Software update device and software update control method

Abstract

To provide a software update apparatus capable of avoiding a situation such as updating software without notifying a user who wants to use a vehicle of the software update.SOLUTION: A software update apparatus comprises: a communication unit that transmits, to a plurality of terminals, a notification signal for causing update information regarding a software update to be notified of before updating software for a vehicle; and a determination unit that determines whether or not to execute the software update. The determining unit receives a permission signal for permitting the software update from one terminal among the plurality of terminals and determines that the software update is to be executed if a rejection signal for rejecting the software update is not received from another terminal among the plurality of terminals.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a software update device and a software update control method. [Background technology]

[0002] Conventionally, there have been known information processing terminals that can automatically update software at a timing that suits the user's preference, such as a type that wants to update immediately when the latest version of the software becomes available, or a type that wants to wait a certain period of time after a new version becomes available before updating the software (Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-38634 Summary of the Invention [Problem to be solved by the invention]

[0004] In the information processing terminal described in Patent Document 1, when vehicle software is automatically updated without notifying the user who wants to use the vehicle, the user is unaware of the software update and is unable to use the vehicle while the software is being updated.

[0005] The problem to be solved by the present invention is to provide a software update device and a software update control method that can avoid a situation where software is updated without notifying a user who wants to use a vehicle of the software update. [Means for solving the problem]

[0006] The present invention solves the above problem by transmitting a notification signal to multiple terminals before updating software for a vehicle, notifying them of update information regarding the software update, and if the communication device receives an approval signal from one of the multiple terminals authorizing the software update and does not receive a rejection signal from another of the multiple terminals rejecting the software update, determining to execute the software update. [Effects of the Invention]

[0007] According to the present invention, it is possible to avoid a situation where software is updated without notifying a user who wants to use a vehicle of the software update. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a software update system according to this embodiment. [Figure 2] FIG. 2 is a schematic diagram for explaining the control flow when consent is obtained from users A and B to allow software updates. [Figure 3] FIG. 3 is a schematic diagram for explaining the control flow when a notification is received from user B that the software update is rejected. [Figure 4] FIG. 4 is a flowchart illustrating the flow of control processing by the server. [Figure 5] Figure 5 is a diagram for explaining the control flow in a software update system according to another embodiment of the present invention, in which the user terminal of user A is selected as the licensed terminal and the in-vehicle terminal of vehicle 1 being used by user B is not selected as the licensed terminal. [Figure 6] FIG. 6 is a table for explaining permission levels set for terminals in a software update system according to another embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of a software update device and a software update method according to the present invention will be described below with reference to the drawings. As shown in FIG. 1, the software update device according to this embodiment is realized as part of a software update system 100. FIG. 1 is a block diagram showing an example of the software update system 100 according to this embodiment. The software update system 100 is a system capable of updating software for vehicle control, diagnosis, etc., implemented in an electronic control unit (hereinafter referred to as an ECU (Electronic Control Unit)) of a vehicle 1 via OTA (Over The Air). Updating software via OTA in this manner is called FOTA (Firmware Over The Air).

[0010] The software of the ECU is realized by the execution of a program by a microcomputer included in the ECU. In this embodiment, a case where a program executed by the microcomputer of the ECU is wirelessly rewritten will be described as an example of wireless ECU software update. However, the software update system 100 can also be applied to cases where data used in various software, such as map data used in a navigation system of the vehicle 1 and control parameters used in the ECU, is wirelessly rewritten. Furthermore, when an FPGA (Field Programmable Gate Array) is used in the ECU, the software update system 100 can also be applied to cases where the function (logic) of the FPGA is wirelessly rewritten. Furthermore, while FIG. 1 illustrates a single vehicle as the vehicle 1, the software update system 100 is a system capable of updating software for multiple vehicles 1.

[0011] In this embodiment, "ECU software update" refers to updating the version of the ECU software to a newer version, i.e., updating the program executed by the microcomputer to a newer version. Wireless software update includes not only wirelessly obtaining and rewriting the new version of the program itself from outside the vehicle 1, but also wirelessly obtaining and rewriting various data used when the new version of the program is executed and differential data between the new version of the program and the old version of the program from outside the vehicle 1.

[0012] 1, software update system 100 includes a vehicle 1, a server 2, and a user terminal 3. Each component included in software update system 100 is capable of exchanging information via a wireless communication network 4. Wireless communication network 4 includes, for example, a mobile communication network using a 4G line or the like, the Internet, Wifi (Wireless Fidelity) (registered trademark), and the like. First, the roles of the vehicle 1, the server 2, and the user terminal 3 in the software update system 100 will be described.

[0013] Vehicle 1 is equipped with an ECU having software to be updated. Vehicle 1 exchanges various information related to the software update with server 2. Information related to each ECU equipped in vehicle 1 is transmitted from vehicle 1 to server 2. Vehicle 1 then updates the software included in the ECU using the update data received from server 2.

[0014] Vehicle 1 also receives information related to software updates from server 2. Examples of information related to software updates include campaign information and update data. A campaign is an event in which server 2 distributes a distribution package to vehicle 1. The distribution package includes update data, authentication data used for authenticating the update data, and the like. If the user agrees to the start of update processing in vehicle 1, vehicle 1 executes the software update processing. When update processing is started in vehicle 1, vehicle 1 transmits information indicating the progress of the update processing to server 2.

[0015] The server 2 is a server that controls the software update process in the software update system 100 and functions as an OTA center. The server 2 exchanges various pieces of information related to the above-mentioned software update with the vehicle 1. The server 2 also exchanges various pieces of information with the user terminal 3.

[0016] The server 2 has a storage function for storing update data, a data management function for managing the version of each software, the vehicle identification number (VIN) of the vehicle 1 to be updated, the ECU to be updated, etc., and a distribution function for distributing the update data. For example, when the server 2 receives various information including update data from a software supplier, the server 2 stores the update data in the database 22. Based on the information received from the software provider, the server 2 identifies the VIN to which the update data is to be distributed and the ECU to be updated. The server 2 sets the distribution timing of the campaign information, and when the distribution timing of the campaign information arrives, transmits the information to the vehicle 1 and / or the user terminal 3. After the server 2 has completed transmission of the distribution package to the vehicle 1 and the user has consented to the software update, the update process begins in the vehicle 1.

[0017] The user terminal 3 has a function to accept operational input from the user and a function to display various screens. Examples of the user terminal 3 include a smartphone or tablet that the user can carry. The user terminal 3 exchanges various information, such as campaign information, with the server 2. When the user terminal 3 receives campaign information from the server 2, it notifies the user of the campaign information. When the user operates the user terminal 3 to accept the distribution package, the user terminal 3 transmits information indicating that the user has accepted to the server 2. After the server 2 has completed transmitting the distribution package to the vehicle 1, when the update process is started in the vehicle 1, the user terminal 3 receives information indicating the progress of the update process from the server 2 and notifies the user of the information indicating the progress.

[0018] Next, the configurations of the vehicle 1, the server 2, and the user terminal 3 will be described with reference to Fig. 1. First, the configuration of the server 2 will be described. As shown in Fig. 1, the server 2 includes a communication device 21, a database 22, and a control device 23. Note that the "software update device" of the present invention corresponds to a device having at least the control device 23, and the "software update method" of the present invention corresponds to a method having control processing executed by the control device 23.

[0019] The communication device 21 is connected to the in-vehicle communication device 12 of the vehicle 1 and the terminal communication device 31 of the user terminal 3 via the wireless communication network 4, and transmits and receives various data. The communication device 21 transmits a notification signal regarding the software update to the vehicle 1 and / or the user terminal 3 before a software update. The communication device 21 also transmits an identification package and a common package generated by the update data management unit 231 to the vehicle 1. The database 22 stores the registration information of the vehicle 1, campaign information, update data, terminal information, etc. The registration information of the vehicle 1 includes at least the VIN of the vehicle 1, the number of ECUs installed in the vehicle 1, the type of each ECU, and the software version of each ECU. The campaign information includes the data size of the update data, information identifying the ECU to be updated (ECU name, ECU ID, etc.), information on the version of the software to be updated (version name, version ID, etc.), and a summary of the functions to be updated. The terminal information is information input from an application included in the terminal, and includes the user's personal information, terminal identification information, information for associating the user with the vehicle owned by the user, etc.

[0020] The control device 23 is a device that functions as a control tower for the server 2, and is composed of, for example, a processor and memory programmed to execute one or more functions embodied by a computer program. The control device 23 has, as functional blocks, an update data management unit 231 that manages software update data, and a determination unit 232 that determines whether or not to execute a software update. The functional blocks included in the control device 23 are not limited to the update data management unit 231 and the determination unit 232, and may include other functional blocks according to the functions.

[0021] When new update data is provided by a software supplier or the like, the update data management unit 231 stores the update data in a distribution package. The distribution package includes a common package and an identification package prepared for each vehicle. The common package is a package that is used in common among multiple vehicles. The common package includes update data and common package identification information. The common package identification information is information for identifying the update data included in the common package, and includes the ID of the update data, the data volume of the update data, version information of the update data, etc. The identification package includes vehicle identification information (VIN) assigned to each vehicle and common package identification information. The vehicle identification information is information for identifying the vehicle to be updated.

[0022] The update data management unit 231 manages a software update list that manages update data. The software update list is a list of information related to update data according to an update data campaign. The software update list includes, for example, a campaign ID, the VIN of the update target, the target ECU, the software version, a link to the common package, and common package identification information.

[0023] When new update data is input, the update data management unit 231 generates common package identification information corresponding to the update data and stores the update data and the common package identification information in the common package. The update data management unit 231 also assigns a campaign ID to the software update campaign, identifies information corresponding to each item in the software update list from the update information included in the update data, and updates the software update list by associating the information of the identified list item with the assigned campaign ID, etc. The update data management unit 231 also stores link information to the common package in the software update list. For each target VIN included in the software update list, the update data management unit 231 associates the VIN with common package identification information and stores it as an identified package. The update data management unit 231 manages software version information, software update history, and VIN for various ECUs in a list for each vehicle.

[0024] The determination unit 232 determines whether a software update is required for all managed vehicles. Specifically, for each vehicle, the determination unit 232 first compares the vehicle identification number of the vehicle with the target VIN managed as a software update target, and determines whether the vehicle identification numbers match. If the vehicle identification numbers match, the control unit 23 compares the current ECU software version of the vehicle with the matching vehicle identification number with the software version of the latest software. If the current ECU software version of the vehicle 1 is not the latest software version applicable to the vehicle, the control unit 23 determines that a software update is required. If it is determined that a software update is required, the control unit 23 generates an identification package for each vehicle determined to require a software update.

[0025] If the determination unit 232 determines that a software update is necessary based on the software version, it notifies the user of the software update to obtain permission to perform the software update. The update notification is performed by transmitting a notification signal from the communication device 21 to the vehicle 1 and the user terminal 3. The notification signal is a signal for notifying update information related to the software update, and the update information may be, for example, the time required for the software update and the update contents. The update information also includes notification information for allowing the user to select whether to accept or reject the software update, disclaimer information related to the update, warning information, etc.

[0026] Here, the relationship between software updates included in ECUs and the use of the vehicle 1 will be described. The ECUs included in the vehicle 1 include a driving system ECU, a multimedia system ECU, and a power management ECU. For example, when updating software for a navigation system ECU, an example of a multimedia ECU, the processing of the multimedia ECU may be temporarily stopped during the software update, such as when map information cannot be displayed. This interruption of control processing in the multimedia ECU does not directly affect the vehicle's driving functions. On the other hand, when updating software for a driving system ECU, the software updates the vehicle's driving functions themselves, so the user cannot use the vehicle 1 during the software update. Therefore, the software update system 100 according to this embodiment requests the user's permission to perform the software update before performing the software update, and performs the software update process only if the user grants permission. The content of the notification to the user before the software update and the determination of whether or not to perform the software update based on the user's consent will be described later.

[0027] The following describes the configuration of the user terminal 3. As shown in Fig. 1, the user terminal 3 includes a terminal communication device 31, a terminal HMI (Human Machine Interface) 32, and a terminal control device 33.

[0028] The terminal communication device 31 has a function of performing data communication with the server 2 via the wireless communication network 4. The terminal HMI 32 functions as at least one of a device that accepts user operation input and a device that notifies the user of information. An example of the terminal HMI 32 is a touch panel display. The terminal HMI 32 is not limited to a device that displays information, but may also be a device that outputs information audibly, such as a speaker. If the user terminal 3 is directly connected to the in-vehicle device via Bluetooth (registered trademark) or the like, the user terminal 3 may perform data communication with the server 2 via the in-vehicle communication device 12 of the vehicle 1. If the in-vehicle device and the user terminal 3 are directly connected, the in-vehicle device may communicate with the server 2 from the user terminal 3 via the wireless communication network 4.

[0029] The terminal control device 33 is a device that functions as a control tower for the user terminal 3, and is composed of, for example, a processor and memory programmed to execute one or more functions embodied in a computer program. The terminal control device 33 executes processing for notifying the user of campaign information and progress information of the update processing in the software update processing of the ECU of the vehicle 1. The terminal control device 33 also executes processing for requesting permission from the user in the software update processing of the ECU of the vehicle 1. For example, in the case where the user is requested to consent to the start of the update processing, the terminal control device 33 generates an image for requesting permission from the user to start the update processing, outputs the generated image to the terminal HMI 32, and causes the image for requesting permission from the user to be displayed on the terminal HMI 32.

[0030] Next, we will explain the configuration of vehicle 1. As shown in Fig. 1, vehicle 1 includes a CGW (Central Gateway) 11, an on-board communication device 12, an ECU 13, and an on-board HMI (Human Interface) 14, which are connected via a communication network so as to be able to communicate data with each other.

[0031] The CGW 11 is a vehicle gateway device with a data relay function. When it receives update data from the in-vehicle communication device 12, it distributes the update data to the ECU to be updated. First, the CGW 11 determines whether the vehicle identification number included in the identification package transmitted from the server 2 matches the vehicle identification number of the host vehicle. The CGW 11 first obtains the vehicle identification number of the host vehicle from its in-vehicle memory. Next, when the CGW 11 receives the identification package from the server 2 via the in-vehicle communication device 12, it obtains the vehicle identification number from the identification package and compares the vehicle identification number included in the identification package with the vehicle identification number of the host vehicle. If the vehicle identification number included in the identification package matches the vehicle identification number of the host vehicle, the CGW 11 transmits a request signal to the server 2 via the in-vehicle communication device 12 to request acquisition of a common package.

[0032] When the CGW 11 receives the common package from the server 2, it acquires a common package identifier from the common package. The CGW 11 determines whether the common package identifier acquired from the common package matches the common package identifier included in the identification package. If the common package identifiers match, the CGW 11 extracts update data from the common package. The CGW 11 then transmits the extracted update data to the ECU to be updated and uses the update data to update the software in the ECU to be updated. Note that the software update is executed when an authorization signal authorizing the software update is received from the user terminal 3 and / or the in-vehicle HMI (Human Interface) 14, as described below.

[0033] The CGW 11 also aggregates the software versions of the software of the multiple ECUs 13. When the ignition power of the vehicle 1 is turned on, the CGW 11 aggregates the software versions of the ECUs at that time. The CGW 11 also aggregates the software versions of the ECUs at that time at regular intervals. The CGW 11 transmits the aggregated software versions of each ECU to the server 2 via the in-vehicle communication device 12.

[0034] The in-vehicle communication device 12 has a function of performing data communication with the server 2 via the wireless communication network 4. An example of the in-vehicle communication device 12 is a telematics control unit (TCU).

[0035] The ECU 13 includes, for example, a body system ECU, a driving system ECU, and an information system ECU. The body system ECU is an ECU that controls body systems, such as a door ECU that controls door locking / unlocking, a meter ECU that controls meter display, an air conditioner ECU that controls air conditioner operation, and a window ECU that controls window opening and closing. The driving system ECU is an ECU that controls driving systems, such as an engine ECU that controls engine operation, a brake ECU that controls brake operation, and a power steering ECU that controls power steering operation. The information system ECU is an ECU that controls information systems, such as a navigation ECU that controls a navigation system and an audio ECU that controls audio equipment. The type of ECU 13 is not limited to the illustrated configuration. When the ECU 13 obtains update data from the CGW 11, it updates software using the update data. The ECU 13 also manages software versions and transmits the software version in response to a request signal from the CGW 11.

[0036] The in-vehicle HMI 14 functions as a device that accepts user operation inputs and a device that notifies the user of information. The form of the in-vehicle HMI 14 is not particularly limited, and examples of the in-vehicle HMI 14 include a touch panel display and an ignition switch that turns the ignition of the vehicle 1 on or off. For example, when the in-vehicle HMI 14 receives a signal from the server 2 that includes notification information that prompts the user to select whether to accept or reject a software update, the in-vehicle HMI 14 displays an image that requests the user's consent. Furthermore, for example, when the user operates the in-vehicle HMI 14 to accept the start of the update process, the in-vehicle HMI 14 outputs a signal representing the user's operation to the server 2. Furthermore, for example, when the user operates the in-vehicle HMI 14 to turn the ignition from on to off, the in-vehicle HMI 14 outputs a signal representing the user's operation to the server 2. Note that the in-vehicle HMI 14 is not limited to a device that displays information and may be a device that outputs information audibly, such as a speaker.

[0037] As described above, vehicle 1 becomes unusable during a software update. For example, consider a scenario in which user B, while in vehicle 1, temporarily stops the vehicle to shop at a store, and then uses vehicle 1 again after finishing his shopping at the store (hereinafter referred to as a "shopping scenario"). In this "shopping scenario," user A, who is staying at home, realizes that a software update is necessary and operates user terminal 3 to request a software update. If user B does not receive a notification about the software update and the software update begins, the software update process will begin without user B's knowledge. In the "shopping scenario," the software update begins while vehicle 1 is parked in a parking lot near the store, and user B will be unable to use vehicle 1 until the software update is complete.

[0038] To avoid such a situation, the software update system according to this embodiment notifies user A and user B about the software update, and executes the software update process when consent (consensus) to the software update is obtained from user A and user B. On the other hand, if either user A or user B rejects the software update, the software update process is not executed.

[0039] 2 and 3, the control flow will be described for the case where user A and user B are notified about a software update and consent (consensus) is obtained from users A and B to allow the software update, and for the case where user B rejects the software update. FIG. 2 shows the control flow when both users A and B consent, and FIG. 3 shows the control flow when user B rejects. Note that in the examples of FIGS. 2 and 3, there are two users, but there may be three or more users. There may also be multiple user terminals 3.

[0040] In this embodiment, the target terminal for obtaining permission to update software (hereinafter also referred to as the licensed terminal) is determined in advance. Information about the licensed terminal is managed by the server 2. When using the software update system, the user inputs the user's personal information, terminal information, etc., to register the licensed terminal in the system (pre-registration). The information about the licensed terminal is registered in association with the vehicle 1. The terminal information input by the user is stored in the database 22. Note that in this embodiment, the on-board terminal of the vehicle 1 is the licensed terminal, and the information about the on-board terminal of the vehicle 1 does not necessarily need to be input before using the system; the on-board terminal may be registered with default settings. In the example of FIGS. 2 and 3, user A uses the user terminal 3, and user B is in vehicle 1 and uses the on-board terminal. The on-board terminal corresponds to the on-board HMI 14.

[0041] As shown in FIG. 2, when new update data is provided, the update data management unit 231 stores the update data in a distribution package and updates the software update list. The determination unit 232 determines whether a software update is necessary for each vehicle including a target ECU, based on information such as the target ECU and software version included in the software update list. The determination unit 232 identifies the vehicle 1 for which it is determined that a software update is necessary as an update target vehicle. The update data management unit 231 notifies the authorized terminal associated with the update target vehicle that a software update of the ECU 13 is necessary. This notification does not need to be sent from the server 2 to the vehicle 1 and the user terminal 3 when it is determined that a software update is necessary; instead, the server 2 may notify the vehicle 1 and the user terminal 3 when the vehicle 1 and the user terminal 3 connect to the server 2.

[0042] In the example of Fig. 2, user A confirms from the notification screen on the display of terminal HMI 32 that a software update is required and operates user terminal 3 to update the software (software update operation). Terminal control device 33 controls terminal communication device 31 in response to the user's operation and transmits a request signal to server 2 requesting the system to update the software. Communication device 21 of server 2 receives the request signal, and control device 23 determines, based on the request signal, that a software update request has been made and identifies the target terminal for permission to update the software.

[0043] The control device 23 controls the communication device 21 to transmit a notification signal regarding the software update to the vehicle 1 and the user terminal 3. The notification signal is a signal for notifying the vehicle 1 of update information regarding the software update. The update information includes at least information for allowing the user to select whether to accept or reject the software update. Furthermore, in the example of FIG. 2, the update information includes information indicating a disclaimer and / or information regarding a warning regarding the software update. The disclaimer notification is, for example, a notification for allowing the user to acknowledge that data stored in the memory of the in-vehicle device may be lost due to the software update and that the system provider is not responsible for paying damages even if the data is lost. The warning is, for example, a notification that the vehicle 1 cannot be used during the software update. When the in-vehicle communication device 12 receives the notification signal including the update information, the in-vehicle HMI 14 displays a selection screen for allowing the user to select whether to accept or reject the software update and a notification screen regarding the disclaimer and / or warning.

[0044] When user B approves the software update, he / she confirms the notification screen regarding the disclaimer and / or warning on the display of the in-vehicle HMI 14, and then touches the button for approving the software update included in the selection screen (approval operation). Based on the approval operation on the in-vehicle HMI 14, the CGW 11 causes the in-vehicle communication device 12 to transmit an approval signal for approving the software update.

[0045] When the terminal communication device 31 of the user terminal 3 receives a notification signal including update information from the server 2, the terminal HMI 32 displays a selection screen that allows the user to select whether to accept or reject the software update, and a notification screen regarding a disclaimer and / or warning. If user A accepts the software update, he / she checks the notification screen regarding the disclaimer and / or warning on the display of the terminal HMI 32 and touches a button to accept the software update on the selection screen (approval operation). Based on the approval operation on the terminal HMI 32, the terminal control device 33 causes the terminal communication device 31 to transmit an approval signal that accepts the software update.

[0046] When the communication device 21 of the server 2 receives permission signals from the vehicle 1 and the user terminal 3, the determination unit 232 determines that the software update should be executed. When the determination unit 232 determines that the software update should be executed, the update data management unit 231 controls the communication device 21 to transmit data necessary for the software update, such as campaign information and a distribution package, to the vehicle 1. This causes the download of the update data to begin in the vehicle 1.

[0047] The CGW 11 determines whether the activation conditions are met. The activation conditions are conditions that indicate whether the vehicle state is suitable for a software update, and are determined by the vehicle speed, whether the main switch (ignition switch) of the vehicle 1 is on or off, etc. Software updates are suitable when the vehicle 1 is stopped or parked. For example, when the vehicle speed of the vehicle 1 is zero, the CGW 11 determines that the activation conditions are met and executes the software update process. Then, the software update is started in the ECU 13 to be updated.

[0048] Next, we will explain the case where user B rejects the software update. The operation of user A and the control flow between the user terminal 3 and the server 2 are the same as the control flow in Figure 2. In addition, the control flow from when a communication signal is sent from the server 2 to the vehicle 1 until the on-board HMI 14 displays a selection screen that allows the user to select whether to accept or reject the software update and a notification screen regarding the exemption from liability and / or warning is displayed is the same as the control flow in Figure 2.

[0049] User B touches a button included in the selection screen to reject the software update (rejection operation). Based on the rejection operation on the in-vehicle HMI 14, the CGW 11 controls the in-vehicle communication device 12 to transmit a rejection signal rejecting the software update. Based on the rejection signal, the determination unit 232 of the server 2 determines not to perform the software update. The control device 23 transmits a communication signal indicating that the software update will not be performed to the vehicle 1 and the user terminal 3. Based on the notification signal indicating that the software update will not be performed, the display of the in-vehicle HMI 14 displays a screen indicating that the software update will not be performed. The display of the terminal HMI 32 also displays a screen indicating that the software update will not be performed. User A can confirm that the software update has been rejected from the display screen of the display of the terminal HMI 32. At this time, the display of the terminal HMI 32 may display that User B has rejected the software update.

[0050] Next, the control flow of the control device 23 of the server 2 will be described with reference to Fig. 4. The control flow of Fig. 4 shows the control flow after the control of transmitting a notification signal to obtain permission for a software update from the user. Control processes before transmitting the notification signal for permission for an update include, for example, a control process of updating the distribution package and software update list based on new update data, a control process of determining whether a software update is necessary, and a process of receiving a request signal requesting a software update, and these controls are executed before the control flow of Fig. 4.

[0051] In step S1, the update data management unit 231 transmits a notification signal including software update information to the target terminal to allow the user to select whether to approve or reject the software update. In the examples of Figures 2 and 3, the target terminals are the in-vehicle terminal of the vehicle 1 and the user terminal 3.

[0052] In step S2, the update data management unit 231 starts a timer for the license acceptance period. The license acceptance period is the time during which permission to update the software is accepted after the notification signal is sent. The license signal received by the server 2 during the license acceptance period becomes valid. The timer for the license acceptance period starts from the time the notification signal is sent. The timer may count down, count up, or any other method.

[0053] In step S3, the determination unit 232 determines whether or not a rejection signal has been received by the communication device 21. If the communication device 21 has received a rejection signal, the control process of step S8 is executed. If the communication device 21 has not received a rejection signal, in step S4 the determination unit 232 determines whether or not an acceptance signal has been received from all of the licensed terminals. If an acceptance signal has been received from all of the licensed terminals, the control flow of step S6 is executed. If an acceptance signal has not been received from all of the licensed terminals, in step S5 the determination unit 232 determines whether or not the license acceptance period has elapsed. If the license acceptance period has not elapsed, the control process of step S3 is executed. If the license acceptance period has elapsed, that is, if an acceptance signal has not been received from all of the licensed terminals within the license acceptance period, the control process of step S8 is executed.

[0054] If approval signals have been received from all of the approval target terminals, in step S6, the determination unit 232 determines to "execute software update." In step S7, the determination unit 232 transmits a control command to the vehicle 1 to execute the software update. Thereafter, the control flow ends.

[0055] If a rejection signal has been received from at least one licensed terminal, or if permission signals have not been received from all licensed terminals and the license acceptance period has elapsed, the determination unit 232 determines in step S8 that "the software update will not be executed." In step S9, the determination unit 232 notifies the user of the rejection of the software update by controlling the communication device 21 to transmit a signal indicating that the software update has been rejected. Thereafter, the control flow ends.

[0056] As described above, the software update device and software update control method according to this embodiment transmit a notification signal notifying update information related to the software update to multiple terminals before updating the vehicle software, and if communication device 21 receives an approval signal permitting the software update from one of the multiple terminals but does not receive a refusal signal refusing the software update from any other of the multiple terminals, it determines to execute the software update. This makes it possible to avoid a situation where the software is updated without notifying users who wish to use the vehicle of the software update.

[0057] Furthermore, in the software update device and software update control method according to the present embodiment, if the communication device 21 does not receive a rejection signal from the user terminal or the in-vehicle terminal within the permission acceptance period, it determines to execute the software update. This makes it possible to avoid a situation where the software is updated without notifying the user who wants to use the vehicle of the software update.

[0058] Furthermore, the software update device and software update control method according to this embodiment determine to execute a software update when the communication device 21 receives an approval signal from all terminals (corresponding to "licensed terminals") to which the notification signal is to be sent. This allows the software to be updated on the condition that consent (consensus) has been obtained from all licensed terminals, thereby avoiding a situation in which the software is updated without the knowledge of the user operating the licensed terminal.

[0059] Furthermore, the software update device and software update control method according to this embodiment determine not to execute a software update when communication device 21 receives a rejection signal from at least one of the multiple licensed terminals. This prevents the software update from being executed if there is even one user who wants to use the vehicle, thereby improving user convenience.

[0060] Furthermore, the software update device and software update control method according to this embodiment determine not to execute a software update if the communication device 21 does not receive a license signal from all licensed terminals within the license acceptance period. This prevents the software update from being executed if consent (consensus) is not obtained from all licensed terminals, thereby avoiding a situation in which the software is updated without the knowledge of the user operating the licensed terminal.

[0061] Furthermore, the software update device and software update control method according to the present embodiment transmit a signal indicating that the software update will not be performed to one of the multiple terminals when a rejection signal is received from another terminal, thereby notifying a user who has permitted the software update that the other user has rejected the software update.

[0062] In this embodiment, the distribution package is a plurality of packages, including a common package and a unique package, but it may be a single package.

[0063] As a modified example of this embodiment, the software update device and software update control method may determine to execute a software update when the communication device 21 does not receive a rejection signal from a user terminal or an in-vehicle terminal within the license acceptance period and receives an acceptance signal from at least one licensed terminal. In this modified example, the control device 23 adds the following control process to the control flow shown in FIG. 4. If it is determined in step S5 that the license acceptance period has elapsed (if the determination result in step S5 is "Yes"), the determination unit 232 determines whether or not an acceptance signal has been received from at least one licensed terminal. If an acceptance signal has been received from at least one licensed terminal, the control process of step S6 is executed. If it is determined that an acceptance signal has not been received from at least one licensed terminal, that is, if acceptance signals have not been received from all licensed terminals and the license acceptance period has elapsed, the control flow ends.

[0064] The communication device 21 in this embodiment corresponds to the "communication unit" of the present invention, and the database 22 corresponds to the "storage unit" of the present invention.

[0065] Second Embodiment Next, a software update system according to the second embodiment will be described. The software update system according to the second embodiment has the same configuration as the first embodiment except that the function of the determination unit 232 is partially different from that of the software update system according to the first embodiment. Therefore, the above-mentioned description will be used for the same configuration as the first embodiment.

[0066] In this embodiment, a target terminal for approval is selected from among the terminals registered in the system according to the status of the vehicle 1 and / or the user terminal. For example, if the in-vehicle terminal of the vehicle 1 is registered as a target terminal for obtaining approval for a system update, and the main switch of the vehicle 1 is turned off, the in-vehicle HMI 14 cannot display a notification regarding the software update, and the server 2 cannot receive a signal from the vehicle 1 approving / rejecting the software update. In such a case, if an in-vehicle terminal with the main switch turned off is included in the target terminal for approval, it is not possible to obtain consent (consensus) regarding the software update from all target terminals for approval. Therefore, in this embodiment, terminals in a state in which they cannot notify the user of update information from the server 2 are excluded from the target terminals for approval. The state in which they cannot notify the user of update information includes a state in which they cannot communicate with the server 2, a state in which they cannot display the information on the screen on the display included in the HMI, etc.

[0067] 5 is a diagram for explaining the control flow when the user terminal of user A is selected as the licensed terminal and the in-vehicle terminal of vehicle 1 being used by user B is not selected as the licensed terminal. In the example of FIG. 5, the main switch (ignition switch) of vehicle 1 is turned off, and the screen display of the in-vehicle HMI 14 cannot be displayed.

[0068] In the example of FIG. 5, user A confirms from the notification screen on the display of the terminal HMI 32 that a software update is required and operates the user terminal 3 to update the software (software update operation). The terminal control device 33 controls the terminal communication device 31 in response to the user's operation and transmits a request signal to the server 2 requesting a software update from the system. The communication device 21 of the server 2 receives the request signal, and the control device 23 determines, based on the request signal, that a software update request has been made. The determination unit 232 selects an authorized terminal from among terminals associated with a target vehicle requiring a software update. Specifically, the communication device 21 receives a status signal of the main switch of the vehicle 1, and the determination unit 232 determines, from the received status signal, whether the main switch of the vehicle 1 is on or off. The communication device 21 also receives a status signal of the main switch of the user terminal 3, and the determination unit 232 determines, from the received status signal, whether the main switch of the user terminal 3 is on or off. The main switch status signal may be transmitted from the vehicle 1 and the user terminal 3 to the server 2, for example, when the main switches of the vehicle 1 and the user terminal 3 are switched on and off.

[0069] The determination unit 232 selects a terminal whose main switch is on as a licensed terminal and does not select a terminal whose main switch is off as a licensed terminal. That is, when the main switch is off, the terminal may not be able to receive a notification signal related to the software update, and the terminal display may not be able to display a notification screen related to the software update. Therefore, such a terminal is not selected as a licensed terminal. In the example of FIG. 5, the user terminal 3 of user A is selected as a licensed terminal, and the in-vehicle terminal of vehicle 1 is not selected as a licensed terminal. The control device 23 controls the communication device 21 to transmit a notification signal related to the software update to the licensed terminal. In the example of FIG. 5, the user terminal 3 is the only licensed terminal, but if there are multiple licensed terminals, the control device 23 controls the communication device 21 to transmit a communication signal to the multiple licensed terminals.

[0070] The control flow after the server 2 transmits a notification signal to the user terminal 3 is the same as that in the first embodiment. No notification signal is transmitted to the in-vehicle terminal of the vehicle 1, and the display of the in-vehicle HMI 14 does not display a selection screen for selecting whether to accept or reject the software update, nor a notification screen regarding the exemption and / or warning. When the communication device 21 of the server 2 receives an acceptance signal from the user terminal 3, the determination unit 232 determines to execute the software update. That is, when the communication device 21 receives an acceptance signal from a terminal eligible for approval, the determination unit 232 determines to execute the software update. The control flow after the determination unit 232 determines to execute the software update is the same as that in the first embodiment. In this way, in this embodiment, terminals that cannot display a notification screen regarding the software update or terminals from which an answer regarding whether to accept the software update cannot be obtained are excluded from the terminals eligible for approval, and approval is obtained from valid terminals.

[0071] As described above, the software update device and software update control method according to this embodiment selects a license target terminal from among a plurality of terminals to obtain permission for a software update, and determines to execute a software update when the communication device 21 receives an permission signal from the license target terminal. This allows software to be updated on the condition that consent (consensus) is obtained from terminals that can respond as to whether or not to permit the software update, thereby avoiding a situation in which software is updated without the knowledge of the user operating the license target terminal.

[0072] Furthermore, the software update device and software update control method according to this embodiment select, from among multiple terminals, terminals that are in a state where they can notify the user of update information as terminals to be authorized, and do not select terminals that are in a state where they cannot notify the user of the update information as terminals to be authorized. This makes it possible to exclude terminals that cannot answer whether or not to authorize a software update from terminals to be authorized.

[0073] In this embodiment, whether or not the vehicle 1 and the user terminal 3 are connected in a state where they can communicate with the server 2 is determined from the state of the main switch of the vehicle 1 and the user terminal 3. However, instead of the state signal of the main switch, for example, a confirmation signal may be sent from the server 2 to the vehicle 1 and the user terminal 3, and whether or not a response signal is received from the vehicle 1 and the user terminal 3 may be determined to determine whether or not the vehicle 1 and the user terminal 3 are connected in a state where they can communicate with the server 2.

[0074] As a modified example of this embodiment, the software update device and software update control method select the in-vehicle terminal 1 as the licensed terminal when the in-vehicle terminal 1 and the user terminal 3 are connected to each other in a communicable state, and do not select the user terminal 3 connected to the in-vehicle terminal 1 in a communicable state as the licensed terminal. For example, when the user terminal 3 is connected to a hotspot in a vehicle with the main switch turned on, the user can check a notification screen regarding the software update on the display of the in-vehicle HMI 14, so there is no need to display the notification screen on the display of the user terminal 3. Furthermore, there is no need to have the user in the vehicle transmit an acceptance / rejection signal by operating the user terminal 3. The control device 23 of the server 2 may determine whether the in-vehicle terminal 1 and the user terminal 3 are connected to each other in a communicable state by receiving a signal indicating that the user terminal is connected to the vehicle 1 and the in-vehicle terminal from the vehicle 1 or a terminal connected to the in-vehicle terminal 1. The control device 23 of the server 2 may determine whether the in-vehicle terminal 1 and the user terminal 3 are connected to each other in a communicable state based on the location information of the vehicle 1 and the location information of the user terminal 3. As a result, for example, if the user terminal 3 is inside a vehicle and there is no need to obtain consent for software updates from both the user terminal 3 inside the vehicle and the in-vehicle terminal, the user terminal 3 inside the vehicle can be excluded from the terminals subject to permission. Note that the in-vehicle terminal of the vehicle 1 and the user terminal 3 may be connected by wire or by short-range wireless means such as Bluetooth (registered trademark) or Wi-Fi.

[0075] Third Embodiment Next, a software update system according to the third embodiment will be described. The software update system according to the third embodiment has the same configuration as the software update system according to the first embodiment, except for some differences in the functions of the determination unit 232. Therefore, the descriptions of the first and second embodiments are cited for the same configuration as the first embodiment.

[0076] In this embodiment, a terminal that requires permission to update software is registered in the system as a license-requiring terminal. Obtaining permission for the software update from a terminal that is registered as requiring permission is a prerequisite for starting the software update.

[0077] The software update system allows device information to be registered according to permission levels for software updates. Figure 6 is a table showing the permission levels. As shown in Figure 6, there are three permission levels. At the highest permission level, "Level 3," a device can receive notifications about software updates, has the right to reject software updates, and is registered as a device that requires consent for software updates. A device with permission level "Level 3" corresponds to a device that requires permission. At permission level "Level 2," a device can receive notifications about software updates, has the right to reject software updates, but is registered as a device that does not require consent for software updates. At the lowest permission level, "Level 1," a device can receive notifications about software updates, does not have the right to reject software updates, and is registered as a device that does not require consent for software updates. Users can select the permission level when registering their device information in the system.

[0078] If communication device 21 receives permission signals from all terminals with permission level 3, it determines that "software update will be performed." On the other hand, if communication device 21 receives a rejection signal from at least one terminal with permission level 2 or higher, or if communication device 21 does not receive a permission signal from at least one terminal with permission level 3, determination unit 232 determines that "software update will not be performed." As a result, the software is updated on the condition that consent (consensus) has been obtained from all terminals that require permission for the software update.

[0079] As described above, the software update device and software update control method according to this embodiment stores information about license-required terminals (corresponding to "level 3" terminals) that require permission to update software in database 22, and determines to execute a software update when communication device 21 receives permission signals from all license-required terminals. This allows software to be updated on the condition that consent (consensus) has been obtained from all license-required terminals, thereby avoiding a situation in which software is updated without the knowledge of the user operating the license-required terminal.

[0080] Furthermore, the software update device and software update control method according to this embodiment determine not to execute the software update when the communication device 21 receives a rejection signal from a terminal (corresponding to a "Level 2" terminal) other than the license-requiring terminal among the multiple terminals. This allows for the user's intention to be reflected if the user has the right to reject the software and does not want to update the software, thereby improving user convenience.

[0081] In this embodiment, the permission levels are three levels, but they may be two levels, for example, "Level 2" and "Level 3," or four or more levels.

[0082] It should be noted that the above-described embodiments have been described to facilitate understanding of the present invention, and are not intended to limit the present invention. Therefore, each element disclosed in the above-described embodiments is intended to include all design modifications and equivalents that fall within the technical scope of the present invention. [Explanation of symbols]

[0083] 1...Vehicle 2. Server 3...User terminal 4. Wireless communication network 11...CGW 12...In-vehicle communication device 13...ECU 14…In-vehicle HMI 21...Communication equipment 22...Database 23...Control device 31...Terminal communication device 32...Terminal HMI 33...Terminal control device 100...Software update system 231...Update Data Management Unit 232...Judgment section

Claims

1. a communication unit that transmits, before updating software for a vehicle, a notification signal that notifies a plurality of terminals of update information regarding the software update; a determination unit that determines whether to execute the software update; The determination unit Selecting, from among the plurality of terminals, a terminal that is in a state where it is possible to notify the user of the update information as a licensed terminal that is to obtain permission to update the software, and not selecting, as the licensed terminal, a terminal that is in a state where it is not possible to notify the user of the update information; If the communication unit receives permission signals permitting the software update from all of the license target terminals within a permission acceptance period for accepting permission for the software update, it determines that the software update for the plurality of vehicles will be executed; A software update device that, if it receives a rejection signal rejecting the software update from at least one of the plurality of licensed terminals within the license acceptance period, determines not to perform the software update for the plurality of vehicles.

2. 2. The software update device according to claim 1, The determination unit determines to perform the software update for the plurality of vehicles when the communication unit has not received the rejection signal from at least one of the plurality of terminals and has received the acceptance signal from at least one of the plurality of terminals.

3. 2. The software update device according to claim 1, the plurality of terminals include an in-vehicle terminal mounted in the vehicle and a user terminal different from the in-vehicle terminal, A software update device in which the determination unit selects the in-vehicle terminal as the licensed terminal when the in-vehicle terminal and the user terminal are connected in a state where they can communicate with each other, and does not select the user terminal that is connected in a state where it can communicate with the in-vehicle terminal as the licensed terminal.

4. The software update device according to any one of claims 1 to 3, A software update device in which, when the communication unit receives the rejection signal from one of the plurality of licensed terminals, it transmits a signal indicating that the software update will not be performed to the other terminals of the plurality of licensed terminals.

5. The software update device according to any one of claims 1 to 4, a storage unit for storing information on a license-required terminal for which a license must be obtained in order to update the software; The software update device, wherein the determination unit determines to execute the software update when the communication unit receives the permission signals from all of the permission-requiring terminals.

6. 6. The software update device according to claim 5, The software update device, wherein the determination unit determines not to execute the software update when the communication unit receives the rejection signal from a terminal other than the license-requiring terminal among the plurality of terminals.

7. 1. A software update control method executed by a processor that controls updates of software included in a vehicle, comprising: The processor: Selecting, from among a plurality of terminals, a terminal that is in a state where it is possible to notify the user of update information relating to the interest of the software as a licensed terminal that is a target for obtaining permission to update the software, and not selecting, as the licensed terminal, a terminal that is in a state where it is not possible to notify the user of the update information; Before updating software for a vehicle, a notification signal is transmitted to the plurality of licensed terminals to notify update information regarding the software update; If the communication unit receives permission signals from all of the license target terminals during a permission acceptance period for accepting permission for the software update, it determines that the software update for the plurality of vehicles will be executed; A software update control method that determines not to perform the software update for the multiple vehicles if a rejection signal rejecting the software update is received from at least one of the multiple licensed terminals within the license acceptance period.

Images