Patent Description:
A network system, configured of a plurality of onboard devices called electronic control units (ECUs) connected to each other via communication lines, is installed in a vehicle. The onboard devices exchange messages with each other to respectively undertake various functions of the vehicle.

The onboard devices typically are provided with a processor, a transitory storage unit such as random access memory (RAM), and a nonvolatile storage unit such as flash read-only memory (ROM). Software (program) that the processor executes is stored in the nonvolatile storage unit. Updating the software by rewriting to a newer version enables functions of the onboard devices to be improved and enhanced.

Updating of software includes steps of downloading, in which updating data is received from a server (center) by wireless communication or the like, and installing, in which updating software is written to the storage units of the onboard devices based on the downloaded updating data. Installing includes overwrite installing and other-face installing. In the overwrite installing, downloaded updating software is overwritten over the current software (old software) in one region (one face) set as a region for software storage in a storage region of a storage unit in accordance with specifications of the onboard device. In the other-face installing, writing is performed to, out of two regions (two faces) set as regions for software storage, a region (other face) that is not a region in which the current software (old software) is stored (one face). The two regions set as regions for software storage may be regions each included in different banks (configuration increments) of the same memory part, or may each be regions of different memory parts, such as standard-equipment memory parts and expansion-equipment memory parts, for example.

When performing other-face installing, the step of software updating includes, in addition to the steps of downloading and installing, a step of activating, in which the installed updating software is enabled as software to be executed.

With regard to software updating of ECUs, <CIT> discloses a particular ECU functioning as a master ECU, communicating with a server, and updating software of the master ECU itself and other ECUs.

<CIT> discloses an update control apparatus to control update of software in a terminal connected to a network. The update control apparatus includes a first communication unit, a second communication unit, a control unit, and a verification unit. The first communication unit is configured to communicate with a server located outside the network. The second communication unit is configured to communicate with the terminal through the network. The control unit is configured to receive update data to update the software from the server, and transmit the update data to the terminal, as well as receive an update result indicating whether update of the software has succeeded, together with verification data, from the terminal. The verification unit is configured to verify, using the verification data, whether the update result is proper data.

While updating software, such as while performing overwrite installation of software, or while activating other-face-installed software, for example, the onboard device thereof cannot be operated since the software cannot be executed, and functions of the vehicle may be restricted.

Accordingly, software updating may lead to impaired user convenience.

The present disclosure provides an onboard device that is capable of suppressing reduced convenience regarding software updating.

According to aspects of the present invention when an onboard device performs software updating, functions of other onboard devices can be kept from stopping, and reduction in convenience can be suppressed.

<FIG> illustrates a configuration example of a network system <NUM> according to an embodiment. The network system <NUM> is installed in a vehicle. The network system <NUM> includes a software updating device <NUM>. A plurality of busses <NUM>, <NUM>, <NUM>. are connected to the software updating device (over-the-air (OTA) master) <NUM>. A plurality of onboard devices (ECUs) <NUM>, <NUM>. is connected to the bus <NUM>. A plurality of onboard devices <NUM>, <NUM>. is connected to the bus <NUM>. A plurality of actuators <NUM>, <NUM>. is connected to the bus <NUM>. Although in <FIG> and the following description, the busses <NUM>, <NUM>, and <NUM> are exemplified as busses, and the onboard devices <NUM>, <NUM>, <NUM>, and <NUM> and the actuators <NUM> and <NUM> are exemplified as onboard devices, these numbers are not limiting. Note that various types of sensors for acquiring the states of the vehicle and the surroundings of the vehicle are connected to the busses <NUM>, <NUM>, and <NUM>, and the onboard devices <NUM>, <NUM>, <NUM>, and <NUM> as appropriate.

The software updating device <NUM> includes a communication unit (communication module) <NUM> capable of communicating with a server (center, external device) <NUM> that is installed outside of the vehicle, a storage unit (storage) <NUM> that stores various types of data, and a control unit <NUM>.

The onboard devices <NUM>, <NUM>, <NUM>, and <NUM> communicate with each other via a network, and perform various types of processing for vehicle control. <FIG> illustrates a configuration example of the onboard device <NUM>. The onboard device <NUM> includes a nonvolatile storage unit (storage) <NUM> such as flash ROM or the like, a control unit (processor, microcontroller) <NUM> that reads software out from the storage unit <NUM> and executes the software, thereby performing various types of processing, and a communication unit <NUM> that performs communication with other onboard devices and the software updating device <NUM>. Although omitted from illustration, the onboard device <NUM> also includes a transitory storage unit such as RAM that stores part of software and data. The onboard devices <NUM>, <NUM>, and <NUM> are configured in the same way. Note that the software updating device <NUM> also stores software (program) for the software updating device <NUM> in the storage unit <NUM> in the same way, and is capable of executing the functions of the software updating device <NUM> by the control unit (processor, microcontroller) <NUM> reading out and executing the software. That is to say, the onboard devices <NUM>, <NUM>, <NUM>, and <NUM> and the software updating device <NUM> can be implemented as computers including processors, microcontrollers, or the like.

Also, the control unit <NUM> of the software updating device <NUM> controls and relays communication between the server <NUM> and the onboard devices <NUM>, <NUM>, <NUM>, and <NUM>, communication among the onboard devices <NUM>, <NUM>, <NUM>, and <NUM>, and communication between the onboard devices <NUM>, <NUM>, <NUM>, and <NUM>, and the actuators <NUM> and <NUM>, via the busses <NUM>, <NUM>, and <NUM>. Thus, the software updating device <NUM> also functions as a relay device that relays communication. Alternatively, the software updating device <NUM> may be provided as a part of such a relay device, or may be provided by being connected to one of the busses <NUM>, <NUM>, and <NUM> separately from such a relay device.

The actuators <NUM> and <NUM> are onboard devices that generate mechanical actions with regard to the vehicle and a part thereof, such as brakes, engine, power steering, and so forth, for example, and operate under instructions from the onboard devices <NUM>, <NUM>, <NUM>, and <NUM>. The actuators <NUM> and <NUM> may also include a computer configured of a processor or a microcontroller, memory, and so forth.

The control unit <NUM> of the software updating device <NUM> is capable of updating software stored in the storage unit of each of the onboard devices <NUM>, <NUM>, <NUM>, and <NUM>. That is to say, the software updating device <NUM> performs control of downloading, control of installing, and further control of activating. Downloading is processing of receiving and storing updating data (distribution package) for updating software of one of the onboard devices <NUM>, <NUM>, <NUM>, and <NUM> that has been transmitted from the server <NUM>. Control of downloading is not limited to executing downloading alone, and may include a series of control of processing relating to downloading, such as determination regarding whether to execute downloading, verification of updating data, and so forth. Installing is processing of writing update-version software (updating software) in the second storage unit of the onboard device that is the object of updating, based on the downloaded updating data. Control of installing is not limited to executing installing alone, and may include control of a series of processing relating to installing, such as determination regarding whether to execute installing, transfer of updating data, verification of update-version software, and so forth. Activating is processing of performing configuration and so forth, such as setting a value of an execution start address of the software, for example, in order to enable the installed update-version software as software to be executed. Control of activating is not limited to executing activating alone, and may include a series of control relating to activating, such as determination regarding whether to execute activating, verification of execution results, and so forth.

In control of installing, the control unit <NUM> can transmit the updating software to the onboard device when the updating data includes the updating software itself. Also, when the updating data includes compressed data, difference data, or divided data of the updating software, the control unit <NUM> can perform unpacking, assembling, or the like, of the updating data, thereby generating the updating software, and transmit the updating software to the onboard device. Alternatively, the control unit <NUM> may transmit the updating data to the onboard device, and the onboard device may perform unpacking, assembling, or the like, of the updating data, and generate the updating software.

The control unit <NUM> may execute installation itself of writing the updating software to the second storage unit of the onboard device, the onboard device may perform this under instruction of the control unit <NUM>, or the onboard device that has received the updating data (or the updating software) may autonomously perform this without explicit instruction of the control unit <NUM>.

The control unit <NUM> may execute activation itself of enabling the installed updating software, the onboard device may perform this under instruction of the control unit <NUM>, or the onboard device may autonomously perform this following installation, without explicit instruction of the control unit <NUM>.

Note that such updating processing of software can be performed successively, or in parallel, to each of the onboard devices. Also note that updating data is data used for generating updating software, and includes, for example, the updating software itself, difference data for generating the updating software, compressed data or divided data thereof, or the like, as described above, and the content and the format thereof are not limited. The updating data may also include an identifier of the onboard device (ECU ID) that is the object of software updating (target ECU) and the identifier of the version of software prior to updating (WCU Software ID).

The server <NUM> is in one example a computer device, such as a server or the like installed in a particular center or the like, and is capable of transmitting respective updating data to each of a plurality of vehicles, for updating software of onboard devices of the vehicles. The server <NUM> includes a communication unit (communication module) <NUM> for communicating with the software updating device <NUM> and a control unit <NUM> for controlling the communication unit <NUM>. The functions of the control unit <NUM> are executed by a processor, microcontroller, or the like. The server <NUM> is provided with a storage unit that is omitted from illustration, and is also capable of externally accepting and storing data for updating software for each of the onboard devices.

An example of software updating processing according to the present embodiment will be described below. <FIG> is a sequence diagram showing an example of this processing. This processing is started in a state in which the power of the vehicle is on (ignition on, power on), for example.

The control unit <NUM> of the software updating device <NUM> controls the communication unit <NUM> to query the server <NUM> regarding whether there is updating software.

Upon the communication unit <NUM> of the server <NUM> receiving the query, when there is updating software, the control unit <NUM> controls the communication unit <NUM> to transmit an update-available notification to the software updating device <NUM>. The control unit <NUM> is capable of determining, based on information representing types of the onboard devices included in the network system <NUM> and current software versions, for example, whether there is updating software, which is an update version, of software for these onboard devices. The server <NUM> may store such information in advance, or may receive the information at the time of the query from the software updating device <NUM>. Note that when there is no updating software, the control unit <NUM> controls the communication unit <NUM> to transmit an update-not-available notification to the software updating device <NUM>.

Upon the communication unit <NUM> of the software updating device <NUM> receiving an update-available notification, the control unit <NUM> displays a prompt on a human-machine interface (HMI) device, which is one of the onboard devices, for permission to download the updating data. When the user performs an operation for permission on the HMI device, the control unit <NUM> controls the communication unit <NUM> to make an updating data request to the server <NUM>.

Upon the communication unit <NUM> of the server <NUM> receiving the updating data request, the control unit <NUM> of the server <NUM> generates updating data to be transmitted to the vehicle, based on the updating software provided to the server <NUM>. The updating data includes data for updating the software of one or more onboard devices (target ECUs) that are the object of software updating.

The control unit <NUM> of the server <NUM> controls the communication unit <NUM> to transmit updating data.

The communication unit <NUM> of the software updating device <NUM> receives the updating data, and the control unit <NUM> stores the updating data in the storage unit <NUM> (download).

The control unit <NUM> of the software updating device <NUM> starts processing of installation, or installation and activation. As one example here, the onboard device <NUM> is included in the onboard devices that are the object of software updating, and the control unit <NUM> transmits, to the onboard device <NUM>, data for updating the software of the onboard device <NUM>. The data is included in the updating data received from the server <NUM>.

In parallel with the above-described steps S101 through S107, the control unit <NUM> of the onboard device <NUM> executes software stored in the storage unit <NUM> to generate first information, which is data to be transmitted to another onboard device, and controls the communication unit <NUM> to transmit the first information to the other onboard device. Although the onboard device <NUM> generates the first information as information for the onboard device <NUM> to use, and transmits the first information to the onboard device <NUM> in the example shown in <FIG>, the onboard device <NUM> may generate the first information as information for another onboard device to use, and transmit the first information to the other onboard device. Also, the onboard device <NUM> may generate the first information as information for a plurality of other onboard devices to use, and transmit the first information to the onboard devices. Further, the onboard device <NUM> may generate mutually different information for each of the other onboard devices to use, as first information for the respective onboard devices, and transmit the first information to the respective onboard devices. The first information is information necessary for other onboard devices to execute the functions thereof, examples of which include various types of control values, requests, and so forth. The timing of transmitting the first information is not limited, and may be periodic, or may be only at times when particularly necessary. The first information is information that is calculated by highly-sophisticated processing by executing software, and is used for other onboard devices to carry out their functions well. Note that the term "onboard device" as used here can also include the above-described actuators <NUM> and <NUM> as well.

In parallel with the above-described steps S101 through S107, the onboard device <NUM> receives the first information, and operates based on the first information.

Upon receiving the data, the onboard device <NUM> updates the software based on the received data. That is to say, when the onboard device <NUM> is a type that performs overwrite installation, the onboard device <NUM> performs the above-described overwrite installation. Also, when the onboard device <NUM> is a type that performs the above-described other-face installing, the onboard device <NUM> performs the above-described other-face installing and activation, in that order. This processing may be performed with either the control unit <NUM> of the onboard device <NUM> or the control unit <NUM> of the software updating device <NUM> as the main entity, as described above.

In parallel with step S110, the control unit <NUM> of the onboard device <NUM> generates second information without execution of software during overwrite installation processing or activation processing following other-face installing, and controls the communication unit <NUM> to transmit the second information to another onboard device. The second information is information that temporarily substitutes for the first information. The second information is, for example, predetermined values such as fixed values set as standard values for various types of control values, and can cause the functions of another onboard device to be carried out in at least a limited and temporary way, for example. Alternatively, the second information may be a request or the like requesting the other onboard device to operate in an operation mode in which functions are limited. Again, the second information may be software that the other onboard device executes. The other onboard device executes this software, so that the other onboard device can execute functions of the onboard device <NUM> generating the first information in at least a temporary or partial way. Thus, it is possible to avoid a situation that the functions completely stop. Note that when performing other-face installing, prior to activation processing, the control unit <NUM> can execute the pre-update software, and accordingly can generate the first information.

In parallel with step S110, the onboard device <NUM> receives the second information, and operates in at least a temporary or partial way, based on the second information. Accordingly, the functions of the onboard device <NUM> do not completely stop even when the onboard device <NUM> is performing installation or activation processing.

Upon the processing of overwrite installing or other-face installing and activation in the above-described step S110 ending, the control unit <NUM> of the onboard device <NUM> executes the updated software stored in the storage unit <NUM>, generates the first information, and controls the communication unit <NUM> to transmit the first information to the other onboard device.

The onboard device <NUM> receives the first information, and operates based on the first information. Thereafter, steps S <NUM> and S <NUM> are repeated as appropriate. This ends description of the sequence.

Although the above example is an example regarding when the updating data received from the server <NUM> includes data for updating software for the onboard device <NUM>, updating of software of other onboard devices can be performed in the same way. Also, the number of onboard devices that are the object of updating is not limited, and updating of software for two or more onboard devices may be performed. Also, the data transmitted from the software updating device <NUM> to the onboard device in step S107 may substantively be the updating software itself, as described above, or may be compressed data thereof, or difference data as to the software before updating, or the like.

The other onboard device may be configured to transmit the first information and the second information in the same way as the above-described onboard device <NUM>, and to perform the same processing. Accordingly, the onboard devices can reduce effects on each other from updating software, and suppress reduction in user convenience due to limitation of vehicle functions. As a matter of course, there may be cases in which ensuring safety of the vehicle by this method is difficult, depending on the type of onboard device performing software update, but in such cases, function restriction such as prohibition of driving or the like may be performed upon having notified the user and received permission from the user for example, and the software may be updated under the function restriction.

When the onboard device <NUM> stores two or more pieces of software in the storage unit <NUM> and updates the software that generates the first information, the onboard device <NUM> may generate the second information by executing the other software.

Also, updating of the software that generates the first information while the onboard device <NUM> stores two or more pieces of software in the storage unit <NUM> may be executed when other onboard devices are not operating and thus the other onboard devices are not readily affected, such as when the vehicle is stopped or the like. Updating of software that does not generate the first information while the onboard device <NUM> stores two or more pieces of software in the storage unit <NUM> may be executed at an optional timing, including when the vehicle is traveling. In this aspect, the second information does not need to be generated.

In the present embodiment, when an onboard device is performing software updating, the second information is generated so that functions of other onboard devices can be kept from being completely stopped. Thus, it is possible to suppress convenience from being reduced.

The technology of the present disclosure can be understood as being an onboard device, a network system including the onboard device, a method executed by a computer provided to the onboard device, a program and a computer-readable non-transitory storage medium storing the program, a vehicle provided with the onboard device, and so forth.

Claim 1:
An onboard device (<NUM>; <NUM>; <NUM>; <NUM>) configured to communicate with one or more other onboard devices (<NUM>; <NUM>; <NUM>; <NUM>) in an onboard network, and configured to execute processing for updating of software of an own device while communicating with the other onboard devices (<NUM>; <NUM>; <NUM>; <NUM>), the onboard device (<NUM>; <NUM>; <NUM>; <NUM>) comprising an electronic control unit (<NUM>) configured to:
when not performing the processing for updating of software, execute (S108) software stored in a storage unit (<NUM>) of the onboard device (<NUM>; <NUM>; <NUM>; <NUM>) to generate first information, wherein the first information is data to be transmitted to the other onboard device (<NUM>; <NUM>; <NUM>; <NUM>), the first information being information necessary for other onboard devices to execute functions thereof,
wherein, in parallel, the other onboard device (<NUM>; <NUM>; <NUM>; <NUM>) receives (S109) the first information, and operates based on the first information;
when performing the processing of overwrite installing or other-face installing and activation (S110) for updating of software, generate (S111) second information to transmit to the other onboard device (<NUM>; <NUM>; <NUM>; <NUM>) without executing the software, wherein the second information is information that temporarily substitutes for the first information and causes the functions of the other onboard device (<NUM>; <NUM>; <NUM>; <NUM>) to be carried out in at least a limited and temporary way,
wherein, in parallel, the other onboard device (<NUM>; <NUM>; <NUM>; <NUM>) receives (S112) the second information, and operates in at least a temporary or partial way, based on the second information; and
upon the processing of overwrite installing or other-face installing and activation (S110) for updating of software ending, execute the updated software stored in the storage unit (<NUM>) to generate the first information, and control a communication unit (<NUM>) of the onboard device (<NUM>; <NUM>; <NUM>; <NUM>) to transmit the first information to the other onboard device (<NUM>; <NUM>; <NUM>; <NUM>).