Patent Description:
<CIT> (<CIT>) discloses a system that updates ECU programs with upgrade programs transmitted from a server. In the system of <CIT>, occurrence of operation failure attributed to inconsistent versions of the ECU programs is prevented by determining whether or not to update an ECU program with reference to information on dependency relation between an upgrade program for the ECU program to be updated and other ECU programs, before the pertinent program is updated. <CIT> relates to a method for updating a software application stored in an equipment item on board an aircraft. The method describes a step of acquiring a version of software and a step of switching back to the prior version of the software application if the equipment item diagnoses an operating error after the switch. <CIT> describes a method for a vehicle including: receiving a software update to be installed to a vehicle electronic control unit; performing software update compatibility testing; and switching the software update into active use when the compatibility result indicates an allowable configuration. <CIT> discloses a method for a system to identify and upgrade software to one or multiple components within the system. Based on topology maps, the system determines whether the software configurations differ. If the software configurations differ, the system identifies the at least one of multiple components to upgrade.

When the versions of a plurality of on-board programs are inconsistent, unexpected vehicle control may possibly be performed. Although the system of <CIT> confirms the dependency relation between a program to be updated and other programs at the time of updating, confirming the dependency relation at the time of updating the program may be insufficient to prevent the unexpected vehicle control.

The present invention provides a device mounted on a vehicle, a vehicle, a method and a program that is executable by a computer, according to the appended set of claims, capable of further reducing the possibility of unexpected vehicle control performed due to inconsistent versions of a plurality of on-board software.

The present invention allows further reduction in the possibility of unexpected vehicle control performed due to inconsistent versions of the software of a plurality of on-board devices.

In a vehicle control system according to the present invention, one of a plurality of on-board devices that constitute the vehicle control system confirms the consistency of the versions of software, whenever the power source of a vehicle is turned on, to reduce the possibility of unexpected vehicle control performed due to inconsistent versions of the software.

<FIG> is a block diagram showing the schematic configuration of a vehicle control system according to a first embodiment.

A vehicle control system <NUM> is a system constituted of on-board devices A to D that can communicate with each other. The system implements specified vehicle control by combining the functions of the on-board devices A to D. In the example of <FIG>, the vehicle control system <NUM> is constituted of four on-board devices A to D. However, the number of the on-board devices that constitute the vehicle control system <NUM> is not limited to four. Examples of the specified vehicle control implemented by the vehicle control system <NUM> may include automatic driving. The on-board devices A to D correspond to ECUs that control vehicle travel functions, such as acceleration, deceleration, and steering, and to an ECU that offers travel assistance by combining the ECUs that control the vehicle travel functions. The on-board devices A to D can communicate with an external server <NUM> through a wireless communications device <NUM>. In the following description, a specific on-board device A that is one of the plurality of on-board devices A to D that constitute the vehicle control system is called "representative on-board device A.

<FIG> is a functional block diagram of the vehicle control system shown in <FIG>. <FIG> shows one example of a consistency table stored in a consistency information storage unit shown in <FIG>.

Although the representative on-board device A is one of the on-board devices that provide a control function of the vehicle control system <NUM>, the representative on-board device A functions as a master device in a process of confirming consistency of software versions of the on-board devices A to D. When the power source of a vehicle is turned on, the representative on-board device A confirms the consistency of versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM>. The representative on-board device A includes a software storage unit <NUM>, a consistency information storage unit <NUM>, a version acquisition unit <NUM>, a determination unit <NUM>, a transmission unit <NUM>, a reception unit <NUM>, a consistency information update unit <NUM>, and an update instruction unit <NUM>.

The software storage unit <NUM> stores software for operating the representative on-board device A. The representative on-board device A implements specified functions for controlling the operation of the vehicle by executing the software stored in the software storage unit <NUM>.

The consistency information storage unit <NUM> prestores a consistency table that defines a combination of the versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM>. The combination of the versions of the software of the on-board devices A to D defined in the consistency table is a combination of the versions that is confirmed to normally operate the vehicle control system <NUM>. The combination is also a combination of the versions permitted to be executed. For example, the consistency table may include a system number that identifies the vehicle control system <NUM>, and software versions of the on-board devices A to D, as shown in <FIG>. As the system number, an identifier that identifies the vehicle control system <NUM> may be used, or the version of the vehicle control system <NUM> may be used. Although the consistency table defines a single version for each of the on-board devices in the example of <FIG>, the consistency table may define the range of the versions of the on-board devices that can be combined. The consistency table may also define a plurality of combinations of versions (or the range of the versions) that are permitted to be concurrently executed. When one on-board device retains a plurality of software, the consistency table defines a permitted version of each of the software. The consistency table is used as consistency information (first consistency information) for the later-described determination unit <NUM> to determine whether or not the versions of the software of the on-board devices A to D are consistent.

Whenever the power source of the vehicle is turned on, the version acquisition unit <NUM> acquires the version of each software in the other on-board devices B to D through communication. When there is any on-board device that retains a plurality of software in the on-board devices B to D, the version acquisition unit <NUM> acquires the versions of all the software retained in the pertinent on-board device.

Whenever the version acquisition unit <NUM> acquires the versions of the software from the other on-board devices B to D, the determination unit <NUM> determines whether or not the versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM> are consistent. The determination unit <NUM> makes the determination by comparing the versions of the software stored in the software storage unit <NUM> of the representative on-board device A and the versions of the software that the version acquisition unit <NUM> acquires from the other on-board devices B to D with the consistency information stored in the consistency information storage unit <NUM>. When determining that the versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM> are consistent based on the consistency table stored in the consistency information storage unit <NUM>, the determination unit <NUM> permits execution of the specified vehicle control that is implemented by a combination of the functions of the on-board devices A to D.

When the determination unit <NUM> determines that the versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM> are inconsistent, the transmission unit <NUM> transmits version information including the versions of the software of the on-board devices A to D to the external server <NUM>. The version information transmitted by the transmission unit <NUM> is used in the external server <NUM> to reconfirm whether or not the versions of the software of the on-board devices A to D are consistent.

The reception unit <NUM> receives various pieces of information transmitted from the external server <NUM>. One piece of the information that the reception unit <NUM> receives from the external server <NUM> is determination result information. The determination result information indicates whether or not the versions of the software of the on-board devices A to D are consistent. The determination result information can be obtained as a result of determination made by the external server <NUM> based on the version information received from the transmission unit <NUM>.

The transmission unit <NUM> and the reception unit <NUM> communicate with the external server <NUM> through the wireless communications device <NUM> shown in <FIG>.

The consistency information update unit <NUM> updates the consistency information stored in the consistency information storage unit <NUM>, when the determination result information received by the reception unit <NUM> indicates that the versions of the software of the on-board devices A to D are consistent. The consistency information update unit <NUM> may update the consistency information by replacing the combination of the versions of the software included in the consistency table (first consistency information) stored in the consistency information storage unit <NUM> with a combination of current versions of the software of the on-board devices A to D, or by adding the combination of the current versions of the software of the on-board devices A to D to the consistency table stored in the consistency information storage unit <NUM>. The consistency information update unit <NUM> may update the consistency information by acquiring an updated consistency table from the external server <NUM>, and replacing the consistency table stored in the consistency information storage unit <NUM> with the consistency table acquired from the external server <NUM>.

When the determination result information received by the reception unit <NUM> indicates that the versions of the software of the on-board devices A to D are inconsistent, the update instruction unit <NUM> instructs the on-board device retaining the software inconsistent with the combination of the permitted versions to perform software update.

The on-board devices B to D each include a software storage unit <NUM>, a transmission unit <NUM>, and a reception unit <NUM>.

The software storage unit <NUM> stores software for operating each of the on-board devices B to D. The on-board devices B to D each implement specified functions for controlling the operation of the vehicle by executing the software stored in the software storage unit <NUM>.

The transmission unit <NUM> transmits the version of the software stored in the software storage unit <NUM> to the representative on-board device A. The transmission unit <NUM> may transmit the version of the software to the representative on-board device A when the power source of the vehicle is turned on. Alternatively, the transmission unit <NUM> may transmit the version of the software to the representative on-board device A in response to a request from the representative on-board device A that is transmitted when the power source of the vehicle is turned on.

The reception unit <NUM> receives various pieces of information transmitted from the representative on-board device A or the external server <NUM>.

The external server <NUM> includes a consistency information storage unit <NUM>, a determination unit <NUM>, a transmission unit <NUM>, and a reception unit <NUM>.

The consistency information storage unit <NUM> prestores a consistency table that defines a combination of the versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM>. The combination of the software of the on-board devices A to D defined in the consistency table is a combination of the versions that are confirmed to normally operate the vehicle control system <NUM>. The combination is also a combination of the versions permitted to be executed. The consistency table stored in the consistency information storage unit <NUM> may include a system number that identifies the vehicle control system <NUM>, and software versions of the on-board devices A to D, as in the case illustrated in <FIG>. The consistency table is used as consistency information (second consistency information) for the later-described determination unit <NUM> to determine whether or not the versions of the software of the on-board devices A to D are consistent.

The determination unit <NUM> determines whether or not the versions of the software of all the on-board devices A to D that constitute the vehicle control system <NUM> are consistent. The determination unit <NUM> makes the determination by comparing the versions of the software of the on-board devices A to D included in the version information received from the representative on-board device A with the consistency table stored in the consistency information storage unit <NUM>. The external server <NUM> can manage the software of all the versions of the on-board devices A to D. Therefore, as compared with the consistency table stored in the consistency information storage unit <NUM> of the representative on-board device A, the consistency table stored in the consistency information storage unit <NUM> can define a larger number of permitted combinations of the versions of the software of the on-board devices A to D. Therefore, even when the representative on-board device A fails to confirm the consistency of the versions of the software, it is possible to determine the consistency of the versions of the software of the on-board devices A to D with high accuracy by making a determination again in the external server <NUM>.

The transmission unit <NUM> transmits determination result information that is the result of determination by the determination unit <NUM> to the representative on-board device A. The determination result information indicates whether or not the versions of the software of the on-board devices A to D are consistent.

The reception unit <NUM> receives various pieces of information transmitted from the representative on-board device A.

The control process executed by the representative on-board device A will be described below with reference to <FIG> and <FIG>.

<FIG> is a flowchart showing one example of a process of confirming consistency executed by the representative on-board device in the vehicle control system according to the first embodiment. The control process shown in <FIG> is executed when the power source of the vehicle is turned on.

Step S1: the version acquisition unit <NUM> acquires the versions of the software of the other on-board devices B to D. Then, the process shifts to step S2.

Step S2: the determination unit <NUM> compares the version of the software of the representative on-board device A and the versions of the software acquired from the other on-board devices B to D with the consistency table stored in the consistency information storage unit <NUM> to determine whether the versions of the software of the on-board devices A to D are consistent. When the determination result in step S2 is YES, the process shifts to step S3. Otherwise, the process shifts to step S4.

Step S3: the determination unit <NUM> permits execution of vehicle control using a combination of the on-board devices A to D. Then, the determination unit <NUM> ends the process.

Step S4: the transmission unit <NUM> transmits version information including the version of the software of the representative on-board device A, and the versions of the software acquired from the other on-board devices B to D to the external server <NUM>. Then, the process shifts to step S5.

Step S5: the reception unit <NUM> determines whether or not the determination result information was received from the external server <NUM>. When the determination result in step S5 is YES, the process shifts to step S6. Otherwise, after waiting for a predetermined time, the reception unit <NUM> performs the determination process of step S5 again. When the state where the reception unit <NUM> is unable to receive the determination result information from the external server <NUM> continues for a predetermined time (timeout time) in step S5, the reception unit <NUM> determines timeout, and ends the process of step S5. The process then proceeds to step S6.

Step S6: the determination unit <NUM> determines whether or not the versions of the software of the on-board devices A to D are consistent based on the determination result information received from the external server <NUM>. When the determination result in step S6 is YES, the process shifts to step S7. Otherwise, the process shifts to step S9. When the reception unit <NUM> determines timeout in step S5, the determination unit <NUM> determines the versions of the software of the on-board devices A to D are inconsistent.

Step S7: the determination unit <NUM> permits execution of the vehicle control using a combination of the on-board devices A to D. Then, the process shifts to step S8.

Step S8: the consistency information update unit <NUM> updates the consistency table stored in the consistency information storage unit <NUM>. As described before, the consistency table may be updated by using the versions of the software used for determination in step S2, or may be updated by using the consistency table acquired from the external server <NUM> through the reception unit <NUM>. Then, the process is ended.

Step S9: the determination unit <NUM> prohibits execution of the vehicle control using a combination of the on-board devices A to D. Then, the process shifts to step S10.

Step S10: the update instruction unit <NUM> instructs an on-board device retaining the software of a version inconsistent with the consistency table stored in the consistency information storage unit <NUM> to perform software update. Then, the update instruction unit <NUM> ends the process.

When the update instruction unit <NUM> instructs software update, and the on-board device to be updated completes reception of updated software from the server <NUM>, a user may be encouraged to temporarily turn off and then turn on the power source of the vehicle again so as to switch the execution target software from the software of the current version to the updated software.

When the software of any one of the on-board devices is updated based on the update instruction in step S10, the consistency information update unit <NUM> may update the consistency table stored in the consistency information storage unit <NUM> as necessary.

In the vehicle control system <NUM> according to the present embodiment, the representative on-board device A acquires the versions of the software of the on-board devices B to D when the power source of the vehicle is turned on, and determines whether or not the versions of the software of the on-board devices A to D are consistent based on the consistency table prepared in advance. Since the consistency of the versions of software is confirmed whenever the power source of the vehicle is turned on, it is possible to further reduce the possibility of unexpected vehicle control executed due to the inconsistent versions of the software of the on-board devices A to D.

In the vehicle control system <NUM> according to the present embodiment, when inconsistency is determined based on a consistency check of software versions (first check) by the representative on-board device A, the representative on-board device A transmits the versions of the software of the on-board devices A to D to the external server <NUM>. The external server <NUM> then performs the consistency check of software versions again (secondary check) with use of the consistency table retained in the external server <NUM>. Even when the representative on-board device A fails to confirm the consistency with the information that the representative on-board device A retains, the external server <NUM> performs the consistency check again with the information that the external server <NUM> retains. This makes it possible to determine whether or not the versions of the software of the on-board devices A to D are consistent with higher accuracy.

In the vehicle control system <NUM> according to the present embodiment, whether or not the versions of the software of the on-board devices A to D are consistent is determined by comparison with the consistency table prepared in advance. As a result of comparison, it is possible to identify which version of the software of which on-board device is consistent with the consistency table. Since the information, used to identify the on-board device that is inconsistent with the consistency table, is applicable to software update, repair, or the like, of the on-board devices, it becomes possible to cope with the situation where the versions of the software are inconsistent at early stages.

In the vehicle control system <NUM> according to the present embodiment, when the representative on-board device A determines that the versions of the software of the on-board devices A to D are inconsistent, and then the external server <NUM> determines that the versions of the software of the on-board devices A to D are consistent, it is possible to update the consistency table stored in the consistency information storage unit <NUM> of the representative on-board device A. If the consistency table stored in the consistency information storage unit <NUM> is updated, the representative on-board device A can confirm the consistency of the software versions by itself when the power source of the vehicle is turned on next time, unless the software of the on-board devices A to D is changed. Hence, the time taken for confirmation of the consistency can be shortened.

The representative on-board device A may be constituted of only the software storage unit <NUM>, the consistency information storage unit <NUM>, the version acquisition unit <NUM>, and the determination unit <NUM> in the functional block of the representative on-board device A shown in <FIG>. Accordingly, it is possible to constitute a simple vehicle control system that can determine only the consistency of the versions of the software of the on-board devices A to D when the power source of the vehicle is turned on. The transmission unit <NUM> and the reception unit <NUM> may further be added to this configuration to constitute a vehicle control system that allows the primary check in the representative on-board device A and the secondary check in the external server <NUM>. It is also possible to constitute a vehicle control system with the consistency information update unit <NUM> or the update instruction unit <NUM> being excluded from the functional block of the representative on-board device A shown in <FIG>.

<FIG> is a functional block diagram of a vehicle control system according to a second embodiment.

The vehicle control system <NUM> according to the second embodiment is characterized in that the consistency of the versions of the software of the on-board devices A to D can be secured even in the state where communication between the representative on-board device A and the external server <NUM> is not possible after the representative on-board device A determines that the versions of the software of the on-board devices A to D are inconsistent. Hereinafter, description is mainly given of the difference between the present embodiment and the first embodiment.

The software storage unit <NUM> of the representative on-board device A stores software Sa_cur of a current version and software Sa_old of a previous version as the software for operating the representative on-board device A. The software Sa_cur of the current version and the software Sa_old of the previous version are stored in different storage regions in the software storage unit <NUM>. At the time of software update, the software Sa_old of the previous version is deleted, the software of the current version is retained as the software of the previous version, and the updated software is newly stored as the software of the current version.

The consistency information storage unit <NUM> stores a consistency table T_cur of a current version and a consistency table T_old of a previous version as consistency information. At the time of update of the consistency information, the consistency table T_old of the previous version is deleted, the consistency table of the current version is retained as the consistency table of the previous version, and an updated consistency table is newly stored as the consistency table of the current version.

The representative on-board device A further includes a switching instruction unit <NUM> and a software switch unit <NUM>.

When the determination unit <NUM> determines that the versions of the software of the on-board devices A to D are inconsistent, and the representative on-board device A is in the state where communication with the external server <NUM> is not possible, the switching instruction unit <NUM> instructs each of the on-board devices A to D to switch execution target software from the software of the current version to the software of the previous version. When the switching instruction unit <NUM> instructs the on-board devices A to D to switch the software, a user may be notified, by a display on the display unit or by voice, that the software is switched to the previous version.

When the switching instruction unit <NUM> instructs switching of the software, the software switch unit <NUM> switch execution target software from the software Sa_cur of the current version to the software Sa_old of the previous version. At the same time, the software switch unit <NUM> switches the consistency information used by the determination unit <NUM> from the consistency table T_cur of the current version to the consistency table T_old of the previous version. When the power source of the vehicle is turned on next time, the software switch unit <NUM> switches the software before the process of confirming the consistency of the versions of the software of the on-board devices A to D.

In the case where the switching instruction unit <NUM> instructs switching of the software, the version acquisition unit <NUM> and the determination unit <NUM> confirm the consistency of the versions of the software of the on-board devices A to D when the power source of the vehicle is turned on. The processes executed by the version acquisition unit <NUM> and the determination unit <NUM> are the same as normal processes performed when the power source is turned on. As a result of the processes, the version acquisition unit <NUM> acquires from the other on-board devices B to D the versions of the software after switching. The determination unit <NUM> confirms the consistency of the versions of software, by comparing the version of the software of the representative on-board device A after switching and the versions of the software acquired from the other on-board devices B to D after switching with the consistency table of the previous version.

The software storage units <NUM> of the on-board devices B, C, D store software Sb_cur, Sc_cur, Sd_cur of a current version, and software Sb_old, Sc_old, Sd_old of a previous version as the software for operating the on-board device B, C, D. Also in the on-board devices B to D, the software of the current version and the software of the previous version are stored in different storage regions in the software storage units <NUM>, respectively. At the time of software update, the software of the previous version is deleted, updated software is newly stored as the software of the current version, and the software of the current version is retained as the software of the previous version. The software Sa_old to Sd_old of the previous version is a combination of the software used before the software Sa_cur to Sa_cur of the current version, and is also a combination of the software having version consistency.

Each of the on-board devices B to D further includes a software switch unit <NUM>. When the switching instruction unit <NUM> instructs switching of the software, the software switch unit <NUM> switches execution target software from the software Sb_cur, Sc_cur, Sd_cur of the current version to the software Sb_old, Sc_old, Sd_old of the previous version software, respectively. When the power source of the vehicle is turned on next time, the software switch unit <NUM> also switches the software before the process of confirming the consistency of the versions of the software of the on-board devices A to D. Control Process.

<FIG> is a flowchart showing one example of a process of confirming consistency executed by a representative on-board device in the vehicle control system according to the second embodiment. The control process shown in <FIG> is executed when the power source of the vehicle is turned on.

Step S21: the software switch unit <NUM> determines whether or not switching of the software is instructed before the power source of the vehicle is turned on. In the case where an instruction is made for switching the software of the current version of the on-board devices A to D to the software of the previous version in later-described step S28, step S21 is a determination step necessary for performing the switching of the software when the power source is turned on for the first time after the instruction is made. Whether switching of the software is instructed before the power source of the vehicle is turned on may be determined based on a flag set in a nonvolatile storage region or the like. When the determination result in step S21 is YES, the process shifts to step S22. Otherwise, the process shifts to step S23.

Step S22: when it is determined that switching of the software is instructed in step S21, the software switch unit <NUM> switches execution target software from the software Sa_cur of the current version to the software Sa_old of the previous version. The software switch unit <NUM> also switches the consistency information used by the determination unit <NUM> from the consistency table T_cur of the current to the consistency table T_old of the previous version.

Although illustration is omitted, in other on-board devices that are instructed to switch software, the software switch unit <NUM> switches execution target software from the software of the current version to the software of the previous version, in parallel with the timing when the software is switched in the representative on-board device A.

Step S23: the version acquisition unit <NUM> acquires the versions of the software of the other on-board devices B to D. Then, the process shifts to step S24.

Step S24: the determination unit <NUM> determines whether or not the versions of the software of the on-board devices A to D are consistent, by comparing the version of the software of the representative on-board device A and the versions of the software acquired from the other on-board devices B to D with the consistency table stored in the consistency information storage unit <NUM>. When the determination result in step S24 is YES, the process shifts to step S25. Otherwise, the process shifts to step S26.

Step S25: the determination unit <NUM> permits execution of the vehicle control using a combination of the on-board devices A to D. Then, the determination unit ends the process.

Step S26: the transmission unit <NUM> determines whether or not communication with the external server <NUM> is possible. The transmission unit <NUM> can determine whether or not communication is established with the external server <NUM> based on, for example, the signal strength of a radio signal that the reception unit <NUM> receives. When the determination result in step S26 is YES, the process shifts to step S29. Otherwise, the process shifts to step S27.

Step S27: the determination unit <NUM> prohibits execution of the vehicle control using a combination of the on-board devices A to D. Then, the process shifts to step S28.

Step S28: the switching instruction unit <NUM> instructs the on-board device, which needs to switch software from the software of the current version to the software of the previous version, to switch the software of the current version to the software of the previous version. Then, the switching instruction unit <NUM> ends the process.

When the switching instruction unit <NUM> instructs the on-board devices A to D to switch the software, the representative on-board device A may notify a user that the software is switched. The representative on-board device A may also encourage the user to temporarily turn off and then turn on the power source of the vehicle at the time when preparation of the process of switching software is completed.

Step S29: the transmission unit <NUM> transmits version information including the version of the software of the representative on-board device A and the versions of the software acquired from the other on-board devices B to D to the external server <NUM>. Then, the process shifts to step S30.

Step S30: the reception unit <NUM> determines whether or not the determination result information was received from the external server <NUM>. When the determination result in step S30 is YES, the process shifts to step S31. Otherwise, after waiting for a predetermined time, the reception unit <NUM> performs the determination step of step S30 again. When the state where the reception unit <NUM> is unable to receive the determination result information from the external server <NUM> continues for a predetermined time (timeout time) in step S30, the reception unit <NUM> determines timeout, and ends the process of step S30. The process then proceeds to step S31.

Step S31: the determination unit <NUM> determines whether or not the versions of the software of the on-board devices A to D are consistent based on the determination result information received from the external server <NUM>. When the determination result in step S31 is YES, the process shifts to step S32. Otherwise, the process shifts to step S34. When the reception unit <NUM> determines timeout in step S30, the determination unit <NUM> determines that the versions of the software of the on-board devices A to D are inconsistent.

Step S32: the determination unit <NUM> permits execution of the vehicle control using a combination of the on-board devices A to D. Then, the process shifts to step S33.

Step S33: the consistency information update unit <NUM> updates the consistency information stored in the consistency information storage unit <NUM>. Then, he consistency information update unit <NUM> ends the process.

Step S34: the determination unit <NUM> prohibits execution of the vehicle control using a combination of the on-board devices A to D. Then, the process shifts to step S35.

Step S35: the update instruction unit <NUM> instructs the on-board device retaining the software of a version inconsistent with the consistency table stored in the consistency information storage unit <NUM> to perform software update. Then, the update instruction unit <NUM> ends the process.

In the vehicle control system <NUM> according to the present embodiment, whether or not the versions of the software of the on-board devices A to D are consistent is determined when the power source of the vehicle is turned on as in the first embodiment. This makes it possible to further reduce the possibility of unexpected vehicle control executed due to the inconsistent versions of the software of the on-board devices A to D.

In addition, in the vehicle control system <NUM> according to the present embodiment, each on-board device retains the software of the previous version, and the representative on-board device A retains the consistency table of the previous version. Therefore, when the representative on-board device A determines that the versions of the software of the on-board devices A to D are inconsistent, but the representative on-board device A and the external server <NUM> are not in a communicable state, it is possible to switch to the software of the previous version. According to this configuration, when the latest versions of software are not consistent, and the representative on-board device A fails to communicate with the external server, the consistency of the versions of the software of the on-board devices A to D can be secured.

It is also possible to constitute a vehicle control system with the consistency information update unit <NUM> or the update instruction unit <NUM> being excluded from the functional block of the representative on-board device A shown in <FIG>.

<FIG> is a schematic view for describing the background of a vehicle control system according to a third embodiment.

The on-board devices A to D that constitute a vehicle control system <NUM> have software having versions Sa to Sd that are consistent at the time of shipment of the vehicle (left column of <FIG>). The consistency of the versions of the software of the on-board devices A to D may be compromised because of the versions being mismatched due to replacement of the on-board devices A to D, or replacement of components, such as substrates, included in the on-board devices A to D. For example, assume the case where the on-board device C fails (a central column of <FIG>), and the failed on-board device C is replaced with a new on-board device. As a result of the replacement, the version of software Sc' of the new on-board device C may be different from the version of the software Sc before the replacement (right column of <FIG>). In this case, the version Sc' of the software of the new on-board device C is not necessarily consistent with the versions of the software of the on-board devices A, B, D. Depending on the version of the software Sc', it may be difficult to confirm the software consistency of the on-board devices A to D through only the consistency confirmation process executed by the representative on-board device A. In the case where the vehicle is used at the places where a sufficient wireless communication environment is not available, such as undergrounds and mountain areas, it is difficult to confirm the consistency through communication with the external server. This may lead to the situation where the vehicle control functions implemented by a combination of the on-board devices A to D are assumed to be restricted, or software update may be assumed to take time. As a result, the convenience of the user may be deteriorated.

On the assumption of such problems, the vehicle control system according to the third embodiment is characterized in that the consistency of the versions of the software of the on-board devices A to D can swiftly be secured even when repair or replacement of the on-board devices A to D is needed. Hereinafter, description is mainly given of the difference between the present embodiment and the first embodiment.

<FIG> is a functional block diagram of the vehicle control system according to the third embodiment.

In addition to the software storage unit <NUM>, the consistency information storage unit <NUM>, the version acquisition unit <NUM>, the determination unit <NUM>, the transmission unit <NUM>, and the reception unit <NUM> described in the first embodiment, the representative on-board device A includes a software acquisition unit <NUM> and a software update unit <NUM>.

When any one of the other on-board devices B to D fails, and replacement or repair is needed, the software acquisition unit <NUM> receives from the external server <NUM> the software of the current version of the failed on-board device while communication with the external server <NUM> is possible, and stores the acquired software. The software acquisition unit <NUM> is able to detect occurrence of failure in any one of the on-board devices B to D based on a failure notification output from the failed on-board device. <FIG> and <FIG> shows an example in which the on-board device C fails. The software acquisition unit <NUM> acquires software Sc of the on-board device C, which is consistent with the versions of the software Sa, Sb, Sd of the on-board device A, B, D, from the external server <NUM>, and stores the acquired software Sc. The version of the software that the software acquisition unit <NUM> acquires from the external server <NUM> may be acquired from the failed on-board device C through communication, or may be acquired from the consistency table stored in the consistency information storage unit <NUM>.

When the determination unit <NUM> determines that the versions of the software of the on-board devices A to D are inconsistent after replacement or repair of the failed on-board device, and determines that the on-board device, which retains the software of the version that is determined to be inconsistent with the consistency table, is the replaced or repaired on-board device, the software update unit <NUM> writes the software to be stored in the software acquisition unit <NUM> in the software storage unit <NUM> of the replaced or repaired on-board device. Then, the software update unit <NUM> instructs the replaced or repaired on-board device to switch the software.

In the case where the software update unit <NUM> instructs switching of software, the version acquisition unit <NUM> and the determination unit <NUM> confirm the consistency of the versions of the software of the on-board devices A to D when the power source of the vehicle is turned on next time. The processes executed by the version acquisition unit <NUM> and the determination unit <NUM> are the same as normal processes performed when the power source is turned on.

The on-board devices B to D may further include a software switch unit <NUM> same as the software switch unit described in the second embodiment. When the software update unit <NUM> instructs switching of the software, the software switch unit <NUM> switches execution target software from the software of the current version to the software written by the software update unit <NUM>. The software switch unit <NUM> switches the software before the process of confirming the consistency of the versions of the software of the on-board devices A to D, when the power source of the vehicle is turned on next time. Control Process.

The control process executed by the representative on-board device A will be described below with reference to <FIG>.

<FIG> is a flowchart showing one example of a software acquisition process executed by the representative on-board device in the vehicle control system according to the third embodiment.

Step S41: the reception unit <NUM> determines whether or not a failure notification is received from the other on-board devices B to D. When the determination result in step S41 is YES, the process shifts to step S42. Otherwise, the reception unit <NUM> ends the step.

Step S42: the software acquisition unit <NUM> acquires the software of the current version of the failed on-board device from the external server <NUM>, and stores the acquired software. Then, the software acquisition unit <NUM> ends the process.

<FIG> is a flowchart showing one example of a process of confirming consistency executed by the representative on-board device in the vehicle control system according to the third embodiment. The control process shown in <FIG> is executed when the power source of the vehicle is turned on.

Step S51: the version acquisition unit <NUM> acquires the versions of the software of the other on-board devices B to D. Then, the process shifts to step S52.

Step S52: the determination unit <NUM> determines whether or not the versions of the software of the on-board devices A to D are consistent, by comparing the version of the software of the representative on-board device A and the versions of the software acquired from the other on-board devices B to D with the consistency table stored in the consistency information storage unit <NUM>. When the determination result in step S52 is YES, the process shifts to step S54. Otherwise, the process shifts to step S53.

Step S53: the determination unit <NUM> permits execution of the vehicle control using a combination of the on-board devices A to D. Then, the determination unit <NUM> ends the process.

Step S54: the determination unit <NUM> determines whether or not the on-board device having software of the version, which is inconsistent with the consistency table, is a replaced or repaired on-board device. Whether or not the on-board device is replaced or repaired can be identified based on the failure notification received in step S41 of <FIG>. When the determination result in step S54 is YES, the process shifts to step S55. Otherwise, the process shifts to step S56.

Step S55: the software update unit <NUM> writes the software to be stored in the software acquisition unit <NUM> in a specified region of the software storage unit <NUM> of the replaced or repaired on-board device. The software update unit <NUM> then instructs the replaced or repaired on-board device to perform updating of software. Then, the process is ended.

Step S56: the determination unit <NUM> prohibits execution of the vehicle control with use of a combination of the on-board devices A to D. Then, the determination unit <NUM> ends the process.

When the software update unit <NUM> instructs switching of the software, a user may be encouraged to temporarily turn off and then turn on the power source of the vehicle again in order to switch execution target software of the replaced or repaired on-board device from the software of the current version to updated software. The representative on-board device A may temporarily turn off and then turn on again the power source of the on-board device which is instructed by the software update unit <NUM> to switch the software. In the on-board device instructed by the software update unit <NUM> to switch the software, the software switch unit <NUM> switches execution target software to the software written in the software storage unit <NUM> by the software update unit <NUM>, when the power source is turned on next time.

In addition, in the vehicle control system <NUM> according to the present embodiment, when replacement or repair of the on-board devices B to D is needed due to failure, the representative on-board device A acquires from the external server <NUM> in advance the software of a failed on-board device which is confirmed to be consistent in advance. When the version of the software of the replaced or repaired on-board device is inconsistent with the consistency table after replacement or repair of the failed on-board device, the representative on-board device A switches the inconsistent software with the software acquired from the external server <NUM> in advance. Therefore, even when the versions of the software of the on-board devices A to D are inconsistent due to replacement or repair of an on-board device, and a sufficient wireless communication environment is not available, it is possible to swiftly restore the state where the on-board devices A to D are consistent. As a result, restrictions of the vehicle control functions implemented with a combination of the on-board devices A to D can be eliminated at an early stage, and therefore the convenience of the user can be improved.

The method for confirming software consistency according to the third embodiment may be combined with the vehicle control system <NUM> according to the first embodiment, or the vehicle control system <NUM> according to the second embodiment. Specifically, the vehicle control system <NUM> according to the first embodiment, or the vehicle control system <NUM> according to the second embodiment may further include the software acquisition unit <NUM> and the software update unit <NUM>, and the representative on-board device A is configured to be able to execute the process of steps S41, S42 shown in <FIG> and the process of steps S54, S55 shown in <FIG>. The process of steps S54, S55 shown in <FIG> is preferably executed after the primary check where the determination unit <NUM> determines that the versions of software are inconsistent, and before the external server <NUM> executes the secondary check. With such configuration, the consistency is preferentially determined with the information retained in the representative on-board device A, and when it is difficult to make the determination by only the representative on-board device A, the secondary check in the external server <NUM> is performed. Thus, the process of determining software consistency can efficiently be performed without communication. When there is a step (S26 of <FIG>) of determining whether or not communication between the vehicle and the external server <NUM> is possible, and the vehicle is unable to communicate with the external server <NUM>, the process of step S54, S55 of <FIG> may be executed.

The control processes of <FIG>, <FIG>, <FIG> and <FIG> may be implemented with dedicated circuitry, or may be implemented by causing a computer, such as an ECU having a processor, a ROM, a RAM, a hard disk, and the like, to execute the process of the respective steps. When the computer such as an ECU is caused to execute the control processes of <FIG>, <FIG>, <FIG> and <FIG>, programs described to enable execution of the control processes may be prestored in a storage device, such as a ROM or a hard disk, such that the programs may be read from the storage device and executed by the processor included in the computer.

In the embodiments described above, one of the on-board devices that provide the control functions of the vehicle control system confirms the consistency of the versions of software as a representative on-board device. However, the above-described control process may be executed by an on-board device dedicated to confirming the consistency of the versions of software.

Claim 1:
A device mounted on a vehicle comprising:
a first instruction unit configured to perform a switching instruction to switch software mounted on a plurality of on-board devices;
an acquisition unit (<NUM>) configured to acquire version information of the software that has been switched of the on-board devices responding to the switching instruction;
a second instruction unit configured to instruct the on-board devices to restore the switched software to the software previous to switching; and
a confirmation unit configured to confirm whether combinations of versions of the respective software mounted on the plurality of on-board devices have consistency, based on the version information acquired by the acquisition unit,
characterized by:
a transmission unit (<NUM>) configured to transmit the version information acquired by the acquisition unit (<NUM>); and
a reception unit (<NUM>) configured to receive, from an external server (<NUM>), confirmation result information confirmed by the external server (<NUM>) based on the version information that is transmitted by the transmission unit (<NUM>), the confirmation result information indicating whether the combinations of versions of the respective software mounted on the plurality of on-board devices have the consistency;
wherein the second instruction unit is configured to instruct the on-board devices to restore the switched software to the software previous to switching when i) the confirmation unit confirms that the combinations of versions of the switched software mounted on the plurality of on-board devices do not have the consistency and ii) the transmission unit is unable to communicate with the external server (<NUM>);
wherein, when iii) the confirmation unit confirms that the combinations of versions of the switched software mounted on the plurality of on-board devices do not have the consistency and iv) the transmission unit is able to communicate with the external server (<NUM>),
the transmission unit (<NUM>) is configured to transmit the version information to the external server (<NUM>) acquired by the acquisition unit (<NUM>),
the reception unit (<NUM>) is configured to receive the confirmation result information from the external server (<NUM>), and
the confirmation unit is configured to confirm whether the combinations of versions of the respective software mounted on the plurality of on-board devices have the consistency based on the confirmation result information received by the reception unit (<NUM>).