Center, method, and program

Abstract

To provide a center and the like capable of properly controlling a series of update processing of software of an electronic control unit mounted on a vehicle.SOLUTION: The center for controlling the update of software of an electronic control unit mounted on a vehicle includes: a communication unit that performs communications between the vehicle and information terminals associated with the vehicle; and a control unit that controls the software update processing based on an update acceptance notice that the communication unit receives from the information terminal. The control unit is configured so as to, when the communication between the vehicle and the information terminal is interrupted, restrict the software update processing even when the communication unit receives the update acceptance notice.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a center for controlling software updates of electronic control units mounted on vehicles, and a method and program executed by the center. [Background technology]

[0002] Vehicles are equipped with multiple electronic control units (ECUs) for controlling the vehicle's operation. Each electronic control unit includes a processor, a temporary storage unit such as RAM, and a non-volatile memory, which is a non-volatile storage unit such as flash ROM. The processor executes software stored in the non-volatile memory to realize the control functions of the electronic control unit. The software stored in each electronic control unit is rewritable, and by updating to a newer version of the software, it is possible to improve the functions of each electronic control unit or add new vehicle control functions.

[0003] A known technology for updating software in an electronic control unit is OTA (Over The Air) technology, in which an in-vehicle communication device connected to an in-vehicle network is wirelessly connected to a communication network such as the Internet, and a device responsible for updating the vehicle's software downloads software from a server via wireless communication, writes and installs the downloaded software in the electronic control unit, and activates the installed software, thereby updating or adding software to the electronic control unit. See, for example, Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2017-149323 Summary of the Invention [Problem to be solved by the invention]

[0005] When updating software using OTA, processes such as notifying the vehicle user or administrator that a software update is available and requesting consent for the software update are performed. These notifications and consent requests are sent to the vehicle user or administrator via information terminals such as the car navigation device installed in the vehicle or smartphones that can communicate wirelessly with the vehicle.

[0006] A portable information device such as a smartphone may become disconnected from a vehicle after consenting to a software update while connected to the vehicle. However, with current software update control, once a software update is consented to, the software update process for the vehicle continues even if the consenting information device subsequently becomes disconnected from the vehicle. For this reason, there is room for further improvement in the control of software update processes.

[0007] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a center or the like that can appropriately control the software update process of an electronic control unit installed in a vehicle. [Means for solving the problem]

[0008] In order to solve the above problem, one aspect of the disclosed technology is a center that controls software updates for an electronic control unit installed in a vehicle, and includes a communication unit that communicates between the vehicle and an information terminal associated with the vehicle, and a control unit that controls the software update process based on an update acceptance notification received by the communication unit from the information terminal, and the control unit is a center that restricts the software update process if communication between the vehicle and the information terminal is interrupted even if the communication unit receives the update acceptance notification. [Effects of the Invention]

[0009] According to the center etc. of the present disclosure, it is possible to appropriately control the software update process of the electronic control unit mounted on the vehicle. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing the overall configuration of a network system according to an embodiment. [Figure 2] Block diagram showing the general configuration of the center [Figure 3] Center functional block diagram [Figure 4] Block diagram showing the schematic configuration of the OTA master [Figure 5] OTA Master Functional Block Diagram [Figure 6A] A block diagram showing an example of a schematic configuration of an electronic control unit. [Figure 6B] A block diagram showing an example of a schematic configuration of an electronic control unit. [Figure 7] A diagram showing an example of type information [Figure 8A] Flowchart of software update process according to specific example 1 performed by the center [Figure 8B] Flowchart of software update process according to specific example 1 performed by the center [Figure 9A] Flowchart of software update process according to specific example 2 performed by the center [Figure 9B] Flowchart of software update process according to specific example 2 performed by the center DETAILED DESCRIPTION OF THE INVENTION

[0011] When a software update for an electronic control unit installed in a vehicle is approved by an information terminal outside the vehicle, the center according to the present disclosure further imposes necessary restrictions on the software update process based on the state of cooperation between the information terminal and the vehicle, thereby enabling the software update process for the electronic control unit to be completed safely and in a short time. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0012] <Embodiment> [System Configuration] Fig. 1 is a block diagram showing the overall configuration of a network system according to an embodiment of the present disclosure. The network system shown in Fig. 1 is a system for updating software of multiple electronic control units (ECUs) 50a to 50d mounted on a vehicle, and includes a center 10 located outside the vehicle, an in-vehicle network 90 established within the vehicle, and an information terminal 95 linked (associated) with the vehicle.

[0013] (1) Center The center 10 can communicate with the OTA master 30 (described later) provided in the in-vehicle network 90 via the network 100, and can control and manage software updates for the multiple electronic control units 50a to 50d connected to the OTA master 30 by transmitting software update data for the electronic control units 50a to 50d and information defining the update process procedures, and by receiving notifications indicating the progress of the software update process. The center 10 functions as a so-called server. The center 10 can also communicate with an information terminal 95 via the network 100, and can notify vehicle users, managers, etc. that software updates are available for the electronic control units 50a to 50d, and request consent for the software update.

[0014] FIG. 2 is a block diagram showing a schematic configuration of the center 10 in FIG. 1. As shown in FIG. 2, the center 10 includes a central processing unit (CPU) 11, a random access memory (RAM) 12, a storage device 13, and a communication device 14. The storage device 13 is a device equipped with a readable and writable storage medium such as a hard disk drive (HDD) or a solid state drive (SSD), and stores a program for managing software updates, information used for software update control and management, and software update data for each electronic control unit. In the center 10, the CPU 11 executes a program read from the storage device 13 using the RAM 12 as a work area, thereby performing predetermined processing related to software updates. The communication device 14 is a device for communicating with the OTA master 30 and the information terminal 95 via the network 100.

[0015] Fig. 3 is a functional block diagram of the center 10 shown in Fig. 2. The center 10 shown in Fig. 3 includes a memory unit 16, a communication unit 17, a control unit 18, a determination unit 19, and an HMI function unit 20. The memory unit 16 is realized by the storage device 13 shown in Fig. 2. The communication unit 17, the control unit 18, the determination unit 19, and the HMI function unit 20 are realized by the CPU 11 shown in Fig. 2 executing a program stored in the storage device 13 using the RAM 12.

[0016] The storage unit 16 stores information related to software update processing for one or more electronic control units mounted on the vehicle. As information related to the software update processing, the storage unit 16 stores at least update management information that associates, for each vehicle identification information (vehicle ID) that identifies the vehicle, information indicating software available in the electronic control units 50a to 50d, and update data for the software of the electronic control units 50a to 50d. As information indicating software available in the electronic control units 50a to 50d, for example, a combination of the latest version information for each software of the multiple electronic control units 50a to 50d is defined. As information related to the software update processing, the storage unit 16 can store an update status that indicates the status of software updates being performed in the vehicle. As information related to the software update processing, the storage unit 16 can also store information related to an update sequence that indicates the procedure for the software update processing, for issuing control instructions to the OTA master 30.

[0017] The communication unit 17 functions as a transmitter and a receiver that transmits and receives data, information, notifications, requests, and the like to and from the OTA master 30 and the information terminal 95. The communication unit 17 receives a software update confirmation request from the OTA master 30 (receiver). The update confirmation request is information that is transmitted from the OTA master 30 to the center 10, for example, when the power or ignition is turned on in the vehicle (hereinafter referred to as "power ON"), and is information for requesting the center 10 to confirm whether or not there is update data for the electronic control units 50a to 50d based on vehicle configuration information described below. In response to the update confirmation request received from the OTA master 30, the communication unit 17 transmits information indicating the presence or absence of update data to the OTA master 30 (transmitter). The communication unit 17 also receives a distribution package transmission request (download request) from the OTA master 30 (receiver). Furthermore, upon receiving a download request for a distribution package (reception unit), the communication unit 17 transmits to the OTA master 30 (transmission unit) a distribution package including software update data for the electronic control units 50a to 50d, etc., generated by the control unit 18 (described later). Based on instructions from the HMI function unit 20, the communication unit 17 can notify the OTA master 30 or the information terminal 95 that a software update is available and request consent for the software update (transmission unit). The communication unit 17 can also receive, from the OTA master 30 (or the information terminal 95) information about the communication status between the vehicle and the information terminal 95, i.e., information about whether the vehicle and the information terminal 95 are in a linked state (hereinafter referred to as "linkage information") (reception unit). Furthermore, the communication unit 17 can receive, from the OTA master 30 and / or the information terminal 95, a response (update consent notification / update non-consent notification) from the vehicle user, administrator, etc., to the software update consent request (reception unit).

[0018] When the communication unit 17 receives an update check request from the OTA master 30, the control unit 18 determines, based on the update management information stored in the storage unit 16, whether or not software update data is available for the electronic control units 50a-50d installed in the vehicle identified by the vehicle ID included in the update check request. The control unit 18's determination result on whether or not update data is available is transmitted to the OTA master 30 by the communication unit 17. If the control unit 18 determines that software update data is available for the electronic control units 50a-50d, upon receiving a distribution package download request from the OTA master 30, the control unit 18 generates one or more distribution packages including the corresponding update data stored in the storage unit 16. Furthermore, the control unit 18 restricts the software update process for the electronic control units 50a-50d as necessary, based on instructions from the vehicle user or administrator in response to the software update consent request made by the HMI function unit 20 and the state of cooperation between the vehicle and the information terminal 95 determined by the determination unit 19.

[0019] The determination unit 19 determines whether the vehicle and the information terminal 95 are in a linked state based on link information between the vehicle and the information terminal 95 that the communication unit 17 receives from the OTA master 30 (or the information terminal 95). In this embodiment, the linked state between the vehicle and the information terminal 95 refers to a state in which the OTA master 30 and the information terminal 95 are connected to each other so that they can communicate with each other using a predetermined short-range wireless communication method, and the unlinked state between the vehicle and the information terminal 95 refers to a state in which communication between the OTA master 30 and the information terminal 95 using the short-range wireless communication method is interrupted.

[0020] The HMI function unit 20 performs processes such as notifying the information terminal 95 via the communication unit 17 that software updates are available for the electronic control units 50a to 50d installed in the vehicle, requesting consent to the software update, and notifying information such as the software update status, as needed.

[0021] The information terminal 95 is a communication device such as a smartphone owned by a vehicle user or manager. This information terminal 95 can be linked to the vehicle by being registered and managed by the vehicle, and functions as a human-machine interface (HMI) used to perform specific operations related to the vehicle (for example, locking and unlocking the vehicle doors and remote parking operations) and display information. The number of information terminals 95 that can be linked (associated) with the vehicle is not limited to one, and may be multiple.

[0022] (2) In-vehicle network The in-vehicle network 90 includes an OTA master 30, a plurality of electronic control units 50a to 50d, a display device 70, and a communication module 80. The OTA master 30 and the communication module 80 are connected via a bus 60a. The OTA master 30 and the electronic control units 50a and 50b are connected via a bus 60b. The OTA master 30 and the electronic control units 50c and 50d are connected via a bus 60c. The OTA master 30 and the display device 70 are connected via a bus 60d.

[0023] The OTA master 30 can wirelessly communicate with the center 10 via the bus 60a and the communication module 80 and the network 100. The OTA master 30 can also communicate with the information terminal 95 via the bus 60a and the communication module 80 using short-range wireless communication. The OTA master 30 can also communicate with the electronic control units 50a-50d and the display device 70 via buses 60b-60d via wired communication. The OTA master 30 is a device that manages the OTA status and has the function of controlling an update sequence, which is the flow of the software update process, to perform software updates of electronic control units to be updated (hereinafter referred to as "target electronic control units"). The OTA master 30 controls software updates of the target electronic control units among the electronic control units 50a-50d based on update data acquired from the center 10 and the presence or absence of update restrictions according to the state of cooperation between the vehicle and the information terminal 95. The OTA master 30 is sometimes referred to as a central gateway (CGW).

[0024] 4 is a block diagram showing a schematic configuration of the OTA master 30 in FIG. 1. As shown in FIG. 4, the OTA master 30 includes a CPU 31, a RAM 32, a ROM (Read-Only Memory) 33, a storage device 34, and a communication device 36. The CPU 31, RAM 32, ROM 33, and storage device 34 constitute a microcomputer 35. In the OTA master 30, the CPU 31 executes a program read from the ROM 33, using the RAM 32 as a work area, thereby performing predetermined processing related to software update. The communication device 36 is a device for communicating with the communication module 80, the electronic control units 50a to 50d, and the display device 70, respectively, via the buses 60a to 60d shown in FIG. 1.

[0025] Fig. 5 is a functional block diagram of the OTA master 30 shown in Fig. 4. The OTA master 30 shown in Fig. 5 includes a storage unit 37, a communication unit 38, and a control unit 39. The storage unit 37 is realized by the storage device 34 shown in Fig. 4. The communication unit 38 and the control unit 39 are realized by the CPU 31 shown in Fig. 4 executing a program stored in the ROM 33 using the RAM 32.

[0026] The storage unit 37 stores a program for executing software updates for the plurality of electronic control units 50a to 50d (a control program for the OTA master 30), various data used when executing software updates, and software update data downloaded from the center 10. The storage unit 37 can also store information (described later) relating to the type of nonvolatile memory installed in each of the plurality of electronic control units 50a to 50d.

[0027] The communication unit 38 functions as a transmitter and receiver that transmits and receives data, information, notifications, requests, and the like to and from the center 10 and the information terminal 95. The communication unit 38 transmits a software update check request to the center 10, for example, when the vehicle is powered on (transmitter). The update check request includes, for example, a vehicle ID for identifying the vehicle and information regarding the current versions of the software in the electronic control units 50a to 50d connected to the in-vehicle network 90. ​​The vehicle ID and the current versions of the software in the electronic control units 50a to 50d are used to determine whether update data is available for the software in the electronic control units 50a to 50d by comparing them with the latest versions of the software stored by the center 10 for each vehicle ID. The communication unit 38 also receives a notification indicating the availability of update data from the center 10 in response to the update check request (receiver). When there is software update data for the electronic control units 50a to 50d, the communication unit 38 transmits a download request for a distribution package including the software update data and the like to the center 10 (transmitter), and receives (downloads) the distribution package transmitted from the center 10 (receiver). The communication unit 38 also transmits the update status of the software transmitted by the electronic control units 50a to 50d to the center 10 (transmitter). The communication unit 38 can also display the update status of the software on the display device 70 or notify the information terminal 95 based on instructions from the control unit 39.

[0028] The control unit 39 determines whether or not there is software update data for the electronic control units 50a to 50d based on a response from the center 10 to the update confirmation request received by the communication unit 38. The control unit 39 also verifies the authenticity of the update data that the communication unit 38 receives (downloads) from the center 10 in a distribution package and stores in the storage unit 37. The control unit 39 also controls the software update process (installation, activation, etc.) of the electronic control units 50a to 50d using the update data downloaded from the center 10. Specifically, the control unit 39 transfers the downloaded update data to the target electronic control unit and causes the target electronic control unit to install update software based on the update data. After the installation is complete, the control unit 39 instructs the target electronic control unit to activate the installed update software. During this software update process, the control unit 39 performs installation and activation based on information received from the center 10 regarding update process restrictions based on the connection status between the vehicle and the information terminal 95.

[0029] The multiple electronic control units 50a to 50d are devices (ECUs) for controlling the operation of each part of the vehicle. Although FIG. 1 shows an example in which the in-vehicle network 90 includes four electronic control units 50a to 50d, the number of electronic control units is not particularly limited. Furthermore, the number of buses connecting the electronic control units 50a to 50d to the OTA master 30 is not particularly limited. An example of the schematic configuration of the electronic control units 50a to 50d is shown in FIGS. 6A and 6B.

[0030] The electronic control unit 50a shown in FIG. 6A includes a CPU 51, a RAM 52, a nonvolatile memory 53a, and a communication device 54. The CPU 51 executes a program read from the nonvolatile memory 53a using the RAM 52 as a work area, thereby realizing the functions of the electronic control unit 50a. The nonvolatile memory 53a is a memory (hereinafter referred to as a "single-bank memory") having one storage area 55 for storing data such as software. In this embodiment, the memory type of the nonvolatile memory 53a, which is a single-bank memory, may be referred to as a "first type" to distinguish it from other types. The storage area 55 may store, in addition to software for realizing the functions of the electronic control unit 50a, version information, parameter data, a boot program for startup, a program for software update, and the like. The communication device 54 is a device for communicating with the OTA master 30 and other electronic control units 50b to 50d connected to the in-vehicle network 90.

[0031] The electronic control unit 50b shown in FIG. 6B includes a CPU 51, a RAM 52, a nonvolatile memory 53b, and a communication device 54, similar to the electronic control unit 50a. However, the nonvolatile memory 53b installed in the electronic control unit 50b is a memory having two storage areas 56a and 56b for storing data such as software (hereinafter referred to as a "dual bank memory"). In this embodiment, the memory type of the nonvolatile memory 53b, which is a dual bank memory, may be referred to as a "second type" to distinguish it from other types. In addition to software for implementing the functions of the electronic control unit 50b, the storage areas 56a and 56b may store version information, parameter data, a boot program for startup, a program for software update, and the like. The CPU 51 of the electronic control unit 50b selects one of the two storage areas 56a and 56b of the nonvolatile memory 53b as the storage area to be read (operational side) and executes the software stored in the storage area to be read. In the other storage area (non-operational side) that is not the read target, update software (an updated program) based on the update data can be installed (written) in the background while the program in the storage area (operational side) that is the read target is being executed. When activating (enabling update software) in the software update process, the update software can be activated by switching the storage area that is the read target of the program by the CPU 51 of the electronic control unit 50b.

[0032] As a specific example, assume that current software is stored in storage area 56a of nonvolatile memory 53b, which is a dual-bank memory, and update software is installed in storage area 56b. When an instruction to activate the update software is received from OTA master 30, for example, electronic control unit 50b switches the read start address of CPU 51 from the first address of storage area 56a to the first address of storage area 56b, thereby switching the storage area that CPU 51 reads from (the operational side) and executing the update software installed in storage area 56b. Note that in this disclosure, a nonvolatile memory configuration called a "single-side suspend memory," in which one storage area is virtually partitioned into two sides and a program can be written to one side while the other side is running, is also classified as the second type of memory.

[0033] 7 shows an example of type information, which is information relating to the type of nonvolatile memory installed in each of the multiple electronic control units 50a to 50d. In the type information illustrated in FIG. 7, an ECU_ID, which is a number for identifying an electronic control unit, is associated with the type of nonvolatile memory installed in that electronic control unit (first type (single bank) / second type (dual bank)). This type information is stored and managed at least in the storage unit 16 of the center 10. The type information is created in advance based on the specifications of the electronic control units 50a to 50d that make up the in-vehicle network 90, and may be stored in the storage unit 16 or the like when the vehicle is manufactured, or may be obtained from the target electronic control unit through communication within the in-vehicle network 90 during a software update process.

[0034] The display device 70 is a human-machine interface (HMI) used to perform various displays, such as displaying the presence of update data during software update processing for the electronic control units 50a to 50d, displaying a consent request screen to request consent for the software update from the vehicle user or administrator, and displaying the results and status of the software update. A typical example of the display device 70 is a display device for a car navigation system, but it is not particularly limited as long as it can display information required during software update processing. In addition to the display device 70, electronic control units and the like may also be connected to the bus 60d shown in FIG. 1.

[0035] The communication module 80 is a unit having a function of controlling communication between the center 10 and the vehicle, and is a communication device for connecting the in-vehicle network 90 to the center 10. The communication module 80 is wirelessly connected to the center 10 via the network 100, and performs vehicle authentication by the OTA master 30, downloading update data, and the like. The communication module 80 can also be wirelessly connected to the information terminal 95 without going through the network 100. A short-range wireless communication method such as Bluetooth (registered trademark) or RF / LF communication can be used for the wireless connection with the information terminal 95. The communication module 80 may be configured as part of the OTA master 30.

[0036] [Software update process overview] The OTA master 30 transmits a software update check request to the center 10, for example, when the vehicle is powered on. The update check request includes a vehicle ID for identifying the vehicle and vehicle configuration information, which is information about the status (system configuration) of the electronic control units 50a to 50d connected to the in-vehicle network 90, such as the current versions of the hardware and software of the electronic control units 50a to 50d. The vehicle configuration information can be created by acquiring the identification numbers (ECU_IDs) of the electronic control units 50a to 50d and the identification numbers (ECU_Software_IDs) of the software versions of the electronic control units 50a to 50d from the in-vehicle network 90. ​​The vehicle IDs and the current software versions of the electronic control units 50a to 50d are used to determine whether or not update data is available for the software of the electronic control units 50a to 50d by comparing them with the latest versions of the software stored by the center 10 for each vehicle ID. In response to the update check request received from the OTA master 30, the center 10 transmits a notification indicating the availability of update data to the OTA master 30 and / or the information terminal 95. When there is update data for the software of the electronic control units 50a to 50d, the OTA master 30 transmits a download request for a distribution package to the center 10. In response to the download request received from the OTA master 30, the center 10 transmits a distribution package including the update data and the like to the OTA master 30. In addition to the update data, the distribution package may also include verification data for verifying the authenticity of the update data, the number and type of update data, various control information used during the software update, and the like.

[0037] The OTA master 30 determines whether or not there is software update data for the electronic control units 50a to 50d based on the response to the update confirmation request received from the center 10. The OTA master 30 also verifies the authenticity of the distribution package received from the center 10 and stored in the storage device 13. The OTA master 30 also transfers the update data downloaded in the distribution package to the target electronic control unit and causes the target electronic control unit to install the update data. After the installation is complete, the OTA master 30 instructs the target electronic control unit to activate the installed updated software.

[0038] Furthermore, in the consent request process, the center 10 causes an output device to output a notification that consent is required for the software update or a notification prompting input indicating consent to the software update. Examples of the output device that can be used include the display device 70 and the information terminal 95 provided in the in-vehicle network 90. ​​For example, when the display device 70 is used as the output device in the consent request process, the OTA master 30 can cause the display device 70 to display an consent request screen for requesting consent to the software update from the user or administrator, or a notification prompting a specific input operation, such as pressing an consent button, if the user or administrator consents. When the information terminal 95 is used as the output device in the consent request process, the OTA master 30 can cause the display screen of the information terminal 95 to display an consent request for requesting consent to the software update from the user or administrator, or a notification prompting a specific input operation, such as pressing an consent button, if the user or administrator consents. Furthermore, in the consent request process, the center 10 can display on the display device 70 or the information terminal 95, a message or an icon notifying that update data for the software of the electronic control units 50a to 50d is available, and can display on the display device 70 or the information terminal 95 any restrictions that may apply during the execution of the software update process. When the center 10 receives input from the user or administrator via the OTA master 30 and / or the information terminal 95 indicating consent, it instructs the OTA master 30 to execute the above-mentioned installation and activation control processes, and updates the software of the target electronic control units.

[0039] Here, if the nonvolatile memory of the target electronic control unit is a single-bank memory having one storage area for storing data such as software, in principle, installation and activation are performed consecutively, so consent request processing for the software update is performed before installation. Note that even if the target electronic control unit has a single-bank memory, depending on the information regarding the update sequence instructed by the center 10, it may be requested to temporarily stop the update processing after installation is complete, that is, to suspend (wait) activation. Also, if the nonvolatile memory of the target electronic control unit is a dual-bank memory having two storage areas for storing data such as software, consent request processing for the software update is performed at least after installation and before activation. Note that if the nonvolatile memory of the target electronic control unit is a dual-bank memory, consent request processing for the software update before installation may be performed or may be omitted.

[0040] The software update process consists of a phase (download phase) in which the OTA master 30 downloads update data from the center 10, a phase (installation phase) in which the OTA master 30 transfers the downloaded update data to the target electronic control unit and installs update software based on the update data in the storage area of ​​the target electronic control unit, and a phase (activation phase) in which the target electronic control unit activates the installed update software.

[0041] Downloading is a process in which the OTA master 30 receives update data for updating the software of the electronic control unit, which data has been transmitted from the center 10 in a distribution package, and stores the data in the storage unit 37. When receiving update data by download, the download phase not only executes the download, but also includes control of a series of processes related to the download, such as determining whether the download can be executed and verifying the update data.

[0042] The update data transmitted from the center 10 to the OTA master 30 may include update software for the electronic control unit (all data or difference data), compressed data obtained by compressing the update software, or divided data obtained by dividing the update software or compressed data. The update data may also include the ECU_ID (or serial number) of the target electronic control unit and the ECU_Software_ID of the target electronic control unit before the update. The update data is downloaded as the distribution package described above, and the distribution package includes update data for a single electronic control unit or multiple electronic control units.

[0043] Installation is a process in which the OTA master 30 writes update software (an updated program) into the non-volatile memory of the target electronic control unit based on update data downloaded from the center 10. In the installation phase of this embodiment, the installation phase not only executes the installation, but also includes control of a series of processes related to the installation, such as determining whether or not the installation can be executed, transferring the update data, and verifying the update software.

[0044] If the update data includes the update software itself (all data), the OTA master 30 transfers the update data (update software) to the target electronic control unit in the installation phase. If the update data includes compressed data, differential data, or divided data of the update software, the OTA master 30 may transfer the update data to the target electronic control unit, and the target electronic control unit may generate the update software from the update data, or the OTA master 30 may generate the update software from the update data and then transfer the update software to the target electronic control unit. Here, the update software can be generated by decompressing the compressed data or assembling (integrating) the differential data or divided data.

[0045] The target electronic control unit can install the update software based on an installation request from the OTA master 30, in accordance with update restrictions (described later) based on the cooperation status between the vehicle and the information terminal 95 received from the center 10. Note that for a specific target electronic control unit that has received update data, installation may be performed autonomously without receiving an explicit instruction from the OTA master 30.

[0046] Activation is a process in which the target electronic control unit activates the update software installed in its own non-volatile memory. The activation phase not only executes the activation, but also includes a series of controls related to the activation, such as determining whether or not to execute the activation, requesting consent from the vehicle user or administrator for the activation, and verifying the execution results.

[0047] The target electronic control unit can activate the update software based on an activation request from the OTA master 30, in accordance with update restrictions (described later) based on the cooperation status between the vehicle and the information terminal 95 received from the center 10. Note that a specific target electronic control unit that has received update data may autonomously activate the software after installation is complete, without receiving an explicit instruction from the OTA master 30.

[0048] The software update process can be performed consecutively or in parallel for each of the multiple target electronic control units.

[0049] Furthermore, the term "software update processing" in this specification includes not only processing in which downloading, installing, and activating are all performed consecutively, but also processing in which only some of downloading, installing, and activating are performed.

[0050] [process] Next, with further reference to FIGS. 8A, 8B, 9A, and 9B, several specific examples of software update processing executed in the network system according to this embodiment will be described.

[0051] (1) Example 1 8A and 8B are flowcharts illustrating the steps of the software update process according to specific example 1 performed by the center 10. The process of FIG. 8A and the process of FIG. 8B are connected by a connector X. The software update process according to specific example 1 is an example in which the center 10 updates the vehicle software in accordance with update consent from the information terminal 95 when the target electronic control unit that implements the software that requires updating is equipped with a dual bank memory.

[0052] (Step S801) The center 10 determines whether or not there is software that needs to be updated in the target vehicle. This determination can be made based on, for example, the current version of the software in each of the electronic control units 50a to 50d installed in the vehicle, which is obtained from the vehicle configuration information included in the update confirmation request transmitted from the OTA master 30, and the latest version of each software stored in the storage unit 16 of the center 10. Only if there is software that needs to be updated in the target vehicle (step S801, YES), the process proceeds to step S802.

[0053] (Step S802) The center 10 determines whether or not the download of update software (software based on update data) by the information terminal 95 has been approved. This determination can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update approval notice) to the download approval request sent by the center 10 to the information terminal 95. Only if the download of update software by the information terminal 95 has been approved (step S802, Yes), the process proceeds to step S803.

[0054] (Step S803) The center 10 transmits the update software to the OTA master 30, causing the OTA master 30 to download the update software. A predetermined distribution package can be used to transmit the update software. When the OTA master 30 has completed downloading the update software, the process proceeds to step S804.

[0055] (Step S804) The center 10 determines whether or not the installation of the update software has been approved by the information terminal 95. This determination can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update approval notification) to the installation approval request sent by the center 10 to the information terminal 95. Only if the installation of the update software has been approved by the information terminal 95 (step S804, Yes), the process proceeds to step S805.

[0056] (Step S805) The center 10 causes the OTA master 30 and the target electronic control unit to execute installation, which is a process of transferring and writing the update software downloaded by the OTA master 30 to the target electronic control unit. When installation of the update software in the target electronic control unit is complete, the process proceeds to step S806.

[0057] (Step S806) The center 10 determines whether or not the activation of the updated software has been consented to by the information terminal 95. This determination can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update consent notification) to the activation consent request sent by the center 10 to the information terminal 95. Only if the activation of the updated software has been consented to by the information terminal 95 (step S806, Yes), the process proceeds to step S807.

[0058] (Step S807) The center 10 acquires collaboration information indicating the collaboration status between the vehicle and the information terminal 95. Examples of the collaboration information include "collaboration OK" if the vehicle and the information terminal 95 are connected via short-range wireless communication, and "collaboration NG" if the vehicle and the information terminal 95 are not connected via short-range wireless communication. This collaboration information is basically acquired from the vehicle (OTA master 30), but may also be acquired from the information terminal 95. Once the collaboration information between the vehicle and the information terminal 95 is acquired, the process proceeds to step S808.

[0059] (Step S808) The center 10 determines whether the vehicle and the information terminal 95 are linked based on the link information acquired in step S807. The information terminal 95 that is the target of this determination is the information terminal 95 that has consented to the activation. If it is determined that the information terminal 95 that has consented to the activation is linked with the vehicle (step S808, Yes), the process proceeds to step S809, and if it is determined that the information terminal 95 that has consented to the activation is not linked with the vehicle and has been disconnected (step S808, No), the process proceeds to step S807.

[0060] (Step S809) The center 10 permits activation, which is a process for validating the update software installed in the target electronic control unit, and causes the OTA master 30 and the target electronic control unit to execute the activation. When activation of the update software in the target electronic control unit is completed, this software update process ends.

[0061] (2) Example 2 9A and 9B are flowcharts illustrating the steps of the software update process according to specific example 2 performed by the center 10. The process of FIG. 9A and the process of FIG. 9B are connected by a connector Y. The software update process according to specific example 2 is an example in which the center 10 updates the vehicle software in accordance with update consent from the information terminal 95 when the target electronic control unit that implements the software that requires updating is equipped with a single bank memory.

[0062] (Step S901) The center 10 determines whether or not there is software that needs to be updated in the target vehicle. This determination can be made based on, for example, the current version of the software in each of the electronic control units 50a to 50d installed in the vehicle, which is obtained from the vehicle configuration information included in the update confirmation request transmitted from the OTA master 30, and the latest version of each software stored in the storage unit 16 of the center 10. Only if there is software that needs to be updated in the target vehicle (step S901, YES), the process proceeds to step S902.

[0063] (Step S902) The center 10 determines whether or not the download of update software (software based on update data) by the information terminal 95 has been approved. This determination can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update approval notice) to the download approval request sent by the center 10 to the information terminal 95. Only if the download of update software by the information terminal 95 has been approved (step S902, Yes), the process proceeds to step S903.

[0064] (Step S903) The center 10 transmits the update software to the OTA master 30, causing the OTA master 30 to download the update software. A predetermined distribution package can be used to transmit the update software. When the OTA master 30 has completed downloading the update software, the process proceeds to step S904.

[0065] (Step S904) The center 10 determines whether or not the installation of the update software has been approved by the information terminal 95. This determination can be made, for example, by the center 10 receiving from the information terminal 95 a response (such as an update approval notification) to the installation approval request sent by the center 10 to the information terminal 95. Only if the installation of the update software has been approved by the information terminal 95 (step S904, Yes), the process proceeds to step S905.

[0066] (Step S905) The center 10 acquires collaboration information indicating the collaboration status between the vehicle and the information terminal 95. Examples of the collaboration information include "collaboration OK" if the vehicle and the information terminal 95 are connected via short-range wireless communication, and "collaboration NG" if the vehicle and the information terminal 95 are not connected via short-range wireless communication. This collaboration information is basically acquired from the vehicle (OTA master 30), but may also be acquired from the information terminal 95. Once the collaboration information between the vehicle and the information terminal 95 is acquired, the process proceeds to step S906.

[0067] (Step S906) The center 10 determines whether the vehicle and the information terminal 95 are linked based on the link information acquired in step S905. The information terminal 95 that is the target of this determination is the information terminal 95 that consented to the installation. If it is determined that the information terminal 95 that consented to the installation is linked with the vehicle (step S906, Yes), the process proceeds to step S907, and if it is determined that the information terminal 95 that consented to the installation is not linked with the vehicle and has been disconnected (step S906, No), the process proceeds to step S905.

[0068] (Step S907) The center 10 permits installation, which is a process of transferring and writing the update software downloaded by the OTA master 30 to the target electronic control unit, and causes the OTA master 30 and the target electronic control unit to execute the installation. Furthermore, the center 10 causes the OTA master 30 and the target electronic control unit to execute activation, which is a process of validating the update software installed in the target electronic control unit. When the installation and activation of the update software in the target electronic control unit are completed, this software update process ends.

[0069] In the above-described specific examples 1 and 2, when the information terminal 95 that has consented to the installation or activation is not linked with the vehicle and communication is interrupted before the installation or activation process, the information terminal 95 waits until the link between the information terminal 95 and the vehicle is restored (communication is restored) before performing (permitting) the installation and activation process of the update software. However, when the information terminal 95 is not linked with the vehicle and communication is interrupted before the installation or activation process, the update process may be immediately canceled without waiting for the link to be restored (communication is restored) (i.e., the software update process ends with "No" in step S808 of FIG. 8B, and the software update process ends with "No" in step S906 of FIG. 9B).

[0070] <Actions and Effects> As described above, according to the network system according to an embodiment of the present disclosure, when the information terminal 95 approves a software update for a target electronic control unit installed in a vehicle, the center 10 further imposes necessary restrictions on the software update process based on the state of cooperation between the information terminal 95 and the vehicle. More specifically, if the nonvolatile memory of the target electronic control unit is a dual-bank memory, the center 10 does not permit processes subsequent to activation, which validates the updated software installed in the target electronic control unit, even if approval has been granted. Furthermore, if the nonvolatile memory of the target electronic control unit is a single-bank memory, the center 10 does not permit processes subsequent to installation, which writes the updated software to the target electronic control unit, even if approval has been granted.

[0071] This restriction process allows the update process to be permitted only when the information terminal 95 that has given the update consent is in the vicinity of the vehicle, for example, in cases where the consent process must be performed via an information terminal 95 that is linked (associated) with the vehicle, such as in a vehicle that is not equipped with a function that can present information about software updates via OTA. This makes it possible to complete the software update safely and in a short time.

[0072] Furthermore, according to the network system of this embodiment, if the nonvolatile memory of the target electronic control unit is a dual-bank memory, the update process can proceed up to installation, and then activate and subsequent processes can be executed as soon as the connection between the information terminal 95 and the vehicle is restored. If the nonvolatile memory of the target electronic control unit is a single-bank memory, the update process can proceed up to download, and then install and subsequent processes can be executed as soon as the connection between the information terminal 95 and the vehicle is restored. This allows the software update process of the electronic control unit installed in the vehicle to be appropriately controlled.

[0073] In the above embodiment, the software update process is restricted based only on the state of cooperation between the vehicle and the information terminal 95, but it may also be restricted in combination with the vehicle's traveling state. For example, when communication between the vehicle and the information terminal 95 is interrupted and the vehicle is traveling, the software update process can be restricted.

[0074] In addition, in the above embodiment, an example was described in which the restriction on the software update process is lifted when communication between the vehicle and the information terminal 95 is interrupted but then restored, but the software update process may be stopped without lifting the restriction. [Industrial Applicability]

[0075] The disclosed technology can be used in a network system for updating software in an electronic control unit mounted on a vehicle. [Explanation of symbols]

[0076] 10 Center 11, 31, 51 CPUs 12, 32, 52 RAM 13, 34 Storage device 14, 36, 54 Communication equipment 16, 37 Memory section 17, 38 Communications Department 18, 39 Control section 19 Judgment section 20 HMI function section 30 OTA Master 33 ROM 35 Microcomputer 50a~50d Electronic Control Unit (ECU) 53a, 53b Non-volatile memory 55, 56a, 56b storage areas 60a~60d Bus 70 Display device 80 Communication Module 90 In-vehicle network 95 Information terminal 100 Network

Claims

1. A center that controls software updates for electronic control units mounted on vehicles, a communication unit that communicates between the vehicle and an information terminal associated with the vehicle; a control unit that controls the software update process based on an update acceptance notification received by the communication unit from the information terminal; The control unit restricts the software update process when communication between the vehicle and the information terminal is interrupted even if the communication unit receives the update acceptance notification.

2. When the communication unit receives the update acceptance notification and communication between the vehicle and the information terminal is interrupted, The center described in claim 1, wherein the control unit does not allow processing after activation to enable the update software written to the storage area if the electronic control unit to be updated is equipped with a non-volatile memory having two storage areas.

3. When the communication unit receives the update acceptance notification and communication between the vehicle and the information terminal is interrupted, The center described in claim 1, wherein the control unit does not allow processing after installation of writing update software to the storage area if the electronic control unit to be updated is equipped with a non-volatile memory having one storage area.

4. The center according to claim 2 , wherein the control unit permits the activation and subsequent processes when communication between the vehicle and the information terminal is restored.

5. The center according to claim 3 , wherein the control unit allows the installation and subsequent processes when communication between the vehicle and the information terminal is restored.

6. A method executed by a center that controls software updates for an electronic control unit mounted on a vehicle, the method comprising: communicating between the vehicle and an information terminal associated with the vehicle; and controlling the software update process based on an update acceptance notification received from the information terminal, The method, wherein the controlling step limits the software update process when communication between the vehicle and the information terminal is interrupted even if the update acceptance notice is received.

7. A method executed by a computer at a center that controls software updates for an electronic control unit mounted on a vehicle, the method comprising: communicating between the vehicle and an information terminal associated with the vehicle; and controlling the software update process based on an update acceptance notification received from the information terminal, The program wherein the controlling step limits the software update process when communication between the vehicle and the information terminal is interrupted even if the update acceptance notice is received.

Images