Server, update management method, update management program, and center

Abstract

To provide a server, an update management method and an update management program which can timely perform program update through a life cycle of a vehicle.SOLUTION: A server comprises: a storage unit which stores life cycle status information indicating a distribution situation of a vehicle after manufacturing in association with each vehicle identification information for identifying the vehicle; a communication unit which receives a confirmation request including the vehicle identification information from the vehicle; and a control unit which determines whether or not there is update data of software of the vehicle identified by the vehicle identification information included in the confirmation request, when the communication unit receives the confirmation request. The control unit transmits indication information which indicates whether or not approval is required when executing software update processing in the vehicle to the vehicle, based on the life cycle status information, when it is determined that there is the update data of the software of the vehicle.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a server for managing software updates of an electronic control unit, and an update management method. 、 Update Management Program And Center Regarding. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units (ECUs) for controlling the operation of the vehicle. The ECU includes a processor, a temporary storage unit such as RAM, and a non-volatile storage unit such as flash ROM, and the processor executes software stored in the non-volatile storage unit to realize the control functions of the ECU. The software stored in each ECU is rewritable, and by updating the software to a newer version, it is possible to improve the functions of each ECU or add new vehicle control functions.

[0003] One known technology for updating ECU software is Over The Air (OTA) technology, which wirelessly connects an electronic control unit connected to an in-vehicle network to a communication network such as the Internet, downloads software from a server via wireless communication, and installs the downloaded software to update or add software to the ECU (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2004-326689 A Summary of the Invention [Problem to be solved by the invention]

[0005] When updating software by OTA, it is necessary to notify the user or administrator of the update contents of the vehicle functions and the associated restrictions, and to obtain consent from the user or administrator. The subject that gives consent may vary depending on the distribution status of the vehicle. For example, when the vehicle is in a yard, the subject that gives consent is the manufacturer, when the vehicle is being transported to a dealer, the subject that gives consent is the dealer, and after the OTA contract or sales contract, the subject that gives consent is the owner. For example, when the vehicle is in a yard or on a transport ship and there is a software update campaign, it is preferable to perform a software update in response to a specified operation on the vehicle, and to keep the software of the electronic control unit up to date.

[0006] However, with conventional OTA servers, it is difficult to know where the vehicle is located and who is providing consent for software updates via OTA, so it is expected that software updates will not be performed in a timely manner during the vehicle's life cycle.

[0007] Therefore, the present disclosure provides a server and an update management method capable of performing software updates in a timely manner throughout the life cycle of a vehicle. 、 Update Management Program And Center The purpose is to provide. [Means for solving the problem]

[0008] The server according to the present disclosure includes a storage unit that stores life cycle status information indicating a distribution status of a vehicle after manufacture in association with each vehicle identification information that identifies a vehicle, a communication unit that receives a confirmation request including the vehicle identification information from the vehicle, and a control unit that, when the communication unit receives the confirmation request, determines whether or not there is update data for the software of the vehicle identified by the vehicle identification information included in the confirmation request. When the control unit determines that there is update data for the software of the vehicle identified by the vehicle identification information, the communication unit transmits instruction information to the vehicle that instructs whether or not consent is required when executing a software update process in the vehicle based on the life cycle status information associated with the vehicle identification information included in the confirmation request, and the communication unit transmits instruction information to the vehicle based on the life cycle status information associated with the vehicle identification information included in the confirmation request. Consent has been given to a plurality of vehicles, including the vehicle, for software update processing at the same time To indicate a situation ,before Instruction information is transmitted to the vehicle to instruct that consent is not required when executing a software update process in the vehicle.

[0009] The update management method according to the present disclosure is a method executed by a computer having a processor, a memory, and a storage device, and includes the steps of: associating and storing life cycle status information indicating a distribution status of a vehicle after manufacture with each vehicle identification information that identifies a vehicle; receiving a confirmation request including the vehicle identification information from the vehicle; upon receiving the confirmation request, determining whether or not there is update data for the software of the vehicle identified by the vehicle identification information included in the confirmation request; and, if it is determined that there is update data for the software of the vehicle, transmitting instruction information to the vehicle indicating whether or not consent is required when executing a software update process in the vehicle identified by the vehicle identification information based on the life cycle status information associated with the vehicle identification information included in the confirmation request, wherein in the step of transmitting the instruction information to the vehicle, Consent has been given to a plurality of vehicles, including the vehicle, for software update processing at the same time To indicate a situation ,before Instruction information is transmitted to the vehicle to instruct that consent is not required when executing a software update process in the vehicle.

[0010] A program executed by a computer including an update management processor according to the present disclosure, a memory, and a storage device, the program including the steps of: associating and storing life cycle status information indicating a distribution status of a vehicle after manufacture with each vehicle identification information that identifies a vehicle; receiving a confirmation request including the vehicle identification information from the vehicle; determining, upon receiving the confirmation request, whether or not there is update data for the software of the vehicle identified by the vehicle identification information included in the confirmation request; and, if it is determined that there is update data for the software of the vehicle, transmitting instruction information to the vehicle indicating whether or not consent is required when executing a software update process in the vehicle identified by the vehicle identification information based on the life cycle status information associated with the vehicle identification information included in the confirmation request, wherein in the step of transmitting the instruction information to the vehicle, Consent has been given to a plurality of vehicles, including the vehicle, for software update processing at the same time To indicate a situation ,before Instruction information is transmitted to the vehicle to instruct that consent is not required when executing a software update process in the vehicle. Effect of the Invention

[0011] According to the present disclosure, a server and an update management method capable of performing software updates in a timely manner throughout the life cycle of a vehicle 、 Update Management Program And Center can be provided. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a block diagram showing an overall configuration of a network system according to an embodiment; [Diagram 2] A block diagram showing the schematic configuration of the server shown in FIG. 1. [Diagram 3] FIG. 2 is a block diagram showing a schematic configuration of the software update device shown in FIG. 1. [Figure 4] Functional block diagram of the server shown in Figure 1 [Diagram 5] FIG. 2 is a diagram showing an example of update management information stored in the server shown in FIG. 1; [Figure 6] A diagram to explain the life cycle status shown in Figure 5 [Figure 7] Functional block diagram of the software update device shown in FIG. 1. [Figure 8] A flowchart showing an example of a control process executed by a server according to an embodiment. [Figure 9] A flowchart showing an example of a software update process executed by the software update device according to the embodiment. [Figure 10] A flowchart detailing the installation / activation process shown in Figure 9. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] FIG. 1 is a block diagram showing the overall configuration of a network system according to an embodiment, FIG. 2 is a block diagram showing a schematic configuration of a server shown in FIG. 1, and FIG. 3 is a block diagram showing a schematic configuration of a software update device shown in FIG. 1.

[0014] The network system shown in FIG. 1 is a system for updating programs of electronic control units 13a to 13d mounted on vehicles, and includes a server 1 (center) and an in-vehicle network 2 mounted on the vehicles.

[0015] The server 1 is capable of communicating with a software update device 11 mounted on the vehicle via a network 5, and manages software updates for electronic control units 13a to 13d mounted on the vehicle.

[0016] 2, the server 1 includes a CPU 21, a RAM 22, a storage device 23, and a communication device 24. The storage device 23 includes a readable / writable storage medium such as a hard disk or SSD, and stores a program for performing software update management, update management information described below, and update data for the electronic control unit. In the server 1, the CPU 21 executes the program read from the storage device 23 by using the RAM 22 as a working area, thereby executing a control process described below. The communication device 24 is a device that communicates with the software update device 11 via a network.

[0017] The in-vehicle network 2 includes a software update device 11 (OTA master), a communication module 12, a plurality of electronic control units 13a to 13d, and a display device 14. The software update device 11 is connected to the communication module 12 via a bus 15a, to the electronic control units 13a and 13b via a bus 15b, to the electronic control units 13c and 13d via a bus 15c, and to the display device 14 via a bus 15d. The software update device 11 can communicate with the server 1 wirelessly (on the air) via the communication module 12. The software update device 11 controls software update of the electronic control unit to be updated among the electronic control units 13a to 13d based on update data acquired from the server 1. The software update device 11 may also be referred to as a central gateway. The communication module 12 is a communication device that connects the in-vehicle network 2 and the server 1. The electronic control units 13a to 13d are ECUs that control the operation of each part of the vehicle, and include a CPU, a RAM, and a non-volatile storage device such as a flash memory or an EEPROM. The CPU uses the RAM as a working area to execute a program stored in the storage device to perform a control function. The display device 14 (HMI) is used to display various information such as the presence of update data, a request for a user to consent to the software update, and an update result during software update processing of the electronic control units 13a to 13d. The display device 14 can typically be a display device of a car navigation system, but is not particularly limited as long as it can display information required during software update processing. Although four electronic control units 13a to 13d are illustrated in FIG. 1, the number of electronic control units is not particularly limited. An electronic control unit other than the display device 14 may be further connected to the bus 15d shown in FIG. 1.

[0018] 3, the software update device 11 includes a microcomputer 35 including a CPU 31, a RAM 32, a ROM 33, and a storage device 34, and a communication device 36. In the software update device 11, the CPU 31 of the microcomputer 35 executes a program read from the ROM 33 by using the RAM 32 as a working area, thereby performing a control process described below. The communication device 36 is a device that communicates with the communication module 12, the electronic control units 13a to 13d, and the display device 14 via the buses 15a to 15d shown in FIG. 1.

[0019] FIG. 4 is a functional block diagram of the server shown in FIG. 1, FIG. 5 is a diagram showing an example of update management information stored in the server shown in FIG. 1, and FIG. 6 is a diagram for explaining the life cycle status shown in FIG. 5.

[0020] The server 1 includes a storage unit 26, a communication unit 27, and a control unit 28. The communication unit 27 and the control unit 28 are realized by the CPU 21 shown in Fig. 2 executing a program stored in the storage device 23 using the RAM 22, and the storage unit 26 is realized by the storage device 23 shown in Fig. 2.

[0021] The storage unit 26 stores update management information. As shown in Fig. 5, the update management information associates vehicle identification information (vehicle ID) for identifying a vehicle, life cycle status information indicating the distribution status of the vehicle identified by the vehicle ID after manufacture, and information indicating software available for use in the electronic control unit. In this embodiment, a combination of the latest version information of each of the software in a plurality of electronic control units is defined as the information indicating the software available for use in the electronic control unit.

[0022] The life cycle status information is information for identifying the state of the vehicle during its life cycle, and can be set, for example, as shown in FIG. 6, as being in a yard before shipping, being transported by a transport ship, being transported to a dealer, being at a dealer, a sales contract with a user has been made (i.e., the ownership has been transferred to the user), being distributed as a used car, being transported from the original destination country to another country, being scrapped, etc. The life cycle status shown in FIG. 6 is an example, and vehicle states other than those shown in FIG. 6 can also be defined. For example, as the life cycle status information, information indicating at least one of the following can be set: the vehicle is under development, the vehicle is being manufactured, the vehicle is being transported, the vehicle is being sold, the vehicle is owned by a user, the vehicle is being repaired, the registration status of the user of the vehicle (before user registration or after user registration), the ownership status of the vehicle (the vehicle is owned by a user or is not owned by a user), and the type of user of the vehicle (individual, corporation, share, etc.). The life cycle status information of the update management information shown in FIG. 5 can be appropriately acquired and set from information sources such as a manufacturing management database, a sales management database, a user information database, and a registration information database.

[0023] 6 shows an example in which the update management information is provided as one table in which life cycle status information and available software version information are associated with a vehicle ID, but a table in which life cycle status information is associated with each vehicle ID and a table in which available software version information is associated with each vehicle ID may be provided. When the life cycle status information and the available software version information are provided in separate tables, the life cycle status information needs to be set for each vehicle ID, but the available software version information does not necessarily need to be set for each vehicle ID and may be set for each vehicle model ID that identifies the vehicle model (type), for example.

[0024] Moreover, the storage unit 26 further stores update data for the electronic control unit. However, instead of storing the update data in the storage unit 26, a distribution server for the update data may be provided separately from the server 1.

[0025] The communication unit 27 is capable of receiving a software update confirmation request from the software update device 11. The update confirmation request is information transmitted from the software update device 11 to the server 1 when, for example, the power or ignition is turned on in the vehicle, and is information for requesting the server 1 to confirm whether or not there is update data for the electronic control unit. The communication unit 27 also receives a transmission request (download request) for a distribution package from the software update device 11. When the communication unit 27 receives a download request for a distribution package, it transmits instruction information to the software update device 11 instructing whether or not consent is required when executing the software update process.

[0026] When the communication unit 27 receives an update check request, the control unit 28 determines, based on the update management information stored in the memory unit 26, whether or not there is update data for the software of the vehicle identified by the vehicle ID included in the update check request.

[0027] The above-mentioned instruction information is generated based on the life cycle status information included in the update management information stored in the storage unit 26. As one example, the instruction information can be generated by the control unit 28 based on the life cycle status information of the vehicle ID included in the download request when a download request for a distribution package is received from the software update device 11. As another example, the instruction information may be generated by the control unit 28 based on the updated life cycle status information when the life cycle status information included in the update management information is updated.

[0028] When performing software update processing of the electronic control unit, in principle, consent from the user (or administrator) is required. However, for example, when the vehicle is in a yard before transportation or is being transported by a transport ship, the vehicle has not yet been sold and the manufacturer is the owner, so consent from the user is not required. It is preferable to update the software of the electronic control unit to the latest state without requesting consent. Therefore, when the life cycle status information set in the update management information is "1" or "2" in FIG. 6, the control unit 28 generates instruction information indicating that consent is not required during the update processing. Also, when the life cycle status information set in the update management information is "3" to "7" in FIG. 6, the control unit 28 generates instruction information indicating that consent is required during the update processing.

[0029] The instruction information instructs the software update device 11 whether or not consent is required can be appropriately changed by taking into account pre-registration information that is set separately in addition to the life cycle status information. For example, when the vehicle is being transported to the dealer or is at the dealer (case of "3" or "4" in FIG. 6), if it is registered in advance that the software update process will be performed without consent, the control unit 28 may generate instruction information indicating that consent is not required during the update process.

[0030] FIG. 7 is a functional block diagram of the software updating device shown in FIG.

[0031] The software updating device 11 includes a communication unit 37, a storage unit 38, and a control unit 39. The communication unit 37 and the control unit 39 are realized by the CPU 31 shown in Fig. 3 executing a program stored in the ROM 33 using the RAM 32. The storage unit 38 is realized by the storage device 34 shown in Fig. 3.

[0032] For example, when the power or ignition of the vehicle is turned on, the communication unit 37 transmits a request for checking whether software update of the electronic control unit is performed to the server 1, and receives the check result (information indicating whether there is update data) from the server 1. The update check request includes, for example, a vehicle ID for identifying the vehicle and the program versions of the electronic control units 13a to 13d connected to the in-vehicle network 2. If there is update data for the software of the electronic control unit, the communication unit 37 transmits a request for downloading a distribution package to the server 1, and receives the distribution package transmitted from the server 1. The distribution package includes update data for the software of the electronic control unit, and instruction information indicating whether approval is required when executing the software update process. In addition to the update data and instruction information, the distribution package may include verification data for verifying the authenticity of the update data, the number of update data, the installation order, various control information used during software update, and the like.

[0033] The control unit 39 verifies the authenticity of the distribution package that the communication unit 37 received from the server 1 and stored in the storage unit 38. Next, the control unit 39 transfers the one or more downloaded update data to the electronic control unit to be updated, and causes the update data to be installed in the electronic control unit to be updated. When the installation is complete, the control unit 39 instructs the electronic control unit to be updated to validate the installed update data. When there is only one software storage area provided in the storage device of the electronic control unit, installation and activation are performed in succession. The control unit 39 performs the control process of installation and activation, thereby completing the software update of the electronic control unit to be updated.

[0034] Here, the software update process consists of a phase of downloading update data from server 1, a phase of transferring the downloaded update data to the electronic control unit to be updated and installing the update data in the memory area of ​​the electronic control unit to be updated, and an activation phase of enabling the updated version of the software installed in the electronic control unit to be updated.

[0035] Downloading is a process of receiving and storing update data transmitted from the server 1 for updating the software of the electronic control unit. The downloading phase includes not only receiving the update data but also controlling a series of processes related to the download, such as judging whether the download can be performed and verifying the update data. Installing is a process of writing an updated program (update software) to the storage unit of the in-vehicle device in the electronic control unit to be updated based on the downloaded update data. The installing phase includes not only executing the installation but also controlling a series of processes related to the installation, such as judging whether the installation can be performed, transferring the update data and verifying the updated program. Activating is a process of making the installed updated program valid (activating). The control of activating includes not only executing the activation but also controlling a series of processes related to activation, such as judging whether the activation can be performed and verifying the execution results.

[0036] The update data transmitted from the server 1 to the software update device 11 may include update software for the electronic control unit, compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may also include an identifier (ECU ID) for identifying the electronic control unit to be updated, and an identifier (ECU software ID) for identifying the software before the update. The update data is downloaded as the above-mentioned distribution package, and the distribution package includes update data for a single or multiple electronic control units.

[0037] If the update data includes the update software itself, in the installation phase, the software update device transfers the update data (update software) to the electronic control unit to be updated. Also, if the update data includes compressed data, difference data, or divided data of the update software, the software update device 11 may transfer the update data to the electronic control unit to be updated, and the electronic control unit to be updated may generate the update software from the update data, or the software update device 11 may generate the update software from the update data and then transfer the update software to the electronic control unit to be updated. Here, the update software can be generated by decompressing the compressed data and assembling the difference data or divided data.

[0038] The update software can be installed by the electronic control unit to be updated based on an installation request from the software update device 11. Alternatively, the electronic control unit to be updated that has received the update data may autonomously install the software without receiving an explicit instruction from the software update device 11.

[0039] The activation of the updated software can be performed by the electronic control unit to be updated based on an activation request from the software updating device 11. Alternatively, the electronic control unit to be updated that has received the update data may autonomously activate the software without receiving an explicit instruction from the software updating device 11.

[0040] The software update process can be performed consecutively or in parallel for each of the multiple electronic control units.

[0041] In addition, the "software update process" in this specification includes not only a process in which all of the download, installation, and activation steps are performed in succession, but also a process in which only part of the download, installation, and activation steps are performed.

[0042] The control processes executed by the server 1 and the software updating device 11 will be described below.

[0043] Fig. 8 is a flowchart showing an example of a control process executed by the server according to the embodiment. The control process shown in Fig. 8 is executed repeatedly at predetermined time intervals, for example.

[0044] In step S1, the communication section 27 determines whether or not an update confirmation request has been received from the software updating device 11. If the determination in step S1 is YES, the process proceeds to step S2, and otherwise the process proceeds to step S3.

[0045] In step S2, the communication unit 27 transmits information indicating whether or not there is update data for the software of the electronic control unit to the vehicle that transmitted the update check request. The presence or absence of update data can be determined by, for example, the control unit 28 comparing the combination of software versions (see FIG. 5) stored in the update management information in association with the vehicle ID included in the update check request with the combination of current software versions included in the update check request, and determining that there is update data if the combination of current software versions included in the update check request is older than the combination of versions stored in the update management information. Then, the process proceeds to step S3.

[0046] In step S3, the communication section 27 determines whether or not a download request for a distribution package has been received from the software updating device 11. If the determination in step S3 is YES, the process proceeds to step S4, and otherwise the process proceeds to step S1.

[0047] In step S3, the communication unit 27 transmits a distribution package including the software update data and the instruction information to the software update device 11. If it is pre-registered that consent is not required for software update for the vehicle identified by the vehicle ID included in the download request, the instruction information may change whether consent is required based on the pre-registered information. After that, the process proceeds to step S1.

[0048] Fig. 9 is a flowchart showing an example of a control process executed by the software update device according to the embodiment. The control process shown in Fig. 9 is executed, for example, when the power supply or ignition of the vehicle is turned on.

[0049] In step S11, the communication unit 37 transmits an update confirmation request including a combination of the vehicle ID and the software version of the electronic control unit to the server 1. After that, the process proceeds to step S12.

[0050] In step S12, the communication unit 37 receives the confirmation result from the server 1. After that, the process proceeds to step S13.

[0051] In step S13, the control unit 39 determines whether or not there is update data for the software of the electronic control units 13a to 13d, based on the confirmation result received in step S12 from the server 1. If the process in step S13 is YES, the process proceeds to step S14, and otherwise the process ends.

[0052] In step S14, the communication unit 37 executes a download process. More specifically, the communication unit 37 transmits a download request for a distribution package to the server 1, receives the distribution package transmitted in response to the download request, and stores the received distribution package in the storage unit 38. The control unit 39 verifies the authenticity of the update data contained in the received distribution package. In step S14, it may determine whether or not the download can be performed, and may notify the server 1 that the download has been completed. After that, the process proceeds to step S15.

[0053] In step S15, the control unit 39 executes the installation process and the activation process for the electronic control unit to be updated, and ends the process.

[0054] FIG. 10 is a flowchart showing the details of the installation / activation process shown in FIG. It is.

[0055] In step S21, the control unit 39 determines whether or not consent from the user or administrator is required before execution of installation, based on the instruction information included in the distribution package received from the server 1 in step S14 of Fig. 9. As described above, the instruction information is information that is set based on the life cycle status information stored in the server 1. If the determination in step S21 is YES, the process proceeds to step S22, and otherwise the process proceeds to step S24.

[0056] In step S23, the control unit 39 executes an installation confirmation process. For example, the control unit 39 displays a message that a program update for the in-vehicle device is about to start, a message that the user's consent to the start of the program update is requested, and, if necessary, displays the time required for installing the update program and restrictions and precautions during the installation, and accepts an operation input by the user using an input means such as a touch panel or an operation button. Then, the process proceeds to step S24.

[0057] In step S24, the control unit 39 judges whether or not an operation input to consent to the software update (installation) has been made. The operation input to consent to the installation can be judged based on whether or not a button such as "Agree" or "Start Update" displayed on the display device 14 has been pressed. In addition, if the user does not immediately consent to the start of the software update (installation) and wishes to start the software update (installation) later, the user can accept this by pressing a button such as "Later", in which case the control unit 39 judges NO in step S24. If the judgment in step S24 is YES, the process proceeds to step S25, and otherwise the process is terminated.

[0058] In step S25, the control unit 39 determines whether or not consent from the user or administrator is required before activation is performed, based on the instruction information included in the distribution package received from the server 1 in step S14 of Fig. 9. As described above, the instruction information is information that is set based on the life cycle status information stored in the server 1. If the determination in step S25 is YES, the process proceeds to step S26, and otherwise the process proceeds to step S28.

[0059] In step S26, the control unit 39 executes an activation confirmation process. As the activation confirmation process, the control unit 39 displays, for example, that the in-vehicle device is ready for program update, and that the program will be updated by performing a specific operation such as turning off the power or ignition, and if necessary, displays the time required for activation and restrictions and precautions during activation, and accepts operation input by the user using an input means such as a touch panel or an operation button. After that, the process proceeds to step S27.

[0060] In step S27, the control unit 39 judges whether or not an operation input to consent to the software update (activation) has been made. The operation input to consent to the activation can be judged, for example, based on whether or not a button such as "Agree" or "Update" displayed on the display device 14 has been pressed. Also, if the user does not consent to the software update (activation) immediately and wishes to perform the software update later, the user can accept this by pressing a button such as "Later", in which case the control unit 39 judges NO in step S27. If the judgment in step S27 is YES, the process proceeds to step S28, and otherwise the process is terminated.

[0061] In step S28, the control unit 39 instructs the electronic control unit to be updated to activate the updated software. Then, the process ends. The electronic control unit to be updated restarts and executes the updated software when a specific operation such as turning off the power or ignition is performed. This completes the software update (function update) of the electronic control unit.

[0062] If the storage device of the electronic control unit has only one software storage area, the old software stored in the software storage area is overwritten by writing the update data, so installation and activation must be performed as a series of processes. In this case, steps S26 to S28 in the process of FIG. 10 may be omitted.

[0063] As described above, the server 1 according to this embodiment holds life cycle status information representing the state of the vehicle after manufacture for each vehicle ID. When a software update of the vehicle is necessary, the server 1 can instruct the software update device 11 whether or not to forcibly perform a software update without requesting consent, depending on the state of the vehicle in the life cycle. Therefore, the server 1 according to this embodiment can perform software updates at appropriate times throughout the life cycle of the vehicle.

[0064] The functions of the server 1 exemplified as an embodiment can be realized as an update management method executed by a computer having a processor (CPU), memory, and storage device, or as an update management program executed by the computer, or as a computer-readable non-transient storage medium storing the update management program. Similarly, the functions of the software update device 11 exemplified as an embodiment can be realized as an update control method executed by an in-vehicle computer having a processor (CPU), memory, and storage device, or as an update control program executed by the in-vehicle computer, or as a computer-readable non-transient storage medium storing the update control program.

[0065] In the above embodiment, an example has been described in which the software update device 11 provided in the in-vehicle network on the vehicle side controls software updates of all the electronic control units 13a to 13d as a master device, but instead of providing the software update device 11, any one of the electronic control units 13a to 13d may have the update control function shown in Figures 9 and 10 and control software updates of the other electronic control units. Also, instead of providing the software update device 11, it is also possible to provide the update control function shown in Figures 9 and 10 in an external device that can be connected to the in-vehicle network 2 by wire, and use this external device to perform software update processing of the electronic control units 13a to 13d.

[0066] The server 1 according to the above embodiment centrally manages life cycle status information, and therefore can also be used as an information source for understanding the software update status of registered vehicles (e.g., the number of vehicles that have completed software updates via OTA and the number of vehicles that have not) and the current status of the vehicles.

[0067] Furthermore, in the server 1 according to the above embodiment, when a corporation owns multiple vehicles, a life cycle status of "corporate owned (with prior consent)" may be set so that the owners can collectively give consent and force software updates, and for vehicles set with this life cycle status, instruction information may be generated to indicate that consent is not required, on the assumption that consent has been given in advance. With this configuration, when multiple vehicles are owned by the same owner, software updates by OTA can be easily performed. [Industrial Applicability]

[0068] The disclosed technique can be used in a network system for updating software in an electronic control unit. [Explanation of symbols]

[0069] 1 Server 2. In-vehicle network 5. Network 11 Software update device 13a~13d Electronic control unit 26 Memory section 27 Communications Department 28 Control Unit 37 Communications Department 38 Memory section 39 Control Unit

Claims

1. a storage unit that stores life cycle status information indicating a distribution status of the vehicle after manufacture in association with each vehicle identification information that identifies the vehicle; A communication unit that receives a confirmation request including vehicle identification information from the vehicle; a control unit that, when the communication unit receives the confirmation request, determines whether or not there is update data for software of a vehicle identified by the vehicle identification information included in the confirmation request; When the control unit determines that there is update data for the software of the vehicle identified by the vehicle identification information, the communication unit transmits, to the vehicle, instruction information instructing whether or not consent is required when executing a software update process in the vehicle, based on the life cycle status information associated with the vehicle identification information included in the confirmation request; When the life cycle status information indicates a situation in which consent for software update processing has been given collectively for multiple vehicles including the vehicle, the communication unit transmits the instruction information to the vehicle indicating that consent is not required when performing software update processing in the vehicle.

2. The storage unit stores update data for software of an electronic control unit mounted on the vehicle, The server according to claim 1 , wherein the communication unit transmits the instruction information together with the update data to the vehicle.

3. 3. The server according to claim 1 or 2, wherein the life cycle status information can be set to information representing at least one of the following: that the vehicle is under development, that the vehicle is under production, that the vehicle is in transportation, that the vehicle is for sale, that the vehicle is owned by a user, that the vehicle is under repair, and the type of user of the vehicle.

4. The server according to claim 3, wherein when information indicating that the vehicle is in a yard or a transport ship is set as the life cycle status information, the communication unit transmits instruction information to the vehicle indicating that consent is not required when performing a software update process.

5. An update management method executed by a computer having a processor, a memory, and a storage device, comprising: storing life cycle status information indicating a distribution status of the vehicle after manufacture in association with each vehicle identification information for identifying the vehicle; receiving a verification request from a vehicle, the verification request including the vehicle identification information; a step of determining, upon receiving the confirmation request, whether or not there is update data for software of a vehicle identified by vehicle identification information included in the confirmation request; and when it is determined that there is update data for the software of the vehicle identified by the vehicle identification information, transmitting to the vehicle instruction information indicating whether or not consent is required when executing a software update process in the vehicle, based on the life cycle status information associated with the vehicle identification information included in the confirmation request; An update management method in which, in the step of transmitting the instruction information to the vehicle, if the life cycle status information indicates a situation in which consent for software update processing has been given collectively for a plurality of vehicles including the vehicle, the instruction information indicating that consent is not required when performing a software update processing in the vehicle is transmitted to the vehicle.

6. An update management program executed by a computer having a processor, a memory, and a storage device, storing life cycle status information indicating a distribution status of the vehicle after manufacture in association with each vehicle identification information for identifying the vehicle; receiving a verification request from a vehicle, the verification request including vehicle identification information; a step of determining, upon receiving the confirmation request, whether or not there is update data for software of a vehicle identified by vehicle identification information included in the confirmation request; and when it is determined that there is update data for the software of the vehicle identified by the vehicle identification information, transmitting to the vehicle instruction information indicating whether or not consent is required when executing a software update process in the vehicle, based on the life cycle status information associated with the vehicle identification information included in the confirmation request; An update management program in which, in the step of sending the instruction information to the vehicle, if the life cycle status information indicates a situation in which consent has been given collectively for software update processing for multiple vehicles including the vehicle, the instruction information instructing that consent is not required when performing software update processing in the vehicle is sent to the vehicle.

7. a storage unit that stores life cycle status information indicating a distribution status of the vehicle after manufacture in association with each vehicle identification information that identifies the vehicle; A communication unit that receives a confirmation request including vehicle identification information from the vehicle; a control unit that, when the communication unit receives the confirmation request, determines whether or not there is update data for software of a vehicle identified by the vehicle identification information included in the confirmation request; When the control unit determines that there is update data for the software of the vehicle identified by the vehicle identification information, the control unit transmits, to the vehicle, instruction information instructing whether or not consent is required when executing a software update process in the vehicle, based on the life cycle status information associated with the vehicle identification information included in the confirmation request; When the life cycle status information indicates a situation in which consent has been given collectively for software update processing for multiple vehicles including the vehicle, the communication unit transmits the instruction information to the vehicle indicating that consent is not required when performing software update processing in the vehicle, a center.

Images