution of the update process, so that software updates via communication between the server 1 and the vehicle and software updates via the mobile terminal are not performed in parallel, and therefore duplication or inconsistency of software updates can be prevented.

[0105] Furthermore, in this embodiment, since the mobile terminal 3 can be registered as the main terminal in the device identification information, it is possible to reliably notify the vehicle of the availability of update data for the software of the electronic control unit when the vehicle is not equipped with on-board devices required for software update, such as the communication module 12 and the display device 14. Furthermore, when the mobile terminal 3 is registered as the main terminal in the device identification information, software updates can be managed using the pre-registered mobile terminal, which is suitable for managing multiple vehicles for rental cars, car sharing, etc.

[0106] (Other variations) The functions of the server 1 exemplified in each of the above embodiments include a processor (CPU), a memory, and a storage device. It is also possible to realize the functions of the software update device 11 illustrated in each embodiment as an update control method executed by a computer equipped with a processor (CPU), memory, and storage device, or as an update control program executed by the computer equipped with the processor (CPU), memory, and storage device, or as a computer-readable non-transient storage medium storing the update control program.

[0107] In each of the above embodiments, an example has been described in which the software update device 11 provided in the in-vehicle network on the vehicle side controls program updates of all the electronic control units 13a to 13d as a master device, but instead of providing the software update device 11, any one of the electronic control units 13a to 13d may have an update control function and control program updates of the other electronic control units. Also, instead of providing the software update device 11, it is also possible to provide the update control function of the software update device 11 in an external device that can be connected to the in-vehicle network 2 by wire, and use this external device to perform program update processing of the electronic control units 13a to 13d. [Industrial Applicability]

[0108] The disclosed technique can be used in a network system for updating software in an electronic control unit. [Explanation of symbols]

[0109] 1 Server 2. In-vehicle network 3. Mobile devices 5. Network 11 Software update device 13a~13d Electronic control unit 25 1st memory section 26 2nd memory section 27 Communications Department 28 Control Unit 29 2nd Communications Department 46 Memory section 47 Communications Department 48 Control Unit 49 Display section

Claims

1. A server that distributes software update data for an electronic control unit mounted in a vehicle, a storage unit that stores priority information indicating which of a communication module mounted on the vehicle and a mobile terminal configured to communicate with the vehicle has a higher priority; Based on the priority information, If the terminal with the high priority is the communication module, transmitting the update data to the communication module; a transmission unit that transmits the update data to the mobile terminal when the high priority terminal is the mobile terminal; A server comprising:

2. The server according to claim 1 , further comprising a determination unit that determines whether the transmission unit transmits the update data to the communication module or to the mobile terminal based on the priority information.

3. 2. The server according to claim 1, wherein when the high priority terminal is the mobile terminal and the transmission unit fails to transmit the update data to the mobile terminal, the transmission unit transmits the update data to the communication module.

4. The server according to claim 1 , wherein the storage unit stores the priority information in association with identification information of the vehicle.

5. A method for distributing software update data for an electronic control unit mounted in a vehicle, comprising: a step of storing priority information in a server, the priority information indicating which of a communication module mounted on the vehicle and a mobile terminal configured to communicate with the vehicle has a higher priority; a step of transmitting the update data to the communication module by a server when the terminal having a high priority is the communication module based on the priority information; and if the terminal with the highest priority is the mobile terminal based on the priority information, the server transmits the update data to the mobile terminal.

6. A distribution program for distributing software update data for an electronic control unit mounted in a vehicle, the program comprising: storing priority information indicating which of a communication module mounted on the vehicle and a mobile terminal configured to communicate with the vehicle has a higher priority; transmitting the update data to the communication module when the terminal with the higher priority is the communication module based on the priority information; and transmitting the update data to the mobile terminal when the terminal with the highest priority is the mobile terminal based on the priority information.

7. Vehicles and a server that distributes update data for software of an electronic control unit mounted in the vehicle; a mobile terminal configured to communicate with the vehicle; The server, a storage unit that stores priority information indicating which of a communication module mounted on the vehicle and the mobile terminal has a higher priority; Based on the priority information, If the terminal with the high priority is the communication module, transmitting the update data to the communication module; a transmission unit that transmits the update data to the mobile terminal when the high priority terminal is the mobile terminal; A software update system comprising:

Images