Patent Description:
Conventionally, updating the software of an ECU (Electronic Control Unit) mounted on a vehicle by wire essentially requires that the ECU is connected to an external battery during update processing in order to prevent dead battery due to reduction in battery voltage.

On the other hand, <CIT> discloses a data writing system that identifies a vehicle whose ECU program (software) should be rewritten, by wireless communication, and performs transmission/reception of writing data and a writing work for them. This data writing system requires that an engine is in an operating state, as a precondition for enabling the writing of data, so as to prevent dead battery during the data writing work. Other examples of software updating systems are disclosed in patent documents <CIT>, <CIT> and <CIT>.

While the update of the software of the ECU is in progress, equipment to be controlled by the ECU is functionally stopped. Accordingly, like a technique disclosed in the patent literature <NUM>, if the engine or the like is operating during the update of the software, an unexpected accident may occur, for example, in the case where the braking function is stopped. Therefore, it is necessary to stop the operation of a power train including the engine or the like during the update of the software so as to prevent the engine or the like from malfunctioning.

However, stopping the engine for a long time to update the software may lead to dead battery. Although it may be possible to update the software with an external battery being connected, equipment such as a high-power battery will be required to prevent the dead battery, which leads to reduction in convenience.

In view of the above problems, the present invention intends to provide a software updating device, a software updating method, and a software update processing program with improved convenience during update work while preventing malfunctions of an engine or the like during the update of software.

A software updating device according to the invention is defined by appended claim <NUM>. Specific embodiments are defined by the dependent claims. Such a device is for executing processing for updating software causing an equipment mounted on a vehicle to operate. The software updating device includes a controller that acquires the software, and controls the equipment by applying the software to the equipment. The controller includes a first storage unit that stores acquired first software and a second storage unit that stores acquired second software. In a state where no driving force is output by a power train of the vehicle, the controller executes processing for updating the software by changing software to be applied to the equipment from the first software to the second software.

Hereinafter, an embodiment of the present invention will be described with reference to attached drawings.

An embodiment of the present invention will be described with reference to <FIG> and <FIG>. <FIG> is a schematic configuration diagram illustrating a software updating system <NUM> and a software updating device <NUM> according to the embodiment of the present invention.

As illustrated in <FIG>, the software updating system <NUM> is configured by the software updating device <NUM> mounted on a vehicle <NUM>, and an external server <NUM>. The software updating device <NUM> is configured by a controller <NUM> and a detection unit <NUM>.

The controller <NUM> includes a gateway <NUM> that acquires software from the external server <NUM>, and an electronic control unit (ECU) <NUM> that controls each equipment mounted on the vehicle <NUM>.

The gateway <NUM> can communicate with the external server <NUM> and the electronic control unit <NUM>, acquires software for updating from the external server <NUM>, and transmits the acquired software for updating to the electronic control unit <NUM> to be updated. Further, the gateway <NUM> acquires control information of each equipment from the electronic control unit <NUM>, and acquires a driving force output state of a power train from the detection unit <NUM> described below.

The gateway <NUM> is configured by a computer including a central processing unit (CPU), a read-only memory (ROM), a random access memory (RAM) and an input/output interface (I/O interface), and performs integrated control for the software updating device <NUM>. By executing a specific program, the gateway <NUM> executes processing for controlling the software updating device <NUM>. The gateway <NUM> performs software update control described below, in cooperation with the electronic control unit <NUM>, for example.

The electronic control unit (ECU) <NUM> is a controller that controls each equipment mounted on the vehicle <NUM>. Examples of the electronic control unit <NUM> include BCM (Body Control Module), VDC (Vehicle Dynamics Control), and HEVC (Hybrid Electric Vehicle Control). Each electronic control unit <NUM> is configured by a computer including a central processing unit (CPU), a read-only memory (ROM), a random access memory (RAM), and an input/output interface (I/O interface). The BCM controls operating elements of a vehicle body of the vehicle <NUM>, including an engine starter and door locks of the vehicle <NUM>. The VDC controls respective brakes of the vehicle <NUM> and the output of an engine to control the posture of the vehicle <NUM>, thereby preventing the vehicle <NUM> from skidding or the like. In the case where the vehicle <NUM> is a hybrid vehicle, the HEVC controls an engine and a motor, which are driving sources, so as to realize highly efficient driving.

The electronic control unit <NUM> can communicate with the gateway <NUM>, and constantly transmits a signal representing control information of each equipment to the gateway <NUM>. Each electronic control unit <NUM> acquires software including the specific program from the gateway <NUM>, and controls the equipment to be controlled by applying the acquired software to the objective equipment. Further, the electronic control unit <NUM> performs the software update control described below in cooperation with the gateway <NUM>.

Further, each electronic control unit <NUM> is provided with two storage units <NUM> and <NUM> that store the software acquired from the gateway <NUM>, respectively. The electronic control unit <NUM> applies the software stored in one storage unit (first storage unit) <NUM> to the equipment. Further, the electronic control unit <NUM> updates the software by changing the software to be applied to the equipment to the software stored in the other storage unit (second storage unit) <NUM>. Details of the software update processing will be described below.

The detection unit <NUM> includes a crank angle sensor, an accelerator pedal sensor, and the like that detect the driving of the engine, and detects the driving force output state of the power train of the vehicle <NUM>. The driving force output state of the power train detected by the detection unit <NUM> is transmitted, as a signal, to the gateway <NUM>.

Next, the software update processing will be described.

As mentioned above, each electronic control unit <NUM> is provided with two storage units <NUM> and <NUM>. When acquiring software (first software) transmitted from the gateway <NUM>, the electronic control unit <NUM> stores the software in one storage unit (first storage unit) <NUM>. The electronic control unit <NUM> applies the software to the equipment. The first software may not be the one acquired from the gateway <NUM>, but may be stored in advance in the first storage unit <NUM> in an initial state.

Next, when acquiring software for updating (second software) transmitted from the gateway <NUM>, the electronic control unit <NUM> stores the software for updating in the other storage unit (second storage unit) <NUM>. The first software is being applied to the equipment, while acquisition and storage of the second software by the electronic control unit <NUM>.

As mentioned above, providing two storage units <NUM> and <NUM> in each electronic control unit <NUM> enables the electronic control unit <NUM> to acquire (download) and store (install) the software for updating, in the state where the first software is being applied to the equipment. That is, it is possible to acquire and store the software for updating without stopping the operation of the equipment to be controlled.

When completing the acquisition and storage of the software for updating (second software), the electronic control unit <NUM> changes the software to be applied to the equipment from the first software to the second software. As a result, the software to be applied to the equipment is updated. Hereinafter, the processing for changing the software to be applied to the equipment from the first software to the second software is referred to as software update processing (activation).

However, if the software update processing is executed in a state where the driving force by the power train including the engine or the like is being output, an unexpected accident may occur, for example, in the case where the braking function is stopped. Therefore, in the present embodiment, the software update processing is executed in a state where no driving force is output by the power train including the engine or the like.

Specifically, the gateway <NUM> executes the software update processing after the detection unit <NUM> detects the state where no driving force is output by the power train of the vehicle <NUM>, and prohibits the output of the driving force by the power train during the software update processing. For example, when the detection unit <NUM> detects the off state of the engine where the engine speed is <NUM>, the neutral (N) or parking (P) state of the transmission, and the like, the software update processing is started and the output of the driving force by the power train is prohibited. The output of the driving force by the power train is prohibited until the software update processing completes. When the activation is completed, the output of the driving force by the power train is permitted.

As mentioned above, since the software update processing is executed in the state where no driving force is output by the power train of the vehicle <NUM>, the power train including the engine or the like can be prevented from malfunctioning during the activation. In addition, in the state where the first software is being applied to the equipment, the electronic control unit <NUM> acquires (downloads) and stores (installs) the software for updating, and the output of the driving force by the power train is prohibited only during the activation. That is, since the output of the driving force by the power train is permitted while the software for updating is acquired and stored by the electronic control unit <NUM>, it is possible to acquire and store the software for updating while the vehicle <NUM> is traveling. Further, since the engine or the like can be operated during the acquisition and storage of the software for updating, the time during which the engine or the like is being stopped for updating the software can be shortened, compared with a case where the engine or the like is being stopped during the acquisition and storage of the software for updating. Accordingly, the dead battery during the update of software can be prevented.

It is not always required that the driving force output state of the power train of the vehicle <NUM> is detected by the detection unit <NUM>. For example, the gateway <NUM> may be configured to be able to directly receive an ignition switch signal and detect the driving force output state of the power train, so that the detection unit <NUM> can be omitted.

<FIG> is a flowchart illustrating the software update control according to an embodiment of the present invention. All of the following controls can be executed by the controller <NUM> (the gateway <NUM>, the electronic control unit <NUM>). Further, it is assumed that the first storage unit <NUM> of the electronic control unit <NUM> stores the first software in the initial state and the first software is already being applied to the equipment to be controlled.

In step S101, upon acquiring the software for updating (second software) from the external server <NUM>, the gateway (GW) <NUM> transmits the acquired software for updating to the electronic control unit <NUM> to be updated.

In step S102, the electronic control unit <NUM> acquires (downloads) the software for updating (second software) from the gateway <NUM>.

Next, in step S103, the electronic control unit <NUM> stores (installs) the software for updating (second software) in the second storage unit <NUM>. During the acquisition and storage of the second software in these steps S102 and S103, the first software is being applied to the equipment to be controlled by the electronic control unit <NUM>. That is, the equipment including the engine or the like is not stopped during the acquisition and storage of the second software by the electronic control unit <NUM>.

In step S104, the gateway <NUM> acquires the signal representing the driving force output state of the power train (PT) of the vehicle <NUM> detected by the detection unit <NUM>, and executes processing of step S105 if no driving force is output by the power train. As mentioned above, the state where no driving force is output by the power train is, for example, the off state of the engine where the engine speed is <NUM> or the neutral (N) or parking (P) state of the transmission. On the other hand, in the state where the driving force is being output by the power train, the gateway <NUM> repeats the processing of step S104 until the output of the driving force from the power train is stopped.

In the state where the driving force is being output by the power train in step S104, if there is no problem even when the vehicle <NUM> stops the output of the driving force by the power train, the output of the driving force may be stopped. For example, in the state where there is no problem even when the vehicle <NUM> stops the output of the driving force by the power train, the gateway <NUM> transmits a command for stopping the output of the driving force by the power train to the electronic control unit <NUM>. Upon receiving the driving force output stop command, the electronic control unit <NUM> stops the output of the driving force by the power train. The state where there is no problem even when the output of the driving force by the power train is stopped can be determined, for example, by the gateway <NUM> based on the control information received from each electronic control unit <NUM>.

In the state where no driving force is output by the power train, then in step S105, the gateway <NUM> permits the electronic control unit <NUM> to execute the software update processing (activation).

Subsequently, in step S106, the gateway <NUM> prohibits the output of the driving force by the power train.

In step S107, the electronic control unit <NUM> changes the software to be applied to the equipment controlled by the electronic control unit <NUM>, which is a software update object, from the first software to the second software. As a result, the software to be applied to the equipment is updated from the first software to the second software. During the software update processing, it is desirable to notify the driver of the state where the update processing is in progress with a display unit or the like.

If the update of the software completes, then in step S108, the gateway <NUM> permits the output of the driving force by the power train.

As mentioned above, since the gateway <NUM> prohibits the output of the driving force by the power train while the software update processing is being executed, it is possible to more reliably prevent the power train including the engine or the like from malfunctioning during the activation.

Prohibiting the output of the driving force by the power train during the activation is desirable in order to more reliably prevent malfunctions of the power train, but it is not always limited to this. Since the software update processing in the present embodiment does not include acquisition and storage of the software for updating, the software update processing completes in a short period of time. Therefore, if the software update processing is started in the state where no driving force is output by the power train, it is unnecessary to intentionally perform the processing for prohibiting the output of the driving force by the power train during the activation. That is, the processing in steps S106 and S108 may be omitted.

In step S108, after permitting the output of the driving force by the power train, the gateway <NUM> terminates the software update control.

When the software is further updated next time, software for updating transmitted from the gateway <NUM> to the electronic control unit <NUM> is stored (overwritten) in the first storage unit <NUM>. By changing the software to be applied to the equipment from the second software stored in the second storage unit <NUM> to the software for updating stored in the first storage unit <NUM>, the software is reupdated.

The processing illustrated in <FIG> is configured as programs that cause the controller <NUM> being a computer to execute processing, and these programs are described in a storage medium.

The software updating device <NUM> of the above-described embodiment brings the following effects.

In the software updating device <NUM>, the electronic control unit <NUM> (the controller <NUM>) has the first storage unit <NUM> that stores the first software and the second storage unit <NUM> that stores the second software. Therefore, in the state where the first software stored in the first storage unit <NUM> is being applied to the equipment, it is possible to acquire the software for updating (second software) and store it in the second storage unit <NUM>. Therefore, even while the vehicle <NUM> is traveling, it is possible to acquire and store the software for updating. On the other hand, the controller <NUM> executes the software update processing in the state where no driving force is output by the power train of the vehicle <NUM>. As mentioned above, the vehicle <NUM> can travel during the acquisition and storage of the software for updating, meanwhile the software update processing is executed in the state where no driving force is output by the power train of the vehicle <NUM>. Accordingly, it is possible to provide the software updating device <NUM> with improved convenience during the update work while preventing malfunctions of the engine or the like during the update of software.

Further, since it is possible to acquire and store the software for updating in the state where the first software stored in the first storage unit <NUM> is being applied to the equipment, it is sufficient to stop the output of the driving force by the power train including the engine or the like only during the activation. That is, since the engine or the like can be operated during the acquisition and storage of the software for updating, the time during which the engine or the like is being stopped for updating the software can be shortened, compared with a case where the engine or the like is being stopped during the acquisition and storage of the software for updating. Accordingly, the dead battery during the update of software can be prevented.

In the software updating device <NUM>, when the detection unit <NUM> detects the state where no driving force is output by the power train of the vehicle <NUM>, the controller <NUM> permits the execution of the software update processing. As mentioned above, since the execution of the software update processing is permitted after the detection of the state where no driving force is output by the power train, it is possible to more reliably prevent the engine or the like from malfunction during the update of software.

In the software updating device <NUM>, the controller <NUM> prohibits the output of the driving force by the power train of the vehicle <NUM> while the software update processing (activation) is being executed. As a result, it is possible to more reliably prevent the power train including the engine or the like from malfunctioning during the activation.

In the software updating device <NUM>, the controller <NUM> prohibits the output of the driving force by the power train of the vehicle <NUM> while the software update processing (activation) is being executed, and permits the output of the driving force by the power train when the update processing is completed. As mentioned above, since the output of the driving force by the power train is prohibited only during the activation, the time during which the engine or the like is being stopped for updating the software can be shortened. Accordingly, the dead battery during the update of software can be prevented.

Further, the electronic control unit (ECU) <NUM> has been exemplarily described as BCM, VDC, and HEVC in the present embodiment, the electronic control unit <NUM> is not limited in type to them, as long as it can control the equipment mounted on the vehicle <NUM>. The number of them is not limited to the above example.

Further, the software update control including the software update processing of the present embodiment may be executed simultaneously for a plurality of electronic control units <NUM> or may be executed for each electronic control unit <NUM> at a different time.

Further, in the present embodiment, the gateway <NUM> is configured to execute the integrated control for the software updating device <NUM> and the electronic control unit <NUM> is configured to execute the control of each equipment mounted on the vehicle <NUM>, but the main entity of each control may be either the gateway <NUM> or the electronic control unit <NUM>. For example, the electronic control unit <NUM> may be configured to directly execute the prohibition of the output of the driving force by the power train during the activation, without any command of the gateway <NUM>. Further, the gateway <NUM> may execute the change of the software to be applied to the equipment (the software update processing), instead of the electronic control unit <NUM>.

Claim 1:
A software updating device (<NUM>) for executing processing for updating software causing equipment mounted on a vehicle (<NUM>) to operate, the vehicle (<NUM>) including a power train,
wherein the software updating device (<NUM>) includes:
a detection unit (<NUM>) that detects a driving force output state of the power train of the vehicle (<NUM>), and
a controller (<NUM>) that acquires the software and controls the equipment by applying the software to the equipment, the controller (<NUM>) including: a first storage unit (<NUM>) for storing a first software, and a second storage unit (<NUM>) for storing a second software;
wherein, when the first software stored in the first storage unit (<NUM>) is being applied to the equipment to be controlled, the controller (<NUM>) acquires and stores the second software in the second storage unit (<NUM>), the equipment not being stopped during the acquisition and storage of the second software;
wherein, when the detection unit (<NUM>) detects a state where no driving force is output by the power train of the vehicle (<NUM>), the controller (<NUM>) executes processing for updating the software by changing software to be applied to the equipment from the first software to the second software in the state where no driving force is output by the power train of the vehicle (<NUM>);
wherein the controller (<NUM>) prohibits outputting the driving force by the power train of the vehicle (<NUM>) while the processing for updating the software is being executed; and
wherein the state where no driving force is output by the power train is the off state of the engine where the engine speed is <NUM>, or the neutral (N) or parking (P) state of the transmission.