Control device, method, program, and vehicle

Abstract

To provide a control device which ensures consistency of versions of the entire programs of a plurality of on-vehicle instruments in program update of the on-vehicle instrument and can be shifted to a state where the operation is guaranteed.SOLUTION: A control device mounted on a vehicle comprises a communication unit which downloads update data, and a control unit. The control unit executes software update processing of another control device and the control device connected via an on-vehicle network by using the update data, acquires software information of the control device and software information of the other control device after execution of the software update processing, determines whether or not the software information of the control device and the software information of the other control device are in a prescribed combination, and executes processing of returning the software of the control device and the other control device to the software before update when it is determined that the software information of the control device and the software information of the other control device are not in the prescribed combination.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a control device that updates a program of an in-vehicle device mounted in a vehicle. [Background technology]

[0002] Vehicles are equipped with a network system consisting of multiple on-board devices called ECUs (Electronic Control Units), which are connected to each other via communication lines. Each on-board device sends and receives messages to each other and performs a share of the vehicle's functions.

[0003] In-vehicle devices typically include a processor and a temporary storage unit such as RAM or a non-volatile storage unit such as flash ROM. The programs (software) executed by the processor are stored in the non-volatile storage unit. By updating the programs with newer versions, the functionality of the in-vehicle devices can be improved.

[0004] Program updates include the download step, in which update data is received from an external device (center) via wireless communication or the like, and the installation step, in which an update program (update software) is written into the storage unit of the in-vehicle device based on the downloaded update data. Depending on the specifications of the in-vehicle device, installation can be performed in two ways: overwrite installation, in which the downloaded update program is written by overwriting the current program (old program) into one area (first side: single bank) of the storage unit's memory area designated as an area for program storage, or dual-side installation, in which the downloaded update program is written into the area (second side) of two areas (two sides: dual banks) designated as areas for program storage other than the area (first side) where the current program (old program) is stored.

[0005] In the case of a side-by-side installation, the program update steps include not only the download and installation steps, but also an activation step that configures the settings such as the start address of the update so that the installed update becomes the running version.

[0006] In relation to ECU program updates, Patent Document 1 discloses a system that updates an ECU program with an upgrade program sent from a server. When updating an ECU program, the system in Patent Document 1 checks whether the updated program version is consistent with the program versions of other ECUs, thereby preventing version inconsistencies caused by the update.

[0007] Patent Document 2 discloses that each ECU has a backup area for the program, and before updating to an upgrade program, the current program is saved in the backup area as an old program, and if the ECU malfunctions after updating to the upgrade program, the old program saved in the backup area is used to return the ECU to its pre-update state in which it was operating normally. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-53920 [Patent Document 2] Japanese Patent Application Laid-Open No. 2016-16835 Summary of the Invention [Problem to be solved by the invention]

[0009] For a network system to function properly, the combination of program versions for multiple ECUs must be a combination that is guaranteed to work in advance (a consistent combination). Therefore, when a program update fails or the user wishes to downgrade, it is desirable not only to revert only the program of a specific ECU to the older version, but also to ensure that the versions of all programs in multiple on-board devices are consistent and transition to a state where operation is guaranteed.

[0010] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a control device, etc., that can ensure consistency in the overall program versions of multiple on-board devices and transition them to a state where operation is guaranteed when updating the programs of the on-board devices. [Means for solving the problem]

[0011] In order to solve the above problem, one aspect of the disclosed technology is a control device mounted on a vehicle, comprising a communication unit that downloads update data and a control unit, wherein the control unit uses the update data to perform software update processing on other control devices and the control device connected via an in-vehicle network, acquires software information on the control device and the software information on the other control devices after the software update processing is performed, determines whether the software information on the control device and the software information on the other control devices are a predetermined combination, and if it determines that the software information on the control device and the software information of the other control devices are not a predetermined combination, performs processing to restore the software of the control device and the other control devices to the software before the update. [Effects of the Invention]

[0012] According to the disclosed technology, when updating the programs of on-board equipment, the control device checks the consistency of the combination of program versions of multiple on-board equipment, thereby ensuring consistency between the overall program versions of multiple on-board equipment and transitioning the network system to a state where operation is guaranteed. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a configuration diagram of a network system according to an embodiment; [Figure 2] Flowchart showing processing according to one embodiment DETAILED DESCRIPTION OF THE INVENTION

[0014] (Embodiment) <Configuration> FIG. 1 shows an example of the configuration of a network system 1 according to this embodiment. The network system 1 is mounted on a vehicle. The network system 1 includes a software update device 50. A plurality of buses 10, 20, 30, etc. are connected to the software update device (OTA master) 50. A plurality of in-vehicle devices (electronic control units) 11, 12, etc. are connected to the bus 10. A plurality of in-vehicle devices 21, 22, etc. are connected to the bus 20. A plurality of actuators 31, 32, etc. are connected to the bus 30. In FIG. 1 and the following description, buses 10, 20, and 30 are shown as examples of buses, and in-vehicle devices 11, 12, 21, and 22 and actuators 31 and 32 are shown as examples of in-vehicle devices, but the numbers of buses, in-vehicle devices, and actuators are not limited.

[0015] The software update device 50 includes a communication unit (communication module) 51 capable of communicating with an external device 100 (center) installed outside the vehicle, and a control unit 52 that controls updating of programs in the in-vehicle devices 11, 12, 21, and 22 based on update data provided by the external device 100. The software update device 50 is typically a computer including a nonvolatile storage unit (storage) 53 such as a flash ROM, a processor that performs various processes by reading and executing programs from the nonvolatile storage unit, and a temporary storage unit such as RAM that stores parts of the programs and data. The software update device 50 also controls and relays communications between the external device 100 and the in-vehicle devices 11, 12, 21, and 22, communications among the in-vehicle devices 11, 12, 21, and 22, and communications between the in-vehicle devices 11, 12, 21, and 22 and the actuators 31 and 32 via the buses 10, 20, and 30. In this way, the software update device 50 also functions as a relay device that relays communications.

[0016] The on-board devices 11, 12, 21, and 22 communicate with each other and perform various processes for controlling the vehicle. Like the update device, these on-board devices are typically computers equipped with a storage unit and a processor.

[0017] The actuators 31 and 32 are devices that generate mechanical effects on the vehicle or its components, such as the brake, engine, or power steering device, and operate based on instructions from the on-vehicle devices 11, 12, 21, and 22.

[0018] The control unit 52 of the software update device 50 can update the programs stored in the storage units of the in-vehicle devices 11, 12, 21, and 22. That is, the software update device 50 controls downloading, installation, and activation. Downloading is a process of receiving and storing update data (distribution package) for updating the program of one of the in-vehicle devices 11, 12, 21, and 22, transmitted from the external device 100. Downloading control may include not only download execution but also control of a series of processes related to downloading, such as determining whether the download can be performed and verifying the update data. Installation is a process of writing an updated program (update software) into the storage unit of the in-vehicle device to be updated based on the downloaded update data. Installation control may include not only installation execution but also control of a series of processes related to installation, such as determining whether the installation can be performed, transferring the update data, and verifying the updated program. Activation is a process of validating (activating) the installed updated program. The control of activation may include not only the execution of activation but also a series of controls related to activation, such as determining whether activation can be executed or not, and verifying the execution result.

[0019] In controlling the installation, if the update data includes the update program itself, the control unit 52 can transmit the update program to the in-vehicle device. Also, if the update data includes compressed data, difference data, or divided data of the update program, the control unit 52 may extract or assemble the update data to generate an update program and transmit it to the in-vehicle device. Alternatively, the control unit 52 may transmit the update data to the in-vehicle device, and the in-vehicle device may extract or assemble the update data to generate an update program.

[0020] The installation itself, which writes the update program to the second memory unit of the in-vehicle device, may be performed by the control unit 52, or may be performed by the in-vehicle device upon receiving instructions from the control unit 52, or may be performed autonomously by the in-vehicle device that receives the update data (or update program) without explicit instructions from the control unit 52.

[0021] The activation process to enable the installed update program may be performed by the control unit 52, or may be performed by the in-vehicle device upon receiving instructions from the control unit 52, or may be performed autonomously by the in-vehicle device following installation without explicit instructions from the control unit 52.

[0022] Such program update processing can be performed consecutively or in parallel for each of a plurality of in-vehicle devices.

[0023] <Processing> An example of the processing according to this embodiment will be described below. Fig. 2 is a flowchart showing an example of the software update processing performed by the software update device 50. This processing is started, for example, by the software update device 50 making a request for update data to the external device 100.

[0024] (Step S101) The communication unit 51 receives update data for updating one or more programs of the in-vehicle devices provided in the vehicle from the external device 100. The control unit 52 stores (downloads) the update data in the storage unit of the software update device 50.

[0025] In response to an inquiry from the software update device 50, the external device 100 determines whether or not updated versions of programs for the in-vehicle devices included in the network system 1 are present among the programs provided to the external device 100, based on the types of the in-vehicle devices and the current program versions that are pre-stored in the external device 100 or obtained from the software update device 50, and if an updated version of the program is provided, generates update data based on the provided updated program and provides it to the software update device 50. If the external device 100 has successfully updated all programs based on the update data, it generates the update data so that the program versions of all the in-vehicle devices included in the network system 1 are consistent.

[0026] (Step S102) The control unit 52 restricts the operation of the vehicle. For example, while the in-vehicle device is undergoing the above-described overwrite installation or activation, the operation of the in-vehicle device may be affected, which may also affect the control of the vehicle by the network system 1. Therefore, in this step, predetermined vehicle operations that are determined to be undesirable for their impact, such as engine operation, may be stopped or prohibited, thereby suppressing unexpected behavior. Note that such restriction of predetermined operations and processing after this step may wait until user permission is obtained. Note that if all in-vehicle devices to be program-updated are of the dual bank type described above, the predetermined operation may be restricted after the above-described multi-side installation and before activation.

[0027] (Step S103) The control unit 52 controls the communication unit 51 to cause the in-vehicle device to perform the above-mentioned installation, activation, etc., based on the update data. That is, if the in-vehicle device is the above-mentioned single bank type, the control unit 52 causes the in-vehicle device to perform the above-mentioned overwrite installation. Also, if the in-vehicle device is the above-mentioned dual bank type, the control unit 52 causes the in-vehicle device to perform the above-mentioned multi-side installation and activation in this order.

[0028] (Step S104) The control unit 52 acquires information indicating the current program version from each in-vehicle device via the communication unit 51.

[0029] (Step S105) The control unit 52 determines the consistency of the acquired combination of versions. For example, if the acquired versions include all of the updated program versions included in the update data, the control unit 52 can determine that there is consistency. If not, the control unit 52 can determine that an abnormality has occurred in one of the in-vehicle devices during or after the program update process for some reason. If the update was successful, the process proceeds to step S109; if not, the process proceeds to step S106.

[0030] (Step S106) The control unit 52, for example, compares the acquired version combination with the version of the updated program included in the update data, and identifies the in-vehicle device that caused the version inconsistency.

[0031] (Step S107) The control unit 52 repeats the same process as step S103 for each in-vehicle device that caused the inconsistency and retries the update. Alternatively, if the in-vehicle device that caused the inconsistency is an in-vehicle device that performs the above-mentioned multi-side installation (dual bank) and stores the pre-update program (the program that was currently being executed), the control unit 52 may perform a configuration process (restoration process) to continue to execute the pre-update program. Even if the pre-update program is often consistent with the program versions of other in-vehicle devices, the control unit 52 may acquire the program versions of multiple in-vehicle devices and, in the acquired version combination, perform the recovery process after confirming that the version combination is consistent, even if the program version of the in-vehicle device to be restored is the program version before the program update.

[0032] (Step S108) As in step S104, the control unit 52 acquires information indicating the current program versions from each in-vehicle device and checks the consistency of the combination of the current program versions. The check for consistency can be performed, for example, if the acquired versions include all of the updated program versions included in the update data, to determine that the update was successful. Furthermore, if some in-vehicle devices have performed a recovery process, the control unit 52 may transmit the combination of the current program versions to the external device 100 and inquire whether the combination is consistent. The external device 100 can determine whether the combination of program versions is consistent in this way by referring to a pre-set table of multiple combinations of compatible versions. Alternatively, the control unit 52 may acquire and store such a table together with the update data from the external device 100 in advance, and refer to the table to check the consistency of the combination of the current program versions.

[0033] If it is not possible to confirm in this step that the current program version combination is consistent, steps S107 and S108 may be repeated until it is. For example, if the update is retried multiple times and consistency cannot be confirmed, recovery processing may be performed. If consistency cannot be confirmed even after a predetermined number of repetitions, this may indicate that a non-temporary abnormality has occurred in the software update device 50 or the in-vehicle device, or that the version resulting from the recovery processing is inconsistent with the updated program versions of other in-vehicle devices. Therefore, measures such as notifying the user of the abnormality may be taken. If such an abnormality occurs and all in-vehicle devices still store the pre-update programs, recovery processing may be performed on all in-vehicle devices.

[0034] (Step S109) The control unit 52 releases the vehicle operation restriction imposed in step S102. This completes the process. In the above-described installation process, if the update data includes the update program itself, the control unit 52 transmits the update program to the in-vehicle device. In addition, if the update data includes compressed data, difference data, or divided data of the update program, the control unit 52 may extract or assemble the update data to generate an update program and transmit the update program to the in-vehicle device. Alternatively, the control unit 52 may transmit the update data to the in-vehicle device, and the in-vehicle device may extract or assemble the update data to generate an update program. In addition, the external device 100 and the software update device 50 may explicitly instruct the in-vehicle device to install or activate the program, and the in-vehicle device may perform these processes based on the instructions. Alternatively, the in-vehicle device that receives the update data (or update program) may autonomously perform these processes without any explicit instructions.

[0035] As described above, in this embodiment, the update process is not completed and the operation of the vehicle is restricted until the consistency of the program version combinations of each on-board device is confirmed. Therefore, if the program update fails, it is possible to achieve version consistency while suppressing unexpected behavior of the vehicle.

[0036] Also, even if a program update fails once, retrying the update can increase the chances of it ultimately succeeding.

[0037] Furthermore, even if the program update fails, the pre-update program can be used on the premise that the consistency of the combination of program versions of each in-vehicle device can be confirmed, so the operation of the network system 1 can be guaranteed.

[0038] After a program update is successful, the user may wish to revert a specific in-vehicle device to the program before the update. In such a case, the control unit 52 may accept a user request to revert the in-vehicle device to the program before the update. If the in-vehicle device stores the program before the update, this process can be achieved by configuring the in-vehicle device to use the program before the update as the execution version. In this case, the control unit 52 acquires the program versions of multiple in-vehicle devices and executes the configuration if it is confirmed that the acquired version combination is consistent, even if the program version of the specified in-vehicle device is changed to the program version before the program update. This allows the user to downgrade the program, as desired, provided that the consistency of the program version combination of each in-vehicle device can be confirmed. During this process, it is preferable to restrict certain vehicle operations and release the restrictions after confirming the consistency of the versions as in step S108.

[0039] As described above, if there is an inconsistency in the program version combination obtained after program installation (in the case of a single bank) or installation and activation (in the case of a dual bank), the control unit 52 determines that there was an error in the program update process in one of the in-vehicle devices, or that even if there was no error in the installation or activation process, there is a defect in the program provided as an updated version, causing some kind of abnormality, resulting in the inability to notify the control unit 52 of the program version, and identifies that in-vehicle device as the in-vehicle device that caused the version inconsistency. Thus, in this embodiment, even if a version inconsistency occurs as a result of some kind of abnormality occurring in the in-vehicle device during not only the program update process but also subsequent processes, if the in-vehicle device is a dual-bank type and stores the pre-update program, for example, it can restore the in-vehicle device to its pre-update state without the abnormality and with a consistent program version combination. This allows the device to quickly and reliably return to a normal state with guaranteed operation, even if some kind of abnormality occurs after a program update, without the time and cost required to determine whether there is a program defect. In addition, the control unit 52 may determine whether any abnormality has occurred in each in-vehicle device due to or accompanying a program update, such as a program installation or activation error or a program defect, causing the in-vehicle device to have a version inconsistency, using one or more other methods other than the program version, such as the results of self-diagnosis of the in-vehicle device or operation monitoring of the in-vehicle device by the control unit 52; the determination method is not limited.

[0040] Although an example of an embodiment has been described above, the functions of the control unit 52 may be provided in any of the in-vehicle devices. For example, the functions may be implemented in the programs of two or more of the in-vehicle devices, respectively, or may be implemented in a program provided in one in-vehicle device separately from the program to be updated. In this manner, a dedicated configuration for the control unit functions is not required. Furthermore, if the functions of the control unit are implemented in the programs of two or more of the in-vehicle devices, respectively, when the program of one of the in-vehicle devices is updated, the other in-vehicle device can execute the functions of the control unit. Alternatively, if the functions of the control unit are implemented in a program provided in one in-vehicle device separately from the program to be updated, when the program of the in-vehicle device is updated, the functions of the control unit can be executed without being interrupted by the update process.

[0041] <Effects> As described above, in this embodiment, the software update device checks the consistency of the combination of program versions of each in-vehicle device, so that the program update process ensures consistency of the overall program versions of multiple in-vehicle devices and transitions them to a state where operation is guaranteed.

[0042] The disclosed technology can be understood not only as a software update device, but also as a network system including a software update device, a method executed by a computer equipped in the software update device, a program and a computer-readable non-transitory storage medium storing the program, a vehicle equipped with a software update device, etc. [Industrial Applicability]

[0043] The disclosed technique is useful for a software update device that updates programs of on-board devices installed in a vehicle. [Explanation of symbols]

[0044] 1 Network System 10, 20, 30 buses 11, 12, 21, 22 Automotive equipment 31, 32 Actuator 50 Software update device 51 Communications Department 52 Control section 100 External device

Claims

1. A control device mounted on a vehicle, a communication unit that downloads update data; A control unit; a notification unit, The control unit After the update data is downloaded, starting to restrict predetermined operations of the vehicle; After restricting a predetermined operation of the vehicle, using the update data, a software update process is performed on the in-vehicle devices and the control device connected via an in-vehicle network; acquiring software information of the control device and software information of the in-vehicle device after the software update process is executed; determining whether the software information of the control device and the software information of the in-vehicle device are a predetermined combination; If it is determined that the software information of the control device and the software information of the in-vehicle device are not the predetermined combination, a process is performed to restore the software of the control device and the in-vehicle device to the software before the update; After executing the process of restoring the software to the software before the update, the restriction on a predetermined operation of the vehicle is lifted; The notification unit notifies a user of the occurrence of an abnormality before the control unit executes the process of restoring the software to the software before the update.

2. 2. The control device according to claim 1, wherein the software update process includes an installation step of writing update software to the respective memory units of the control device and the in-vehicle equipment based on the update data, and an activation step of making the update software written to the respective memory units of the control device and the in-vehicle equipment the execution version.

3. The control device according to claim 2 , wherein the update data is differential data between the updated software and the software before the update.

4. A vehicle comprising the control device according to any one of claims 1 to 3.

5. A method executed by a control device mounted on a vehicle, comprising: downloading update data; After downloading the update data, starting to restrict predetermined operations of the vehicle; a step of restricting a predetermined operation of the vehicle, and then using the update data to execute a software update process for the in-vehicle devices and the control device connected via an in-vehicle network; acquiring software information of the control device and software information of the in-vehicle device after the software update process is executed; determining whether the software information of the control device and the software information of the in-vehicle device are a predetermined combination; notifying a user of the occurrence of an abnormality when it is determined that the software information of the control device and the software information of the in-vehicle device are not the predetermined combination; a step of executing a process of restoring the software of the control device and the in-vehicle device to the software before the update after notifying the user of the occurrence of the abnormality; and releasing restrictions on predetermined vehicle operations after performing the process of reverting to the software before the update.

6. A program to be executed by a computer of a control device mounted on a vehicle, downloading update data; After downloading the update data, starting to restrict predetermined operations of the vehicle; a step of restricting a predetermined operation of the vehicle, and then using the update data to execute a software update process for the in-vehicle devices and the control device connected via an in-vehicle network; acquiring software information of the control device and software information of the in-vehicle device after the software update process is executed; determining whether the software information of the control device and the software information of the in-vehicle device are a predetermined combination; notifying a user of the occurrence of an abnormality when it is determined that the software information of the control device and the software information of the in-vehicle device are not the predetermined combination; a step of executing a process of restoring the software of the control device and the in-vehicle device to the software before the update after notifying the user of the occurrence of the abnormality; and releasing restrictions on predetermined operations of the vehicle after executing processing to restore the software to the software before the update.

Images