Update System

Abstract

To properly execute a determination regarding the consistency of associations between software versions.SOLUTION: An update system includes a server, a master ECU mounted on a vehicle, and a plurality of slave ECUs. When software on a slave ECU is updated, the master ECU stores a consistency table corresponding to the software, as a first consistency table in the master ECU, and stores a second consistency table on the server (S21). When the second consistency table acquired from the server does not match the first consistency table in the master ECU, the master ECU stores the second consistency table as a first consistency table (S44). When a combination of version numbers of software stored in the slave ECU does not match a combination of version numbers specified in the first consistency table, the master ECU determines that the association does not maintain consistency.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to an update system.

Background Art

[0002] An update system includes a server and a vehicle. The vehicle includes a master ECU and a plurality of slave ECUs. The master ECU executes software updates for the plurality of slave ECUs. Specifically, the master ECU downloads new software from the server. Subsequently, the master ECU installs the new software on the slave ECUs. Then, the master ECU instructs the slave ECUs to activate the new software.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In an update system such as Patent Document 1, for example, the software of the ECU may be downgraded due to, for example, the initialization of the data of some ECUs. And the correspondence relationship of the software versions of the plurality of slave ECUs may become inconsistent. Therefore, in an update system such as Patent Document 1, it is conceivable to execute a determination as to whether the correspondence relationship of the software versions of the plurality of slave ECUs is consistent by referring to, for example, a consistency table stored in the master ECU. However, when the data of the consistency table stored in the master ECU is initialized, there is a possibility that the determination as to whether the correspondence relationship of the software versions of the plurality of slave ECUs is consistent cannot be appropriately executed.

Means for Solving the Problems

[0005] The update system for solving the above problems comprises a server, a master ECU mounted in a vehicle and capable of communicating with the server, and a plurality of slave ECUs mounted in the vehicle and whose software is updated by the master ECU, each of the plurality of slave ECUs stores the software of the slave ECU and a version number indicating the version of the software, and when a matching table is defined as data that defines the allowed combinations of the version numbers corresponding to the software of the plurality of slave ECUs, the master ECU stores the matching table corresponding to the software as a first matching table when the software of the slave ECU is updated, and when the software of the slave ECU is updated, the master ECU stores the matching table corresponding to the software as a first matching table. It is possible to: transmit the corresponding alignment table to the server and store it as a second alignment table in the server; retrieve the second alignment table from the server at a predetermined timing; if the retrieved second alignment table and the first alignment table stored in the master ECU do not match, store the retrieved second alignment table as the first alignment table in the master ECU; retrieve the version numbers corresponding to the current software stored in the slave ECUs from multiple slave ECUs; and if the combination of the retrieved multiple version numbers and the combination of the multiple version numbers defined in the first alignment table do not match, determine that the software version correspondence for multiple slave ECUs is not consistent. [Effects of the Invention]

[0006] With the above configuration, for example, even if the data in the first consistency table stored in the master ECU is initialized, the second consistency table is stored as the first consistency table because it does not match the first consistency table with the second consistency table obtained from the server. This restores the data in the master ECU's first consistency table. As a result, even if the data in the first consistency table stored in the master ECU is initialized, for example, by referring to the first consistency table, it is possible to appropriately determine whether the software version correspondences for multiple slave ECUs are consistent. [Brief explanation of the drawing]

[0007] [Figure 1] Figure 1 is a schematic diagram of the update system. [Figure 2] Figure 2 is a sequence diagram showing registration control and table check control. [Figure 3] Figure 3 is a sequence diagram showing the consistency check control. [Modes for carrying out the invention]

[0008] <Outline of the update system configuration> An embodiment of the present invention will be described below with reference to Figures 1 to 3. First, the general configuration of the update system US will be described.

[0009] As shown in Figure 1, the update system US comprises multiple vehicles 100. A vehicle 100 is, for example, a car owned by the user. Note that Figure 1 shows only one vehicle 100 as a representative example. In this embodiment, vehicle 100 is a vehicle equipped with an engine and a motor generator as its power source, a so-called hybrid vehicle.

[0010] The vehicle 100 includes a master ECU 10, a plurality of slave ECUs 20, a DCM 50, a first external bus 61, a second external bus 62, and a display 71. The first external bus 61 connects the master ECU 10 and the DCM 50 so that they can communicate with each other. The second external bus 62 connects the master ECU 10 and the plurality of slave ECUs 20 so that they can communicate with each other. The display 71 is capable of displaying various types of information. In this embodiment, the display 71 is located near the driver's seat of the vehicle 100. "ECU" is an abbreviation for Electronic Control Unit, and "DCM" is an abbreviation for Data Communication Module.

[0011] The master ECU 10 manages software updates in the slave ECU 20. The master ECU 10 includes an execution device 11 and a storage device 12. An example of the execution device 11 is a CPU. The storage device 12 includes a read-only ROM, a read and write volatile RAM, and a read and write non-volatile storage. The storage device 12 pre-stores various programs and various data. Specifically, the storage device 12 pre-stores a consistency table TM and a vehicle identification number VIN as various data. The vehicle identification number VIN is a number used to identify the vehicle 100. Therefore, the vehicle identification number VIN stored in the storage device 12 of the master ECU 10 is a number predetermined for the vehicle 100 equipped with the master ECU 10. A detailed explanation of the consistency table TM will be given later. The execution device 11 performs various processes described later by executing the programs stored in the storage device 12. The master ECU 10 can communicate wirelessly with external devices of the vehicle 100 via the DCM 50 and the communication network NW.

[0012] The slave ECU 20's software updates are managed by the master ECU 10. The slave ECU 20 includes an execution device 21 and a storage device 22. An example of the execution device 21 is a CPU. The storage device 22 includes ROM, RAM, and storage. The storage device 22 pre-stores various programs and various data. Specifically, the storage device 22 pre-stores the version number NV as various data. A detailed explanation of the version number NV will be given later. The execution device 21 performs various processes, which will be described later, by executing the programs stored in the storage device 22. In this embodiment, the vehicle 100 is equipped with four slave ECUs 20. An example of the four slave ECUs 20 is a hybrid ECU, an engine ECU, a motor ECU, and a battery ECU.

[0013] As shown in Figure 1, the update system US includes a server 200. The server 200 includes an execution device 210, a storage device 220, and a communication device 230. The communication device 230 can communicate with devices outside the server 200 via a communication network NW. An example of the execution device 210 is a CPU. The storage device 220 includes ROM, RAM, and storage. The storage device 220 pre-stores various programs and various data. The execution device 210 performs various processes described later by executing programs stored in the storage device 220.

[0014] <Update control> Next, the update control performed by the master ECU 10 of the vehicle 100 will be described. The update control is the control related to the software update in the slave ECU 20 of the vehicle 100. In this embodiment, the master ECU 10 starts the update control when, for example, all of the following conditions (1) and (2) are met.

[0015] Condition (1): The update device and the master ECU 10 are connected via a cable. Condition (2): The update device has performed an operation to request a software update on the slave ECU20.

[0016] Here, the update device is a device for updating the software in the slave ECU 20. For example, the update device is installed in a factory that performs maintenance on the vehicle 100. One example of an update device is a personal computer.

[0017] When the master ECU 10 initiates update control, the execution device 11 of the master ECU 10 first obtains the new software, the version number NV corresponding to the software, and the matching table TM corresponding to the software from the update device. Next, the execution device 11 of the master ECU 10 installs the new software and version number NV into the storage device 22 of the slave ECU 20 to be updated. Then, the execution device 11 of the master ECU 10 instructs the slave ECU 20 to activate the new software. The execution device 11 of the master ECU 10 also stores the obtained matching table TM as the first matching table TM1 in the storage device 12. In other words, when the master ECU 10 updates the software of the slave ECU 20, it stores the obtained matching table TM as the first matching table TM1 in the storage device 12. As a result, each time update control is executed, the software and version number NV in the slave ECU 20 to be updated are updated. Furthermore, each time update control is performed, the first consistency table TM1 in the master ECU 10 is updated.

[0018] Here, the version number NV is a numerical value indicating the version of the software corresponding to the version number NV. Further, the version number NV is a numerical value that increases each time the software corresponding to the version number NV is updated. Also, the consistency table TM defines combinations of version numbers NV for a plurality of slave ECUs 20 indicating the correspondence relationship of the software versions when the software is normally stored in the plurality of slave ECUs 20. In other words, the consistency table TM defines allowable combinations of version numbers NV for combinations of version numbers NV of a plurality of slave ECUs 20.

[0019] <Registration control> Next, referring to FIG. 2, the registration control executed by the master ECU 10 and the server 200 of the vehicle 100 will be described. The registration control is control for registering the consistency table TM obtained in the update control in the server 200. In the present embodiment, the master ECU 10 starts the registration control each time the update control is completed. In other words, the master ECU 10 starts the registration control when updating the software of the slave ECU 20.

[0020] As shown in FIG. 2, when the execution device 11 of the master ECU 10 starts the registration control, it executes the process of step S11. In step S11, the execution device 11 of the master ECU 10 transmits the consistency table TM obtained in the update control and the vehicle identification number VIN stored in the storage device 12 to the server 200. When the server 200 acquires the consistency table TM and the vehicle identification number VIN, the execution device 210 of the server 200 advances the process to step S21.

[0021] In step S21, the execution device 210 of the server 200 registers the matching table TM acquired in step S11. Specifically, the execution device 210 stores the matching table TM acquired in step S11 in the storage device 220 as the second matching table TM2. At this time, the execution device 210 stores the second matching table TM2 in the storage device 220 in association with the vehicle identification number VIN acquired in step S11. Therefore, in the registration control, the master ECU 10 transmits the matching table TM to the server 200, and the server 200 stores it as the second matching table TM2. After step S21, the execution device 210 ends the current registration control.

[0022] Next, referring to FIG. 2, the table check control executed by the master ECU 10 of the vehicle 100 and the server 200 will be described. The table check control is for checking the first matching table TM1 stored in the storage device 12 of the master ECU 10. In the present embodiment, the master ECU 10 starts the table check control at every predetermined regular period. An example of the regular period is one month. Note that the above regular period corresponds to a predetermined timing.

[0023] As shown in FIG. 2, when the execution device 11 of the master ECU 10 starts the table check control, it executes the process of step S41. In step S41, the execution device 11 of the master ECU 10 transmits a request signal for requesting the second matching table TM2 and the vehicle identification number VIN stored in the storage device 12 to the server 200. When the server 200 acquires the request signal and the vehicle identification number VIN, the execution device 210 of the server 200 advances the process to step S42.

[0024] In step S42, the execution device 210 of the server 200 transmits the second consistency table TM2 stored in the storage device 220 to the master ECU 10. Specifically, the execution device 210 of the server 200 transmits the second consistency table TM2, which is associated with the vehicle identification number VIN obtained in step S41, to the master ECU 10. If the master ECU 10 obtains the second consistency table TM2, the execution device 11 of the master ECU 10 proceeds to step S43.

[0025] In step S43, the execution device 11 of the master ECU 10 determines whether the second consistency table TM2 obtained in step S42 and the first consistency table TM1 stored in the storage device 12 match. If the execution device 11 determines in step S43 that the second consistency table TM2 obtained in step S42 and the first consistency table TM1 stored in the storage device 12 match, the execution device 11 terminates the table check control. On the other hand, if the execution device 11 determines in step S43 that the second consistency table TM2 obtained in step S42 and the first consistency table TM1 stored in the storage device 12 do not match, the execution device 11 proceeds to step S44.

[0026] In step S44, the execution device 11 of the master ECU 10 updates the first consistency table TM1. Specifically, the execution device 11 stores the second consistency table TM2, obtained in step S42, in the storage device 12 as the first consistency table TM1. In other words, the first consistency table TM1 is updated. After step S44, the execution device 11 terminates the current table check control.

[0027] <Integrity check control> Next, with reference to Figure 3, the consistency check control performed by the master ECU 10 and the multiple slave ECUs 20 will be described. The consistency check control is a control to determine whether the software version correspondences for the multiple slave ECUs 20 are consistent. In this embodiment, the slave ECU 20 starts the consistency check control when the vehicle 100's system is requested to start up. One example of when the vehicle 100's system is requested to start up is when the vehicle 100's main switch is turned ON.

[0028] As shown in Figure 3, when the execution device 21 of the slave ECU 20 starts consistency check control, it executes the process in step S61. In step S61, the execution device 21 of the slave ECU 20 sends the version number NV corresponding to the current software stored in the storage device 22 to the master ECU 10. Each of the four execution devices 21 of the slave ECU 20 sends the version number NV to the master ECU 10. When the master ECU 10 has received a total of four version numbers NV, the execution device 11 of the master ECU 10 proceeds to step S71.

[0029] In step S71, the execution device 11 of the master ECU 10 determines whether the combination of version numbers NV obtained in step S61 matches any of the multiple combinations of version numbers NV defined in the first consistency table TM1. If the execution device 11 determines in step S71 that the combination of version numbers NV obtained in step S61 matches any of the multiple combinations of version numbers NV defined in the first consistency table TM1, the execution device 11 determines that the software version correspondence for the multiple slave ECUs 20 is consistent (S71: YES). The execution device 11 then proceeds to step S81.

[0030] In step S81, the execution device 11 of the master ECU 10 starts the vehicle 100 system. Specifically, the execution device 11 allows the multiple slave ECUs 20 to perform various controls related to the driving of the vehicle 100. After step S81, the execution device 11 of the master ECU 10 terminates the current consistency check control.

[0031] On the other hand, if the execution device 11 determines in step S71 that the combination of version numbers NV obtained in step S61 and the multiple combinations of version numbers NV defined in the first consistency table TM1 do not match, the execution device 11 determines that the correspondence of software versions for the multiple slave ECUs 20 is not consistent (S71: NO). Then, the execution device 11 proceeds to step S91.

[0032] In step S91, the execution device 11 of the master ECU 10 notifies the user of the vehicle 100 that the software version correspondences for the multiple slave ECUs 20 are inconsistent. Specifically, the execution device 11 outputs a control signal to the display 71, which displays that the software version correspondences for the multiple slave ECUs 20 are inconsistent. The execution device 11 also outputs a control signal to the display 71, which displays the slave ECUs 20 that are assumed to have had their software downgraded. Here, the slave ECUs 20 that are assumed to have had their software downgraded are the slave ECUs 20 that had different version numbers NV in step S71. Furthermore, in step S91, the execution device 11 prohibits the execution of various controls related to the driving of the vehicle 100 by the multiple slave ECUs 20. After step S91, the execution device 11 terminates this consistency check control.

[0033] <Operation of this embodiment> In update control, the master ECU 10 stores the acquired consistency table TM as the first consistency table TM1 in the storage device 12. Subsequently, as shown in Figure 2, in steps S11 and S21 of registration control, the master ECU 10 transmits the consistency table TM acquired in update control to the server 200, where it is stored as the second consistency table TM2. Then, when it is time to execute table check control, the master ECU 10 starts table check control. In steps S41 and S42 of table check control, the master ECU 10 acquires the second consistency table TM2 from the server 200. Furthermore, in steps S43 and S44, if the acquired second consistency table TM2 and the first consistency table TM1 stored in the storage device 12 do not match, the master ECU 10 stores the acquired second consistency table TM2 as the first consistency table TM1 in the storage device 12. Then, as shown in Figure 3, in step S61 of the consistency check control, the master ECU 10 obtains a total of four version numbers NV from the four slave ECUs 20. In step S71, the execution device 11 of the master ECU 10 determines whether the combination of version numbers NV obtained in step S61 matches the multiple combinations of version numbers NV defined in the first consistency table TM1. Here, the master ECU 10 determines that the software version correspondence for the multiple slave ECUs 20 is consistent if the obtained combination of version numbers NV matches the multiple combinations of version numbers NV defined in the first consistency table TM1. On the other hand, the master ECU 10 determines that the software version correspondence for the multiple slave ECUs 20 is inconsistent if the obtained combination of version numbers NV matches the multiple combinations of version numbers NV defined in the first consistency table TM1.

[0034] <Effects of this embodiment> (1) According to this embodiment, for example, even if the first consistency table TM1 stored in the storage device 12 of the master ECU 10 is initialized after registration control, the data of the first consistency table TM1 in the storage device 12 is restored by executing table check control. As a result, in consistency check control, the master ECU 10 can refer to the correct first consistency table TM1. As a result, the master ECU 10 can appropriately determine whether the correspondence of software versions for multiple slave ECUs 20 is consistent.

[0035] <Example of changes> This embodiment can be implemented with the following modifications. This embodiment and the following modifications can be combined with each other to the extent that they do not contradict each other technically.

[0036] • In the above embodiment, the update control may be modified. For example, in update control, the execution device 11 of the master ECU 10 may download new software, the version number NV corresponding to the software, and the consistency table TM corresponding to the software from the server 200.

[0037] • In the above embodiment, the table check control may be modified. For example, the timing of the table check control may be changed. Specifically, the specified period may be shorter than one month or longer than one month. Also, specifically, the execution device 11 of the master ECU 10 may execute the table check control when the system startup of the vehicle 100 is requested. In this case, the execution device 11 should execute the consistency check control after executing the table check control.

[0038] In the above embodiment, the consistency check control may be modified. For example, steps S81 to S91 can be omitted. Specifically, if the only requirement is to determine whether the software versions of multiple slave ECUs 20 are compatible, steps S81 to S91 can be omitted. [Explanation of symbols]

[0039] NW…Communication Network US…Update System 10…Master ECU 11…Execution Unit 12…Storage Device 20…Slave ECU 21…Execution Unit 22…Storage Device 50…DCM 71…Display 100…Vehicle 200…Server 210…Execution Unit 220…Storage Device 230…Communication Device

Claims

[Claim 1] The system comprises a server, a master ECU mounted in the vehicle and capable of communicating with the server, and a plurality of slave ECUs mounted in the vehicle whose software is updated by the master ECU. Each of the aforementioned slave ECUs stores the software of the slave ECU and a version number indicating the version of the software. When the data defining the acceptable combinations of version numbers for the software of multiple slave ECUs is set as a consistency table, The aforementioned master ECU is When the software of the slave ECU is updated, the matching table corresponding to the updated software is stored in the master ECU as the first matching table. When the software of the slave ECU is updated, the matching table corresponding to the updated software is sent to the server, and the server stores it as a second matching table. Obtaining the second consistency table from the server at a predetermined timing, If the acquired second alignment table and the first alignment table stored in the master ECU do not match, the acquired second alignment table is stored in the master ECU as the first alignment table. Obtaining the version number corresponding to the current software stored in the slave ECU from multiple slave ECUs, If the combination of multiple version numbers obtained and the combination of multiple version numbers defined in the first matching table do not match, it is determined that the software version correspondence for multiple slave ECUs is not consistent. It is possible to do so. Update system.

Images