Software update device, software update program, software update method, and software update system

Abstract

To suppress increased processing load of an updating apparatus which results from excessively longer waiting of reception of an article number signal and an excessively increased number of times of execution of consistency check.SOLUTION: A software updating apparatus according to the present invention executes the steps of: transmitting an activation signal to an information processing apparatus (S11); in response to transmission of the activation signal, entering into a stand-by state for reception of a model number signal transmitted from the information processing apparatus (S12); and after reception of the model number signal, performing consistency check on the software based on the received model number signal (S23, S28).SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a software update device, a software update program, a software update method, and a software update system. [Background technology]

[0002] The software update system for a vehicle disclosed in Patent Document 1 includes an update device and multiple information processing devices. The update device updates the software of the multiple information processing devices. Specifically, the update device downloads new software. The update device also installs the new software into the information processing devices. The update device also transmits an activation signal to the information processing devices to instruct them to activate the new software. Thereafter, for example, when the vehicle's system is switched from an off state to an on state, the software installed in the information processing devices is activated.

[0003] The update device also performs a consistency check when updating software in the information processing devices. To perform the consistency check, the update device receives product number signals indicating the software product numbers from all of the information processing devices. The update device then performs a consistency check to determine whether the product numbers of the software in each of the information processing devices are consistent based on the product numbers indicated by the product number signals. In this consistency check, the update device determines whether the latest software product numbers of each of the information processing devices satisfy a correspondence relationship determined by design. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2019-159399 Summary of the Invention [Problem to be solved by the invention]

[0005] In an update system such as that described in Patent Document 1, for example, the power supply to some of the information processing devices among multiple information processing devices may be momentarily interrupted. When this momentary power interruption occurs to some of the information processing devices, the information processing devices may switch from an on state to an off state and then switch back on. This may result in the software of the information processing devices being activated. Therefore, in an update system such as that described in Patent Document 1, for example, the update device may constantly wait to receive a product number signal and perform a consistency check at a predetermined interval. However, such an update system is undesirable in that it places a heavy processing load on the update device due to excessively long wait times for receiving a product number signal or excessively frequent execution of consistency checks. [Means for solving the problem]

[0006] A software update device for solving the above problem performs the following steps: sending an activation signal to an information processing device installed in a vehicle to instruct the device to activate the software; upon the condition that the activation signal has been sent, waiting to receive a product number signal indicating the product number of the software sent from the information processing device; and upon the condition that the product number signal has been received, performing a consistency check on the software based on the received product number signal.

[0007] A software update program for solving the above problem causes an update device to send an activation signal to an information processing device installed in a vehicle to instruct the device to activate the software, wait for reception of a product number signal indicating the product number of the software sent from the information processing device on the condition that the activation signal has been sent, and perform a consistency check of the software based on the received product number signal on the condition that the product number signal has been received.

[0008] A software update method for solving the above problem involves an update device sending an activation signal to an information processing device installed in a vehicle to instruct the device to activate the software, waiting to receive a product number signal indicating the product number of the software sent from the information processing device on the condition that the activation signal has been sent, and performing a consistency check on the software based on the received product number signal on the condition that the product number signal has been received.

[0009] A software update system for solving the above problem includes an update device mounted on a vehicle and an information processing device mounted on the vehicle, wherein the update device transmits an activation signal to the information processing device to instruct the information processing device to activate the software, and, on condition that the activation signal has been transmitted, waits to receive a product number signal indicating the product number of the software transmitted from the information processing device, and, on condition that the activation signal has been transmitted, the information processing device activates the software when the information processing device changes from an off state to an on state, on condition that the activation signal has been received, and, on condition that the activation has been performed, transmits the product number signal to the update device, and, on condition that the update device has received the product number signal, performs a consistency check on the software based on the received product number signal. [Effects of the Invention]

[0010] According to the above configuration, the processing load on the updating device can be reduced compared to when the updating device always waits to receive a product number signal and executes a consistency check at a predetermined interval, for example. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a schematic configuration diagram of an update system according to the first embodiment. [Figure 2] FIG. 2 is a flowchart showing consistency check control according to the first embodiment. [Figure 3] FIG. 3 is a flowchart showing the first control according to the first embodiment. [Figure 4] FIG. 4 is a flowchart showing the second control according to the first embodiment. [Figure 5] FIG. 5 is a flowchart showing consistency check control according to the second embodiment. [Figure 6] FIG. 6 is a flowchart showing the third control according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] First Embodiment <Outline of update system configuration> A first embodiment of the present invention will be described below with reference to Figures 1 to 4. First, the schematic configuration of the update system US will be described.

[0013] As shown in Fig. 1, the update system US includes a plurality of vehicles 100. The vehicles 100 are, for example, automobiles owned by users. Note that Fig. 1 illustrates only one representative vehicle 100.

[0014] The vehicle 100 includes a central ECU 10, a powertrain ECU 20, a brake ECU 30, an advanced driving assistance ECU 40, and a DCM 50. The vehicle 100 also includes a first external bus 61, a second external bus 62, a third external bus 63, and a fourth external bus 64. "ECU" is an abbreviation for Electronic Control Unit. "DCM" is an abbreviation for Data Communication Module. In this embodiment, the central ECU 10 is an example of a software update device. The powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 are each an example of an information processing device in which software is updated.

[0015] The central ECU 10 controls the entire vehicle 100. The central ECU 10 includes a CPU 11, a ROM 12, a RAM 13, a storage 14, and an internal bus 15. The internal bus 15 connects the CPU 11, the ROM 12, the RAM 13, and the storage 14 so that they can communicate with one another. The ROM 12 stores various programs and various data in advance. The ROM 12 also stores an update program 12A, which is executed when updating software, as one of the various programs. The RAM 13 is a volatile memory. The RAM 13 temporarily stores various programs and various data. The CPU 11 uses the RAM 13 as a work area and executes various processes by reading out the programs in the ROM 12. The CPU 11 also executes various processes in the software update method by reading out the update program 12A.

[0016] The storage 14 can store various programs and various data. The storage 14 is an electrically rewritable nonvolatile memory. For example, the storage 14 is a NAND flash memory.

[0017] The DCM 50 is connected to the central ECU 10 via a first external bus 61. The DCM 50 is capable of wireless communication with devices external to the vehicle 100 via a communication network NW. Therefore, the central ECU 10 is capable of wireless communication with devices external to the vehicle 100 via the first external bus 61 and the DCM 50.

[0018] The powertrain ECU 20 can communicate with the central ECU 10 via a second external bus 62. The powertrain ECU 20 executes various processes for controlling an engine, a transmission, and the like (not shown). The powertrain ECU 20 includes a CPU 21, a ROM 22, a RAM 23, a storage 24, and an internal bus 25. The internal bus 25 connects the CPU 21, the ROM 22, the RAM 23, and the storage 24 so that they can communicate with each other. The ROM 22 stores various programs and various data in advance. The ROM 22 also stores a control program 22A as one of the various programs in advance. The ROM 22 is a so-called erasable programmable read-only memory (EPROM). That is, the control program 22A stored in the ROM 22 is updatable. The ROM 22 is a so-called dual-sided ROM having two data storage areas. In other words, even if ROM 22 is in an on state, software can be installed in a storage area separate from the storage area for data used in that on state. RAM 23 is a volatile memory. RAM 23 temporarily stores various programs and various data. CPU 21 uses RAM 23 as a work area and executes various processes by reading out programs from ROM 22. CPU 21 also executes various processes for controlling the engine, transmission, etc. by reading out control program 22A.

[0019] The storage 24 can store various programs and various data. The storage 24 is an electrically rewritable nonvolatile memory. For example, the storage 24 is a NOR flash memory.

[0020] The brake ECU 30 can communicate with the central ECU 10 via a third external bus 63. The brake ECU 30 controls a brake device (not shown). The internal configuration of the brake ECU 30 is similar to the internal configuration of the powertrain ECU 20. That is, the brake ECU 30 includes a CPU 31, a ROM 32, a RAM 33, a storage 34, and an internal bus 35. The ROM 32 stores a control program 32A in advance as one of various programs. The CPU 31 reads the control program 32A to execute various processes for controlling the brake device.

[0021] The advanced driving assistance ECU 40 can communicate with the central ECU 10 via a fourth external bus 64. The advanced driving assistance ECU 40 executes various application software programs to realize various driving assistance functions. The various application software programs include software for following a preceding vehicle while maintaining a constant distance from the preceding vehicle, and software for automatically applying the brakes to reduce damage to the vehicle 100 in the event of a collision. The internal configuration of the advanced driving assistance ECU 40 is similar to that of the powertrain ECU 20. Specifically, the advanced driving assistance ECU 40 includes a CPU 41, a ROM 42, a RAM 43, a storage 44, and an internal bus 45. The ROM 42 stores a control program 42A in advance as one of the various programs. The CPU 41 reads the control program 42A to execute various processes for realizing the various driving assistance functions described above.

[0022] As shown in Fig. 1, the vehicle 100 includes a device group made up of multiple devices. Examples of these devices are a secondary battery 71 and a display 76. The secondary battery 71 supplies power to the central ECU 10, the powertrain ECU 20, the brake ECU 30, the advanced driving assistance ECU 40, the DCM 50, and the like. Note that Fig. 1 only shows the power path connecting the secondary battery 71 and the central ECU 10 and the power path connecting the secondary battery 71 and the powertrain ECU 20 as representative examples.

[0023] The display 76 can display various types of information. The display 76 is a so-called touch panel display. Therefore, the user of the vehicle 100 can input various types of information via the display 76. In other words, the display 76 functions as both an output device that outputs information to the user and an input device that receives information from the user.

[0024] The central ECU 10 outputs a control signal to the display 76 to display various information on the display 76. The central ECU 10 also acquires information input by the user of the vehicle 100 from the display 76.

[0025] As shown in FIG. 1, the update system US includes a data center 200. An example of the data center 200 is a so-called server. The data center 200 includes an execution unit 210, a memory unit 220, and a communication unit 230. The communication unit 230 is capable of communicating with devices external to the data center 200 via a communication network NW. The memory unit 220 includes a ROM, a RAM, and storage. The memory unit 220 stores various types of data. The memory unit 220 also stores various programs in advance. The execution unit 210 executes various processes by reading the programs from the memory unit 220. An example of the execution unit 210 is a CPU.

[0026] <Validation control> Next, the consistency check control executed by the central ECU 10 will be described with reference to Fig. 2. In this embodiment, the CPU 11 of the central ECU 10 executes the consistency check control when, for example, all of the following requirements (1) to (3) are satisfied.

[0027] Requirement (1): The central ECU 10 receives a campaign notification from the data center 200 indicating that new software is available. Requirement (2): After receiving the campaign notification, new software to be updated is downloaded from the data center 200 and stored in the storage 14 of the central ECU 10.

[0028] Requirement (3): After the new software is downloaded, the new software is installed on the information processing device to be updated. In the following, as an example of software update, a process for updating the control program 22A, the control program 32A, and the control program 42A will be described. Therefore, in the example described here, requirement (3) is satisfied when the control program 22A is installed in the ROM 22, the control program 32A is installed in the ROM 32, and the control program 42A is installed in the ROM 42. In this embodiment, when downloading new software, the CPU 11 of the central ECU 10 acquires a consistency table TM along with the new software. The consistency table TM includes information indicating the version of the new software. The consistency table TM will be described in detail later.

[0029] 2, when the CPU 11 of the central ECU 10 starts the consistency check control, it executes the process of step S11. In step S11, the CPU 11 of the central ECU 10 transmits an activation signal SA to each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 to instruct them to activate new software. After step S11, the CPU 11 of the central ECU 10 proceeds to the process of step S12. In other words, the CPU 11 of the central ECU 10 proceeds to the process of step S12 on the condition that the activation signal SA has been transmitted.

[0030] In step S12, the CPU 11 of the central ECU 10 starts waiting to receive a part number signal SN transmitted from each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40. In this embodiment, the part number signal SN indicates the software version of the information processing device. The software version of the information processing device is an example of the software part number of the information processing device. In this first embodiment, the part number signal SN is transmitted from each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 by executing a second control described later. After step S12, the CPU 11 of the central ECU 10 advances the process to step S13.

[0031] In step S13, the CPU 11 of the central ECU 10 confirms with the user of the vehicle 100 whether or not to consent to the software update. Specifically, the CPU 11 of the central ECU 10 outputs a control signal to the display 76, thereby causing the display 76 to display an option for whether or not to consent to the software update. The CPU 11 of the central ECU 10 also causes the display 76 to display warning information that the system of the vehicle 100 will be restarted due to the software update. After step S13, the CPU 11 of the central ECU 10 proceeds to step S20.

[0032] In step S20, the CPU 11 of the central ECU 10 determines whether consent to perform the software update has been confirmed. For example, when the user of the vehicle 100 consents to perform the software update by operating the display 76, the CPU 11 of the central ECU 10 determines that consent to perform the software update has been confirmed. In step S20, when the CPU 11 of the central ECU 10 determines that consent to perform the software update has been confirmed (S20: YES), the CPU 11 of the central ECU 10 proceeds to step S21.

[0033] In step S21, the CPU 11 of the central ECU 10 restarts the system of the vehicle 100. Specifically, the CPU 11 of the central ECU 10 turns the system of the vehicle 100 off. Thereafter, the CPU 11 of the central ECU 10 turns the system of the vehicle 100 on. Here, the off state of the system of the vehicle 100 refers to a state in which power is not supplied to each ECU except for the central ECU 10, and therefore the vehicle 100 cannot run. Furthermore, the on state of the system of the vehicle 100 refers to a state in which power is supplied to all ECUs including the central ECU 10. Therefore, the on state of the system of the vehicle 100 includes a so-called accessory on state. After step S21, the CPU 11 of the central ECU 10 proceeds to step S22. In other words, the CPU 11 of the central ECU 10 proceeds to step S22 when the system of the vehicle 100 changes from the off state to the on state while waiting to receive the product number signal SN.

[0034] In step S22, the CPU 11 of the central ECU 10 determines whether or not it has received part number signals SN from all of the information processing devices. Specifically, when the CPU 11 of the central ECU 10 has received a total of three part number signals SN from each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40, it determines that it has received part number signals SN from all of the information processing devices. When the CPU 11 of the central ECU 10 receives a part number signal SN, it associates the part number signal SN with the information processing device that transmitted the part number signal SN and stores the part number signal SN in the storage 14. In step S22, when the CPU 11 of the central ECU 10 determines that it has not received part number signals SN from all of the information processing devices (S22: NO), the CPU 11 of the central ECU 10 proceeds to step S22 again. On the other hand, if the CPU 11 of the central ECU 10 determines in step S22 that the part number signals SN have been received from all the information processing devices (S22: YES), the CPU 11 of the central ECU 10 advances the process to step S23.

[0035] In step S23, the CPU 11 of the central ECU 10 determines whether the software of the information processing devices is consistent. Specifically, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices based on the consistency table TM and the received part number signal SN. Here, the received part number signal SN is the part number signal SN received in the immediately preceding step S22. The consistency table TM predefines allowable combinations of software versions for each information processing device. The CPU 11 of the central ECU 10 performs the consistency check by comparing the combination of software versions indicated by the received three part number signals SN with the consistency table TM. Then, if the combination of software versions indicated by the three part number signals SN matches the combination of software versions specified in the consistency table TM, the CPU 11 determines that the software of each information processing device is consistent. On the other hand, if the combination of software versions indicated by the three part number signals SN does not match the combination of software versions specified in the consistency table TM, the CPU 11 determines that the software of each information processing device is inconsistent.

[0036] In step S23, when the CPU 11 of the central ECU 10 determines that the software of the information processing device is consistent (S23: YES), the CPU 11 of the central ECU 10 proceeds to step S31. In other words, when the CPU 11 of the central ECU 10 determines that the software of the information processing device is consistent by the consistency check in step S23, the CPU 11 proceeds to step S31.

[0037] In step S31, the CPU 11 of the central ECU 10 ends the wait for receipt of the part number signal SN transmitted from each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40. After step S31, the CPU 11 of the central ECU 10 proceeds to step S32.

[0038] In step S32, the CPU 11 of the central ECU 10 permits execution of the software to be updated. Specifically, the CPU 11 of the central ECU 10 permits execution of the control program 22A of the powertrain ECU 20, the control program 32A of the brake ECU 30, and the control program 42A of the advanced driving assistance ECU 40. As a result, various controls that can be realized by executing the control programs 22A, 32A, and 42A, such as control of autonomous driving of the vehicle 100, are permitted. After step S32, the CPU 11 of the central ECU 10 ends the current consistency check control.

[0039] On the other hand, if the CPU 11 of the central ECU 10 determines in step S23 that the software of the information processing device is not consistent (S23: NO), the CPU 11 of the central ECU 10 advances the process to step S36.

[0040] In step S36, the CPU 11 of the central ECU 10 prohibits the execution of the software to be updated. Specifically, the CPU 11 of the central ECU 10 prohibits the execution of the control program 22A of the powertrain ECU 20, the control program 32A of the brake ECU 30, and the control program 42A of the advanced driving assistance ECU 40. As a result, various controls that can be realized by executing the control programs 22A, 32A, and 42A, such as controls for autonomous driving of the vehicle 100, are prohibited. After step S36, the CPU 11 of the central ECU 10 again proceeds to step S11.

[0041] If the CPU 11 of the central ECU 10 determines in step S20 that consent to the software update cannot be confirmed (S20: NO), the CPU 11 of the central ECU 10 proceeds to step S27. In other words, the CPU 11 of the central ECU 10 proceeds to step S27 while waiting to receive the product number signal SN and before the system of the vehicle 100 changes from the off state to the on state.

[0042] In step S27, the CPU 11 of the central ECU 10 determines whether or not a part number signal SN has been received from the information processing device. Specifically, when the CPU 11 of the central ECU 10 receives one or more part number signals SN from the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40, the CPU 11 determines that a part number signal SN has been received from the information processing device. When the CPU 11 of the central ECU 10 receives a part number signal SN, the CPU 11 associates the part number signal SN with the information processing device that transmitted the part number signal SN and stores the part number signal SN in the storage 14. In step S27, when the CPU 11 of the central ECU 10 determines that a part number signal SN has not been received from the information processing device (S27: NO), the CPU 11 of the central ECU 10 proceeds to step S20 again. On the other hand, if the CPU 11 of the central ECU 10 determines in step S27 that the part number signal SN has been received from the information processing device (S27: YES), the CPU 11 of the central ECU 10 advances the process to step S28.

[0043] In step S28, the CPU 11 of the central ECU 10 determines whether the software of the information processing device is consistent. Specifically, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing device based on the consistency table TM, the received part number signal SN, and the part number signal SN stored in the storage 14. Here, the received part number signal SN is the part number signal SN received in the immediately preceding step S27. Furthermore, the part number signal SN stored in the storage 14 is the part number signal SN received in the previous step S22 or step S27. For example, assume that the CPU 11 of the central ECU 10 receives part number signals SN only from the powertrain ECU 20 in step S27. In this case, the CPU 11 uses the part number signal SN from the brake ECU 30 that was received most recently prior to the processing of step S28, among the part number signals SN from the brake ECU 30 stored in the storage 14, as the part number signal SN from the brake ECU 30 to be used in step S28. Similarly, the CPU 11 determines the part number signal SN from the advanced driving assistance ECU 40 that was received most recently prior to the processing of step S28, among the part number signals SN from the advanced driving assistance ECU 40 stored in the storage 14, as the part number signal SN from the advanced driving assistance ECU 40 to be used in step S28. The CPU 11 of the central ECU 10 then performs a consistency check by comparing the combination of software versions indicated by the received part number signal SN and the part number signal SN stored in the storage 14 with the consistency table TM. Specifically, as in the processing of step S23 described above, the CPU 11 determines that the software in each information processing device is consistent when the combination of software versions indicated by the three part number signals SN matches the combination of software versions specified in the consistency table TM. On the other hand, the CPU 11 determines that the software in each information processing device is inconsistent when the combination of software versions indicated by the three part number signals SN does not match the combination of software versions specified in the consistency table TM.

[0044] In step S28, when the CPU 11 of the central ECU 10 determines that the software of the information processing device is consistent (S28: YES), the CPU 11 of the central ECU 10 proceeds to step S31. In other words, when the CPU 11 of the central ECU 10 determines that the software of the information processing device is consistent by the consistency check in step S28, the CPU 11 proceeds to step S31 and the subsequent step S32. The processes of step S31 and step S32 are as described above.

[0045] On the other hand, if the CPU 11 of the central ECU 10 determines in step S28 that the software of the information processing device is not consistent (S28: NO), the CPU 11 of the central ECU 10 proceeds to step S36. The process of step S36 is as described above.

[0046] <First control> Next, the first control executed by each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 will be described with reference to Fig. 3. This first control is a control related to permission to activate software based on the activation signal SA. Note that the following describes the first control executed by the powertrain ECU 20. The CPU 21 of the powertrain ECU 20 executes the first control when, for example, all of the above requirements (1) to (3) are satisfied.

[0047] 3, when the CPU 21 of the powertrain ECU 20 starts the first control, it executes the process of step S41. In step S41, the CPU 21 of the powertrain ECU 20 starts waiting for reception of an activate signal SA transmitted from the central ECU 10. After step S41, the CPU 21 of the powertrain ECU 20 advances the process to step S42.

[0048] In step S42, the CPU 21 of the powertrain ECU 20 determines whether or not the activate signal SA has been received. If the CPU 21 of the powertrain ECU 20 determines in step S42 that the activate signal SA has not been received (S42: NO), the CPU 21 of the powertrain ECU 20 proceeds to step S42 again. On the other hand, if the CPU 21 of the powertrain ECU 20 determines in step S42 that the activate signal SA has been received (S42: YES), the CPU 21 of the powertrain ECU 20 proceeds to step S43.

[0049] In step S43, the CPU 21 of the powertrain ECU 20 permits activation of the new software. As a result, the software can be activated in the second control described later. In other words, at the time of processing in step S43, the software activation is only permitted, but the software activation itself is not executed. After step S43, the CPU 21 of the powertrain ECU 20 proceeds to step S44.

[0050] In step S44, the CPU 21 of the powertrain ECU 20 ends the wait for reception of the activate signal SA transmitted from the central ECU 10. After step S44, the CPU 21 of the powertrain ECU 20 ends the current first control.

[0051] <Second control> Next, the second control executed by each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 will be described with reference to Fig. 4. This second control is a control related to the execution of software activation. Note that the second control executed by the powertrain ECU 20 will be described below. The CPU 21 of the powertrain ECU 20 executes the second control when, for example, the following requirements (4) and (5) are all satisfied.

[0052] Requirement (4): The first control has been executed. Requirement (5): The information processing device changes from an off state to an on state. For example, when the system of vehicle 100 is restarted, the state of the system of vehicle 100 changes from the on state to the off state to the on state in this order, and the state of powertrain ECU 20 changes from the on state to the off state to the on state in this order. As a result, requirement (5) is satisfied when powertrain ECU 20 changes from the off state to the on state. Also, for example, when the supply of power from secondary battery 71 to powertrain ECU 20 is momentarily cut off, a so-called momentary power supply interruption occurs, and the state of powertrain ECU 20 changes from the on state to the off state to the on state in this order. As a result, requirement (5) is satisfied when powertrain ECU 20 changes from the off state to the on state.

[0053] 4, when the CPU 21 of the powertrain ECU 20 starts the second control, the CPU 21 executes the process of step S51. In step S51, the CPU 21 of the powertrain ECU 20 activates new software. After step S51, the CPU 21 of the powertrain ECU 20 proceeds to the process of step S52.

[0054] In step S52, the CPU 21 of the powertrain ECU 20 transmits the part number signal SN to the central ECU 10. After step S52, the CPU 21 of the powertrain ECU 20 ends the current second control.

[0055] <Operation of this embodiment> For example, assume that in the vehicle 100, the control program 22A is installed in the ROM 22, the control program 32A is installed in the ROM 32, and the control program 42A is installed in the ROM 42. In this case, as shown in FIG. 2, the CPU 11 of the central ECU 10 executes consistency check control. On the condition that the CPU 11 of the central ECU 10 has transmitted an activation signal SA in step S11, the CPU 11 proceeds to step S12. In step S12, the CPU 11 of the central ECU 10 starts waiting for receipt of a product number signal SN transmitted from each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40. Furthermore, if consent to the software update is confirmed in step S20, the CPU 11 of the central ECU 10 restarts the system of the vehicle 100 in step S21. When the system of the vehicle 100 changes from the off state to the on state while waiting to receive the part number signal SN in this way, the CPU 11 of the central ECU 10 proceeds to step S22. Then, on the condition that the CPU 11 of the central ECU 10 has received part number signals SN from all of the information processing devices in step S22, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices in step S23. Specifically, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices based on the consistency table TM and the received part number signals SN.

[0056] On the other hand, while waiting to receive the part number signal SN and before the system of the vehicle 100 is switched from the off state to the on state, the CPU 11 of the central ECU 10 proceeds to step S27. Then, on the condition that the CPU 11 of the central ECU 10 has received part number signals SN from one or more information processing devices in step S27, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices in step S28. Specifically, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices based on the consistency table TM, the received part number signal SN, and the part number signal SN stored in the storage 14.

[0057] <Effects of this embodiment> (1-1) In the vehicle 100, before the system of the vehicle 100 changes from an off state to an on state, software of some of the information processing devices may be activated due to some cause, such as a momentary power interruption. In response to this, the CPU 11 of the central ECU 10 starts waiting for reception of a part number signal SN in step S12, provided that it has transmitted an activation signal SA in step S11. In other words, the CPU 11 of the central ECU 10 starts waiting for reception of a part number signal SN in step S12 when a part number signal SN may be transmitted from the powertrain ECU 20 or the like. Then, on the condition that it has received the part number signal SN, the CPU 11 of the central ECU 10 performs a consistency check of the software of the information processing devices based on the received part number signal SN in step S23 or step S28. This reduces the processing load on the CPU 11 of the central ECU 10 compared to, for example, a case in which the CPU 11 of the central ECU 10 always waits for reception of a part number signal SN and performs a consistency check at a predetermined interval.

[0058] (1-2) When the system of the vehicle 100 changes from an off state to an on state while waiting to receive a part number signal SN, the CPU 11 of the central ECU 10 performs a consistency check on the software on the condition that part number signals SN have been received from all information processing devices. Specifically, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices based on the consistency table TM and the received part number signals SN. This allows the consistency check on the software of each information processing device to be correctly executed in a situation where part number signals SN have been received from all information processing devices in step S22.

[0059] Meanwhile, while waiting to receive a part number signal SN and before the system of the vehicle 100 is switched from an off state to an on state, the CPU 11 of the central ECU 10 performs a consistency check on the software on the condition that it has received a part number signal SN from one or more information processing devices. Specifically, the CPU 11 of the central ECU 10 performs a consistency check on the software of the information processing devices based on the consistency table TM, the received part number signal SN, and the part number signal SN stored in the storage 14. Therefore, for a part number signal SN for which the CPU 11 of the central ECU 10 has not received a part number signal SN in step S27, the CPU 11 of the central ECU 10 uses the part number signal SN stored in the storage 14, i.e., a part number signal SN received in the past. This allows the consistency check on the software of each information processing device to be correctly performed even in a situation where part number signals SN have been received from only some of the information processing devices in step S27.

[0060] (1-3) For example, when part number signals SN have been received from all information processing devices, or when it has been determined by a consistency check that the software of the information processing devices is consistent, there is little need to receive the part number signal SN. In this regard, when it has been determined by the consistency check in step S23 or step S28 that the software of the information processing devices is consistent, the CPU 11 of the central ECU 10 ends the wait for reception of the part number signal SN in step S31. This allows the period of time for which the wait for reception of the part number signal SN is performed to be shorter than, for example, when the wait for reception of the part number signal SN is continued.

[0061] Second Embodiment A second embodiment of the present invention will be described below with reference to Figures 5 and 6. In the second embodiment, some processing of the consistency check control is different from that of the first embodiment. Also, in the second embodiment, in addition to the first control and the second control, a third control, which will be described later, is executed. Note that the description of the second embodiment will focus on the differences from the first embodiment, and the same components as those in the first embodiment will be denoted by the same reference numerals, and the description will be omitted or simplified.

[0062] <Validation control> First, the consistency check control executed by the central ECU 10 will be described with reference to FIG.

[0063] 5, when the CPU 11 of the central ECU 10 starts the consistency check control, it executes the process of step S11. In step S11, the CPU 11 of the central ECU 10 transmits an activation signal SA to each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 to instruct them to activate the new software. After step S11, the CPU 11 of the central ECU 10 advances the process to step S13.

[0064] In step S13, the CPU 11 of the central ECU 10 confirms with the user of the vehicle 100 whether or not the software update is approved. After step S13, the CPU 11 of the central ECU 10 advances the process to step S61.

[0065] In step S61, the CPU 11 of the central ECU 10 determines whether the communication status with the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 is normal. The CPU 11 of the central ECU 10 determines whether the communication status is normal, for example, as follows. Generally, the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 each transmit a periodic signal to the central ECU 10 at predetermined intervals. Therefore, the CPU 11 of the central ECU 10 determines that the communication status is normal if it has received a total of three periodic signals from the powertrain ECU 20, etc. during the period from the time of processing step S61 until the certain period before. On the other hand, the CPU 11 of the central ECU 10 determines that the communication status is abnormal if it has not received one or more periodic signals from the powertrain ECU 20, etc. during the period from the time of processing step S61 until the certain period before. In step S61, if the CPU 11 of the central ECU 10 determines that the communication state is normal (S61: YES), the CPU 11 of the central ECU 10 advances the process to step S20.

[0066] In step S20, the CPU 11 of the central ECU 10 determines whether consent to perform the software update has been confirmed. If the CPU 11 of the central ECU 10 determines in step S20 that consent to perform the software update has not been confirmed (S20: NO), the CPU 11 of the central ECU 10 again proceeds to step S61. On the other hand, if the CPU 11 of the central ECU 10 determines in step S20 that consent to perform the software update has been confirmed (S20: YES), the CPU 11 of the central ECU 10 proceeds to step S21. Note that the processing from step S21 onwards in the second embodiment is the same as the processing from step S21 onwards in the first embodiment.

[0067] On the other hand, if the CPU 11 of the central ECU 10 determines in step S61 that the communication state is not normal (S61: NO), the CPU 11 of the central ECU 10 proceeds to step S71. In other words, the CPU 11 of the central ECU 10 proceeds to step S71 on the condition that communication with the information processing device has been interrupted.

[0068] In step S71, the CPU 11 of the central ECU 10 transmits a request signal SR to the information processing device with which communication has been interrupted, requesting the transmission of a part number signal SN. In this second embodiment, the part number signal SN is transmitted from the information processing device in response to the request signal SR by executing a third control, which will be described later. After step S71, the CPU 11 of the central ECU 10 advances the process to step S72.

[0069] In step S72, the CPU 11 of the central ECU 10 starts waiting for reception of the part number signals SN transmitted from each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40. After step S72, the CPU 11 of the central ECU 10 proceeds to step S73.

[0070] In step S73, the CPU 11 of the central ECU 10 determines whether or not a part number signal SN has been received from an information processing device. Specifically, the CPU 11 of the central ECU 10 determines that a part number signal SN has been received from an information processing device when part number signals SN have been received from all of the information processing devices with which communication has been interrupted. When the CPU 11 of the central ECU 10 receives a part number signal SN, the CPU 11 associates the part number signal SN with the information processing device that transmitted the part number signal SN and stores the part number signal SN in the storage 14.

[0071] In step S73, if the CPU 11 of the central ECU 10 determines that the part number signal SN has not been received from the information processing device (S73: NO), the CPU 11 of the central ECU 10 proceeds to step S71 again. Therefore, in a situation where the part number signal SN has not been received from the information processing device with which communication has been interrupted, the CPU 11 of the central ECU 10 repeatedly executes the process of step S71. As a result, when communication with the information processing device is enabled after communication with the information processing device has been interrupted, the CPU 11 of the central ECU 10 transmits a request signal SR to request the information processing device with which communication has been interrupted to transmit the part number signal SN.

[0072] On the other hand, if the CPU 11 of the central ECU 10 determines in step S73 that the part number signal SN has been received from the information processing device (S73: YES), the CPU 11 of the central ECU 10 proceeds to step S28. Note that the processing from step S28 onwards in the second embodiment is the same as the processing from step S28 onwards in the first embodiment.

[0073] <Third Control> Next, the third control executed by each of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 will be described with reference to Fig. 6. This third control is a control related to the transmission of the part number signal SN in response to the request signal SR. Note that the third control executed by the powertrain ECU 20 will be described below. The CPU 21 of the powertrain ECU 20 executes the third control, for example, on the condition that the second control has been executed.

[0074] 6, when the CPU 21 of the powertrain ECU 20 starts the third control, it executes the process of step S91. In step S91, the CPU 21 of the powertrain ECU 20 starts waiting for reception of a request signal SR transmitted from the central ECU 10. After step S91, the CPU 21 of the powertrain ECU 20 advances the process to step S92.

[0075] In step S92, the CPU 21 of the powertrain ECU 20 determines whether or not the request signal SR has been received. If the CPU 21 of the powertrain ECU 20 determines in step S92 that the request signal SR has not been received (S92: NO), the CPU 21 of the powertrain ECU 20 proceeds to step S92 again. On the other hand, if the CPU 21 of the powertrain ECU 20 determines in step S92 that the request signal SR has been received (S92: YES), the CPU 21 of the powertrain ECU 20 proceeds to step S93.

[0076] In step S93, the CPU 21 of the powertrain ECU 20 transmits the part number signal SN to the central ECU 10. After step S93, the CPU 21 of the powertrain ECU 20 advances the process to step S94.

[0077] In step S94, the CPU 21 of the powertrain ECU 20 ends the wait for reception of the request signal SR transmitted from the central ECU 10. After step S94, the CPU 21 of the powertrain ECU 20 ends the current third control.

[0078] <Effects of this embodiment> In addition to the above advantages (1-1) to (1-3), the present embodiment also provides the following advantages (2-1) to (2-2).

[0079] (2-1) When communication between the CPU 11 of the central ECU 10 and the powertrain ECU 20, etc. is temporarily interrupted, there is a possibility that a momentary interruption in the power supply to the powertrain ECU 20, etc. Also, when a momentary interruption in the power supply to the powertrain ECU 20, etc. occurs, there is a possibility that the communication state is unstable. As a result, even if the powertrain ECU 20, etc. transmits the part number signal SN to the central ECU 10 in step S52 of the second control, there is a possibility that the central ECU 10 will not receive the part number signal SN.

[0080] In this regard, when communication with an information processing device is interrupted and then becomes possible again, the CPU 11 of the central ECU 10 transmits a request signal SR to the information processing device with which communication has been interrupted to request transmission of a part number signal SN. As a result, even if communication is temporarily interrupted, the information processing device with which communication has been interrupted transmits the part number signal SN when communication becomes possible again. As a result, the part number signal SN can be more reliably received from an information processing device whose software may have been activated due to a momentary interruption in power supply.

[0081] (2-2) In this embodiment, the CPU 11 of the central ECU 10 proceeds to step S72 on the condition that it has transmitted the activate signal SA in step S11 and also transmitted the request signal SR in step S71. Then, in step S72, the CPU 11 of the central ECU 10 starts waiting to receive the part number signal SN transmitted from the powertrain ECU 20 or the like. This shortens the period during which it waits to receive the part number signal SN compared to, for example, starting to wait to receive the part number signal SN immediately after transmitting the activate signal SA. As a result, it is possible to effectively prevent an increase in the processing load on the CPU 11 of the central ECU 10 due to the execution of waiting to receive the part number signal SN.

[0082] <Example of change> This embodiment can be modified as follows: This embodiment and the following modifications can be combined and implemented within the scope of technical compatibility.

[0083] In the first embodiment, the consistency check control may be changed. For example, the method of confirming consent in step S13 may be changed. As a specific example, the CPU 11 of the central ECU 10 may output a control signal to a personal terminal owned by the user of the vehicle 100, thereby displaying an option to consent to or not consent to the software update on the display of the personal terminal. An example of the personal terminal is a so-called smartphone.

[0084] For example, the timing at which the wait for reception of the part number signal SN in step S31 ends may be changed. As a specific example, if the CPU 11 of the central ECU 10 determines in step S22 that part number signals SN have been received from all of the information processing devices (S22: YES), the CPU 11 of the central ECU 10 may proceed to step S31. In other words, if the CPU 11 of the central ECU 10 has received part number signals SN from all of the information processing devices, the CPU 11 of the central ECU 10 may end the wait for reception of the part number signal SN in step S31. In this case, after step S31, the CPU 11 of the central ECU 10 may proceed to step S23.

[0085] In the first and second embodiments described above, the first control may be modified. For example, the process of step S41 may be omitted in the first control. In this case, the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 may always wait for reception of the activation signal SA regardless of the first control. In this configuration, the process of step S44 may be omitted in the first control.

[0086] In the second embodiment, the consistency check control may be changed. For example, the processing content of step S61 may be changed. As a specific example, in step S61, the CPU 11 of the central ECU 10 may determine whether or not the time elapsed since the previous processing of step S71 is less than a predetermined specified period. In this case, the CPU 11 of the central ECU 10 proceeds to step S71 if the time elapsed since the previous processing of step S71 is equal to or greater than the predetermined specified period. In other words, the CPU 11 of the central ECU 10 may transmit a request signal SR in step S71 at every specified period. In this case, it is preferable that the CPU 11 of the central ECU 10 transmits the request signal SR to all information processing devices. This allows the CPU 11 of the central ECU 10 to perform a consistency check at every specified period.

[0087] In the second embodiment, the third control may be modified. For example, the process of step S91 may be omitted in the third control. In this case, the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40 may always wait for reception of the request signal SR regardless of the third control. In this configuration, the process of step S94 may be omitted in the third control.

[0088] In the first and second embodiments described above, the configuration of the update system US may be changed. For example, the software update device is not limited to the central ECU 10. As a specific example, instead of the central ECU 10, the CPU 31 of the brake ECU 30 may execute the consistency check control by reading out the update program 12A stored in the ROM 32. That is, the software update device is not limited to the central ECU 10, and an ECU mounted on the vehicle 100 may be used.

[0089] For example, the information processing device is not limited to the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40. As a specific example, the information processing device may be part of the powertrain ECU 20, the brake ECU 30, and the advanced driving assistance ECU 40. Also, as a specific example, the information processing device may be another ECU provided in the vehicle 100. In other words, an ECU mounted on the vehicle 100 may be used as the information processing device.

[0090] <Other technical ideas> The technical ideas that can be understood from the above-described embodiment and modified examples will be described. (Appendix 1) transmitting an activation signal to an information processing device mounted on the vehicle to instruct the device to activate software; awaiting reception of a product number signal indicating a product number of the software transmitted from the information processing device on condition that the activation signal has been transmitted; Upon receiving the product number signal, performing a consistency check on the software based on the received product number signal; Run Software update device.

[0091] (Appendix 2) When receiving the product number signal, storing the product number signal in association with the information processing device that transmitted the product number signal; when the vehicle system is switched from an off state to an on state while waiting for reception of the part number signal, performing a consistency check on the software based on the received part number signal on the condition that the part number signals have been received from all of the information processing devices; performing a consistency check on the software based on the received part number signal and the stored part number signal, on condition that the part number signal is received from one or more of the information processing devices while waiting for reception of the part number signal and before the vehicle system is switched from an off state to an on state; Run 10. The software update device of claim 1.

[0092] (Appendix 3) when communication with the information processing device becomes possible after communication with the information processing device has been interrupted, transmitting a request signal to the information processing device with which communication has been interrupted to request transmission of the product number signal; Run 10. The software update device according to claim 1 or 2.

[0093] (Appendix 4) ending the wait for reception of the product number signals on the condition that one or more of the following requirements are satisfied: that the product number signals have been received from all of the information processing devices; and that the software of the information processing devices has been determined to be consistent by the consistency check. Run 4. The software update device according to claim 1. [Explanation of symbols]

[0094] NW: communication network US…Update System 10...Central ECU 11...CPU 12...ROM 12A…Update Program 13...RAM 14…Storage 20...Powertrain ECU 21...CPU 22...ROM 22A...Control program 23...RAM 24…Storage 30...Brake ECU 31...CPU 32...ROM 32A...Control program 40...Advanced driver assistance ECU 41...CPU 42...ROM 42A...Control program 50…DCM 71…Secondary battery 76...Display 100...Vehicle 200...Data center

Claims

1. transmitting an activation signal to an information processing device mounted on the vehicle to instruct the device to activate software; awaiting reception of a product number signal indicating a product number of the software transmitted from the information processing device on condition that the activation signal has been transmitted; When receiving the product number signal, storing the product number signal in association with the information processing device that transmitted the product number signal; when the vehicle system is switched from an off state to an on state while waiting for reception of the part number signal, performing a consistency check on the software based on the received part number signal on the condition that the part number signals have been received from all of the information processing devices; performing a consistency check on the software based on the received part number signal and the stored part number signal, on condition that the part number signal is received from one or more of the information processing devices while waiting for reception of the part number signal and before the vehicle system is switched from an off state to an on state; Run Software update device.

2. When communication with the information processing device becomes possible after communication with the information processing device has been interrupted, transmitting a request signal to the information processing device with which communication has been interrupted to request transmission of the product number signal; Run 2. The software update device according to claim 1.

3. ending the wait for reception of the product number signals on the condition that one or more of the following requirements are satisfied: that the product number signals have been received from all of the information processing devices; and that the software of the information processing devices has been determined to be consistent by the consistency check. Run 2. The software update device according to claim 1.

4. To the update device, transmitting an activation signal to an information processing device mounted on the vehicle to instruct the device to activate software; awaiting reception of a product number signal indicating a product number of the software transmitted from the information processing device on condition that the activation signal has been transmitted; When receiving the product number signal, storing the product number signal in association with the information processing device that transmitted the product number signal; when the vehicle system is switched from an off state to an on state while waiting for reception of the part number signal, performing a consistency check on the software based on the received part number signal on the condition that the part number signals have been received from all of the information processing devices; performing a consistency check on the software based on the received part number signal and the stored part number signal, on condition that the part number signal is received from one or more of the information processing devices while waiting for reception of the part number signal and before the vehicle system is switched from an off state to an on state; Run Software updates.

5. The update device is transmitting an activation signal to an information processing device mounted on the vehicle to instruct the device to activate software; awaiting reception of a product number signal indicating a product number of the software transmitted from the information processing device on condition that the activation signal has been transmitted; When receiving the product number signal, storing the product number signal in association with the information processing device that transmitted the product number signal; when the vehicle system is switched from an off state to an on state while waiting for reception of the part number signal, performing a consistency check on the software based on the received part number signal on the condition that the part number signals have been received from all of the information processing devices; performing a consistency check on the software based on the received part number signal and the stored part number signal, on condition that the part number signal is received from one or more of the information processing devices while waiting for reception of the part number signal and before the vehicle system is switched from an off state to an on state; Run How to update your software.

6. An update device mounted on a vehicle and an information processing device mounted on the vehicle, The update device transmitting an activation signal to the information processing device to instruct the device to activate the software; awaiting reception of a product number signal indicating a product number of the software transmitted from the information processing device on condition that the activation signal has been transmitted; Run The information processing device includes: activating the software when the information processing device is switched from an off state to an on state, on condition that the activation signal has been received; transmitting the product number signal to the update device on the condition that the activation has been performed; Run The update device On condition that the product number signal is received, performing a consistency check on the software based on the received product number signal; Run Software update system.

Images