Patent ID: 11960877
Assignee: TOYOTA JIDOSHA KABUSHIKI KAISHA
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. An updating system mounted on a vehicle, the updating system comprising
an update management device including a central processing unit (CPU), and
a plurality of electronic control units (ECUs) including a first ECU and a second ECU, each ECU including a processor for executing programs stored in memory, a storage device, a communication interface, wherein
the first ECU is configured to
(i) stop a first un-updated program in response to turning-off of the vehicle,
(n) start an operation with a first updated program in response to turning-on of the vehicle, and
(iii) switch a program to be executed by the first ECU from the first updated program to the first un-updated program in response to a predetermined request from the update management device,

the second ECU is configured to
(i) maintain a control by a second un-updated program even when the vehicle is turned off,
(ii) switch a program to be executed by the second ECU from the second un-updated program to a second updated program in response to the turning-on of the vehicle, and
(iii) switch the program to be executed by the second ECU from the second updated program to the second un-updated program in response to the predetermined request from the update management device, and

the CPU of the update management device is configured to, in response to turning-on of the vehicle, determine whether at least one of the ECUs fails to update programs by confirming success or failure of updating programs of the ECUs, and
send the predetermined request, to the ECUs, to cause the ECUs, to switch the program executed by the first ECU to the program before the first update from the program after the first update and to switch the program executed by the second ECU to the program before the second update from the program after the second update, on a condition that the CPU determines that at least one of the ECUs fails to update programs based on the determination performed in response to turning-on of the vehicle.