Patent Description:
<CIT> discloses an onboard data updating device in which an onboard control unit receives update data from an external server and updates (performs an update process on) a unit that is to be updated by using the aforementioned update data.

<CIT> describes a master device for a vehicle includes: an install condition determination unit for determining whether a first condition, in which there is an approval of install by a user, a second condition, in which the master device is ready to communicate with a center device, a third condition, in which the state of a vehicle is ready to be installed, and a fourth condition, in which a rewriting target ECU is ready to be installed, and a fifth condition, in which update data is normal data, are all established; and an install instruction unit for instructing the rewriting target ECU to install using the update data if the install condition determination unit has determined that the first, second, third, fourth, and fifth conditions are all established.

However, when a process for updating software in a vehicle-mounted electronic control unit (ECU) is to be performed, hardware of the ECU is temporarily reset in order to update software rewrite details. Because communications with other onboard equipment are temporarily cut during the reset, an abnormality is assessed to have occurred, a fault code is recorded in a control unit of the vehicle, and a warning is issued to the driver, etc. Therefore, the driver, etc., might be misled into thinking that the software update process has failed or that a fault has occurred in the vehicle, which might cause undue concern on the part of the driver, etc..

The present invention was contrived in view of the above-mentioned problems, it being an object of the present invention to provide a software updating device, a software update method, and a software updating process program in which outputting of unnecessary warnings arising from a software update process is prevented.

The present invention provides a software updating device, a method for updating software that operates a vehicle-mounted equipment, and a software updating process program for implementing a process for updating software that operates a vehicle-mounted equipment as defined in the appended independent claims. Further advantageous effects can be achieved by preferred embodiments defined in the appended dependent claims.

Namely, the present invention provides software updating device that executes a process for updating software that operates a vehicle-mounted equipment, the software updating device comprising a controller that acquires the software and applies the software to the equipment to control the equipment, and the controller being configured to acquire the software and apply the software to the equipment, thereby executing the update process; cause a warning device to output a warning when an abnormality relating to the equipment is detected while the update process is not being executed; and record a fault code corresponding to the abnormality in a storage region of the controller and cause the warning device to output the warning based on the fault code that was recorded when the abnormality relating to the equipment occurs; prohibit outputting of the warning by the warning device when the abnormality relating to the equipment is detected while the update process is being executed; and prohibit the outputting of the warning by the warning device without recording the fault code when the abnormality relating to the equipment occurs while the update process is being executed.

An embodiment of the present invention is described below with reference to the accompanying drawings, etc..

One embodiment of the present invention is described with reference to <FIG> and <FIG>. <FIG> is a schematic block diagram of a software update system <NUM> and a software updating device <NUM> according to this embodiment of the present invention.

As shown in <FIG>, the software update system <NUM> is configured from a software updating device <NUM> mounted in a vehicle <NUM>, and an external server <NUM>. The software updating device <NUM> is configured from a controller <NUM> and a warning device <NUM>. The vehicle <NUM> is, e.g., an electric vehicle (EV).

The controller <NUM> includes a gateway <NUM> that acquires software from the external server <NUM>, and electronic control units <NUM> that control various pieces of equipment mounted in the vehicle <NUM>.

The gateway <NUM> is capable of communicating with the external server <NUM> and the electronic control units <NUM>. The gateway <NUM> acquires updating software from the external server <NUM> and transmits the aforementioned acquired updating software to electronic control units <NUM> that are to be updated. Additionally, the gateway <NUM> is also capable of communicating with the warning device <NUM>, which shall be described later. The gateway <NUM> acquires control information for the various pieces of equipment from the electronic control units <NUM> and senses the occurrence of an abnormality relating to the various pieces of equipment from the aforementioned control information. The gateway <NUM> has a storage region for recording a fault code when an abnormality occurs. Upon sensing the occurrence of an abnormality in the various pieces of equipment, the gateway <NUM> records a fault code corresponding to the aforementioned abnormality in the storage region. When the fault code is recorded in the storage region, the gateway <NUM> outputs a warning by using the warning device <NUM> on the basis of the recorded fault code.

The gateway <NUM> is configured from a computer provided with a central processing device (CPU), a read-only memory (ROM), a random access memory (RAM), and an input/output interface (I/O interface), the gateway <NUM> integrally controlling the software updating device <NUM>. By executing a specific program, the gateway <NUM> executes a process for controlling the software updating device <NUM>. Together with, e.g., the electronic control units <NUM>, the gateway <NUM> performs software update control that shall be described later.

The electronic control units (ECUs) <NUM> are controllers that control the various pieces of equipment mounted in the vehicle <NUM>, and include, e.g., a body control module (BCM), a vehicle dynamics control (VDC), and a hybrid electric vehicle control (HEVC). The various ECUs <NUM> are each configured from a computer provided with a central processing device (CPU), a read-only memory (ROM), a random access memory (RAM), and an input/output interface (I/O interface). The BCM controls operating elements in a body of the vehicle <NUM>, including an engine starter, a door lock, etc., of the vehicle <NUM>. The VDC controls output of brakes or an engine of the vehicle <NUM> and controls an orientation of the vehicle <NUM>, thereby preventing, inter alia, lateral sliding of the vehicle <NUM>. When the vehicle <NUM> is a hybrid vehicle, the HEVC controls the engine and a motor, which are drive sources, and realizes high-efficiency driving.

The ECUs <NUM> are capable of communicating with the gateway <NUM> and continuously transmit control information for the various pieces of equipment to the gateway <NUM> in the form of signals. The various ECUs <NUM> acquire software including the specific program from the gateway <NUM> and apply the acquired software to the equipment being controlled, thereby controlling the equipment. The ECUs <NUM> also perform, together with the gateway <NUM>, the software update control that shall be described later.

The various ECUs <NUM> are also each provided with two storage units <NUM>, <NUM> that store the software acquired from the gateway <NUM>. The ECUs <NUM> apply the software stored in one storage unit (first storage unit) <NUM> to the equipment, and change the software being applied to the equipment to the software stored in the other storage unit (second storage unit) <NUM>, thereby updating the software. Further details about a software update process shall be described later.

The warning device <NUM> is, e.g., a warning lamp in the vehicle <NUM>. When an abnormality occurs in the various pieces of equipment mounted in the vehicle <NUM>, the warning device <NUM> informs the driver, etc., about the aforementioned abnormality. The warning device <NUM> is capable of communicating with the gateway <NUM>. Upon sensing the occurrence of an abnormality in onboard equipment, the gateway <NUM> records a fault code corresponding to the aforementioned abnormality in the storage region and, for example, causes the warning lamp, which is the warning device <NUM>, to illuminate, thereby outputting a warning. The warning device <NUM> is not limited to being a warning lamp, and can be, e.g., an alarm that operates through sound.

The software update process is described next.

As described previously, the various ECUs <NUM> are each provided with two storage units <NUM>, <NUM>. When the ECUs <NUM> acquire software (first software) that is transmitted from the gateway <NUM>, the aforementioned software is stored in one storage unit (first storage unit) <NUM>, and the ECUs <NUM> apply the aforementioned software to the equipment. The first software can also be already stored in the first storage unit <NUM> in an initial state rather than being acquired from the gateway <NUM>.

When the ECUs <NUM> then acquire updating software (second software) that is transmitted from the gateway <NUM>, the aforementioned updating software is stored in the other storage unit (second storage unit) <NUM>. The first software is still applied to the equipment while the ECUs <NUM> are acquiring and storing the second software.

Thus, providing two storage units <NUM>, <NUM> to each of the various ECUs <NUM> makes it possible for the ECUs <NUM> to acquire (download) and store (install) the updating software in a state in which the first software is applied to the equipment. Specifically, it is possible to acquire and store the updating software without stopping operation of the equipment being controlled.

Upon acquiring and storing the updating software (second software), the ECUs <NUM> change the software applied to the equipment from the first software to the second software. The software applied to the equipment is thereby updated. The process for changing the software applied to the equipment from the first software to the second software is referred to below as a software update process (activation).

When the process for updating the software in the ECUs <NUM> is to be performed, hardware in the ECUs <NUM> is temporarily reset in order to update software rewrite details. Because communications between the ECUs <NUM> that are to be updated and ECUs <NUM> that control other onboard equipment are temporarily cut during the reset, an abnormality in the equipment is assessed to have occurred, and a fault code is recorded in the storage region of the gateway <NUM>. A warning is therefore issued to the driver, etc., by the warning device <NUM>. Therefore, the driver, etc., might be misled into thinking that the software update process has failed or that a fault has occurred in the vehicle <NUM>, which might cause undue concern on the part of the driver, etc. Additionally, because software update processes of the various ECUs <NUM> are not limited to being executed simultaneously, it is also possible that a plurality of warnings will be issued one after another. There is a risk that such issuance of a plurality of warnings might cause more undue concern on the part of the driver, etc. Thus, in the present embodiment, outputting of warnings by the warning device <NUM> while the software update process is being executed is prohibited.

Specifically, while the software update process is being executed, the gateway <NUM> does not record a fault code in the storage region even if the occurrence of an abnormality relating to the equipment is sensed. This makes it possible for outputting of warnings while the software update process is being executed to be prohibited.

Thus, because outputting of warnings by the warning device <NUM> while the software update process is being executed is prohibited, it is possible to prevent outputting of unnecessary warnings arising from the software update process.

In a case in which the occurrence of an equipment abnormality not arising from the software update process is sensed after outputting of warnings is prohibited, a fault code will be recorded and a warning will be outputted after conclusion of the update process, provided that the aforementioned abnormality is not eliminated even after the software update process has concluded.

<FIG> is a flowchart illustrating software update control according to the one embodiment of the present invention. The control described below is, in either instance, executed by the controller <NUM> (gateway <NUM> and ECUs <NUM>). The first software is stored in the first storage units <NUM> of the ECUs <NUM> in an initial state, and is applied to the equipment being controlled.

In step S101, upon acquiring the updating software (second software) from the external server <NUM>, the gateway (GW) <NUM> transmits the aforementioned updating software to the ECUs <NUM> that are to be updated.

In step S102, the ECUs <NUM> acquire (download) the updating software (second software) from the gateway <NUM>.

Next, in step S103, the ECUs <NUM> store (install) the updating software (second software) in the second storage unit <NUM>. Because the first software is still applied to the equipment being controlled by the ECUs <NUM> while the second software is being acquired and stored in steps S102 and S103, the equipment being controlled by the ECUs <NUM> is not stopped. Therefore, for example, the updating software can be acquired and stored even while the vehicle <NUM> is traveling. Additionally, because the updating software can be activated within a short time, it is possible to perform processes for acquiring, storing, and updating the software in a state in which an ignition switch is turned on (including while the vehicle <NUM> is traveling).

In step S104, the gateway <NUM> prohibits outputting of warnings by the warning device <NUM> simultaneously with starting of the software update process by the ECUs <NUM>.

The ECUs <NUM> change the software applied to the equipment being controlled from the first software to the second software, whereby the software update process is executed. The software applied to the equipment is thereby updated from the first software to the second software. During the software update process, it is preferable for the driver to be notified via a display device, etc. (not shown), that the update process is in progress.

Outputting of warnings is prohibited by, e.g., masking the storage region of the gateway <NUM>. As a consequence, fault codes are not recorded in the storage region even if the gateway <NUM> senses the occurrence of an abnormality relating to the equipment. Therefore, outputting of warnings by the warning device <NUM> is prohibited.

Step S104 can be configured such that the update process is permitted only when no occurrence of abnormality is sensed before the software update process is started. For example, the gateway <NUM> senses whether an abnormality has occurred in the equipment controlled by the pre-software-update ECUs <NUM> and transmits results of the aforementioned sensing to the ECUs <NUM>. The ECUs <NUM> execute the update process only when no occurrence of abnormality has been sensed. In a case in which the occurrence of an abnormality in the equipment is sensed before the software update process is executed, the ECUs <NUM> prohibit the software update process until the aforementioned abnormality is eliminated. Specifically, because outputting of warnings while the software update process is being executed is prohibited, no warning is outputted even with respect to an abnormality not arising from the update process. Therefore, eliminating an abnormality not arising from the software update process before starting the software update process reliably prevents a countermeasure to the abnormality from being delayed until after the software update process. The software update process can be permitted or prohibited by the gateway <NUM>.

Once the software update process is started in step S104, the gateway <NUM>, in step S105, temporarily resets the hardware (HW) of the ECUs <NUM> that are to be updated and updates the software rewrite details. Once the HW of the ECUs <NUM> is reset, communications between the ECUs <NUM> that are to be updated and the ECUs <NUM> that control other onboard equipment are temporarily cut. The gateway <NUM> senses the severance of communication as the occurrence of an abnormality relating to the equipment, but because the storage region of the gateway <NUM> is masked, no fault code is recorded in the storage region. Therefore, no warning is outputted.

Next, once the software update process has concluded in step S106, the gateway <NUM>, in step S107, removes the prohibition on outputting of warnings (permits outputting of warnings) and terminates the software update process.

Additionally, in a case in which the occurrence of an equipment abnormality not arising from the software update process is sensed by the gateway <NUM> over the course of steps S104 to S107 after outputting of warnings is prohibited, a warning will be outputted after the prohibition on outputting of warnings is removed, provided that the aforementioned abnormality is not eliminated even after the software update process has concluded.

The prohibition on outputting of warnings is preferably removed immediately after conclusion of the software update process, but such an arrangement is not necessarily provided by way of limitation. For example, outputting of warnings can be permitted after a fixed time has elapsed.

After the software update process has concluded, when the software is furthermore updated in a subsequent instance, updating software that is transmitted from the gateway <NUM> to the ECUs <NUM> is stored (written over) in the first storage unit <NUM>. The software applied to the equipment is changed from the second software stored in the second storage unit <NUM> to the aforementioned updating software that is stored in the first storage unit <NUM>, whereby the software is re-updated.

The processes shown in <FIG> are configured as programs that are to be executed by the controller <NUM>, which is a computer. These programs are written in a storage medium.

By using the software updating device <NUM> according to the embodiment described above, it is possible to obtain the following effects.

In the software updating device <NUM>, the gateway <NUM> (controller <NUM>) causes the warning device <NUM> to output a warning when an abnormality relating to the equipment occurs, and prohibits outputting of warnings by the warning device <NUM> while the software update process is being executed. Because outputting of warnings while the software update process is being executed is prohibited, no warning is outputted even if the HW of the ECUs <NUM> is temporarily reset and communication with other electronic control units is temporarily severed in order to update the software rewrite details. Therefore, it is possible to prevent outputting of unnecessary warnings arising from the software update process.

In the software updating device <NUM>, the gateway <NUM> (controller <NUM>) prohibits outputting of warnings while the software update process is being executed, and permits outputting of warnings after the software update process has concluded. This makes it possible to prevent outputting of unnecessary warnings arising from the software update process and to warn the driver, etc., about an equipment abnormality not arising from the software update process, the warning being issued after the software update process.

In the software updating device <NUM>, when an abnormality relating to the equipment occurs, the gateway <NUM> (controller <NUM>) records a fault code corresponding to the aforementioned abnormality in a storage region of the gateway <NUM> (controller <NUM>), and causes the warning device <NUM> to output a warning on the basis of the recorded fault code. However, the gateway <NUM> (controller <NUM>) does not record a fault code while the software update process is being executed even if an abnormality relating to the equipment occurs. Therefore, no warning is outputted by the warning device <NUM> while the software update process is being executed. It is therefore possible to prevent outputting of unnecessary warnings arising from the software update process.

In the software updating device <NUM>, each of the ECUs <NUM> (controller <NUM>) has the first storage unit <NUM> that stores the first software and the second storage unit <NUM> that stores the second software. Therefore, it is possible to acquire the updating software (second software) and to store the updating software in the second storage unit <NUM> in a state in which the first software stored in the first storage unit <NUM> is applied to the equipment. It is therefore possible to acquire and store the updating software without stopping the equipment controlled by the ECUs <NUM> that are to be updated, and convenience during software update work is improved.

The software updating device <NUM> is provided with a plurality of ECUs <NUM> that control each of a plurality of equipment, and each of the plurality of ECUs <NUM> executes the software update process. The gateway <NUM> (controller <NUM>) prohibits outputting of warnings by the warning device <NUM> while the software update processes are being executed. Thus, prohibiting outputting of warnings while the software update processes of the various ECUs <NUM> are being executed makes it possible to prevent a plurality of warnings arising from the software update processes of the various ECUs <NUM> from being issued one after another and causing more undue concern on the part of the driver, etc..

In the present embodiment, a BCM, a VDC, and an HEVC are employed as the ECUs <NUM>, but the types of ECUs <NUM> and the quantity thereof are not limited to those in the present embodiment, provided that the ECUs <NUM> control equipment mounted in the vehicle <NUM>.

The software update control including the software update process according to the present embodiment can be executed simultaneously in any number of the plurality of ECUs <NUM>, or can be executed at different times for each of the various ECUs <NUM>.

In the present embodiment, a configuration was employed in which the gateway <NUM> integrally controls the software updating device <NUM> and the ECUs <NUM> control the various pieces of equipment mounted in the vehicle <NUM>. However, the elements executing the various controls can be either of the gateway <NUM> and the ECUs <NUM>. For example, the changing of the software applied to the equipment (i.e., the software update process) can be executed by the gateway <NUM> rather than by the ECUs <NUM>.

In the present embodiment, when an abnormality relating to the equipment occurs, a fault code corresponding to the aforementioned abnormality is recorded in the storage region of the gateway <NUM>, and a warning is outputted by the warning device <NUM> on the basis of the recorded fault code. However, the method for outputting a warning is not limited to this arrangement. For example, when the occurrence of an abnormality in the equipment is sensed, the warning device <NUM> can be directly caused to output a warning, without a fault code having been recorded.

In the present embodiment, even if an abnormality relating to the equipment is sensed, the storage region of the gateway <NUM> is masked and no fault code is recorded while the software update process is being executed, whereby outputting of warnings while the update process is being executed is prohibited. However, the method for prohibiting warnings is not necessarily limited to this arrangement. For example, when the occurrence of an abnormality in the equipment is sensed as described above, in a case in which the warning device <NUM> is directly caused to output a warning without a fault code having been recorded, the prohibition on outputting of warnings also involves directly prohibiting the warning device <NUM> from outputting warnings.

In the present embodiment, the ECUs <NUM> are each configured so as to have two storage units <NUM>, <NUM>. However, such an arrangement is not necessarily provided by way of limitation. As described previously, it is preferable for each of the ECUs <NUM> to have two storage units <NUM>, <NUM> in order to make it possible to acquire and store the updating software without stopping the onboard equipment, but the ECUs <NUM> can also each be configured so as to have only one storage unit. When each of the ECUs <NUM> has only one storage unit, the updating software is written over the software stored in the aforementioned storage unit, whereby the software update process is performed. Outputting of warnings is also prohibited while the updating software is being acquired and stored when each of the ECUs <NUM> has only one storage unit.

Claim 1:
A software updating device (<NUM>) that executes a process for updating software that operates a vehicle-mounted equipment,
the software updating device comprising a controller (<NUM>) that acquires the software and applies the software to the equipment to control the equipment, and
the controller being configured to
acquire the software and apply the software to the equipment, thereby executing the update process;
cause a warning device (<NUM>) of the software updating device (<NUM>) to output a warning when an abnormality relating to the equipment is detected while the update process is not being executed; and record a fault code corresponding to the abnormality in a storage region of the controller and cause the warning device to output the warning based on the fault code that was recorded when the abnormality relating to the equipment occurs;
characterized in that
the controller is further configured to prohibit outputting of the warning by the warning device when the abnormality relating to the equipment is detected while the update process is being executed; and prohibit the outputting of the warning by the warning device without recording the fault code when the abnormality relating to the equipment occurs while the update process is being executed.