VEHICLE SYSTEM, CENTER, METHOD, AND PROGRAM

Abstract

To provide a system for a vehicle or the like, configured to allow a user of the vehicle or an administrator to receive information on software update when software is updated using OTA.SOLUTION: A system configured to control software update for an electronic control unit mounted on a vehicle includes: a first center configured to execute processing for updating software to the vehicle; the vehicle configured to execute the software update for the electronic control unit on the basis of, the processing by the first center; and a second center configured to provide information on the software update to a user of the vehicle. The second center transmits, to the first center, a notification indicating that the information on the software update has been provided to the user of the vehicle. The first center is configured to, after receiving the notification from the second center, execute processing based on the notification on the vehicle.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a system for a vehicle that controls software updates for an electronic control unit mounted in the vehicle. [Background technology]

[0002] A vehicle is equipped with multiple electronic control units (ECUs) for controlling the operation of the vehicle. Each electronic control unit includes a processor, a temporary storage unit such as a RAM, and a non-volatile memory that is a non-volatile storage unit such as a flash ROM, and the processor executes software stored in the non-volatile memory to realize the control functions of the electronic control unit. The software stored in each electronic control unit is rewritable, and by updating the software to a newer version, it is possible to improve the functions of each electronic control unit or add new vehicle control functions.

[0003] As a technology for updating software in an electronic control unit, there is known an OTA (Over The Air) technology, in which an in-vehicle communication device connected to an in-vehicle network is wirelessly connected to a communication network such as the Internet, and a device responsible for updating the software in the vehicle downloads software from a server via wireless communication, writes and installs the downloaded software in the electronic control unit, and activates the installed software, thereby updating or adding software to the electronic control unit. For example, see Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2017-149323 A Summary of the Invention [Problem to be solved by the invention]

[0005] When updating software using OTA, processes such as notifying the vehicle user or administrator that there is a software update and requesting consent to the software update are performed. These notifications and consent requests are generally made to the vehicle user or administrator via the car navigation device installed in the vehicle.

[0006] However, if a vehicle is not equipped with a high-performance display device such as a car navigation device, users or administrators who do not own a separate device that can replace a display device such as a car navigation device (for example, an information terminal such as a smartphone or PC that can wirelessly communicate with the vehicle) will be unable to receive information about updates when a software update using OTA becomes necessary, which is a problem.

[0007] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a system for a vehicle that allows vehicle users, administrators, etc. to receive information regarding software updates when updating software using OTA. [Means for solving the problem]

[0008] In order to solve the above problems, one aspect of the disclosed technology is a system for controlling software updates of an electronic control unit installed in a vehicle, the system comprising: a first center that performs processing for updating the software on the vehicle; a vehicle that executes an update of the software of the electronic control unit based on the processing by the first center; and a second center that provides information regarding the software update to a user of the vehicle, wherein the second center sends a notification to the first center that the information regarding the software update has been provided to the user of the vehicle, and the first center performs processing on the vehicle based on the notification after receiving the notification from the second center. Effect of the Invention

[0009] According to the vehicle system disclosed herein, when updating software using OTA, the vehicle user or administrator can receive information regarding the software update. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an overall configuration of a network system according to an embodiment; [Diagram 2] Block diagram showing the schematic configuration of the first center [Diagram 3] Functional block diagram of Center 1 [Figure 4] Block diagram showing the schematic configuration of the OTA master [Diagram 5] OTA Master Functional Block Diagram [Figure 6] 1 is a flowchart of a process for transmitting information about software updates performed by a first center and a second center; [Figure 7] An example of management information stored in the second center [Figure 8] A flowchart illustrating an example of a software update control process executed by a first center, an OTA master, and a target electronic control unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] In the system according to the present disclosure, when updating software of an electronic control unit mounted on a vehicle, if the display device mounted on the vehicle cannot adequately display information about the software update, a customer center or the like provides information about the software update to vehicle users, administrators, etc. by telephone, postcard, etc. This allows vehicle users, administrators, etc. to receive necessary information about software updates using OTA even if they do not own high-performance equipment such as a car navigation device. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0012] <Embodiment> [System Configuration] Fig. 1 is a block diagram showing an overall configuration of a network system according to an embodiment of the present disclosure. The network system shown in Fig. 1 is a system for updating software of a plurality of electronic control units (ECUs) 50a to 50d mounted on a vehicle, and includes a first center 10a and a second center 10b that are located outside the vehicle, and an in-vehicle network 90 that is built inside the vehicle.

[0013] (1) First Center The first center 10a can communicate with the OTA master 30 (described later) provided in the in-vehicle network 90 via the network 100, and can control and manage software updates of the multiple electronic control units 50a to 50d connected to the OTA master 30 by sending notifications of software updates to vehicle users and managers, sending information defining software update data and update processing procedures for the electronic control units 50a to 50d, and receiving notifications indicating the progress of software update processing. This first center 10a has a function as a so-called server. The first center 10a can also communicate with the second center 10b via the network 100, and can receive necessary notifications from the second center 10b.

[0014] FIG. 2 is a block diagram showing a schematic configuration of the first center 10a in FIG. 1. As shown in FIG. 2, the first center 10a includes a central processing unit (CPU) 11, a random access memory (RAM) 12, a storage device 13, and a communication device 14. The storage device 13 is a device including a readable and writable storage medium such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a program for performing software update management, information used for software update control and update management, and software update data for each electronic control unit. In the first center 10a, the CPU 11 executes a program read from the storage device 13 by using the RAM 12 as a working area, thereby executing a predetermined process related to software update. The communication device 14 is a device for communicating with the OTA master 30 and the second center 10b via the network 100.

[0015] Fig. 3 is a functional block diagram of the first center 10a shown in Fig. 2. The first center 10a shown in Fig. 3 includes a storage unit 16, a communication unit 17, a control unit 18, an acquisition unit 19, and a processing unit 20. The storage unit 16 is realized by the storage device 13 shown in Fig. 2. The communication unit 17, the control unit 18, the acquisition unit 19, and the processing unit 20 are realized by the CPU 11 shown in Fig. 2 executing a program stored in the storage device 13 using the RAM 12.

[0016] The storage unit 16 stores information related to software update processing of one or more electronic control units mounted on the vehicle. As the information related to the software update processing, the storage unit 16 stores at least update management information in which information indicating software available in the electronic control units 50a to 50d is associated with each vehicle identification information (vehicle ID) that identifies the vehicle, and update data of the software of the electronic control units 50a to 50d. As the information indicating the software available in the electronic control units 50a to 50d, for example, a combination of the latest version information of each software of the multiple electronic control units 50a to 50d is defined. As the information related to the software update processing, the storage unit 16 can store an update status indicating an update state of the software being performed in the vehicle. Furthermore, as the information related to the software update processing, the storage unit 16 can store information related to an update sequence indicating a procedure of the software update processing for issuing a control instruction to the OTA master 30. Furthermore, the storage unit 16 can store information related to the display device 70 mounted on the vehicle acquired by the acquisition unit 19 described later.

[0017] The communication unit 17 functions as a transmitting unit and a receiving unit that transmits and receives data, information, notifications, requests, and the like between the OTA master 30 (vehicle) and the second center 10b. The communication unit 17 receives a software update confirmation request from the OTA master 30 (receiving unit). The update confirmation request is information transmitted from the OTA master 30 to the first center 10a when, for example, the power or ignition is turned on in the vehicle (hereinafter referred to as "power ON"), and is information for requesting the first center 10a to confirm whether or not there is update data for the electronic control units 50a to 50d based on vehicle configuration information described later. In addition, in response to the update confirmation request received from the OTA master 30, the communication unit 17 transmits information indicating the presence or absence of update data to the OTA master 30 (transmitting unit). In addition, the communication unit 17 receives a transmission request (download request) for a distribution package from the OTA master 30 (receiving unit). Furthermore, when the communication unit 17 receives a download request for a distribution package (reception unit), it transmits a distribution package including software update data for the electronic control units 50a to 50d generated by the control unit 18 described later to the OTA master 30 (transmission unit). Furthermore, based on an instruction from the processing unit 20, the communication unit 17 transmits to the vehicle a notification that there is a software update for the vehicle user or manager, an explanation about the software update, a consent request for the software update, and the like (hereinafter, these are collectively referred to as "information about the software update") (transmission unit). Furthermore, the communication unit 17 can receive from the vehicle a request for retransmission of information about the display device 70 mounted on the vehicle and information about the software update (reception unit). Furthermore, the communication unit 17 can receive a notification indicating that information about the software update has been provided to the vehicle user or manager from the second center 10b (reception unit).

[0018] When the communication unit 17 receives an update check request from the OTA master 30, the control unit 18 determines whether or not there is software update data for the electronic control units 50a to 50d mounted on the vehicle identified by the vehicle ID included in the update check request, based on the update management information stored in the storage unit 16. The control unit 18 transmits the determination result of whether or not there is update data to the OTA master 30 by the communication unit 17. When the control unit 18 determines that there is software update data for the electronic control units 50a to 50d, and receives a distribution package download request from the OTA master 30, the control unit 18 generates one or more distribution packages including the corresponding update data stored in the storage unit 16. In addition, the control unit 18 controls the software update process of the electronic control units 50a to 50d based on an update consent notification from the vehicle user, manager, etc., received from the vehicle as a response to the information on the software update transmitted by the processing unit 20, or a notification indicating that the information on the software update received from the second center 10b has been provided to the vehicle user, manager, etc.

[0019] The acquisition unit 19 acquires information about the display device 70 mounted on the vehicle from the vehicle via the communication unit 17. The information about the display device 70 includes at least information indicating whether or not information (such as changes in control) that should be explained to the vehicle user or manager in advance can be displayed on the screen of the display device 70 when updating software using OTA. Being able to display on the screen typically means that all of the information that should be explained in advance can be presented to the vehicle user or manager through screen display. This information about the display device 70 may be acquired from the vehicle by the first center 10a, for example, every time the vehicle is turned on, or may be acquired in advance by some other method.

[0020] When performing a software update using OTA, the processing unit 20 performs a process of transmitting information related to the software update based on the display device 70 mounted on the vehicle. More specifically, if the display device 70 is capable of displaying information to be explained to the vehicle user or manager in advance on a screen when performing a software update using OTA, the processing unit 20 performs a process of transmitting information related to the software update to the vehicle (OTA master 30). On the other hand, if the display device 70 is unable to display information to be explained to the vehicle user or manager in advance on a screen when performing a software update using OTA, the processing unit 20 instructs the second center 10b to provide the vehicle user or manager with information related to the software update. In this way, the processing unit 20 operates as a so-called human machine interface (HMI) function unit. Note that the notification from the first center 10a to the vehicle may be acquired by the OTA master 30 and the display device 70 may control the display based on this notification, or the display device 70 may directly receive the notification without going through the OTA master 30 and display the notification by itself.

[0021] (2) Second Center The second center 10b is a facility where operators and the like are stationed, such as a so-called customer center or call center, and manual operations are involved in the control. Some functions of the second center 10b can be expressed as a block diagram as shown in FIG. 3. In this second center 10b, vehicles and users and managers of the vehicles are linked and managed, and addresses and telephone numbers are registered in advance in the facility's server as contact information for the users and managers. In the second center 10b, the display device 70 of the vehicle that is the target of the software update using OTA provides information about the software update to the user or manager of the vehicle via telephone or postcard by the operator. In addition, when the information about the software update is provided to the user or manager of the vehicle, a notification to that effect is transmitted to the first center 10a. This transmission may be performed automatically by a communication device or the like, or may be performed manually by an operator or the like. In addition, the second center 10b receives consent from the user or manager of the vehicle to the information about the software update provided. These processes will be described later.

[0022] (3) In-vehicle network The in-vehicle network 90 includes an OTA master 30, a plurality of electronic control units 50a to 50d, a display device 70, and a communication module 80. The OTA master 30 and the communication module 80 are connected via a bus 60a. The OTA master 30 and the electronic control units 50a and 50b are connected via a bus 60b. The OTA master 30 and the electronic control units 50c and 50d are connected via a bus 60c. The OTA master 30 and the display device 70 are connected via a bus 60d.

[0023] The OTA master 30 can communicate wirelessly with the first center 10a via the network 100 through the bus 60a and the communication module 80. The OTA master 30 can also communicate wired with the electronic control units 50a-50d and the display device 70 through the buses 60b-60d. The OTA master 30 is a device having a function of managing an OTA state, controlling an update sequence, which is a flow of a software update process, and performing software update of an electronic control unit to be updated (hereinafter referred to as a "target electronic control unit"). The OTA master 30 controls software update of the target electronic control unit among the electronic control units 50a-50d based on update data acquired from the first center 10a. The OTA master 30 can also control an appropriate screen display on the display device 70 based on information and notifications related to software updates received from the first center 10a. The OTA master 30 may also be called a central gateway (CGW).

[0024] 4 is a block diagram showing a schematic configuration of the OTA master 30 in FIG. 1. As shown in FIG. 4, the OTA master 30 includes a CPU 31, a RAM 32, a ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, the RAM 32, the ROM 33, and the storage device 34 constitute a microcomputer 35. In the OTA master 30, the CPU 31 executes a program read from the ROM 33 by using the RAM 32 as a working area, thereby executing a predetermined process related to software update. The communication device 36 is a device for communicating with the communication module 80, the electronic control units 50a to 50d, and the display device 70, respectively, via the buses 60a to 60d shown in FIG. 1.

[0025] Fig. 5 is a functional block diagram of the OTA master 30 shown in Fig. 4. The OTA master 30 shown in Fig. 5 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is realized by the storage device 34 shown in Fig. 4. The communication unit 38 and the control unit 39 are realized by the CPU 31 shown in Fig. 4 executing a program stored in the ROM 33 using the RAM 32.

[0026] The storage unit 37 stores a program for executing software updates of the electronic control units 50a-50d (a control program for the OTA master 30), various data used when executing software updates, and software update data downloaded from the first center 10a. The storage unit 37 can also store information related to the type of non-volatile memory mounted in each of the electronic control units 50a-50d. The storage unit 37 can also store information related to the display device 70.

[0027] The communication unit 38 functions as a transmitting unit and a receiving unit that transmits and receives data, information, notifications, requests, and the like to and from the first center 10a. The communication unit 38 transmits a software update check request to the first center 10a, for example, when the power of the vehicle is turned on (transmitting unit). The update check request includes, for example, a vehicle ID for identifying the vehicle and information on the current version of the software of the electronic control units 50a to 50d connected to the in-vehicle network 90. ​​The vehicle ID and the current version of the software of the electronic control units 50a to 50d are used to determine whether or not there is update data for the software of the electronic control units 50a to 50d by comparing them with the latest version of the software held by the first center 10a for each vehicle ID. In addition, the communication unit 38 receives a notification indicating the presence or absence of update data from the first center 10a as a response to the update check request (receiving unit). When there is software update data for the electronic control units 50a-50d, the communication unit 38 transmits a download request for a distribution package including the software update data and the like to the first center 10a (transmission unit), and receives (downloads) the distribution package transmitted from the first center 10a (reception unit). The communication unit 38 also transmits the update status of the software transmitted by the electronic control units 50a-50d to the first center 10a (transmission unit). The communication unit 38 can also display information related to the software update, a notification related to the transmission of the information, and the software update status on the display device 70 based on an instruction from the control unit 39. The communication unit 38 can also transmit information related to the display device 70 to the first center 10a (transmission unit).

[0028] The control unit 39 judges whether or not there is update data for the software of the electronic control units 50a to 50d, based on a response from the first center 10a to the update confirmation request received by the communication unit 38. The control unit 39 also verifies the authenticity of the update data that the communication unit 38 receives (downloads) from the first center 10a in a distribution package and stores in the storage unit 37. The control unit 39 also uses the update data downloaded from the first center 10a to control the software update process (installation, activation, etc.) of the electronic control units 50a to 50d. Specifically, the control unit 39 transfers the downloaded update data to the target electronic control unit and causes the target electronic control unit to install update software based on the update data. After the installation is completed, the control unit 39 instructs the target electronic control unit to activate the installed update software.

[0029] The electronic control units 50a to 50d are devices (ECUs) for controlling the operation of each part of the vehicle. Although an example in which the in-vehicle network 90 includes four electronic control units 50a to 50d is shown in Fig. 1, the number of electronic control units is not particularly limited. In addition, the number of buses connecting the electronic control units 50a to 50d to the OTA master 30 is not particularly limited.

[0030] The display device 70 is a human machine interface (HMI) used to perform various displays, such as displaying the presence of update data during software update processing of the electronic control units 50a to 50d, displaying an explanation of the software update, displaying a consent request screen for requesting consent to the software update from the vehicle user or administrator, and displaying the result and status of the software update. The display device 70 can typically be a display device of a car navigation system, but is not particularly limited as long as it can display information required during software update processing. For example, a simple HMI device such as a meter that cannot present information about software updates is also included in the display device 70. In the present embodiment, the display device 70 receives information and notifications transmitted from the first center 10a via the OTA master 30, but the display device 70 may receive the information and notifications directly from the communication module 80 without the OTA master 30, or directly via another communication device not shown in the figure instead of the communication module 80. In addition to the display device 70, an electronic control unit and the like may be further connected to the bus 60d shown in FIG. 1.

[0031] The communication module 80 is a unit having a function of controlling communication between the first center 10a and the vehicle, and is a communication device for connecting the in-vehicle network 90 to the first center 10a. The communication module 80 is wirelessly connected to the first center 10a via the network 100, and performs vehicle authentication by the OTA master 30, downloading update data, and the like. The communication module 80 may be configured as being included in the OTA master 30.

[0032] The vehicle including the in-vehicle network 90 may be provided with an input unit such as a switch (not shown) for allowing a vehicle user or manager to consent to the software update process. This consent switch may be provided, for example, near the display device 70 or on the steering wheel.

[0033] [Software update process overview] The OTA master 30 transmits a software update check request to the first center 10a, for example, when the power supply of the vehicle is turned on. The update check request includes a vehicle ID for identifying the vehicle, and vehicle configuration information, which is information about the state (system configuration) of the electronic control units 50a to 50d connected to the in-vehicle network 90, such as the current versions of the hardware and software of the electronic control units 50a to 50d. The vehicle configuration information can be created by acquiring the identification numbers (ECU_ID) of the electronic control units and the identification numbers (ECU_Software_ID) of the software versions of the electronic control units from the electronic control units 50a to 50d connected to the in-vehicle network 90. ​​The vehicle ID and the current versions of the software of the electronic control units 50a to 50d are used to determine whether or not there is update data for the software of the electronic control units 50a to 50d by comparing them with the latest version of the software held by the first center 10a for each vehicle ID. In response to the update check request received from the OTA master 30, the first center 10a transmits a notification indicating the presence or absence of update data, information about software updates, and the like to the OTA master 30. When there is update data for the software of the electronic control units 50a to 50d, the OTA master 30 transmits a download request for a distribution package to the first center 10a. In response to the download request received from the OTA master 30, the first center 10a transmits a distribution package including the update data to the OTA master 30. In addition to the update data, the distribution package may include verification data for verifying the authenticity of the update data, the number and type of update data, various control information used when updating the software, and the like.

[0034] The OTA master 30 determines whether there is update data for the software of the electronic control units 50a to 50d based on the response to the update confirmation request received from the first center 10a. The OTA master 30 also verifies the authenticity of the distribution package received from the first center 10a and stored in the storage device 13. The OTA master 30 also transfers the update data downloaded in the distribution package to the target electronic control unit and causes the target electronic control unit to install the update data. After the installation is completed, the OTA master 30 instructs the target electronic control unit to activate the installed updated software to make it valid.

[0035] In addition, in the consent request process, the first center 10a causes the output device to output information explaining the software update, a notification that consent is required for the software update, and a notification prompting input that the software update has been consented to, to the consent request process. The display device 70 provided in the in-vehicle network 90 can be used as the output device. For example, in the consent request process, if it is possible to display information to be explained in advance to the vehicle user or administrator on the screen of the display device 70, the display device 70 is used as the output device. When the display device 70 is used as the output device, the OTA master 30 can cause the display device 70 to display information about the software update, a consent request screen for requesting consent to the software update from the user or administrator, and a notification prompting a specific input operation such as pressing an consent button if the user or administrator consents. In the consent request process, if it is impossible to display information to be explained in advance to the vehicle user or administrator on the screen of the display device 70, the second center 10b provides information to the vehicle user or administrator. In this case, an explanation of the software update content and confirmation of consent to the software update from the user or administrator are performed. When the first center 10a determines that consent has been obtained from the user or administrator via the OTA master 30 or via notification from the second center 10b, it instructs the OTA master 30 to execute the above-mentioned installation and activation control processes and updates the software of the target electronic control unit.

[0036] Here, if the non-volatile memory of the target electronic control unit is a single bank memory having one storage area for storing data such as software, in principle, installation and activation are performed consecutively, so consent request processing for software update is performed before installation is performed. Note that even if the target electronic control unit is a single bank memory, depending on the information on the update sequence instructed from the first center 10a, it may be requested to temporarily stop the update processing in the state where installation is completed, that is, to suspend (standby) activation. Also, if the non-volatile memory of the target electronic control unit is a dual bank memory having two storage areas for storing data such as software, consent request processing for software update is performed at least after installation is performed and before activation is performed. Note that if the non-volatile memory of the target electronic control unit is a dual bank memory, consent request processing for software update before installation may be performed or may be omitted.

[0037] The software update process consists of a phase in which the OTA master 30 downloads update data from the first center 10a (download phase), a phase in which the OTA master 30 transfers the downloaded update data to the target electronic control unit and installs update software based on the update data in the storage area of ​​the target electronic control unit (installation phase), and a phase in which the target electronic control unit activates the installed update software (activation phase).

[0038] Downloading is a process in which the OTA master 30 receives update data for updating the software of the electronic control unit, which is transmitted from the first center 10a in a distribution package, and stores the data in the storage unit 37. When receiving update data by downloading, the download phase not only executes the download, but also includes control of a series of processes related to the download, such as judging whether the download can be executed and verifying the update data.

[0039] The update data transmitted from the first center 10a to the OTA master 30 may include update software for the electronic control unit (all data or difference data), compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or the compressed data. The update data may also include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The update data is downloaded as the above-mentioned distribution package, and the distribution package includes update data for a single electronic control unit or multiple electronic control units.

[0040] The installation is a process in which the OTA master 30 writes update software (an updated program) to the non-volatile memory of the target electronic control unit based on the update data downloaded from the first center 10a. The installation phase includes not only the execution of the installation, but also the control of a series of processes related to the installation, such as judging whether the installation can be executed, the transfer of the update data, and the verification of the update software.

[0041] If the update data includes the update software itself (all data), the OTA master 30 transfers the update data (update software) to the target electronic control unit in the installation phase. If the update data includes compressed data, difference data, or divided data of the update software, the OTA master 30 may transfer the update data to the target electronic control unit and the target electronic control unit may generate the update software from the update data, or the OTA master 30 may generate the update software from the update data and then transfer the update software to the target electronic control unit. Here, the update software can be generated by decompressing the compressed data or assembling (integrating) the difference data or divided data.

[0042] The target electronic control unit can install the update software based on an installation request from the OTA master 30. Note that for a specific target electronic control unit that has received the update data, the installation may be performed autonomously without receiving an explicit instruction from the OTA master 30.

[0043] Activation is a process in which the target electronic control unit activates the update software installed in its own non-volatile memory. The activation phase includes not only the execution of activation, but also a series of controls related to activation, such as judging whether activation can be executed, requesting the vehicle user or administrator to consent to activation, and verifying the execution result.

[0044] The activation of the update software can be performed by the target electronic control unit based on an activation request from the OTA master 30. Note that, for a specific target electronic control unit that has received the update data, the activation may be performed autonomously after the installation is completed, without receiving an explicit instruction from the OTA master 30.

[0045] The software update process can be performed consecutively or in parallel for each of the multiple target electronic control units.

[0046] Furthermore, in this specification, the "software update process" includes not only a process in which download, installation, and activation are all performed consecutively, but also a process in which only some of the download, installation, and activation are performed.

[0047] [process] Next, with further reference to FIGS. 6 and 7, a software update process executed in the network system according to this embodiment will be described.

[0048] 6 is a flow chart for explaining the procedure of the transmission process of information related to software updates performed by the first center 10a and the second center 10b. The first center 10a and the second center 10b communicate with each other as needed to share information necessary for processing decisions.

[0049] (Step S601) The first center 10a judges whether or not there is software in the vehicle that needs to be updated. This judgment can be made based on, for example, the current version of the software in each of the electronic control units 50a to 50d mounted on the vehicle obtained from the vehicle configuration information included in the update confirmation request transmitted from the OTA master 30, and the latest version of each piece of software stored in the storage unit 16 of the first center 10a. If there is software in the target vehicle that needs to be updated (step S601, Yes), the process proceeds to step S602. On the other hand, if there is no software in the target vehicle that needs to be updated (step S601, No), this process ends.

[0050] (Step S602) The first center 10a judges whether the display device 70 mounted on the vehicle that is the target of the software update satisfies a predetermined condition. Here, the predetermined condition is a condition that, when updating the software using OTA, information that should be explained to the vehicle user, manager, etc. in advance (such as changes in control) can be displayed on the screen of the display device 70. The judgment of whether this condition is satisfied is made based on information about the display device 70 acquired by the acquisition unit 19. If the display device 70 of the vehicle that is the target of the software update satisfies the predetermined condition (step S602, Yes), the process proceeds to step S604. On the other hand, if the display device 70 of the vehicle that is the target of the software update does not satisfy the predetermined condition (step S602, No), the process proceeds to step S603.

[0051] (Step S603) The second center 10b provides information about the software update (such as an explanation of the contents of the software update and a request for consent to the software update) to the user or manager of the vehicle that is the target of the software update. Examples of methods for providing the information include (i) a method in which an operator at the second center 10b calls the contact of the user or manager and verbally explains the information about the software update, (ii) a method in which the second center 10b mails a postcard or an envelope to the contact of the user or manager and explains the information about the software update in the text written on the postcard or envelope, and (iii) a method in which the second center 10b mails a postcard or an envelope to the contact of the user or manager and explains the information about the software update in response to a call from the user or manager to the call center written on the postcard or envelope. When the information about the software update is provided to the user or manager of the vehicle, the process proceeds to step S605.

[0052] (Step S604) The first center 10a transmits information about the software update (such as an explanation of the contents of the software update and a request for consent to the software update) to the vehicle (OTA master 30) that is the target of the software update. In the vehicle that receives this information, a screen display based on the information about the software update is performed on the display device 70. When the information about the software update is transmitted to the vehicle, the process proceeds to step S606.

[0053] (Step S605) The second center 10b judges whether or not consent to the software update has been obtained from the user or manager of the vehicle. This consent to the update can be judged to mean that the user or manager of the vehicle has understood the contents of the software update and agreed to the update. For example, in the case of the information providing method (i) or (iii) described in step S603 above, the operator can directly obtain consent from the user or manager over the phone, and in the case of the information providing method (ii) described in step S603 above, consent can be obtained by having the user or manager mail a reply postcard indicating consent. Also, for example, consent to the update can be obtained by pressing a consent switch provided in advance in the vehicle.

[0054] In addition, there may be cases where the explanation of the software update contents to the vehicle user or administrator and the consent of the software update from the user or administrator are not performed at the same time. Therefore, the second center 10b may store management information indicating how much has been completed for each user or administrator. FIG. 7 shows an example of management information stored by the second center 10b. In FIG. 7, whether or not the explanation of the software update contents has been completed and whether or not consent to the software update has been received are stored for each vehicle (VIN). If the format of this management information is shared between the first center 10a and the second center 10b, the first center 10a can easily understand the management information received from the second center 10b. In addition, the management information stored in the second center 10b may be made available to the first center 10a at any time without being notified by the second center 10b.

[0055] In step S605, only if consent to the software update is obtained from the vehicle user, administrator, etc. (step S605, Yes), the process proceeds to step S607. Note that if consent to the software update is not obtained from the vehicle user, administrator, etc., a deadline may be set and this process may be terminated without performing the software update process.

[0056] (Step S606) The first center 10a judges whether or not an update consent notice has been received from the vehicle (OTA master 30) in response to the information regarding the software update. By receiving the update consent notice, the center 10 can judge that the vehicle user or manager has understood the contents of the software update and has given consent to the update. The update consent notice can be transmitted to the first center 10a, for example, by pressing an consent switch provided in advance in the vehicle. Only when the update consent notice has been received from the vehicle (OTA master 30) (step S606, Yes), the process proceeds to step S608. Note that, if the update consent notice cannot be received from the vehicle (OTA master 30), the process may be terminated by setting a deadline without carrying out the software update process.

[0057] (Step S607) The second center 10b transmits a notification to the first center 10a that the information regarding the software update has been provided to the vehicle user, administrator, etc. This notification enables the first center 10a to determine that the explanation regarding the software update has been completed for the vehicle user, administrator, etc., and that consent to the software update has been received from the vehicle user, administrator, etc. When the notification is transmitted to the first center 10a, the process proceeds to step S608.

[0058] (Step S608) The first center 10a executes the process of updating (downloading, installing, and activating) the software of the target electronic control unit mounted on the vehicle, thereby completing the process of transmitting information related to the software update.

[0059] Fig. 8 is a flowchart for explaining an example of a software update control process executed by the first center 10a, the OTA master 30, and the target electronic control unit. Fig. 8 shows an example of a software update sequence after the above-mentioned software update information transmission process (Fig. 6) is performed in the download phase to obtain permission for downloading in the software update process.

[0060] In addition, the process of sending information regarding software updates (Figure 6) may be performed not only in the download phase described in this embodiment, but also in the installation phase to obtain permission for installation in the software update process, or in the activation phase to obtain permission for activation in the software update process.

[0061] (Step S801) The first center 10a judges whether or not there has been a download request for the distribution package from the OTA master 30. Only if there has been a download request (step S801, Yes), the process proceeds to step S802.

[0062] (Step S802) The OTA master 30 downloads the update data. More specifically, the OTA master 30 receives a distribution package including the update data transmitted from the first center 10a. The OTA master 30 stores the received distribution package in the storage unit 37. Once the update data has been downloaded, the process proceeds to step S803.

[0063] (Step S803) The OTA master 30 executes the installation of software based on the update data in the target electronic control unit. More specifically, the OTA master 30 instructs the installation of the update software, which is a process of transferring the update data included in the distribution package to the target electronic control unit and writing the update data to a data storage area, based on the information included in the distribution package. When the installation of the update software is executed, the process proceeds to step S804.

[0064] (Step S804) The OTA master 30 activates the update software installed in the target electronic control unit. More specifically, the OTA master 30 instructs the target electronic control unit, which has written the update software to its data storage area, to activate the update software based on information included in the distribution package. The target electronic control unit restarts when a specific input operation, such as turning the power off, is performed, and executes the update software. When the update software activation process is executed, this software update control process ends.

[0065] <Actions and Effects> As described above, according to the network system of one embodiment of the present disclosure, when performing a software update of an electronic control unit installed in a vehicle, if the display device 70 installed in the vehicle cannot adequately display information related to the software update, the second center 10b provides information related to the software update to the vehicle user, administrator, etc. by telephone, postcard, etc.

[0066] This process allows a vehicle user or administrator to receive necessary information regarding software updates using OTA even if the user or administrator does not have a separate device (for example, an information terminal such as a smartphone or a personal computer capable of wireless communication with the vehicle) that replaces a display device such as a car navigation device. After the vehicle user or administrator understands the contents of the software update and determines that consent to the update has been obtained, the process of updating the software of the target electronic control unit installed in the vehicle can be executed.

[0067] In the above embodiment, the first center 10a first determines whether the display device 70 installed in the vehicle can adequately display information about software updates, but the information about software updates may be uniformly provided to the vehicle user, administrator, etc. according to a predetermined rule without making this determination. Alternatively, the information about software updates may be provided to the vehicle user, administrator, etc. according to their preferred contact method.

[0068] The above describes one embodiment of the disclosed technology, but the present disclosure can be understood as a system including a first center and a second center, a method executed by not only the first center but also the first center including a processor and memory, a program, a computer-readable non-transitory storage medium storing a program, an OTA master capable of communicating with the first center, or a vehicle equipped with an OTA master, etc. [Industrial Applicability]

[0069] The disclosed technique can be used in a network system for updating software of an electronic control unit mounted on a vehicle. [Explanation of symbols]

[0070] 10a 1st Center 10b 2nd Center 11, 31 CPU 12,32 RAM 13, 34 Storage device 14, 36 Communication equipment 16, 37 Memory section 17, 38 Communications Department 18, 39 Control section 19 Acquisition Department 20 Processing section 30 OTA Master 33 ROM 35 Microcomputer 50a~50d Electronic Control Unit (ECU) 60a~60d Bus 70 Display device 80 Communication Module 90 In-vehicle network 100 Network

Claims

1. A system for controlling software updates of an electronic control unit mounted on a vehicle, comprising: a first center that performs a process for updating the software on the vehicle; The vehicle updates the software of the electronic control unit based on the processing by the first center; a second center that provides information about the software update to a user of the vehicle when the information about the software update cannot be displayed on a screen of the vehicle; The second center includes: providing information regarding the software update to a user of the vehicle via a telephone call from an operator; sending a notification to the first center that information regarding the software update has been provided to the user of the vehicle; The system further comprises: when the first center receives the notification from the second center, the first center performs processing on the vehicle based on the notification after the reception.

2. The system of claim 1 , wherein the notification that the software update information has been provided to the user of the vehicle includes a consent of the user of the vehicle to the software update process.

3. a switch for allowing a user of the vehicle to consent to the software update process is provided in the vehicle; 3. The system according to claim 2, wherein a notification regarding consent to the software update process inputted via the switch is transmitted from the vehicle to the first center.

4. The system according to claim 2 or 3, wherein the software update process includes processes of downloading update data for updating the software to the vehicle, installing update software based on the update data, and activating the update software.

5. A method for controlling software updates of an electronic control unit mounted on a vehicle, the method being executed by a first center which performs a process for updating the software on the vehicle and a second center which provides information on the software update to a user of the vehicle when the information on the software update cannot be displayed on a screen of the vehicle, the method comprising: providing information about the software update to a user of the vehicle via a telephone call from an operator at the second center; the second center transmitting to the first center a notification that information regarding the software update has been provided to a user of the vehicle; and if the first center receives the notification from the second center, performing a process on the vehicle based on the notification after the reception.

6. A method for controlling software updates of an electronic control unit mounted on a vehicle, the method being executed by a first center which performs a process for updating the software on the vehicle and a second center which provides information on the software update to a user of the vehicle when the information on the software update cannot be displayed on a screen of the vehicle, the method comprising: providing information about the software update to a user of the vehicle via a telephone call from an operator at the second center; the second center transmitting to the first center a notification that information regarding the software update has been provided to a user of the vehicle; and when the first center receives the notification from the second center, after the reception, performing a process on the vehicle based on the notification.

Images