Update management device, update management system and computer program

Abstract

To provide an update management device, an update management system, and a computer program for installing and activating software on each ECU with update data, even when the ECUs on a vehicle having multiple power supply states cooperate with each other to actuate a function, thereby allowing a predetermined system to operate consistently.SOLUTION: An update management system 1 manages software update of an in-vehicle device in a vehicle having a plurality of power supply states, including a first power supply state and a second power supply state. An update management ECU includes: a receiving unit for receiving first update data and second update data from an external device of the vehicle; a determination unit that determines whether the power supply state of the vehicle is the first power supply state or the second power supply state; a first transmission unit for transmitting the first update data to the in-vehicle device if the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second transmission unit for transmitting the first update data and the second update data to the in-vehicle device if the determination unit determines that the power supply state of the vehicle is the second power supply state.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an update management device, an update management system, and a computer program. [Background technology]

[0002] In-vehicle devices are known that are installed in vehicles and connected to multiple ECUs (Electronic Control Units). In recent years, vehicle power supplies have become more complex and their power supply states have become more diverse. In addition, with the diversification of vehicle control, such as parking assistance systems, the opportunities for updating software installed in ECUs have also increased.

[0003] Patent Document 1 discloses a vehicle master device that acquires update data from an external source, instructs an ECU to be rewritten to install the update data using the acquired update data, and distributes the acquired update data to the ECU to be rewritten. The vehicle master device includes an installation condition determination unit that determines whether all of the following conditions are met: a first condition that user consent for installation has been obtained, a second condition that data communication with a center device is possible, a third condition that the vehicle state is in a state where installation is possible, a fourth condition that the ECU to be rewritten is in a state where installation is possible, and a fifth condition that the update data is normal data; and an installation instruction unit that instructs the electronic control unit to be rewritten to install the update data when the installation condition determination unit determines that all of the first condition, the second condition, the third condition, the fourth condition, and the fifth condition are met. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-27629 Summary of the Invention [Problem to be solved by the invention]

[0005] There are known vehicles equipped with multiple ECUs and having multiple power states, including a +B state, which is a power state when the vehicle cannot run, and an IG state, which is a power state when the vehicle can run. For example, a first ECU may be installed with first software that operates in the +B state and the IG state, and second software that does not operate in the +B state but operates in the IG state, and a second ECU may be installed with third software that does not operate in the +B state but operates in the IG state, and the second software and third software may work together to operate a predetermined system.

[0006] When the first software and second software of the first ECU are updated with update data, the first software and second software are installed on a single first ECU, so they can be activated even in the +B state. Meanwhile, the second ECU has third software installed, which operates in the IG state. Therefore, when the power state transitions to the IG state, the third software begins installation and activation with the update data. If the second software of the first ECU is already activated in the +B state, the second software may issue a command to the third software of the second ECU when the power state transitions to the IG state. However, the third software of the second ECU has just started installation, so it may not understand the command issued by the second software of the first ECU, which could cause the specified system to malfunction.

[0007] The vehicle master device of Patent Document 1 can handle one ECU, but cannot handle a case where a predetermined system operates in cooperation with multiple ECUs in a vehicle having multiple power supply states.

[0008] In view of such problems, the present disclosure aims to provide an update management device that installs and activates software in each ECU using update data, allowing a specified system to operate without discrepancies, even when multiple ECUs in a vehicle with multiple power states work together to operate functions. [Means for solving the problem]

[0009] The update management device of the present disclosure is an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, and a first storage unit that, when the determining unit determines that the power state of the vehicle is the first power state, stores the update data in the first storage unit. and a second memory unit, a first transmission unit that transmits the first update data to the in-vehicle device so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software, and a second transmission unit that transmits the first update data and the second update data to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state so that the in-vehicle device installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0010] The update management system of the present disclosure is an update management system that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, wherein the update management system includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, a first storage unit and a second storage unit, and a first transmitting unit that, when the determining unit determines that the power state of the vehicle is the first power state, installs the updated first software in the first storage unit and transmits the first update data to the in-vehicle device to activate the updated first software, and when the determining unit determines that the power state of the vehicle is the second power state, a second transmission unit that transmits the first update data and the second update data to the in-vehicle device to install the updated first software and the updated second software into a second storage unit and activate the updated first software and the updated second software; a first instruction unit that transmits a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit that transmits a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when the determination unit determines that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device includes a first activation unit that activates the updated first software installed in the first storage unit when the in-vehicle device receives the first activation instruction, and a second instruction unit that activates the updated first software installed in the first storage unit when the determination unit receives the second activation instruction.and a second activation unit that activates the updated first software and the updated second software installed in the second storage unit.

[0011] A computer program disclosed herein is a computer program for controlling an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a determining step of determining whether the power state of the vehicle is the first power state or the second power state; and, when it is determined that the power state of the vehicle is the first power state, A computer program for controlling an update management device, comprising: a first transmission step in which the in-vehicle device, which has a memory unit and a second memory unit, transmits the first update data to the in-vehicle device so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software; and a second transmission step in which, when it is determined that the power supply state of the vehicle is the second power supply state, the in-vehicle device transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0012] The update management device disclosed herein is an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining unit that creates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a memory unit that stores the combined update data. memory a transmitting unit that transmits the composite update data to the on-board device to install the composite software into the on-board device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state.

[0013] The update management system of the present disclosure is an update management system for a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management system including an update management device for managing software updates for an in-vehicle device and the in-vehicle device, the update management device including a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining unit that creates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a memory unit that stores the combined update data. memorya transmitting unit that transmits the combined update data to the in-vehicle device to install the combined software in a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state; a determining unit that determines whether the power supply state of the vehicle is the first power supply state or the second power supply state; a first instruction unit that transmits a first activation instruction to the in-vehicle device to activate the first function when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit that transmits a second activation instruction to the in-vehicle device to activate the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device includes a first activation unit that activates the first function when the first activation instruction is received, and a second activation unit that activates the second function when the second activation instruction is received.

[0014] A computer program disclosed herein is a computer program for controlling an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a combining step of creating, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and a storage unit for storing the combined update data. memorya transmitting step of transmitting the composite update data to the in-vehicle device to install the composite software to a unit, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram illustrating an example of an update management system. [Figure 2] FIG. 2 is a block diagram showing an example of the internal configuration of an update management ECU. [Figure 3] FIG. 2 is a block diagram showing an example of the internal configuration of an ECU. [Figure 4] 2 is a functional block diagram of an update management ECU according to the first embodiment. FIG. [Figure 5] 1 is a table showing an example of an ECU table that lists ECUs. [Figure 6] 1 is a table showing an example of an ECU table that lists ECUs. [Figure 7] 3 is a flowchart showing a control method according to the first embodiment. [Figure 8] FIG. 2 is a sequence diagram of the update management system according to the first embodiment. [Figure 9] FIG. 10 is a functional block diagram of an update management ECU according to a second embodiment. [Figure 10] 10 is a flowchart showing a control method according to a second embodiment. [Figure 11] FIG. 10 is a sequence diagram of an update management system according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] [Description of the embodiments of the present disclosure] The gist of the present disclosure includes the following configurations.

[0017] (1) An update management device disclosed herein is an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, and when the determining unit determines that the power state of the vehicle is the first power state, an update management device comprising: a first transmission unit that transmits the first update data to the in-vehicle device, the in-vehicle device having a first memory unit and a second memory unit, so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software; and a second transmission unit that transmits the first update data and the second update data to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state, so that the in-vehicle device installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0018] With this configuration, the update management device transmits update data to the in-vehicle device to alternately install and activate software in the two storage units of the in-vehicle device depending on the vehicle's power supply status. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times depending on the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0019] (2) In the update management device of (1), the update management device may further include a first instruction unit that sends a first activation instruction to the in-vehicle device to activate the updated first software installed in the first memory unit when the determination unit determines that the power supply state of the vehicle is the first power supply state, and a second instruction unit that sends a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second memory unit when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0020] With this configuration, the update management device installs and activates software in the on-board device using update data according to the vehicle's power supply status. This allows the software in the on-board device to be updated and activated sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation with each other without any discrepancies.

[0021] (3) In the update management device of (1), the update management device may further include a first erasure instruction unit that transmits a first erasure instruction to the in-vehicle device when the pre-update first software and the pre-update second software are installed in the second memory unit and the updated first software is installed in the first memory unit, to erase the pre-update first software and the pre-update second software from the second memory unit, and a second erasure instruction unit that transmits a second erasure instruction to the in-vehicle device when the updated first software is installed in the first memory unit and the updated first software and the updated second software are installed in the second memory unit, to erase the updated first software from the first memory unit.

[0022] With this configuration, the update management device installs software in one storage unit, activates it in the in-vehicle device, and then erases the software in the other storage unit, which makes the storage unit where the next software will be installed empty, allowing the next software to be installed.

[0023] (4) In the update management device of (1), the first power supply state may be a power supply state when the vehicle is in a state where it cannot run, and the second power supply state may be a power supply state when the vehicle is in a state where it can run.

[0024] With this configuration, the update management device transmits update data for alternately installing and activating software in the two storage units of the in-vehicle device to the in-vehicle device according to the power state when the vehicle can be driven and the power state when the vehicle cannot be driven. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power state, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0025] (5) In the update management device of (1) above, the receiving unit may receive the first update data and the second update data from the external device while the power state is the first power state.

[0026] With this configuration, update data is downloaded to the update management device in the first power state, so that the software is quickly installed and activated after transition to the second power state.

[0027] (6) The update management system of the present disclosure is an update management system including the update management device according to any one of (1) to (5) above and the in-vehicle device.

[0028] (7) An update management system according to the present disclosure is an update management system that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, wherein the update management device includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a determining unit that determines whether the power state of the vehicle is the first power state or the second power state, a first storage unit and a second storage unit, and a first transmitting unit that, when the determining unit determines that the power state of the vehicle is the first power state, installs the updated first software in the first storage unit and transmits the first update data to the in-vehicle device to activate the updated first software, and when the determining unit determines that the power state of the vehicle is the second power state, transmits the first update data to the in-vehicle device. a second transmission unit that transmits the first update data and the second update data to the in-vehicle device to install the updated first software and the updated second software in a second storage unit and activate the updated first software and the updated second software; a first instruction unit that transmits a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit when the determination unit determines that the power supply state of the vehicle is the first power supply state; and a second instruction unit that transmits a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when the determination unit determines that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device includes a first activation unit that activates the updated first software installed in the first storage unit when the in-vehicle device receives the first activation instruction, and a second instruction unit that activates the updated first software installed in the first storage unit when the determination unit receives the second activation instruction.and a second activation unit that activates the updated first software and the updated second software installed in the second storage unit.

[0029] With this configuration, the update management device transmits update data to the in-vehicle device for alternately installing and activating software in the two storage units of the in-vehicle device. The in-vehicle device then installs and activates the software based on the transmitted update data according to the vehicle's power supply status. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times according to the power supply status, ensuring seamless operation of the software of multiple ECUs working together.

[0030] (8) In the update management device of (7), the update management system may further include a first erasure unit in the in-vehicle device that erases the pre-update first software and the pre-update second software from the second memory unit when the pre-update first software and the pre-update second software are installed in the second memory unit and the first software is installed in the first memory unit, and a second erasure unit that erases the post-update first software from the first memory unit when the post-update first software is installed in the first memory unit and the post-update first software and the post-update second software are installed in the second memory unit.

[0031] With this configuration, the update management system installs software in one storage unit of the in-vehicle device, activates the in-vehicle device, and then erases the software in the other storage unit, which empties the storage unit of the in-vehicle device where the next software will be installed, allowing the next software to be installed.

[0032] (9) A computer program disclosed herein is a computer program for controlling an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a determining step of determining whether the power state of the vehicle is the first power state or the second power state; and when it is determined that the power state of the vehicle is the first power state, A computer program for controlling an update management device, comprising: a first transmission step in which the in-vehicle device, which has a first memory unit and a second memory unit, transmits first update data to the in-vehicle device so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software; and a second transmission step in which, when the power supply state of the vehicle is determined to be the second power supply state, the in-vehicle device transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second memory unit and activates the updated first software and the updated second software.

[0033] With this configuration, the update management device transmits update data to the in-vehicle device to alternately install and activate software in the two storage units of the in-vehicle device depending on the vehicle's power supply status. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times depending on the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0034] (10) An update management device disclosed herein is an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining unit that creates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a memory unit. memory a transmitting unit that transmits the composite update data to the on-board device to install the composite software into the on-board device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state.

[0035] With this configuration, the update management device creates combined update data from the two update data for updating the two pieces of software, installs it in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the vehicle's power supply status. This updates the software in the in-vehicle device and activates it sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0036] (11) In the update management device of (10), the update management device may further include a judgment unit that judges whether the power supply state of the vehicle is the first power supply state or the second power supply state, a first instruction unit that sends a first activation instruction to the in-vehicle device to activate the first function when the judgment unit judges that the power supply state of the vehicle is the first power supply state, and a second instruction unit that sends a second activation instruction to the in-vehicle device to activate the second function when the judgment unit judges that the power supply state of the vehicle is the second power supply state.

[0037] With this configuration, the update management device activates software in the in-vehicle device according to the vehicle's power supply status. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation with each other without any discrepancies.

[0038] (12) In the update management device of (11), when the determination unit determines that the power supply state of the vehicle is the first power supply state, it stores information indicating the first power supply state in a state memory unit that stores information indicating a power supply state, and when the determination unit determines that the power supply state of the vehicle is the second power supply state, it stores information indicating the second power supply state in the state memory unit, and the first instruction unit may refer to the state memory unit and, when information indicating the first power supply state is stored, send the first activation instruction to the in-vehicle device, and the second instruction unit may refer to the state memory unit and, when information indicating the second power supply state is stored, send the second activation instruction to the in-vehicle device.

[0039] With this configuration, the update management device activates software in the on-board device based on information indicating the vehicle's power supply status. This allows the software in the on-board device to be updated and activated sequentially at appropriate times depending on the power supply status, ensuring that the software of multiple ECUs operates in cooperation with each other without any discrepancies.

[0040] (13) In the update management device of (10), the first power supply state may be a power supply state when the vehicle is in a state where it cannot run, and the second power supply state may be a power supply state when the vehicle is in a state where it can run.

[0041] With this configuration, the update management device creates combined update data from the two update data for updating the two pieces of software, installs the combined update data in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the vehicle's power supply status. As a result, the software in the in-vehicle device is updated and activated sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0042] (14) In the update management device of (10), the receiving unit may receive the first update data and the second update data from the external device while the power state is the first power state.

[0043] With this configuration, update data is downloaded to the update management device in the first power state, so that the software is quickly installed and activated after transition to the second power state.

[0044] (15) The update management system of the present disclosure is an update management system including the update management device according to any one of (10) to (14) above and the in-vehicle device.

[0045] (16) An update management system according to the present disclosure is an update management system for a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the update management system including an update management device for managing software updates for an in-vehicle device and the in-vehicle device, the update management device including a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining unit that creates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a memory unit that stores the combined update data. memory a transmitting unit that transmits the combined update data to the in-vehicle device in order to install the combined software in a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state; a determining unit that determines whether the power supply state of the vehicle is the first power supply state or the second power supply state; and a first instruction unit that transmits a first activation instruction to the in-vehicle device to activate the first function when the determining unit determines that the power supply state of the vehicle is the first power supply state. an instruction unit that transmits a second activation instruction to the in-vehicle device to activate the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state, and the in-vehicle device includes a first activation unit that activates the first function when the first activation instruction is received, and a second activation unit that activates the second function when the second activation instruction is received.

[0046] With this configuration, the update management device creates combined update data from the two update data sets for updating the two pieces of software, installs the combined update data in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the vehicle's power supply status. The update management device then sends an activation instruction to the in-vehicle device according to the vehicle's power supply status, causing the in-vehicle device to activate the software. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times according to the power supply status, ensuring seamless operation of the software in multiple ECUs working together.

[0047] (17) In the update management system of (16), when the determination unit determines that the power supply state of the vehicle is the first power supply state, it stores information indicating the first power supply state in a state memory unit that stores information indicating a power supply state, and when the determination unit determines that the power supply state of the vehicle is the second power supply state, it stores information indicating the second power supply state in the state memory unit, and the first instruction unit may refer to the state memory unit and, when information indicating the first power supply state is stored, send the first activation instruction to the in-vehicle device, and the second instruction unit may refer to the state memory unit and, when information indicating the second power supply state is stored, send the second activation instruction to the in-vehicle device.

[0048] With this configuration, the update management device activates software in the on-board device based on information indicating the vehicle's power supply status. This allows the software in the on-board device to be updated and activated sequentially at appropriate times depending on the power supply status, ensuring that the software of multiple ECUs operates in cooperation with each other without any discrepancies.

[0049] (18) A computer program disclosed herein is a computer program for controlling an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the computer program including: a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a combining step of creating, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and a storage unit for storing the combined update data. memory a transmitting step of transmitting the composite update data to the in-vehicle device to install the composite software to a unit, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state.

[0050] With this configuration, the update management device creates combined update data from the two update data for updating the two pieces of software, installs it in the storage unit of the in-vehicle device, and transmits the update data to the in-vehicle device for activation according to the vehicle's power supply status. This updates the software in the in-vehicle device and activates it sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0051] <Embodiment 1> [1. Details of Embodiment 1 of the Present Disclosure] Hereinafter, the first embodiment of the present disclosure will be described in detail with reference to the drawings.

[0052] [1.1 Update Management System Configuration] Figure 1 shows Embodiment 11 is a diagram showing an example of the configuration of an update management system 1 according to the present invention. The update management system 1 is a system installed in a vehicle such as an automobile, etc. The update management system 1 includes an update management ECU 11, a first ECU 12, a second ECU 13, communication buses 14a and 14b, and a communication device 15.

[0053] The update management ECU 11 (Electronic Control Unit) is an update management device that manages software updates for on-board devices in a vehicle that has multiple power supply states including a first power supply state and a second power supply state different from the first power supply state. The first power supply state is, for example, a power supply state when the vehicle is in a state where it cannot run, and the second power supply state is a power supply state when the vehicle is in a state where it can run. The first power state is, for example, the power state when the key switch used to start the engine when the key is inserted is in the OFF position. Specifically, the first power state is a state in which power is not supplied from the vehicle battery to most of the electrical devices in the vehicle, but is supplied directly only to the minimum necessary on-board devices. Examples of the few electrical devices include a security system and a clock. Hereinafter, the first power state may be referred to as the +B state. The second power state is, for example, a power state when the key switch that starts the engine is in the ignition position. Specifically, the second power state is a state in which power is supplied to all electrical devices and the vehicle starts moving when the accelerator is depressed. Hereinafter, the second power state may be referred to as the IG state. In addition, the following description will be given assuming that the vehicle has two power supply states, a first power supply state and a second power supply state, but the present invention is not limited to these and may be further subdivided. Also, the in-vehicle device may be referred to as an ECU.

[0054] The update management ECU 11 manages software updates for on-board devices in a vehicle with multiple power states. For this reason, the update management ECU 11 is configured to operate in a power state in which software updates are performed. For example, the update management ECU 11 can operate in the +B state and the IG state.

[0055] The update management ECU 11 functions as, for example, an integrated ECU that manages the first ECU 12 and the second ECU 13. The update management ECU 11 may transmit update data downloaded from a server 2, which is an external device outside the vehicle and connected via a network 3, to the first ECU 12 and the second ECU 13.

[0056] The update management ECU 11 may function as a GW-ECU (Gateway-ECU) that relays data transmitted and received between the first ECU 12, the second ECU 13, and the communication device 15. The internal configuration of the update management ECU 11 will be described later.

[0057] The communication device 15 is, for example, a communication interface that performs wireless communication. The communication device 15 communicates with the server 2 via a network 3 such as the Internet. Specifically, the communication device 15 is a TCU (Telematics Communication Unit). The communication device 15 transmits data output from the update management ECU 11 to the server 2 via the network 3. The communication device 15 also receives data (such as update data) transmitted from the server 2 via the network 3. The communication device 15 transmits the data to the update management ECU 11 via the communication bus 14a.

[0058] The server 2 is a device installed outside the vehicle. The server 2 is a server that includes, for example, a control unit, a memory unit, and a communication unit (not shown). The memory unit of the server 2 stores, for example, programs or data for controlling each unit of the update management system 1 (for example, the update management ECU 11, the first ECU 12, and the second ECU 13). For example, the manufacturers of the first ECU 12 and the second ECU 13 update the programs or data as needed and store the updated programs or data in the memory unit of the server 2 as needed. The control unit of the server 2 uses the communication unit to transmit the updated programs or data to the update management ECU 11 as update data.

[0059] The communication buses 14a and 14b are in-vehicle communication networks connected to the update management ECU 11. Various devices (such as the first ECU 12, the second ECU 13, and the communication device 15) are connected to the communication buses 14a and 14b extending from the update management ECU 11. In the example of FIG. 1, two communication buses 14a and 14b extend from the update management ECU 11, but the number of communication buses is not particularly limited. The communication buses 14a and 14b are compliant with a communication protocol such as, for example, CAN (Controller Area Network), Ethernet (registered trademark), or FlexRay (registered trademark), but are not limited thereto.

[0060] The update management ECU 11 is connected to the first ECU 12 and the second ECU 13 via the communication bus 14b. In the example of Fig. 1, the update management ECU 11 is connected to the first ECU 12 and the second ECU 13 via the communication bus 14b.

[0061] The number of ECUs included in the update management system 1 is not particularly limited as long as it is two or more. The ECUs are, for example, devices (operation system ECUs) that control various parts of the vehicle (for example, braking devices, doors, batteries, air conditioners, etc.). The multiple ECUs may have different functions or may have the same functions.

[0062] The first ECU 12 is an ECU in which first software that operates in the +B state and the IG state and second software that does not operate in the +B state but operates in the IG state are installed. The internal configuration of the first ECU 12 will be described later. Note that the software that operates in the +B state and the IG state is sometimes referred to as +B software, and the software that does not operate in the +B state but operates in the IG state is sometimes referred to as IG software.

[0063] The second ECU 13 is an ECU in which IG drive software is installed. The internal configuration of the second ECU 13 will be described later.

[0064] [1.2 Internal structure of update management ECU11] FIG. 2 is a diagram showing an example of the internal configuration of the update management ECU 11. As shown in FIG. The update management ECU 11 includes an information processing unit 21 including a control unit 22 and a storage unit 23, and a plurality of transceivers 25a and 25b. These units are electrically connected to each other via an internal bus 24.

[0065] The control unit 22 includes, for example, one or more central processing units (CPUs), but is not limited to this. In the case of a CPU, the control unit 22 reads out a computer program stored in the storage unit 23 and executes various calculations and controls.

[0066] The storage unit 23 has a volatile memory and a nonvolatile memory, and stores various data. The volatile memory includes, for example, a random access memory (RAM). The nonvolatile memory includes, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a read only memory (ROM). A part of the nonvolatile memory may be provided outside the update management ECU 11.

[0067] The storage unit 23 stores, for example, a computer program, various parameters, and tables in a nonvolatile memory. Note that the storage unit 23 also stores, for example, the computer program, various parameters, and tables downloaded from the server 2 via the network 3 and the communication device 15.

[0068] Multiple transceivers 25a, 25b transmit and receive signals flowing through communication buses 14a, 14b via respective ports (not shown). The transceivers 25a, 25b send information contained in the received signals to the control unit 22 via the internal bus 24. The transceivers 25a, 25b receive information sent by the control unit 22 via the internal bus 24 and transmit it to the communication buses 14a, 14b. The transceiver 25a is connected to the communication bus 14a, and the transceiver 25b is connected to the communication bus 14b.

[0069] In the above description, the control unit 22 of the information processing unit 21 includes a CPU, but the present invention is not limited to this. For example, the information processing unit 21 may be an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), or the like. In the case of an FPGA, the information processing unit 21 executes various calculations and controls according to a pre-programmed configuration. In the case of an ASIC, the information processing unit 21 executes various calculations and controls according to a configuration built in at the time of manufacture.

[0070] [1.3 Internal structure of ECU] 3 is a diagram showing an example of the internal configuration of the first ECU 12. The internal configuration of the second ECU 13 is similar to that of the first ECU 12, and therefore a description thereof will be omitted.

[0071] The first ECU 12 includes an information processing unit 31 including a control unit 32, a first storage unit 33, and a second storage unit 34, a transceiver 35, an input unit 36, and an output unit 37. The transceiver 35 is electrically connected to the information processing unit 31 via an internal bus 38.

[0072] The control unit 32 includes, for example, one or more CPUs, but is not limited to this. In the case of a CPU, for example, the CPU reads out a computer program stored in the first storage unit 33 or the second storage unit 34 and executes various calculations and controls.

[0073] Like the storage unit 23, the first storage unit 33 and the second storage unit 34 have volatile and nonvolatile memories and store various types of data. The first storage unit 33 stores, for example, computer programs, various parameters, and tables in nonvolatile memory. For example, the first storage unit 33 and the second storage unit 34 are one bank obtained by dividing physical memory into several banks. The information processing unit 31 may further include a bank register (not shown) for switching between banks. For example, the bank register is configured so that writing 0 to the bank register makes the first storage unit 33 accessible, and writing 1 to the bank register makes the second storage unit accessible. As another example, the first storage unit and the second storage unit may be the same storage unit. For example, the physical memory may be divided into several address spaces, with the memory in the first address space being the first storage unit 33 and the memory in the second address space being the second storage unit 34.

[0074] The transceiver 35 is configured by, for example, an integrated circuit (IC), such as a CAN transceiver, and is connected to the communication bus 14b to receive various control messages from the communication bus 14b.

[0075] The transceiver 35 includes a transmitting circuit and a receiving circuit (not shown). The transmitting circuit and receiving circuit communicate in accordance with the communication protocol of the communication bus 14b. The transmitting circuit converts the digital signal data output by the information processing unit 31 into a predetermined analog signal and sends it to the communication bus 14b. The receiving circuit converts the analog signal input from the communication bus 14b into a digital signal readable by the information processing unit 31 and outputs the digital signal to the information processing unit 31.

[0076] The input unit 36 ​​is connected to, for example, sensors, input devices, etc. The input unit 36 ​​receives signals corresponding to the state of the vehicle and signals corresponding to instructions from the driver, etc. The sensors are, for example, a temperature sensor that detects the temperature inside the vehicle, a door switch that detects whether the door is closed, etc. The input devices are, for example, a switch for operating the air conditioner, etc.

[0077] The output unit 37 is connected to, for example, a motor, a solenoid, etc. The output unit 37 drives the connected motor, solenoid, etc. based on information sent by the information processing unit 31. The information is, for example, information indicating the movement of the connected motor, etc. The motor is, for example, a motor that moves a door window up and down. The solenoid is, for example, a solenoid that locks a door.

[0078] [1.4 Problems to be Solved by the Present Embodiment] There are known vehicles equipped with multiple ECUs and having multiple power states, including a +B state, an IG state, etc. For example, a first ECU may be installed with first software that operates in the +B state and the IG state, and second software that does not operate in the +B state but operates in the IG state, and a second ECU may be installed with third software that does not operate in the +B state but operates in the IG state. In such a situation, the second software and the third software may work together to operate a specific system.

[0079] When the first software and second software of the first ECU are updated with update data, the first software and second software are installed on a single first ECU, so they can be activated even in the +B state. Meanwhile, the second ECU has third software installed, which operates in the IG state. Therefore, when the power state transitions to the IG state, the third software begins installation and activation with the update data. In a situation where the second software of the first ECU is already activated in the +B state, the second software may issue a command to the third software of the second ECU when the power state transitions to the IG state. However, the third software of the second ECU has just started installation, so it may not understand the command issued by the second software of the first ECU, which could cause the specified system to malfunction.

[0080] For example, the first ECU is a door ECU, and the second ECU is a sensor ECU. For example, the first software is door lock software for controlling door locks, the second software is window software for controlling power windows, and the third software is raindrop detection software for a sensor that detects raindrops. A given system is a rain window closing system that closes windows when it rains.

[0081] In this case, if the door ECU's door lock software and window software are updated with update data, the door lock software and window software can be activated even in the +B state because they are installed in the door ECU. Meanwhile, the sensor ECU has raindrop detection software installed that operates in the IG state. Therefore, when the power state transitions to the IG state, the raindrop detection software begins installation and activation with the update data. Since the door ECU's window software is already activated in the +B state, the window software may issue a command to the sensor ECU's raindrop detection software when the power state transitions to the IG state. However, since the sensor ECU's raindrop detection software has just started installation, it may not understand the command issued by the door ECU's window software, which could cause the rain window closing system to malfunction. For example, the window may not close in rainy weather.

[0082] Specific control details in the update management system 1 will be described below with reference to FIGS. 1 to 6 as appropriate.

[0083] [1. 5 Update Management Device Functions Fig. 4 is a functional block diagram showing functions included in the update management ECU 11 according to the first embodiment. Fig. 5 and Fig. 6 are tables showing examples of an ECU table listing ECUs. The update management ECU 11 includes a receiving unit 41, a determining unit 42, a first transmitting unit 43, a second transmitting unit 44, a first instruction unit 45, a second instruction unit 46, a first deletion instruction unit 47, and a second deletion instruction unit 48.

[0084] 1.5.1 Receiver The receiving unit 41 receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state.

[0085] Specifically, the receiving unit 41 has a function of downloading the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12.

[0086] The receiving unit 41 operates the control unit 22 to access the server 2 via the internal bus 24, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2. The download is initiated, for example, when new update data is recorded in the server 2. In this case, the server 2 transmits information indicating that new update data has been recorded to each update management system 1. The information indicating that new update data has been recorded may include information indicating the version of the newly recorded update data. Hereinafter, information indicating that new update data has been recorded is referred to as update software information. For example, one example of when new update data is recorded in the server 2 is when the window software of the first ECU 12 and the raindrop detection software of the second ECU 13 are updated to implement a rain-weather window-close system due to improved rain sensitivity compared to the previous rain sensor.

[0087] The update management ECU 11 of each update management system 1 is, for example, R An ECU table such as this is stored in the storage unit 23. For example, the ECU table includes information indicating a predetermined system, the ECU and software that executes the predetermined system, the power state in which the software operates, and the version of the ECU software, and is recorded in the storage unit 23 in table form for each predetermined system. An example of a predetermined system is a rain window closing system. As shown in FIG. 5, the ECU and software that execute this function are the window software of the door ECU and the raindrop detection software of the sensor ECU. The window software and the raindrop detection software are software that operate when the power state is the IG state. The software version is, for example, 1.02. In this example, the rain window closing system is realized by the IG drive software, so the system as a whole operates in the IG state. Although the ECU table is described as being stored in the storage unit 23 of the update management ECU 11, the present invention is not limited to this. For example, the ECU table may be stored in the storage unit of the server 2.

[0088] Figure 6 shows another example of an ECU table. In this example, the predetermined system is, for example, a keyless entry system. The ECU and software that execute the predetermined system are, for example, door lock software in the door ECU and software in the ECU that cooperates with it. Since the keyless entry system operates in the +B state, the software in each ECU also operates in the +B state.

[0089] The receiving unit 41, for example, compares the version information included in the update software information sent from the server with the version information recorded in the ECU table to determine whether the software has been updated. If it is determined that the software has been updated, the receiving unit 41 requests the update data from the server 2 and downloads it. The receiving unit 41, for example, temporarily records the downloaded update data in the storage unit 23.

[0090] The receiver 41 may receive the first update data and the second update data from an external device while the power supply is in the first power supply state. For example, update data for updating door lock software (+B software) and window software (IG software) may be downloaded while the vehicle is in the +B state, i.e., while the vehicle is stopped and unable to run. By downloading the update data while the vehicle is stopped, it is possible to quickly start transmitting the update data and installing the IG software to ECUs that do not have the +B software installed but do have the IG software installed, as soon as the power supply state transitions to the IG state.

[0091] [1.5.2 Judgment part] The determination unit 42 has a function of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state.

[0092] Specifically, the determination unit 42, for example, detects the power supply state of the vehicle and determines whether the detected power supply state is the +B state or the IG state. The detection of the power supply state of the vehicle may be performed by the update management ECU 11 or by a power supply monitoring ECU (not shown) that monitors the power supply state of the vehicle. In the case of the +B state, for example, the voltage of a power supply bus connected to an electrical device that receives power directly from the vehicle battery is detected, and if the voltage is equal to or higher than a predetermined voltage, the determination unit 42 determines that the power supply state is the +B state. In the case of the IG state, for example, the voltage of a power supply bus that supplies power to an ECU that operates when the accelerator is depressed, such as an engine control ECU, is detected, and if the voltage is equal to or higher than a predetermined voltage, the determination unit 42 determines that the power supply state is the IG state. Note that if the state is both the +B state and the IG state, the determination unit 42 determines that the power supply state is the IG state.

[0093] [1.5.3 First transmitter] The first transmission unit has a function of transmitting the first update data to the in-vehicle device, which has a first memory unit and a second memory unit, when the determination unit determines that the power supply state of the vehicle is the first power supply state, so that the in-vehicle device installs the updated first software in the first memory unit and activates the updated first software.

[0094] In the cases of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the +B state, the first transmission unit 43 transmits update data for installing door lock software, which is +B software, to the door ECU, which is the first ECU 12.

[0095] For example, the first transmission unit 43 operates the control unit 22 to execute the function of the first transmission unit 43. First, the control unit 22 reads out the first update data that has been temporarily stored. Next, the control unit 22 transmits the read first update data to the communication bus 14b via the transceiver 25b. The first update data transmitted to the communication bus 14b reaches the transceiver 35 of the first ECU 12. The first ECU 12 is operated by the control unit 32, and the control unit 32 receives the received update data via the transceiver 35. The control unit 32 temporarily stores the received update data in the first storage unit 33 or a random access memory (RAM) (not shown).

[0096] When the first transmission unit 43 transmits the first update data, the first ECU 12 installs +B software in the first storage unit 33 based on the received first update data. For example, the door ECU installs door lock software in the first storage unit 33.

[0097] For example, when first update data is sent from the first transmission unit 43, after the reception of the sent update data is completed, the control unit 32 of the first ECU 12 is configured to install software into the first memory unit 33 based on the temporarily stored update data.

[0098] As another example, when the first transmission unit transmits the first update data, the update management ECU 11 transmits a first installation instruction to the first ECU 12, which is an instruction to install the +B software in the first storage unit 33 using the first update data. Then, the first ECU 12 that receives the first installation instruction is configured to install the +B software.

[0099] [1.5.4 Second transmitter] The second transmission unit has a function of transmitting the first update data and the second update data to the in-vehicle device when the determination unit determines that the power supply state of the vehicle is the second power supply state, so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit and activates the updated first software and the updated second software.

[0100] In the cases of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the IG state, the second transmission unit 44 transmits the first update data and the second update data to the door ECU, which is the first ECU 12, for installing the door lock software, which is the +B software, and the window software, which is the IG software.

[0101] For example, the second transmission unit 44 operates the control unit 22 to perform the function of the second transmission unit 44. First, the control unit 22 reads out the first update data that was temporarily stored in the memory unit 23. Next, the control unit 22 transmits the read out first update data to the communication bus 14b via the transceiver 25b. The first update data transmitted to the communication bus 14b reaches the transceiver 35 of the first ECU 12. The first ECU 12 is operated by the control unit 32, and the control unit 32 receives the received update data via the transceiver 35. The control unit 32 temporarily stores the received update data in the first memory unit 33 or a RAM (not shown).

[0102] When the second transmission unit transmits the first update data and the second update data, the first ECU 12 installs the +B software and the IG software in the second storage unit 34 based on the received first update data and second update data. For example, the door ECU installs door lock software and window software in the second storage unit 34.

[0103] When the first update data and the second update data are sent from the second transmission unit 44, the first ECU 12, for example, temporarily stores the sent first update data and second update data in the second storage unit 34. After the first ECU 12 has completely received the sent update data, the control unit 32 of the first ECU 12 may be configured to install software based on the update data temporarily stored in the second storage unit 34.

[0104] As another example, when the second transmission unit transmits the first update data and the second update data, the update management ECU 11 transmits a second installation instruction to the first ECU 12, which is an instruction to install the +B software and the IG software in the second storage unit 34 using the first update data and the second update data. The first ECU 12 may be configured to install the +B software and the IG software upon receiving the second installation instruction.

[0105] [1.5.5 1st instructions Department] The first instruction unit 45 has a function of sending a first activation instruction to the in-vehicle device to activate the updated first software installed in the first memory unit when the determination unit determines that the power supply state of the vehicle is the first power supply state.

[0106] In the example of Figure 6, i.e., in the case of a keyless entry system that is executed in the +B state, when the determination unit 42 determines that the power state is in the +B state, the first instruction unit 45 transmits an activation instruction to activate the door lock software, which is the +B software.

[0107] More specifically, the first instruction unit 45 references an ECU table stored in the storage unit 23, such as the contents shown in FIGS. 5 and 6. From the referenced ECU table, the first instruction unit 45 obtains information indicating in which power state the system is executed by software that operates in that power state. In the example of FIG. 6, the door lock software that executes the keyless entry system operates in both the +B state and the IG state. Therefore, when the power state is the +B state, the first instruction unit 45 transmits a first activation instruction to the door ECU to activate the updated door lock software installed in the first storage unit 33. On the other hand, since the +B software is not listed in FIG. 5, the first instruction unit 45 does not transmit a first activation instruction.

[0108] It is preferable that the first activation instruction be transmitted to the in-vehicle device after the software has been installed by the update data. This is because the software cannot be activated during installation. For example, the first instruction unit 45 is configured to wait a predetermined time before transmitting the instruction. In another example, the in-vehicle device is configured to transmit installation completion information, which is information indicating that the software installation has been completed, to the update management device after the software installation is completed. Then, upon receiving the installation completion information, the first instruction unit 45 is configured to transmit the first activation instruction.

[0109] As an example, when the first ECU 12 receives the first activation instruction sent by the first instruction unit 45, it operates the control unit 32 and activates the first software installed in the first memory unit 33.

[0110] [1.5.6 Second instructions Department] No. 2 instructionsUnit 46 has a function of transmitting a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0111] 5 and 6, when the determination unit 42 determines that the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction to the door ECU to activate the window software, which is the IG software, for the rain window closing system. The second instruction unit 46 also transmits a second activation instruction to the sensor ECU to activate the rain detection software. The second instruction unit 46 also transmits a second activation instruction to the door ECU to activate the door lock software, which is the +B software, for the keyless entry system.

[0112] More specifically, the second instructions The unit 46 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIGS. 5 and 6. instructions The second instruction unit 46 obtains information indicating in which power state the system is executed by the operating software. In the example of Fig. 5, the rainy weather window closing system is executed by window software and raindrop detection software that operate in the IG state, so when the power state is the IG state, the second instruction unit 46 transmits a second activation instruction to the door ECU to activate the updated window software installed in the second storage unit 34. Also, since the door lock software that executes the keyless entry system operates in both the +B state and the IG state, when the power state is the IG state, the second instruction unit 46 transmits a second activation instruction to the door ECU to activate the updated door lock software installed in the second storage unit 34. instructionsThe update management device 46 transmits the activation command to the door ECU. In addition, it is preferable that the update management device also transmits an activation command to the sensor ECU to activate the raindrop detection software.

[0113] For the same reason as for the first instruction unit, it is preferable that the second instruction unit also transmits the second activation instruction to the in-vehicle device after the software has been installed by the update data.

[0114] As an example, when the first ECU 12 receives a second activation instruction sent by the second instruction unit 46, it operates the control unit 32 to activate the first software and second software installed in the second memory unit 34.

[0115] [1.5.7 First erasure instruction part] The first erasure instruction unit 47 has a function of transmitting a first erasure instruction to the in-vehicle device to erase the pre-update first software and the pre-update second software from the second storage unit when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit.

[0116] Specifically, the control unit 22 transmits a first erasure instruction to the communication bus 14b via the transceiver 25b. The transmitted first erasure instruction reaches the transceiver 35 of the first ECU 12 via the communication bus 14b. The control unit 32 of the first ECU 12 receives the first erasure instruction that has reached the transceiver 35. The data installed in the second storage unit 34 in response to the received first erasure instruction is hand The control unit 32 erases the pre-update first software and the pre-update second software that are currently installed.

[0117] By erasing the pre-update software in the second storage unit 34, the second storage unit 34 becomes empty, and when software is installed later, it is possible to reduce the risk that remnants of the pre-update software will adversely affect the later-installed software. Note that if there is no particular problem with installing software over the pre-update software, it is possible to skip sending the first erasure instruction.

[0118] It is more preferable to erase the pre-update software installed in the second storage unit 34 after the software installed in the first storage unit 33 has been activated. This is because if the pre-update software installed in the second storage unit 34 was running until just before activation, it can be instantly swapped with the software in the first storage unit 33.

[0119] [1.5.8 Second erasure instruction part] The second erasure instruction unit 48 has a function of transmitting a second erasure instruction to the in-vehicle device to erase the updated first software from the first storage unit when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit.

[0120] Specifically, the control unit 22 transmits a second erase instruction to the communication bus 14b via the transceiver 25b. The transmitted first erase instruction reaches the transceiver 35 of the first ECU 12 via the communication bus 14b. The control unit 32 of the first ECU 12 receives the second erase instruction that has reached the transceiver 35. In response to the received second erase instruction, the control unit 32 erases the updated first software installed in the first storage unit 33.

[0121] When the updated first software is installed in the first storage unit 33, and the updated first software and the updated second software are installed in the second storage unit 34, it is preferable to erase the updated first software that was installed in the first storage unit 33.

[0122] This is to empty the first storage unit 33, since after the updated first software and the updated second software are installed in the second storage unit 34, the updated first software installed in the first storage unit 33 will not be executed.

[0123] It is more preferable to erase the updated software installed in the first storage unit 33 after the software has been installed in the second storage unit 34 and activated. This is because if the first software installed in the first storage unit has been running until just before activation, it can be instantly swapped with the software in the second storage unit 34.

[0124] [1.6 Control Method] Fig. 7 is a flowchart showing an example of a control method executed by the update management ECU 11 according to the first embodiment. The order of the steps shown in Fig. 7 may be changed as appropriate. A series of control methods will be described using Fig. 7. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is the +B state.

[0125] The control executed by the update management ECU 11 is executed by the information processing unit 21. When the information processing unit 21 executes the control, the control unit 22 reads a computer program from the storage unit 23 and executes various calculations and processes. Furthermore, the control executed by the first ECU 12 is executed by the information processing unit 31. When the information processing unit 31 executes the control, the control unit 32 reads a computer program from the first storage unit 33 and executes various calculations and processes.

[0126] [1.6.1 Step S101] First, the receiving unit 41 of the update management ECU 11 downloads update data from the server 2 (step S101). Specifically, the receiving unit 41 receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state. After the reception is complete, the update management ECU 11 proceeds to step S102.

[0127] More specifically, the receiving unit 41 of the update management ECU 11 downloads first update data and second data from the server 2. The server 2 stores update data for each ECU. The first update data is update data for installing +B software. The second update data is update data for installing IG software. The update management ECU 11 accesses the server 2 via the communication bus 14a, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2.

[0128] For example, when update data is newly recorded in the server 2, the server 2 transmits update software information including information indicating that the update data has been newly recorded to the update management system 1. The update software information may include information indicating the version of the newly recorded update data.

[0129] The update management ECU 11 of the update management system 1 stores, for example, an ECU table such as that shown in Fig. 5 in the storage unit 23. The ECU table records, in tabular form, information indicating a specific system, the ECU and software that executes the specific system, the power state in which the software operates, and the version of the ECU software for each specific system.

[0130] The receiving unit 41 of the update management ECU 11, for example, compares the update software information (including information indicating the version) sent from the server with the ECU table recorded in the storage unit 23 to determine whether the software has been updated. For example, the receiving unit 41 compares the software versions to determine whether the software has been updated. If it determines that the software has been updated, the receiving unit 41 requests the update data from the server 2 and downloads it. The receiving unit 41, for example, temporarily records the downloaded update data in the storage unit 23. After the download is complete, the process proceeds to step S102.

[0131] [1.6.2 Step S102] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the update management ECU 11 transmits the first update data to the in-vehicle device, which includes a first storage unit and a second storage unit, so that the in-vehicle device installs the updated first software in the first storage unit and activates the updated first software (step S102). As described above, since the initial power supply state is the +B state, step S102 is executed. Then, the update management ECU 11 proceeds to step S103.

[0132] 5 and 6, the +B software is door lock software for the first ECU 12, so the first transmitter 43 of the update management ECU 11 transmits first update data for installing the door lock software to the first ECU 12. The first ECU 12 includes a first memory unit 33 and a second memory unit 34, and the update data is to be installed in the first memory unit 33 and activated.

[0133] When the first transmission unit 43 of the first ECU 12 receives the first update data, the first ECU 12 installs the +B software in the first storage unit 33 based on the received first update data. In the cases of FIGS. 5 and 6, the door ECU installs the door lock software in the first storage unit 33.

[0134] [1.6.3 Step S103] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 45 transmits a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit (step S103). 3 Then, the update management ECU 11 proceeds to step S104.

[0135] In the case of the keyless entry system executed in the +B state in the cases of Figures 5 and 6, the first activation instruction is an activation instruction to activate the door lock software, which is the +B software. No. 1 instructions Part 4 5 is sent.

[0136] Specifically, the first instruction unit 45 references an ECU table stored in the storage unit 23, such as the contents shown in FIGS. 5 and 6. From the referenced ECU table, the first instruction unit 45 obtains information indicating in which power state the system is executed by software that operates in that power state. In the example of FIG. 6, the door lock software that executes the keyless entry system operates in both the +B state and the IG state. Therefore, when the power state is the +B state, the first instruction unit 45 transmits a first activation instruction to the door ECU to activate the updated door lock software installed in the first storage unit 33. On the other hand, since the +B software is not listed in FIG. 5, the first instruction unit 45 does not transmit a first activation instruction. It is preferable that the first activation instruction is transmitted to the in-vehicle device after the software is installed by the update data.

[0137] When the first ECU 12 receives the first activation instruction, the first ECU 12 activates the first software installed in the first storage unit 33.

[0138] [1.6.4 Step S104] Next, when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit, the first deletion instruction unit 47 transmits a first deletion instruction to the in-vehicle device to delete the pre-update first software and the pre-update second software from the second storage unit (step S104). 5 Proceed to.

[0139] Specifically, the control unit 22 transmits a first erase instruction to the communication bus 14b via the transceiver 25b. The first erase instruction transmitted via the communication bus 14b reaches the transceiver 35 of the first ECU 12. The first ECU 12 receives the first erase instruction that has reached the transceiver 35. In response to the received first erase instruction, the control unit 32 erases the pre-update first software and the pre-update second software installed in the first storage unit 33.

[0140] It is preferable to erase the pre-update software installed in the second storage unit 34 after the software has been installed and activated in the first storage unit 33. Also, if there is no particular problem with installing the software over the pre-update software, this step can be skipped.

[0141] [1.6.5 Step S105] Next, the determination unit 42 of the update management ECU 11 determines whether the power supply state of the vehicle is the first power supply state or the second power supply state (step S105). If the determination unit determines that the power supply state of the vehicle is the second power supply state, i.e., the IG state, the update management ECU 11 proceeds to step S106. On the other hand, if the determination unit determines that the power supply state of the vehicle is the first power supply state, i.e., the +B state, the update management ECU 11 returns to step S105 and repeats step S105. In other words, the update management ECU 11 is in a state of waiting for the power supply state of the vehicle to transition from the +B state to the IG state.

[0142] [1.6.6 Step S106] Next, when the determination unit determines that the power supply state of the vehicle is the second power supply state, the second transmission unit of the update management ECU 11 transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit and activates the updated first software and the updated second software (step S106).The update management ECU 11 then proceeds to step S107.

[0143] In the cases of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the IG state, that is, when the vehicle's power supply state transitions from the +B state to the IG state, the second transmission unit 44 transmits to the door ECU first update data for installing door lock software, which is +B software, and second update data for installing window software, which is IG software.

[0144] When the first ECU 12 receives the first update data and the second update data, the first ECU 12 installs the +B software and the IG software in the second storage unit 34 based on the received first update data and second update data. For example, the door ECU installs door lock software and window software in the second storage unit 34.

[0145] [1.6.7 Step S107] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 46 transmits a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit (step S107).Then, the update management ECU 11 proceeds to step S108.

[0146] 5 and 6, when the determination unit 42 determines that the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction to activate the window software, which is the IG software, for the rainy weather window closing system. The second instruction unit 46 also transmits a second activation instruction to activate the door lock software, which is the +B software, for the keyless entry system. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the rain detection software. It is preferable that the second activation instruction is transmitted to the in-vehicle device after the software is installed by the update data.

[0147] When the in-vehicle device receives the second activation instruction, the in-vehicle device activates the first software and the second software installed in the second storage unit. In the cases of Figures 5 and 6, the door ECU that received the second activation instruction activates the window software and the door lock software installed in the second storage unit 34. In addition, it is preferable that the raindrop detection software of the sensor ECU be activated as well. This is because the window software and the raindrop detection software work together to execute the rain window closing system.

[0148] [1.6.8 Step S108] Next, when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit, the second deletion instruction unit 48 of the update management ECU 11 transmits a second deletion instruction to the in-vehicle device to delete the updated first software from the first storage unit (step S108). Thereafter, the update management ECU 11 ends the series of processes.

[0149] It is more preferable to erase the updated software installed in the first storage unit 33 after it has been installed in the second storage unit 34 and activated. Also, this step may be skipped if there is no particular need to use the first storage unit 33 in the future.

[0150] [1.7 Control Sequences] Next, the control sequence of the update management system 1 will be described. Figure 8 is a sequence diagram of the update management system according to the first embodiment. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is +B state. Thereafter, the power supply state transitions from +B state to IG state.

[0151] [1.7.1 Step S201] First, the receiving unit 41 of the update management ECU 11 downloads update data from the server 2 (step S201). Specifically, the receiving unit 41 receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state. After the reception is completed, the update management system 1 performs step S 2 Go to 02.

[0152] Specifically, the receiving unit 41 of the update management ECU 11 downloads the first update data and the second data from the server 2. The server 2 stores update data for each ECU. The first update data is update data for installing +B software. New The second update data is IG software. install In order to update The update management ECU 11 accesses the server 2 via the communication bus 14 a, the transceiver 25 a, the communication device 15, and the network 3, and downloads the update data stored in the server 2.

[0153] [1.7.2 Step S202] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the update management ECU 11 transmits the first update data to the in-vehicle device, which has a first storage unit and a second storage unit, so that the in-vehicle device installs the updated first software in the first storage unit and activates the updated first software (step S202). As described above, since the initial power supply state is the +B state, step S202 is executed. The update management system 1 then proceeds to step S203.

[0154] 5 and 6, the +B software is door lock software for the first ECU 12, so the first transmitter 43 of the update management ECU 11 transmits first update data for installing the door lock software to the first ECU 12. The first ECU 12 includes a first memory unit 33 and a second memory unit 34, and the update data is to be installed in the first memory unit 33 and activated.

[0155] [1.7.3 Step S203] Next, when the first transmission unit 43 transmits the first update data, the first ECU 12 installs the +B software in the first storage unit 33 based on the received first update data (step S203). In the case of Figs. 5 and 6, the door ECU installs the door lock software in the first storage unit 33. After the installation, the update management ECU 11 performs step S 2 Go to 04.

[0156] [1.7.4 Step S204] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 45 transmits a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit (step S204). As described above, since the initial power supply state is the +B state, step S204 is executed. The update management system 1 then proceeds to step S205.

[0157] In the example of Figures 5 and 6, that is, in the case of the keyless entry system executed in the +B state, the first activation instruction is an activation instruction to activate the door lock software, which is the +B software. No. 1 instructions Part 4 5 is sent.

[0158] [1.7.5 Step S205] Next, when the first ECU 12 receives the first activation instruction, the first ECU 12 activates the first software installed in the first storage unit 33 (step S205). Then, the update management system 1 proceeds to step S206.

[0159] [1.7.6 Step S206] Next, when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit, the first deletion instruction unit 47 transmits a first deletion instruction to the in-vehicle device to delete the pre-update first software and the pre-update second software from the second storage unit (step S206). 207 Proceed to.

[0160] [1.7.7 Step S207] Next, when the first ECU 12 receives the first deletion instruction, the control unit 32 deletes the pre-update first software and the pre-update second software installed in the first storage unit 33 in accordance with the received first deletion instruction (step S207).Then, the update management system 1 proceeds to step S208. It should be noted that if there is no risk of problems occurring even if the pre-update first software and the pre-update second software are not erased, steps S206 and S207 may be skipped.

[0161] [1.7.8 Step S208] Next, the determination unit 42 of the update management ECU 11 determines whether the vehicle's power supply state is the first power supply state or the second power supply state (step S208). If the determination unit 42 determines that the vehicle's power supply state is the second power supply state, i.e., the IG state, the update management system 1 proceeds to step S209. On the other hand, if the determination unit determines that the vehicle's power supply state is the first power supply state, i.e., the +B state, the update management system 1 returns to step S208 and repeats step S208. In other words, the update management system 1 is in a state of waiting for the vehicle's power supply state to transition from the +B state to the IG state. Therefore, from step S209 onwards, the power supply state is transitioning from the +B state to the IG state.

[0162] [1.7.9 Step S209] Next, when the determination unit determines that the power supply state of the vehicle is the second power supply state, the second transmission unit of the update management ECU 11 transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit and activates the updated first software and the updated second software (step S209).The update management ECU 11 then proceeds to step S210.

[0163] In the cases of Figures 5 and 6, when the determination unit 42 determines that the vehicle's power supply state is in the IG state, that is, when the vehicle's power supply state transitions from the +B state to the IG state, the second transmission unit 44 transmits to the door ECU first update data for installing door lock software, which is +B software, and second update data for installing window software, which is IG software.

[0164] [1.7.10 Step S210] When the first ECU 12 receives the first update data and the second update data transmitted by the second transmission unit, the first ECU 12 installs the +B software and the IG software into the second storage unit 34 based on the received first update data and second update data (step S210). In the case of Figures 5 and 6, the door ECU installs the door lock software and the window software into the second storage unit 34. The update management system 1 then proceeds to step S211.

[0165] [1.7.11 Step S211] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 46 transmits a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit (step S211). Then, the update management ECU 11 proceeds to step S212.

[0166] 5 and 6, when the determination unit 42 determines that the power supply state is the IG state, the second instruction unit 46 transmits a second activation instruction to activate the window software, which is the IG software, for the rainy weather window closing system. The second instruction unit 46 also transmits a second activation instruction to activate the door lock software, which is the +B software, for the keyless entry system. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the rain detection software.

[0167] [1.7.12 Step S212] Next, when the first ECU 12 receives the second activation instruction, the first ECU 12 activates the first software and the second software installed in the second storage unit 34 (step S212). Then, the update management system proceeds to step S213.

[0168] [1.7.13 Step S213] Next, when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit, the second deletion instruction unit 48 of the update management ECU transmits a second deletion instruction to the in-vehicle device to delete the updated first software from the first storage unit (step S21 3 The update management system then proceeds to step S214.

[0169] [1.7.14 Step S214] Next, when the first ECU 12 receives the second deletion instruction, the control unit 32 deletes the updated first software installed in the first storage unit 33 in accordance with the received second deletion instruction (step S214). Then, the update management system 1 ends the series of processes. Note that if there is no risk of problems occurring even if the updated first software is not deleted, steps S213 and S214 may be skipped.

[0170] [1.8 Summary] There are known vehicles equipped with multiple ECUs and capable of multiple power states, including +B state, IG state, etc. In such vehicles, when the ECU software is updated, there is a risk that multiple pieces of software that work together to execute a specific system may be activated in different power states, which could cause one piece of software to be unable to understand an instruction issued by another piece of software, resulting in the specific system not operating.

[0171] According to this embodiment, the update management device transmits update data to the in-vehicle device to alternately install and activate software in two storage units of the in-vehicle device in accordance with the vehicle's power supply status. The update management device then installs software in the in-vehicle device using the update data in accordance with the vehicle's power supply status, and activates the software in accordance with the vehicle's power supply status. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times depending on the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0172] Furthermore, when the +B software and IG software are installed in the first ECU and the IG software is installed in the second ECU, and the IG software of the first ECU and the IG software of the second ECU work together to execute a predetermined system, it is preferable to simultaneously send an activation command to the IG software of the first ECU and the IG software of the second ECU. This explicitly activates the IG software of the first ECU and the IG software of the second ECU at the same time, further reducing discrepancies such as the IG software of the first ECU not being able to understand a command issued by the IG software of the second ECU.

[0173] Although the in-vehicle device has been described as including a first storage unit and a second storage unit, the present invention is not limited to this and may include an additional storage unit.

[0174] <Embodiment 2> 2. Details of Embodiment 2 of the Present Disclosure Hereinafter, the second embodiment of the present disclosure will be described in detail with reference to the drawings. The differences between the first and second embodiments are as follows: In the first embodiment, software is installed alternately in two storage units provided in the in-vehicle device using first update data that updates the first software and second update data that updates the second software. In contrast, in the second embodiment, the update management device creates combined update data from the first update data and the second update data in advance, and installs software in one storage unit of the in-vehicle device using the combined update data. All other points are the same. The same components as in the first embodiment are assigned the same reference numerals, and descriptions of the same components, functions, and operations will be omitted.

[0175] [2.1 Update Management System Configuration] The configuration of the update management system of the second embodiment is the same as that of the first embodiment. Note that the in-vehicle device does not necessarily need to have two storage units, and may have only one storage unit. [2.2 Problems to be solved by this embodiment] The problem that the second embodiment aims to solve is the same as that of the first embodiment. However, if the in-vehicle device has only one storage unit, the first embodiment cannot cope with this problem. Therefore, the second embodiment aims to solve the problem even when there is only one storage unit.

[0176] Therefore, in this embodiment, the update management device is an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device includes a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state, a combining unit that creates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating, and a storage unit. memorya transmitting unit that transmits the combined update data to the in-vehicle device to install the combined software in a unit that activates the first function when the power state of the vehicle is the first power state and activates the second function when the power state of the vehicle is the second power state; The update management device includes:

[0177] With this configuration, the update management device transmits update data to the in-vehicle device to alternately install and activate software in the two storage units of the in-vehicle device according to the vehicle's power supply status. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0178] The update management device further includes a determination unit that determines whether the power supply state of the vehicle is the first power supply state or the second power supply state, a first instruction unit that sends a first activation instruction to the in-vehicle device to activate the first function when the determination unit determines that the power supply state of the vehicle is the first power supply state, and a second instruction unit that sends a second activation instruction to the in-vehicle device to activate the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0179] With this configuration, the update management device activates software in the in-vehicle device according to the vehicle's power supply status. This allows the software in the in-vehicle device to be updated and activated sequentially at appropriate times according to the power supply status, ensuring that the software of multiple ECUs operates in cooperation with each other without any discrepancies.

[0180] [2.3 Functions of the Update Management Device] 9 is a functional block diagram showing functions included in the update management ECU 11 according to the second embodiment. The update management ECU 11 includes a receiving unit 91, a combining unit 92, a transmitting unit 93, a determining unit 94, a first instruction unit 95, and a second instruction unit 96. A major difference from the first embodiment is that the update management ECU 11 includes the combining unit 92.

[0181] 2.3.1 Receiver The receiving unit 91 has a function of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state.

[0182] Specifically, the receiving unit 91 has a function of downloading the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12.

[0183] The receiving unit 91 operates the control unit 22 to access the server 2 via the internal bus 24, the transceiver 25a, the communication device 15, and the network 3, and downloads the update data stored in the server 2. The download is initiated, for example, when new update data is recorded in the server 2. In this case, the server 2 transmits information indicating that new update data has been recorded to each update management system 1. The information indicating that new update data has been recorded may include information indicating the version of the newly recorded update data. Hereinafter, information indicating that new update data has been recorded is referred to as update software information. For example, one example of when new update data is recorded in the server 2 is when the window software of the first ECU 12 and the raindrop detection software of the second ECU 13 are updated to implement a rain-weather window-close system due to improved rain sensitivity compared to the previous rain sensor.

[0184] The update management ECU 11 stores, for example, an ECU table such as that shown in FIG. 5 in the storage unit 23. For example, the ECU table includes information indicating a predetermined system, the ECU and software that executes the predetermined system, the power state in which the software operates, and the version of the ECU software, and is stored in the storage unit 23 in table form for each predetermined system. An example of a predetermined system is a rainy weather window closing system. As shown in FIG. 5, the ECU and software that execute this function are the window software of the door ECU and the raindrop detection software of the sensor ECU. The window software and the raindrop detection software are software that operate when the power state is the IG state. The software version is, for example, 1.02. In this example, the rainy weather window closing system is realized by the IG drive software, so the entire system operates in the IG state. Although the ECU table is described as being stored in the storage unit 23 of the update management ECU 11, the present invention is not limited to this. For example, the ECU table may be stored in the storage unit of the server 2.

[0185] Figure 6 shows another example of an ECU table. In this example, the predetermined system is, for example, a keyless entry system. The ECU and software that execute the predetermined system are, for example, door lock software in the door ECU and software in the ECU that cooperates with it. Since the keyless entry system operates in the +B state, the software in each ECU also operates in the +B state.

[0186] Receiving section 9 The receiving unit 1 compares, for example, the version information included in the updated software information sent from the server with the version information recorded in the ECU table, and determines whether the software has been updated. 9 1 requests update data from server 2 and downloads it. 9 1, for example, temporarily records the downloaded update data in the storage unit 23.

[0187] In addition, the receiving section9 While the power supply state is the first power supply state, the vehicle control device 1 may receive first update data and second update data from an external device. For example, update data for updating door lock software (+B software) and window software (IG software) may be downloaded while the vehicle is in the +B state, i.e., when the vehicle is not in a driving state, such as while the vehicle is stopped. By downloading the update data while the vehicle is stopped, it is possible to quickly start transmitting the update data and installing the IG software to ECUs that do not have the +B software installed but do have the IG software installed, when the power supply state transitions to the IG state.

[0188] [2.3.2 Composition Section] The synthesis unit 92 has a function of creating synthesized update data from the first update data and the second update data to install synthesized software that includes a first function, which is a function of the first software after the update, and a second function, which is a function of the second software after the update.

[0189] Specifically, for example, the control unit 22 reads the first update data and second update data downloaded from the server 2 from the storage unit 23 where they are temporarily stored. Next, the control unit 22 adds predetermined information to the beginning and end of the data to join the first update data and the second update data together to create combined update data for installing the combined software. Examples of the predetermined information include information indicating the beginning of the data, information indicating the end of the data, and information indicating the destination ECU. The portion of the combined update data corresponding to the first update data includes a first function that is the function of the first software after the update, and the portion corresponding to the second update data includes a second function that is the function of the second software after the update.

[0190] 5 and 6, for the first ECU 12, window software, which is IG software, is listed in Fig. 5, and door lock software, which is B software, is listed in Fig. 6. Therefore, the synthesis unit 92 creates synthesized update data including the functions of the window software and the door lock software from the first update data for installing the door lock software and the second update data for installing the window software.

[0191] 2.3.3 Transmitter The transmission unit 93 is a unit for transmitting the information to the in-vehicle device having a storage unit. memory and transmitting the combined update data to the in-vehicle device to install the combined software in the in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state.

[0192] Specifically, the control unit 22 transmits the combined update data created by the combiner to the communication bus 14b via, for example, the transceiver 25b. The transmitted combined update data propagates through the communication bus 14b and reaches the transceiver 35 of the first ECU 12. The combined update data that reaches the transceiver 35 is received by the control unit 32. The control unit 32 temporarily stores the received combined update data in the first storage unit 33 or a RAM (not shown).

[0193] In the cases of Figures 5 and 6, the transmitter 93 transmits to the door ECU synthesized update data created from first update data for installing door lock software and second update data for installing window software.

[0194] When the first ECU 12 receives the combined update data, the first ECU 12 installs combined software in accordance with the received combined update data in the first storage unit 33. For example, the combined update data is transmitted from the transmitter 93, and after reception of the transmitted combined update data is completed, the control unit 32 of the first ECU 12 installs the combined software in the first storage unit 33 based on the temporarily stored combined update data. In the cases of FIGS. 5 and 6, the door ECU installs door lock software and window software in the first storage unit 33.

[0195] As another example, when the transmitter 93 transmits the combined update data, the update management ECU 11 transmits an install instruction to the first ECU 12, which is an instruction to install the combined software in the first storage unit 33 using the combined update data. The first ECU 12 is configured to install the combined software upon receiving the install instruction.

[0196] [2.3.4 Judgment part] The determination unit 94 has a function of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state.

[0197] Specifically, the determination unit 94, for example, detects the power supply state of the vehicle and determines whether the detected power supply state is the +B state or the IG state. The detection of the power supply state of the vehicle may be performed by the update management ECU 11 or by a power supply monitoring ECU (not shown) that monitors the power supply state of the vehicle. In the case of the +B state, for example, the voltage of a power supply bus connected to an electrical device that receives power directly from the vehicle battery is detected, and if the voltage is equal to or higher than a predetermined voltage, the determination unit 94 determines that the power supply state is the +B state. In the case of the IG state, for example, the voltage of a power supply bus that supplies power to an ECU that operates when the accelerator is depressed, such as an engine control ECU, is detected, and if the voltage is equal to or higher than a predetermined voltage, the determination unit 94 determines that the power supply state is the IG state. Note that if the state is both the +B state and the IG state, the determination unit 94 determines that the power supply state is the IG state.

[0198] [2.3.5 1st instructions Department] The first instruction unit 95 has a function of transmitting a first activation instruction to the in-vehicle device to activate the first function when the determination unit determines that the power supply state of the vehicle is the first power supply state.

[0199] Specifically, the first instruction unit 95 references an ECU table stored in the storage unit 23, such as the contents shown in FIGS. 5 and 6. From the referenced ECU table, the first instruction unit 95 obtains information indicating in which power state the system is executed by software that operates. In the example of FIGS. 5 and 6, the door lock software that executes the keyless entry system operates in both the +B state and the IG state. Therefore, when the power state is the +B state, the first instruction unit 95 transmits a first activation instruction to the door ECU to activate the door lock software function of the updated merged software installed in the first storage unit 33. For example, when the first activation instruction is received, the first ECU 12 is configured to activate the first function of the merged software installed in the first storage unit 33.

[0200] It is preferable that the first activation instruction is sent to the in-vehicle device after the software has been installed by the update data. This is because the software cannot be activated during installation. For example, the first instruction unit 95 is configured to wait a predetermined time before sending the instruction. In another example, the in-vehicle device is configured to send installation completion information, which is information indicating that the software installation has been completed, to the update management device after the software installation is completed. Then, upon receiving the installation completion information, the first instruction unit 95 is configured to send the first activation instruction.

[0201] [2.3.6 Second instructions Department] No. 2 instructionsThe unit 96 has a function of transmitting a second activation instruction to the in-vehicle device to activate the second function when the determination unit determines that the power supply state of the vehicle is the second power supply state.

[0202] In the examples of FIGS. 5 and 6, the second instructions The unit 96 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIGS. 5 and 6. instructions The first ECU 12 receives information indicating the power supply state in which the system will be executed by the operating software. In the example of FIG. 5, the rainy weather window closing system is executed by window software and raindrop detection software that operate in the IG state. Therefore, when the power supply state is the IG state, the second instruction unit 96 transmits a second activation instruction to the door ECU to activate the functions of the updated window software installed in the first storage unit 33. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the raindrop detection software. Upon receiving the second activation instruction, the first ECU 12 activates the functions of the updated software. For example, when the first ECU 12 receives the second activation instruction, the first ECU 12 is configured to activate the functions of the first software and the second software installed in the first storage unit 33.

[0203] For the same reason as for the first instruction unit, it is preferable that the second instruction unit also transmits the second activation instruction to the in-vehicle device after the software has been installed by the update data.

[0204] [2.4 Control Method] Fig. 10 is a flowchart showing an example of a control method executed by the update management ECU 11 according to the second embodiment. The order of the steps shown in Fig. 10 may be changed as appropriate. A series of control methods will be described using Fig. 10. Note that the description will be given assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is the +B state.

[0205] The control executed by the update management ECU 11 is executed by the information processing unit 21. When the information processing unit 21 executes the control, the control unit 22 reads a computer program from the storage unit 23 and executes various calculations and processes. Furthermore, the control executed by the first ECU 12 is executed by the information processing unit 31. When the information processing unit 31 executes the control, the control unit 32 reads a computer program from the first storage unit 33 and executes various calculations and processes.

[0206] [2.4.1 Step S301] First, the receiving unit 91 of the update management ECU 11 receives, from an external device of the vehicle, first update data for updating the first software that operates in the first power supply state and the second power supply state, and second update data for updating the second software that does not operate in the first power supply state but operates in the second power supply state (step S301).Then, the update management ECU 11 proceeds to step S302.

[0207] Specifically, the receiving unit 91 downloads the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12.

[0208] The receiving unit 91 of the update management ECU 11, for example, compares the update software information (including information indicating the version) sent from the server with the ECU table recorded in the storage unit 23 to determine whether the software has been updated. For example, the receiving unit 91 compares the software versions to determine whether the software has been updated. If it is determined that the software has been updated, 91 requests the update data from the server 2 and downloads it. The receiving unit 91, for example, temporarily records the downloaded update data in the storage unit 23. After the download is complete, the process proceeds to step S302.

[0209] [2.4.2 Step S302] Next, the synthesis unit 92 of the update management ECU 11 creates synthesis update data for installing synthesis software that includes a first function, which is a function of the first software after the update, and a second function, which is a function of the second software after the update, from the first update data and the second update data (step S302).Then, the update management ECU 11 proceeds to step S303.

[0210] Specifically, for example, the control unit 22 reads the first update data and the second update data downloaded from the server 2 from the storage unit 23 where they are temporarily stored. Next, the control unit 22 adds predetermined information to the beginning and end of the data, connects the first update data and the second update data, and creates combined update data for installing the combined software. Examples of the predetermined information include information indicating the beginning of the data, information indicating the end of the data, and information indicating the destination ECU. The combined software installed by the combined update data will have a portion corresponding to the first update data that includes a first function, which is the function of the first software after the update, and a portion corresponding to the second update data that includes a second function, which is the function of the second software after the update. After creating the combined update data, the update management ECU 11 proceeds to step S303.

[0211] [2.4.3 Step S303] Next, the transmission unit 93 of the update management ECU 11 transmits the update information to the in-vehicle device having the storage unit. memoryThe update management ECU 11 then installs the combined software in the on-board device, activates the first function when the vehicle is in the first power state, and transmits the combined update data to the on-board device to activate the second function when the vehicle is in the second power state (step S303).

[0212] Specifically, the control unit 22 transmits the combined update data created by the combiner to the communication bus 14b via, for example, the transceiver 25b. The transmitted combined update data propagates through the communication bus 14b and reaches the transceiver 35 of the first ECU 12. The combined update data that reaches the transceiver 35 is received by the control unit 32. The control unit 32 temporarily stores the received combined update data in the first storage unit 33 or a RAM (not shown).

[0213] 5 and 6, the transmitter 93 transmits to the door ECU the combined update data for installing combined software including the door lock software function and the window software function. 4 Proceed to.

[0214] When the first ECU 12 receives the combined update data, the first ECU 12 installs combined software including the functions of the +B software and the IG software according to the received combined update data into the first storage unit 33. In the cases of Figures 5 and 6, the door ECU installs combined software including the functions of the door lock software and the functions of the window software into the first storage unit 33.

[0215] [2.4.4 Step S304] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 95 of the update management ECU 11 transmits a first activation instruction to the in-vehicle device to activate the first function (step S304).Then, the update management ECU 11 proceeds to step S305.

[0216] Specifically, the first instruction unit 95 references an ECU table stored in the storage unit 23, such as the contents shown in FIGS. 5 and 6. From the referenced ECU table, the first instruction unit 95 obtains information indicating in which power state the system is executed by software that operates. In the example of FIGS. 5 and 6, the door lock software function that executes the keyless entry system operates in both the +B state and the IG state. Therefore, when the power state is the +B state, the first instruction unit 95 transmits a first activation instruction to the door ECU to activate the door lock software function of the updated merged software installed in the first storage unit 33. Then, upon receiving the first activation instruction, the first ECU 12 activates the first software function of the merged software.

[0217] [2.4.5 Step S305] Next, the determination unit 94 of the update management ECU 11 determines whether the vehicle's power supply state is the first power supply state or the second power supply state (step S305). If the determination unit 94 determines that the vehicle's power supply state is the second power supply state, i.e., the IG state, the update management ECU 11 proceeds to step S306. On the other hand, if the determination unit 94 determines that the vehicle's power supply state is the first power supply state, i.e., the +B state, the update management ECU 11 returns to step S305 and repeats step S305. In other words, the update management ECU 11 is waiting for the vehicle's power supply state to transition from the +B state to the IG state.

[0218] [2. 4 .6 Step S306] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 96 transmits a second activation instruction to the in-vehicle device to activate the second function (step S306). Then, the update management ECU 11 ends the series of processes.

[0219] In the examples of FIGS. 5 and 6, the second instructionsThe unit 96 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIGS. 5 and 6. instructions The update management device 96 obtains information indicating the software functions that operate in which power state the system is executed. In the example of FIG. 5, the rainy weather window closing system is executed by the window software functions that operate in the IG state and the raindrop detection software functions. Therefore, when the power state is the IG state, the second instruction unit 96 transmits a second activation instruction to the door ECU to activate the window software functions of the updated composite software installed in the first storage unit 33. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the raindrop detection software function. Then, upon receiving the second activation instruction, the first ECU 12 activates the second software function of the installed composite software.

[0220] For the same reason as for the first instruction unit, it is preferable that the second instruction unit also transmits the second activation instruction to the in-vehicle device after the software has been installed by the update data.

[0221] [2.5 Control Sequences] Next, the control sequence of the update management system 1 will be described. Fig. 11 is a sequence diagram of the update management system according to the second embodiment. The description will be made assuming that the initial state starts from a state in which the vehicle cannot run. Therefore, in the initial state, the power supply state of the vehicle is +B state. Thereafter, the power supply state transitions from +B state to IG state.

[0222] [2.5.1 Step S401] First, the receiving unit 91 of the update management ECU 11 receives, from an external device of the vehicle, first update data for updating the first software that operates in the first power supply state and the second power supply state, and second update data for updating the second software that does not operate in the first power supply state but operates in the second power supply state (step S401).Then, the update management system 1 proceeds to step S402.

[0223] Specifically, the receiving unit 91 downloads the first update data and the second data from the server 2. The server 2 is provided, for example, in a data center of a vehicle manufacturer. The server 2 stores, for example, update data for updating the software of each ECU. The first update data is update data for installing door lock software, which is +B software of the first ECU 12. The second update data is update data for installing window software, which is IG software of the first ECU 12. After the download is complete, the process proceeds to step S402.

[0224] [2.5.2 Step S402] Next, the synthesis unit 92 of the update management ECU 11 creates synthesized update data from the first update data and the second update data to install synthesized software that includes a first function, which is a function of the first software after the update, and a second function, which is a function of the second software after the update (step S402).Then, the update management system 1 proceeds to step S403.

[0225] Specifically, for example, the control unit 22 reads the first update data and second update data downloaded from the server 2 from the storage unit 23 where they are temporarily stored. Next, the control unit 22 adds predetermined information to the beginning and end of the data, connects the first update data and the second update data, and creates combined update data for installing the combined software. Examples of the predetermined information include information indicating the beginning of the data, information indicating the end of the data, and information indicating the destination ECU. The combined software installed using the combined update data will have a portion corresponding to the first update data that includes a first function, which is the function of the first software after the update, and a portion corresponding to the second update data that includes a second function, which is the function of the second software after the update. After creating the combined update data, the update management system 1 proceeds to step 403.

[0226] [2.5.3 Step S403] Next, the transmission unit 93 of the update management ECU 11 transmits the update information to the in-vehicle device having the storage unit. memory The update management system 1 then installs the combined software in the on-board device, activates the first function when the vehicle is in the first power state, and transmits the combined update data to the on-board device to activate the second function when the vehicle is in the second power state (step S403).

[0227] 5 and 6, the transmitter 93 transmits to the door ECU the combined update data created from the second update data for installing combined software including the door lock software function and the window software function. The update management system 1 then proceeds to step S404.

[0228] [2.5.4 Step S404] Next, when the first ECU 12 receives the combined update data, the first ECU 12 installs combined software including the functions of the +B software and the IG software according to the received combined update data into the first storage unit 33 (step S404). In the cases of Figures 5 and 6, the door ECU installs combined software including the functions of door lock software and window software into the first storage unit 33. After the first ECU 12 installs the software, the update management system 1 proceeds to step S405.

[0229] [2.5.5 Step S405] Next, when the determination unit determines that the power supply state of the vehicle is the first power supply state, the first instruction unit 95 of the update management ECU 11 transmits a first activation instruction to the in-vehicle device to activate the first function (step S405).The update management system 1 then proceeds to step S406.

[0230] Specifically, the first instruction unit 95 references an ECU table stored in the storage unit 23, such as the contents shown in FIGS. 5 and 6. From the referenced ECU table, the first instruction unit 95 obtains information indicating in which power state the system is executed by software that operates. In the example of FIGS. 5 and 6, the door lock software function that executes the keyless entry system operates in both the +B state and the IG state. Therefore, when the power state is the +B state, the first instruction unit 95 transmits a first activation instruction to the door ECU to activate the door lock software function of the updated combined software installed in the first storage unit 33. After transmission, the update management system 1 proceeds to step S406.

[0231] [2.5.6 Step S406] Next, the first ECU 12 that has received the first activation instruction activates the function of the first software (step S406). In the examples of Figures 5 and 6, the function of the door lock software that executes the keyless entry system is a function of +B software that operates in both the +B state and the IG state, so the first ECU 12 activates the door lock software function of the updated combined software installed in the first storage unit 33. The update management system 1 then proceeds to step S407.

[0232] [2.5.7 Step S407] Next, the determination unit 94 of the update management ECU 11 determines whether the vehicle's power supply state is the first power supply state or the second power supply state (step S407). If the determination unit 94 determines that the vehicle's power supply state is the second power supply state, i.e., the IG state, the update management ECU 11 proceeds to step S408. On the other hand, if the determination unit 94 determines that the vehicle's power supply state is the first power supply state, i.e., the +B state, the update management ECU 11 returns to step S407 and repeats step S408. In other words, the update management ECU 11 is waiting for the vehicle's power supply state to transition from the +B state to the IG state.

[0233] [2.5.8 Step S408] Next, the second update management ECU 11 instructions When the determination unit determines that the power supply state of the vehicle is the second power supply state, the unit 96 transmits a second activation instruction to the in-vehicle device to activate the second function (step S408).Then, the update management system 1 proceeds to step S409.

[0234] In the examples of FIGS. 5 and 6, the second instructions The unit 96 refers to the ECU table stored in the storage unit 23, the contents of which are shown in FIGS. 5 and 6. instructionsThe update management device 96 obtains information indicating the software functions that operate in which power state the system is executed. In the example of Fig. 5, the rainy weather window closing system is executed by the window software functions that operate in the IG state and the raindrop detection software functions. Therefore, when the power state is the IG state, the second instruction unit 96 transmits a second activation instruction to the door ECU to activate the window software functions of the updated combined software installed in the first storage unit 33. In addition, it is preferable that the update management device also transmits an activation instruction to the sensor ECU to activate the raindrop detection software.

[0235] [2.5.9 Step S409] Next, the first ECU 12 that has received the second activation instruction activates the function of the updated software (step S409). In the cases of FIGS. 5 and 6, the first ECU 12 activates the function of the window software installed in the first storage unit 33. In addition, if the activation instruction has been sent to the second ECU 13, the second ECU 13 activates the function of the installed raindrop detection software. The update management system 1 then ends the series of processes.

[0236] [2.6 Summary] There are known vehicles equipped with multiple ECUs and capable of multiple power states, including +B state, IG state, etc. In such vehicles, when the ECU software is updated, there is a risk that multiple pieces of software that work together to execute a specific system may be activated in different power states, which could cause one piece of software to be unable to understand an instruction issued by another piece of software, resulting in the specific system not operating.

[0237] According to this embodiment, the update management device creates combined update data from multiple pieces of update data in advance, and transmits the update data to the in-vehicle device for installing and activating the software in the storage unit of the in-vehicle device. The update management device then installs the software in the in-vehicle device using the update data. The update management device then activates the installed software depending on the vehicle's power supply status. This allows the in-vehicle device's software to be updated and activated sequentially at appropriate times depending on the power supply status, ensuring that the software of multiple ECUs operates in cooperation without any discrepancies.

[0238] Furthermore, when the +B software and IG software are installed in the first ECU and the IG software is installed in the second ECU, and the IG software of the first ECU and the IG software of the second ECU work together to execute a predetermined system, it is preferable to simultaneously send an activation command to the IG software of the first ECU and the IG software of the second ECU. This explicitly activates the IG software of the first ECU and the IG software of the second ECU at the same time, further reducing discrepancies such as the IG software of the first ECU not being able to understand a command issued by the IG software of the second ECU.

[0239] [3.1 Supplementary Note 1] The present disclosure includes the following control method for an update management device. A control method for an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the control method including: a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a determining step of determining whether the power state of the vehicle is the first power state or the second power state; a first transmission step of transmitting the first update data to the in-vehicle device, the in-vehicle device having a first storage unit and a second storage unit, when the power state of the vehicle is determined to be the first power state by the determining step, to install the updated first software in the first storage unit and activate the updated first software; Steps and a second transmission step of transmitting the first update data and the second update data to the in-vehicle device when the power supply state of the vehicle is determined to be the second power supply state by the determination step, in order to install the updated first software and the updated second software in the second storage unit and activate the updated first software and the updated second software.

[0240] [3.2 Supplement 2] The present disclosure includes the following control method for an update management device. The control method of the update management device described in Supplementary Note 1 further includes a first activation instruction step of sending a first activation instruction to the in-vehicle device to activate the updated first software installed in the first memory unit when the determination step determines that the power supply state of the vehicle is the first power supply state, and a second activation instruction step of sending a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second memory unit when the determination step determines that the power supply state of the vehicle is the second power supply state.

[0241] [3.3 Supplement 3] The present disclosure includes the following control method for an update management system. a control method for an update management system including an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the in-vehicle device, the control method including a receiving step in which the update management device receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a determining step in which the power state of the vehicle is the first power state or the second power state; a first transmission step in which, when it is determined in the determining step that the power state of the vehicle is the first power state, the in-vehicle device, which has a first storage unit and a second storage unit, installs the updated first software in the first storage unit and transmits the first update data to the in-vehicle device to activate the updated first software; and, when it is determined in the determining step that the power state of the vehicle is the second power state, a second transmission step of transmitting the first update data and the second update data to the in-vehicle device to install the updated first software and the updated second software into a storage unit and activate the updated first software and the updated second software; a first activation instruction step of transmitting a first activation instruction to the in-vehicle device to activate the updated first software installed in the first storage unit when it is determined in the determination step that the power supply state of the vehicle is the first power supply state; and a second activation instruction step of transmitting a second activation instruction to the in-vehicle device to activate the updated first software and the updated second software installed in the second storage unit when it is determined in the determination step that the power supply state of the vehicle is the second power supply state, wherein the in-vehicle device activates the updated first software installed in the first storage unit when it receives the first activation instruction;and a second activation step of activating the updated first software and the updated second software installed in the second storage unit when the second activation instruction is received.

[0242] [3.4 Supplementary Note 4] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device that manages software updates for an on-board device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the on-board device, the control method including a receiving step in which the update management device receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a determining step in which the update management device determines whether the power state of the vehicle is the first power state or the second power state; and a control method for an update management system including a first storage unit and a second storage unit, the update management device receiving, when the power state of the vehicle is determined to be the first power state in the determining step, second update data for updating the first software that operates in the second power state, so that the on-board device can install the updated first software into the first storage unit. The method includes a first transmission step of transmitting update data to the in-vehicle device; a second transmission step of the update management device transmitting the first update data and the second update data to the in-vehicle device when it is determined in the determination step that the power supply state of the vehicle is the second power supply state, so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit; a first activation step of the in-vehicle device activating the updated first software installed in the first storage unit by the first update data transmitted in the first transmission step; and a second activation step of the in-vehicle device activating the updated first software and the updated second software installed in the second storage unit by the first update data and the second update data transmitted in the second transmission step.

[0243] [3.5 Supplement 5] The present disclosure includes the following control method for an update management device. A control method for an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, the control method comprising: a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a combining step of creating, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and a control method for controlling the in-vehicle device having a storage unit that stores the combined update data. memory and a transmitting step of transmitting the combined update data to the in-vehicle device to install the combined software in the in-vehicle device, activate the first function when the power state of the vehicle is the first power state, and activate the second function when the power state of the vehicle is the second power state.

[0244] [3.6 Supplement 6] The present disclosure includes the following control method for an update management device. The control method of the update management device described in Supplementary Note 4 further includes a determination step of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state, a first activation instruction step of sending a first activation instruction to the in-vehicle device to activate the first function when the determination step determines that the power supply state of the vehicle is the first power supply state, and a second activation instruction step of sending a second activation instruction to the in-vehicle device to activate the second function when the determination step determines that the power supply state of the vehicle is the second power supply state.

[0245] [3.7 Supplement 7] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device for managing software updates of an on-board device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the on-board device, the control method including a receiving step in which the update management device receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a combining step in which the update management device generates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and a storage unit in which the on-board device stores the stored update data. memory a transmitting step of transmitting the combined update data to the in-vehicle device in order to install the combined software in a power supply unit, activate the first function when the power supply state of the vehicle is the first power supply state, and activate the second function when the power supply state of the vehicle is the second power supply state; a determining step of determining whether the power supply state of the vehicle is the first power supply state or the second power supply state; a first activation instruction step of transmitting a first activation instruction to the in-vehicle device to activate the first function when the power supply state of the vehicle is determined to be the first power supply state by the determining step; Steps and a second activation instruction step of transmitting a second activation instruction to the in-vehicle device to activate the second function when the power supply state of the vehicle is determined to be the second power supply state by the determination step, wherein the in-vehicle device includes a first activation step of activating the first function when receiving the first activation instruction, and a second activation step of activating the second function when receiving the second activation instruction.

[0246] [3.8 Supplement 8] The present disclosure includes the following control method for an update management system. A control method for an update management system including an update management device for managing software updates of an on-board device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, and the on-board device, the control method comprising: a receiving step in which the update management device receives, from an external device of the vehicle, first update data for updating first software that operates in the first power state and the second power state, and second update data for updating second software that does not operate in the first power state but operates in the second power state; a combining step in which the update management device creates, from the first update data and the second update data, combined update data for installing combined software that includes a first function that is a function of the first software after updating and a second function that is a function of the second software after updating; and a storage unit in the on-board device storing the combined update data. memory a transmitting step of the update management device transmitting the combined update data to the in-vehicle device in order to install the combined software in the in-vehicle device; and memory a first activation step of activating the first function of the composite software installed in the in-vehicle device by the in-vehicle device; and memory and a second activation step in which the in-vehicle device activates the second function of the combined software installed in the in-vehicle device.

[0247] [3.9 Supplement 9] It should be noted that at least some of the above-described embodiments and various modifications may be combined with each other in any desired manner. Furthermore, the embodiments and modifications disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Explanation of symbols]

[0248] 1 Update Management System 2 Server 3 Network 11 Update management ECU 12 1st ECU 13 2nd ECU 14a Communication Bus 14b Communication Bus 15. Communications equipment 21 Information Processing Department 22 Control Unit 23 Memory section 24 Internal Bus 25a transceiver 25b transceiver 31 Information Processing Department 32 Control Unit 33 1st memory section 34 2nd memory section 35 Transceiver 36 Input section 37 Output section 38 Internal Bus 41 Receiving unit 42 Judgment section 43 First Transmission Unit 44 Second Transmission Unit 45 1st instruction section 46 2nd instruction part 47 1st erasure instruction section 48 Second erasure instruction section 91 Receiving unit 92 Synthesis section 93 Transmitter 94 Judgment section 95 1st instruction section 96 2nd instruction part

Claims

1. 1. An update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power supply state and the second power supply state, and second update data for updating second software that does not operate in the first power supply state but operates in the second power supply state; a determination unit that determines whether a power supply state of the vehicle is the first power supply state or the second power supply state; a first transmission unit that, when the determination unit determines that the power supply state of the vehicle is the first power supply state, causes the in-vehicle device, which includes a first storage unit and a second storage unit, to install the updated first software into the first storage unit and transmits the first update data to the in-vehicle device in order to activate the updated first software; a second transmission unit that, when the determination unit determines that the power supply state of the vehicle is the second power supply state, transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software into the second storage unit and activates the updated first software and the updated second software; An update management device comprising:

2. The update management device further a first instruction unit that transmits, to the in-vehicle device, a first activation instruction for activating the updated first software installed in the first storage unit when the determination unit determines that the power supply state of the vehicle is the first power supply state; a second instruction unit that, when the determination unit determines that the power supply state of the vehicle is the second power supply state, transmits to the in-vehicle device a second activation instruction to activate the updated first software and the updated second software installed in the second storage unit; and The update management device of claim 1 , comprising:

3. The update management device further a first erasure instruction unit configured to transmit, to the in-vehicle device, a first erasure instruction for erasing the pre-update first software and the pre-update second software from the second storage unit when the pre-update first software and the pre-update second software are installed in the second storage unit and the updated first software is installed in the first storage unit; a second erasure instruction unit that transmits, to the in-vehicle device, a second erasure instruction for erasing the updated first software from the first storage unit when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit; Equipped with The update management device according to claim 1 .

4. 2. The update management device according to claim 1, wherein the first power state is a power state when the vehicle is in a state where it cannot run, and the second power state is a power state when the vehicle is in a state where it can run.

5. the receiving unit receives the first update data and the second update data from the external device while the power supply state is the first power supply state; The update management device according to claim 1 .

6. The update management device according to any one of claims 1 to 5; the in-vehicle device; An update management system comprising:

7. 1. An update management system comprising: an update management device that manages software updates of an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state; and the in-vehicle device, The update management device a receiving unit that receives, from an external device of the vehicle, first update data for updating first software that operates in the first power supply state and the second power supply state, and second update data for updating second software that does not operate in the first power supply state but operates in the second power supply state; a determination unit that determines whether a power supply state of the vehicle is the first power supply state or the second power supply state; a first transmission unit that, when the determination unit determines that the power supply state of the vehicle is the first power supply state, causes the in-vehicle device, which includes a first storage unit and a second storage unit, to install the updated first software into the first storage unit and transmits the first update data to the in-vehicle device in order to activate the updated first software; a second transmission unit that, when the determination unit determines that the power supply state of the vehicle is the second power supply state, transmits the first update data and the second update data to the in-vehicle device so that the in-vehicle device installs the updated first software and the updated second software into the second storage unit and activates the updated first software and the updated second software; a first instruction unit that transmits, to the in-vehicle device, a first activation instruction for activating the updated first software installed in the first storage unit when the determination unit determines that the power supply state of the vehicle is the first power supply state; a second instruction unit that, when the determination unit determines that the power supply state of the vehicle is the second power supply state, transmits to the in-vehicle device a second activation instruction to activate the updated first software and the updated second software installed in the second storage unit; and Including, The in-vehicle device a first activation unit that activates the updated first software installed in the first storage unit when the first activation instruction is received; a second activation unit that activates the updated first software and the updated second software installed in the second storage unit when the second activation instruction is received; Including, Update management system.

8. The update management system further comprises: the first software before update and the second software before update are installed in the second storage unit, and a first erasing unit erases the first software before update and the second software before update from the second storage unit when the first software is installed in the first storage unit; a second erasing unit that erases the updated first software from the first storage unit when the updated first software is installed in the first storage unit and the updated first software and the updated second software are installed in the second storage unit; The in-vehicle device includes The update management system according to claim 7 .

9. 1. A computer program for controlling an update management device that manages software updates for an in-vehicle device in a vehicle having a plurality of power states including a first power state and a second power state different from the first power state, a receiving step of receiving, from an external device of the vehicle, first update data for updating first software that operates in the first power supply state and the second power supply state, and second update data for updating second software that does not operate in the first power supply state but operates in the second power supply state; a determining step of determining whether a power supply state of the vehicle is the first power supply state or the second power supply state; a first transmission step of transmitting the first update data to the in-vehicle device, the in-vehicle device having a first storage unit and a second storage unit, when it is determined that the power supply state of the vehicle is the first power supply state, in order to install the updated first software into the first storage unit and activate the updated first software; a second transmission step of transmitting the first update data and the second update data to the in-vehicle device when it is determined that the power supply state of the vehicle is the second power supply state, so that the in-vehicle device installs the updated first software and the updated second software in the second storage unit and activates the updated first software and the updated second software; A computer program for controlling an update management device, comprising:

Images