Patent Description:
In recent years, along with development of communication network technology, connected-cars related technology is developing as well. Taking advantage of the technology of connected cars, a system where a center device wirelessly distributes data to vehicles has been provided. For example, Patent Literature <NUM> discloses a system where a center device wirelessly distributes reprogramming data to vehicles to update an application program of an in-vehicle electronic control unit (hereinafter, referred to as ECU (Electronic Control Unit)).

The next coming prior art document of Patent Literature <NUM> discloses that a server divides a plurality of vehicles into groups, transmits control information to an on-vehicle information device of individual vehicles belonging to a group to which a processing turn of the transmission process has come, and receives responses indicating presence or absence of abnormality due to update of on-vehicle devices using the control information from the on-vehicle information device of each vehicle.

Patent Literature <NUM> discloses a computer system which, by transmitting software to a terminal for updating a control system of the terminal, enables the terminal to properly function based on the software. The computer system configured so as to be able to remotely update software of a terminal, wherein a processor generates an update file for updating the software of the terminal and stores the generated update file in a memory, identifies a specific terminal to which the update file should be transmitted, reads the update file from the memory and transmits the update file from a transmission module to the specific terminal, receives operational information of the update file from the specific terminal via a reception module, and determines whether it is necessary to distribute the update file to a terminal other than the specific terminal based on the operational information.

Patent Literature <NUM> discloses a reprogramming controller that comprises: a position information acquisition part which acquires position information of a vehicle; a propriety determination part which determines whether it is possible to perform the reprogramming of a device mounted on the vehicle in a vehicle position indicated by the position information acquired by the position information acquisition part; a signal output part which outputs a signal representing that it is impossible to perform the reprogramming when the propriety determination part determines that it is impossible to perform the reprogramming in the vehicle position; a parking time acquisition part which acquires a parking prediction time which is a prediction value of the time when the vehicle parks in the vehicle position; and a required time acquisition part which acquires the required time of the reprogramming.

In a configuration in which the center device distributes data to a vehicle, an unexpected event may occur due to surrounding factors or the like even if there is no quality defect or issue in the distributed data. If an unexpected event occurs in the distributed data, a huge burden would be required to reduce the impact of damage.

Therefore, at the center device, it is desired to reduce the influence associated with the distributed data.

The objective of the present disclosure is to appropriately reduce the influence associated with the distributed data.

The above objective is achieved by the invention of claim <NUM>. Other aspects of the invention in variation are disclosed in the sub claims.

Data is distributed to a vehicle, and if the operation of the distributed data on the vehicle is determined to be normal, the distribution target for the data is expanded. By expanding the distribution target for the data after confirming that the operation of the distributed data on the vehicle is normal, the range of influence associated with the distributed data can be appropriately decreased.

The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings:.

Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. A data distribution system is a system where a center device wirelessly distributes data to vehicles. In the present embodiment, as data distributed from the center device to the vehicle side, for example, reprograming data for updating an application program for an in-vehicle ECU that is used for vehicle control or vehicle diagnosis, for example. The reprograming data includes software necessary for hardware (a physical machine) of the ECU to control the operation of the ECU by executing the application program.

As shown in <FIG>, the data distribution system <NUM> includes a center device <NUM> that distributes reprograming data to vehicles, a campaign administrator terminal <NUM> managed by a campaign administrator that provides the reprograming data to the center device <NUM>, a vehicle-side system <NUM> mounted in the vehicle, and a mobile terminal <NUM> carried by a user. The mobile terminal <NUM> may be a smartphone or a tablet having a web browser. The center device <NUM>, the campaign administrator terminal <NUM>, the vehicle-side system <NUM>, and the mobile terminal <NUM> are configured to communicate with each other via a communication network <NUM>. The communication network <NUM> may include a communication network compliant with LPWA (Low Power Wide Area) communication method and a communication network compliant with LTE (Long Term Evolution) communication method. The center device <NUM> forms a one-to-many relationship with the vehicle-side systems <NUM> and the mobile terminals <NUM>. That is, the center device <NUM> is configured to communicate with, and distribute reprograming data to, an unspecified number of vehicle-side systems <NUM> and an unspecified number of mobile terminals <NUM>.

The campaign administrator terminal <NUM> administrates the reprograming data distributed from the center device <NUM> to the vehicles. The campaign administrator terminal <NUM> transmits campaign information to the center device <NUM> when a reprograming data distribution event is established such as an event to improve functions or to repair a bug.

When the center device <NUM> receives the campaign information from the campaign manager terminal <NUM>, the center device <NUM> distributes a campaign notification to the vehicle-side system <NUM> and the mobile terminal <NUM>. The campaign notification is a notification that notifies the vehicle-side system <NUM> and the mobile terminal <NUM> of distribution of reprograming data.

The vehicle-side system <NUM> has a vehicle master device <NUM>. The vehicle master device <NUM> has an in-vehicle communication device <NUM> and a gateway device <NUM>, and the in-vehicle communication device <NUM> and the gateway device <NUM> are connected to communicate data with each other. The in-vehicle communication device <NUM> performs data communication with the center device <NUM> via the communication network <NUM>. When the in-vehicle communication device <NUM> downloads reprogramming data from the center device <NUM>, the in-vehicle communication device <NUM> transfers the downloaded reprogramming data to the gateway device <NUM>.

A vehicle HMI (Human Machine Interface) device <NUM> is connected to the gateway device <NUM> via a bus <NUM>, and various types of ECUs <NUM> are connected to the gateway device <NUM> via a bus <NUM>. The vehicle HMI device <NUM> has an HMI function and also has a function of displaying various screen images and a function of accepting user operations. The bus <NUM> is, for example, a bus for a traveling system network, and an ECU that controls the traveling system is connected to the bus <NUM>. The ECU that controls the traveling system may include, for example, an accelerator ECU that controls operations of an accelerator, a brake ECU that controls operations of a brake, a steering ECU that controls operations of a steering, an autonomous driving ECU that controls an autonomous driving function, and the like. The bus <NUM> may be, for example, a body system network bus, a multimedia system network bus, or the like, other than the traveling system network bus, and an ECU that controls the body system or an ECU that controls the multimedia system may be connected to the bus <NUM>. The type and number of buses <NUM> and the type and number of ECUs <NUM> are not limited to the configuration as illustrated.

The gateway device <NUM> has a data relay function, and when reprogramming data is transferred from the in-vehicle communication device <NUM>, the transferred reprogramming data is distributed to the ECU <NUM> that is designated as a distribution target. When the ECU <NUM> receives the reprogramming data from the gateway device <NUM>, the ECU <NUM> writes the received reprogramming data to a flash memory. By writing the reprogramming data to the flash memory, the ECU <NUM> updates a application program to improve the function of the application program and fix a bug.

In the above-described configuration, when the mobile terminal <NUM> and the vehicle HMI device <NUM> receive the campaign notification from the center device <NUM>, a campaign notification screen image is displayed to notify the user of campaign information that notifies the user that the reprogramming data can be downloaded from the center device <NUM>. When the campaign notification screen image is displayed on the mobile terminal <NUM> or the vehicle HMI device <NUM>, the user confirms the procedure for updating the application program through various screens, and can start updating the application program by inputting or selecting necessary items. That is, the user can update the application program by properly using the mobile terminal <NUM> at an outside of the vehicle or the vehicle HMI device <NUM> at an inside of the vehicle. That is, the user can update the application program through the vehicle HMI device <NUM> in the vehicle. On the contrary, if the user is not riding in the vehicle but holds a mobile terminal <NUM>, the user can update the application program through the mobile terminal <NUM>. If an urgent update for the application program is required, reprogramming data may be downloaded from the center device <NUM> without displaying the campaign notification screen image and without the user taking the procedure for updating the application program.

The center device <NUM> includes a control unit <NUM>, a data communication unit <NUM>, a campaign information storage unit <NUM>, a user information storage unit <NUM>, a vehicle information storage unit <NUM>, and an external information storage unit <NUM>. In the present embodiment, these storage units <NUM> to <NUM> are illustrated as provided in the center device <NUM>. However, these storage units <NUM> to <NUM> may be provided in an external server that is different from the center device <NUM> and the center device <NUM> and the external server may communicate data with each other.

The data communication unit <NUM> performs data communication with the campaign administrator terminal <NUM>, the vehicle side system <NUM>, and the mobile terminal <NUM> via the communication network <NUM>. The campaign information storage unit <NUM> stores various information related to reprogramming data for a distribution target as campaign information, and also stores the reprogramming data. The campaign information includes a distribution destination, a data distribution amount, a type of reprogramming data, and the like, and is stored in the campaign information storage unit <NUM> after transmitted from the campaign manager terminal <NUM> to the center device <NUM>. The reprogramming data is stored in the campaign information storage unit <NUM> after transmitted from the campaign manager terminal <NUM> to the center device <NUM>.

The user information storage unit <NUM> stores, as user information, various information about an owner who owns the vehicle. The user information includes a vehicle identification number (hereinafter, referred to as VIN (Vehicle Identification Number)) uniquely assigned to each vehicle, a telephone number of the in-vehicle communication device <NUM> mounted in the vehicle, and a telephone number of the mobile terminal <NUM> owned by the user. The user information is stored in the user information storage unit <NUM> when, for example, the user performs an input operation through the vehicle HMI device <NUM> at the time of, for example, purchasing the vehicle and the input user information is transmitted from the vehicle master device <NUM> to the center device <NUM>.

The vehicle information storage unit <NUM> stores various information about the vehicle as vehicle information. The vehicle information includes log information indicating a vehicle log and position information indicating a vehicle position. The vehicle log is, for example, a time of turning on the engine, a time of turning off the engine, an accelerator operation time and its operation amount, a brake operation time and its operation amount, a steering operation time and its operation amount, and the like. The vehicle information is stored in the vehicle information storage unit <NUM> when transmitted from the vehicle master device <NUM> to the center device <NUM>.

The external information storage unit <NUM> stores various information acquired from an outside of the vehicle as external information. The external information includes, for example, map information, weather information, road information, SNS (Social Networking Service) information, and the like. The map information is stored in the external information storage unit <NUM> when transmitted from a map information distribution server to the center device <NUM>. The weather information includes various information on weather such as weather itself, precipitation, snowfall, wind speeds, and wind directions, and is stored in the external information storage unit <NUM> when transmitted from a weather information distribution server to the center device <NUM>. The road information includes various information about roads such as a road surface condition and a traffic condition, and is stored in the external information storage unit <NUM> when transmitted from a road information distribution server to the center device <NUM>. SNS information is information provided by an unspecified number of users through applications such as Facebook, Twitter (Registered Trademark), Instagram, etc. The SNS information provided from an unspecified number of users is collected by, for example, an organization that provides SNS services and the collected SNS information is stored in the external information storage unit <NUM> when an operator inputs the collected SNS information into the center device <NUM>.

The control unit <NUM> includes a microprocessor having a CPU (central processing unit), a ROM (read only memory), a RAM (random access memory), and the like. The controller executes a control program stored in a non-transitory tangible storage medium to perform various processes and controls operation of the center device <NUM>. The control programs executed by the control unit <NUM> include a distribution control program. The control unit <NUM> includes a distribution control unit 14a, a vehicle information acquisition unit 14b, a vehicle information analysis unit 14c, an external information acquisition unit 14d, an external information analysis unit 14e, a normal operation determination unit 14f, a distribution target expansion unit <NUM>, and a grouping unit <NUM>.

The distribution control unit 14a controls distribution of the reprogramming data to vehicles. The vehicle information acquisition unit 14b acquires the vehicle information stored in the vehicle information storage unit <NUM>. When the vehicle information is acquired by the vehicle information acquisition unit <NUM>, the vehicle information analysis unit 14c analyzes the acquired vehicle information. The vehicle information is periodically transmitted from the vehicle master device <NUM> to the center device <NUM> to periodically update the vehicle information stored in the vehicle information storage unit <NUM>. Thus, the vehicle information analysis unit 14c analyzes the updated vehicle information. The external information acquisition unit 14d acquires the external information stored in the external information storage unit <NUM>. When the external information is acquired by the external information acquisition unit 14d, the external information analysis unit 14e analyzes the acquired external information. The external information is periodically transmitted from the external information distribution server to the center device <NUM> to periodically update the external information stored in the external information storage unit <NUM>. Thus, the external information analysis unit 14e analyzes the updated external information.

When the vehicle information is analyzed by the vehicle information analysis unit 14c and the external information is analyzed by the external information analysis unit 14e, the normal operation determination unit 14f creates an algorithm for determining whether operation of the distributed reprogramming data on the vehicle is normal, and then determines whether the operation of the distributed reprogramming data on the vehicle is normal using the created algorithm.

When the reprogramming data is distributed to a vehicle and when the normal operation determination unit 14f determines that the operation of the distributed reprogramming data on the vehicle is normal, the distribution target expansion unit <NUM> expands the distribution target for the reprogramming data. The pattern where the distribution target expansion unit <NUM> expands the distribution target for the reprogramming data includes a pattern where a distribution destination for the reprogramming data is increased, a pattern where a distribution amount of the reprogramming data is increased, and a pattern where functionality and performance by the distributed reprogramming data is expanded (i.e., extended). That is, expanding the distribution target for the reprogramming data includes increasing the number of the distribution destinations for the reprogramming data, increasing the distribution amount of the reprogramming data, and expanding the functionality and performance by the distributed reprogramming data.

In a situation where a function or performance of the reprogramming data is extended, when on/off of the function or performance is instructed from an outside, and if the function or performance can be turned on or off, the distribution control unit 14a distributes a command for turning on the function or performance of the distributed reprogramming data to the vehicle master device <NUM> during off of the function or performance of the distributed reprogramming data. Then, the function or performance of the distributed reprogramming data is turned on, and as a result the vehicle master device <NUM> expands the function or performance of the distributed reprogramming data.

The distribution target expansion unit <NUM> determines whether the vehicle is in a travelling state, and expands the distribution targets for the reprogramming data according to the determination result. That is, if the distribution control unit 14a expands the distribution targets for the reprogramming data that would not affect travelling of the vehicle, travelling of the vehicle would not be affected even if the distribution targets of the reprogramming data is expanded while the vehicle is traveling. However, if the distribution targets for the reprogramming data that would affect travelling of the vehicle is expanded while the vehicle is travelling, there is a concern that travelling of the vehicle would be affected. Therefore, expanding the distribution targets for the reprogramming data that would affect travelling of the vehicle is performed only when the vehicle is parked.

The grouping unit 14f divides vehicles as the distribution targets for the reprogramming data into a plurality of groups. The distribution target expansion unit <NUM> expands the distribution targets for the reprogramming data according to the groups defined by the grouping unit 14f.

Next, the process of the above configuration will be described with reference to <FIG>.

As shown in <FIG> and <FIG>, when a distribution event condition of the reprogramming data is established, the campaign administrator terminal <NUM> transmits the campaign information and the reprogramming data to the center device <NUM> (S1). At the center device <NUM>, when the control unit <NUM> receives the campaign information and the reprogramming data transmitted from the campaign manager terminal <NUM>, the control unit <NUM> stores the received campaign information and the reprogramming data in the campaign information storage unit <NUM>. When the control unit <NUM> determines a distribution start instruction (S2), the control unit <NUM> distributes the campaign notification to the vehicle master device <NUM> (S3).

When the vehicle master device <NUM> receives the campaign notification distributed from the center device <NUM>, the vehicle master device <NUM> transmits a campaign display instruction to the vehicle HMI device <NUM> (S4), and causes the vehicle HMI device <NUM> to display the campaign notification screen image (S5). to prompt the user to choose whether to allow download of the reprogramming data. When the user selects to allow the start of downloading the reprogramming data, the vehicle HMI device <NUM> transmits its operation by the user to the vehicle master device <NUM> (S7). When the vehicle master device <NUM> receives the user's operation from the vehicle HMI device <NUM>, the vehicle master device <NUM> transmits a download permission instruction to the center device <NUM> (S8).

At the center device <NUM>, when the download permission instruction transmitted from the vehicle master device <NUM> is received, the control unit <NUM> acquires the reprogramming data from the campaign information storage unit <NUM> (S9, S10), and distributes the acquired reprogramming data to the vehicle master device <NUM> (S11).

After downloading the reprogramming data from the center device <NUM>, the vehicle master device <NUM> periodically transmits the vehicle information to the center device <NUM> (S12). At the center device <NUM>, when the vehicle information transmitted from the vehicle master device <NUM> is received, the control unit <NUM> stores the received vehicle information in the vehicle information storage unit <NUM>. The control unit <NUM> periodically monitors the vehicle information stored in the vehicle information storage unit <NUM> (S13).

The external information distribution servers including the map information distribution server, the weather information distribution server, the road information distribution server, and the like periodically transmit the map information, the weather information, and the road information as the external information (S14). At the center device <NUM>, when the external information transmitted from the vehicle master device <NUM> is received, the control unit <NUM> stores the received external information in the external information storage unit <NUM>. The control unit <NUM> periodically monitors the external information stored in the external information storage unit <NUM> (S15).

After transmitting the campaign information and the reprogramming data to the center device, the campaign administrator terminal <NUM> creates a modified version of the reprogramming data that is the modified reprogramming data, and then waits until a distribution event condition for the modified reprograming data is established. When the distribution event condition for the modified reprogramming data is established, the campaign administrator terminal <NUM> transmits the modified reprogramming data to the center device <NUM> (S16).

At the center device <NUM>, when the control unit <NUM> receives the modified reprogramming data transmitted from the campaign administrator terminal <NUM>, the control unit <NUM> stores the received, modified reprogramming data in the campaign information storage unit <NUM> and acquires contents of the modified reprogramming data.

The control unit <NUM> periodically monitors the vehicle information and the external information, analyzes the vehicle information and the external information, sets a distribution timing and a distribution condition for the modified reprogramming data, and expands the distribution targets according to the distribution timing and the distribution condition that were set. When the set distribution timing for the modified reprogramming data comes, the control unit <NUM> acquires the modified reprogramming data from the campaign information storage unit <NUM> according to the set distribution condition (S18, S19), and distributes a download notification to the vehicle master device <NUM> (S20). The distribution condition is a condition on the distribution destination for the modified reprogramming data, the distribution amount of the modified reprogramming data, and the function and performance of the modified reprogramming data that has already been distributed.

When the vehicle master device <NUM> receives the download notification distributed from the center device <NUM>, the vehicle master device <NUM> transmits a download instruction to the vehicle HMI device <NUM> (S21), and causes the vehicle HMI device <NUM> to display a download notification screen image (S22) to prompt the user to choose whether to allow download of the modified reprogramming data. When the user selects to allow the start of downloading the modified reprogramming data (S23), the vehicle HMI device <NUM> transmits this user's operation to the vehicle master device <NUM> (S24). When the vehicle master device <NUM> receives the user's operation from the vehicle HMI device <NUM>, the vehicle master device <NUM> transmits a download permission instruction to the center device <NUM> (S25).

At the center device <NUM>, when the download permission instruction transmitted from the vehicle master device <NUM> is received, the control unit <NUM> distributes the acquired modified reprogramming data to the vehicle master device <NUM> (S26). As the pattern where the distribution target expansion unit <NUM> expands distribution targets for the modified reprogramming data, the control unit <NUM> performs one of the pattern where the distribution destinations for the modified reprogramming data are increased, the pattern where a distribution amount of the modified reprogramming data is increased, and the pattern where functionality and performance by the modified reprogramming data which was distributed is extended. Hereinafter, each pattern will be described.

As shown in <FIG>, the control unit <NUM> analyzes, as the vehicle information and the external information, an average parking time during a time zone from 10AM to 5PM, a temperature change range, and a distance from the nearest dealer for each vehicle. The control unit <NUM> groups the vehicles according to the distances from the nearest dealer. As shown in <FIG>, the control unit <NUM> categorizes vehicles A to C as group A, vehicles D to F as group B, and vehicles G to I as group C in order of distances from the nearest dealer.

As shown in <FIG>, the control unit <NUM> sets the number of target vehicles for each of the groups, and creates a distribution plan to increase the distribution destinations for the modified reprogramming data according to the set number of the target vehicles. For group A, the control unit <NUM> sets, for example, the number of the target vehicles to <NUM>, and sets the distribution timing of the modified reprogramming data to the <NUM> target vehicles on M1(month)/D1(date). Similarly, for group B, the control unit <NUM> sets, for example, the number of the target vehicles to <NUM>, sets the distribution timing of the modified reprogramming data to the <NUM> target vehicles on M2/D2, and sets group C, for example, the number of the target vehicles to <NUM>, and the distribution timing of the modified reprogramming data to the <NUM> target vehicles on M3/D3. The order of the dates is M1/D1, M2/D2, and M3/D3 from the earliest date. It should be noted that M1, M2, and M3 are arbitrary natural numbers of "<NUM>" to "<NUM>", and D1, D2, and D3 are arbitrary natural numbers of "<NUM>" to "<NUM>".

As shown in <FIG> and <FIG>, at the center device <NUM>, when M1/D1 that was set as the distribution timing for group A comes, the control unit <NUM> sets group A as the distribution destination for the modified reprogramming data. The control unit <NUM> acquires the modified reprogramming data from the campaign information storage unit <NUM> (S31, S32), and distributes the download notification to the vehicle master devices <NUM> of the vehicles belonging to group A (S33).

When each of the vehicle master devices <NUM> of the vehicles belonging to group A receives the download notification distributed from the center device <NUM>, the vehicle master device <NUM> transmits a download instruction to the vehicle HMI device <NUM> (S34), and causes the vehicle HMI device <NUM> to display a download notification screen image (S35) to prompt the user to choose whether to allow for download of the modified reprogramming data. When the user selects to allow the start of downloading the modified reprogramming data (S36), the vehicle HMI device <NUM> transmits its operation by the use to the vehicle master devices <NUM> of the vehicles belonging to group A (S37). When each of the vehicle master devices <NUM> of the vehicles belonging to group A receives the user's operation from the vehicle HMI device <NUM>, the vehicle master device <NUM> transmits a download permission instruction to the center device <NUM> (S38).

At the center device <NUM>, when the download permission instructions transmitted from the vehicle master devices <NUM> of the vehicles belonging to group A are received, the control unit <NUM> distributes the acquired modified reprogramming data to the vehicle master devices <NUM> of the vehicles belonging to group A (S39). After that, the control unit <NUM> periodically monitors the vehicle information transmitted from the vehicle master devices <NUM> of the vehicles belonging to the group A (S40, <NUM>), and periodically monitors the external information distributed from the external information distribution server including the map information distribution server, the weather information distribution server, and the road information distribution server (S42, <NUM>). The control unit <NUM> creates the algorithm for determining whether the operation of the distributed, modified reprogramming data on the vehicle is normal from the analysis results of the vehicle information and the external information, and determines whether the operation of the modified reprogramming data that was distributed to each of the vehicles belonging to group A is normal.

When M2/D2 that was set for group B as the distribution timing comes, the control unit <NUM> determines whether the operation of the modified reprogramming data that was distributed to the vehicles belonging to group A is normal during the period from M1/D1 to M2/D2 (a normal operation determination step). When the control unit <NUM> determines that the operation of the modified reprogramming data distributed to the vehicles belonging to group A is normal, the control unit <NUM> sets group B as the distribution destination for the modified reprogramming data and performs the same processing to distribute the modified reprogramming data to the vehicle master devices <NUM> of the vehicles belonging to group B (S44 to S56, a distribution target expansion step).

Similarly, when M3/D3 that was set for group C as the distribution timing comes, the control unit <NUM> determines whether the operation of the modified reprogramming data that was distributed to the vehicles belonging to group B is normal during the period from M2/D2 to M3/D3 (the normal operation determination step). When the control unit <NUM> determines that the operation of the modified reprogramming data distributed to the vehicles belonging to group B is normal, the control unit <NUM> sets group C as the distribution destination of the modified reprogramming data and performs the same processing to distribute the modified reprogramming data to the vehicle master devices <NUM> of the vehicles belonging to group C (the distribution target expansion step).

In this way, the control unit <NUM> expands the distribution targets for the modified reprogramming data by increasing the distribution destinations for the modified reprogramming data step by step. If the operation of the modified reprogramming data distributed to the vehicles belonging to group A is not normal and a defect is detected in the modified reprogramming data, the control unit <NUM> does not distribute the modified reprogramming data to the vehicle master devices <NUM> of the vehicles belonging to group B. That is, the control unit <NUM> suppresses the damage that would be caused by the defect by not distributing the modified reprogramming data to the vehicle master devices <NUM> of the vehicles belonging to the group B. In addition, the control unit <NUM> takes necessary measures for the modified reprogramming data from which the defect is detected.

As illustrated in <FIG>, by grouping the vehicles according to the distances from the nearest dealer, even if a defect is detected in the modified reprogramming data, a person in charge of the dealer can immediately handle this defect. The grouping is not necessarily limited to grouping according to the distances from the nearest dealer, and may be grouped according to, for example, vehicle types, model years, grades, and the like. For example, when grouping is done according to the vehicle types, the modified reprogramming data may be distributed to vehicles categorized as vehicle type A, and then distributed to vehicles categorized as vehicle type B upon determining that the operation of the modified reprogramming data on the vehicles categorized as vehicle type A is normal. Further, when grouping is done according to the model years, the modified reprogramming data may be distributed to vehicles with relatively new model years first, and then distributed to vehicles with relatively old model years upon determining that the operation of the modified reprogramming data on the vehicles with the relatively new model years is normal. Further, when grouping is done according to the grades, the modified reprogramming data may be distributed to vehicles with relatively high grades first, and then distributed to vehicles with relatively low grades upon determining that the operation of the modified reprogramming data on the vehicles with the relatively high grades is normal.

As shown in <FIG>, the control unit <NUM> divides the modified reprogramming data into logical units, and calculates data capacity for each of the divided logical units. The logical unit is a unit of data that is a constituent of the modified reprogramming data. As shown in <FIG>, the control unit <NUM> creates a distribution plan that increases the distribution amount of the reprogramming data according to the calculated data capacity. The control unit <NUM> sets the distribution timing of the modified reprogramming data for logical unit A having a data capacity of <NUM> kB (kilobytes) on M1/D1. Similarly, the control unit <NUM> sets the distribution timing of the modified reprogramming data for logical unit B having a data capacity of <NUM> MB (megabytes) on M2/D2, and sets the distribution timing of the modified reprogramming data for logical unit C having a data capacity of <NUM> MB on M3/D3.

As shown in <FIG> and <FIG>, at the center device <NUM>, when M1/D1 that was set as the distribution timing for logical unit A comes, the control unit <NUM> sets the distribution amount of the modified reprogramming data to <NUM> kB of logical unit A. The control unit <NUM> acquires <NUM> kB of logical unit A among the modified reprogramming data from the campaign information storage unit <NUM> (S61, S62), and distributes the download notification regarding the acquired logical unit A to the vehicle master device <NUM> (S63).

When the vehicle master device <NUM> receives the download notification regarding logical unit A distributed from the center device <NUM>, the vehicle master device <NUM> transmits a download instruction to the vehicle HMI device <NUM> (S64), and causes the vehicle HMI device <NUM> to display a download notification screen image (S64) to prompt the user to choose whether to allow download of logical unit A in the reprogramming data. When the user selects to allow the start of downloading logical unit A(S66), the vehicle HMI device <NUM> transmits its operation by the use to the vehicle master device <NUM> (S67). When the vehicle master device <NUM> receives the user's operation from the vehicle HMI device <NUM>, the vehicle master device <NUM> transmits a download permission instruction to the center device <NUM> (S68).

At the center device <NUM>, when the download permission instruction transmitted from the vehicle master device <NUM> is received, the control unit <NUM> distributes <NUM> kB of logical unit A within the modified reprogramming data to the vehicle master device <NUM> (S69). After that, the control unit <NUM> periodically monitors the vehicle information transmitted from the vehicle master device <NUM> (S70, <NUM>), and periodically monitors the external information distributed from the external information distribution server including the map information distribution server, the weather information distribution server, and the road information distribution server (S72, <NUM>). The control unit <NUM> creates the algorithm for determining whether the operation of logical unit A in the distributed, modified reprogramming data on the vehicle is normal from the analysis results of the vehicle information and the external information, and determines whether the operation of logical unit A in the modified reprogramming data that was distributed to the vehicle is normal.

When M2/D2 that was set for logical unit B as the distribution timing comes, the control unit <NUM> determines whether the operation of logical unit A in the modified reprogramming data that was distributed to the vehicle is normal during the period from M1/D1 to M2/D2 (the normal operation determination step). When the control unit <NUM> determines that the operation of logical unit A in the modified reprogramming data distributed to the vehicle is normal, the control unit <NUM> sets the distribution amount of the modified reprogramming data to <NUM> MB of logical unit B and performs the same processing to distribute <NUM> MB of logical unit B in the modified reprogramming data to the vehicle master device <NUM> (S74 to S86, the distribution target expansion step).

Similarly, when M3/D3 that was set for logical unit C as the distribution timing comes, the control unit <NUM> determines whether the operation of logical unit B in the modified reprogramming data that was distributed to the vehicle is normal during the period from M2/D2 to M3/D3 (the normal operation determination step). When the control unit <NUM> determines that the operation of logical unit B in the modified reprogramming data distributed to the vehicle is normal, the control unit <NUM> sets the distribution amount of the modified reprogramming data to <NUM> MB of logical unit C and performs the same processing to distribute <NUM> MB of logical unit C in the modified reprogramming data to the vehicle master device <NUM> (the distribution target expansion step).

In this way, the control unit <NUM> expands the distribution target for the modified reprogramming data by increasing the distribution amount of the modified reprogramming data step by step. If the operation of logical unit A in the modified reprogramming data distributed to the vehicle is not normal and a defect is detected in logical unit A in the modified reprogramming data, the control unit <NUM> does not distribute <NUM> MB of logical unit B in the modified reprogramming data to the vehicle master device <NUM> of the vehicle. That is, the control unit <NUM> suppresses the damage that would be caused by the defect by not distributing <NUM> MB of logical unit B in the modified reprogramming data to the vehicle master device <NUM> of the vehicle. In addition, the control unit <NUM> takes necessary measures for the modified reprogramming data from which the defect is detected.

As shown in <FIG>, the control unit <NUM> sets an auto-braking function, an auto-steering function, and an auto-acceleration function as target functions of the distributed, modified reprogramming data to be turned on or off. As shown in <FIG>, the control unit <NUM> creates a distribution plan for expanding functions or performance of the distributed reprogramming data by setting mode <NUM>, mode <NUM>, and mode <NUM>. Mode <NUM> is a mode where the auto-braking function is on, the auto-steering function is off, and the auto-acceleration function is off. Mode <NUM> is a mode where the auto-braking function is on, the auto-steering function is on, and the auto-acceleration function is off. Mode <NUM> is a mode where the auto-braking function is on, the auto-steering function is on, and the auto-acceleration function is on. The control unit <NUM> sets a distribution timing for a setting change notification that indicates to change to mode <NUM> on M1/D1. Similarly, the control unit <NUM> sets the distribution timing for the setting change notification that indicates to change to mode <NUM> on M2/D2, and sets the distribution timing for the setting change notification that indicates to change to mode <NUM> on M3/D3.

As shown in <FIG> and <FIG>, at the center device <NUM>, the control unit <NUM> distributes the setting change notification that indicates to change to mode <NUM> to the vehicle master device <NUM> (S94) when M1/D1 that is a distribution timing for the setting change notification that indicates to change to mode <NUM> comes after distributing the modified reprogramming data to the vehicle master device <NUM> (S91 to S93).

Upon receiving the setting change notification distributed from the center device <NUM>, the vehicle master device <NUM> transmits a setting change display instruction to the vehicle HMI device <NUM> (S95), causes the vehicle HMI device <NUM> to display a setting change notification screen image (S96), and prompts the user to select whether to allow a setting change for the distributed reprogramming data. When the user selects to allow the setting change (S97), the vehicle HMI device <NUM> transmits its operation by the user to the vehicle master device <NUM> (S98). When the vehicle master device <NUM> receives the user's operation from the vehicle HMI device <NUM>, the vehicle master device <NUM> transmits a setting change permission instruction to the center device <NUM> (S99).

At the center device <NUM>, when the setting change permission instruction transmitted from the vehicle master device <NUM> is received, the control unit <NUM> distributes a setting change instruction indicating to change to mode <NUM> to the vehicle master device <NUM> (S100). When the vehicle master device <NUM> receives the setting change instruction distributed from the center device <NUM>, the vehicle master device <NUM> turns on or off the auto-braking function, the auto-steering function, and the auto-acceleration function according to the received setting change instruction. That is, the vehicle master device <NUM> transmits a turning-on instruction for the auto-braking function to the brake ECU to turn on the auto-braking function of the brake ECU, transmits a turning-off instruction for the auto-steering function to the autonomous driving ECU to turn off the auto-steering function of the autonomous driving ECU, and transmits a turning-off instruction for the auto-acceleration function to the accelerator ECU to turn off the auto-acceleration function of the accelerator ECU. After that, the control unit <NUM> periodically monitors the vehicle information transmitted from the vehicle master device <NUM> (S101, <NUM>), and distributes the external information distributed from the external information distribution server including the map information distribution server, the weather information distribution server, and the road information distribution server (S103, <NUM>). The control unit <NUM> creates an algorithm for determining whether the operation of mode <NUM> on the vehicle (i.e., the operation of the auto-braking function on the vehicle) is normal from the analysis results of the vehicle information and the external information, and determines whether the operation of the auto-braking on the vehicle is normal using the created algorithm.

When M2/D2 that is a distribution timing for the setting change notification indicating to change to mode <NUM> comes, the control unit <NUM> determines whether the operation of the auto-braking function on the vehicle is normal during the period from M1/D1 to M2/D2 (the normal operation determination step). When the control unit <NUM> determines that the operation of the auto-braking function on the vehicle is normal, the control unit <NUM> distributes the setting change notification indicating to change to mode <NUM> to the vehicle master device <NUM> (S105 to S115, the distribution target expansion step). In this case, when receiving the setting change notification distributed from the center device <NUM>, the vehicle master device <NUM> transmits, according to the received notification, a turning-on instruction for the auto-braking function to the brake ECU to keep the on-state of the auto-braking function of the brake ECU, transmits a turning-on instruction for the auto-steering function to the autonomous driving ECU to change the auto-steering function of the autonomous driving ECU from the off-state to the on-state, and transmits a turning-off instruction for the auto-acceleration function to the accelerator ECU to keep the off-state of the auto-acceleration function of the accelerator ECU.

Similarly, when M3/D3 that is a distribution timing for the setting change notification indicating to change to mode <NUM> comes, the control unit <NUM> determines whether the operation of the auto-braking function and the auto-steering function on the vehicle is normal during the period from M2/D2 to M3/D3 (the normal operation determination step). When the control unit <NUM> determines that the operation of the auto-braking function and the auto-steering function on the vehicle is normal, the control unit <NUM> distributes the setting change notification indicating to change to mode <NUM> to the vehicle master device <NUM> (the distribution target expansion step). In this case, when receiving the setting change notification distributed from the center device <NUM>, the vehicle master device <NUM> transmits, according to the received notification, a turning-on instruction for the auto-braking function to the brake ECU to keep the on-state of the auto-braking function of the brake ECU, transmits a turning-on instruction for the auto-steering function to the autonomous driving ECU to keep the on-state of the auto-steering function of the autonomous driving ECU, and transmits a turning-on instruction for the auto-acceleration function to the accelerator ECU to change the auto-acceleration function of the accelerator ECU from the off-state to the on-state.

In this way, the control unit <NUM> expands the distribution target for the modified reprogramming data by expanding functions or performance by the distributed, modified reprogramming data step by step. If the operation of mode <NUM> on the vehicle is not normal after the control unit <NUM> distributes the setting change notification indicating to change to mode <NUM> to the vehicle and a defect is detected in the modified reprogramming data, the control unit <NUM> does not distribute the setting change notification indicating to change to mode <NUM> to the vehicle master device <NUM> of the vehicle. That is, the control unit <NUM> suppresses the damage that would be caused by the defect by not distributing the setting change notification indicating to change to mode <NUM> to the vehicle master device <NUM> of the vehicle. In addition, the control unit <NUM> takes necessary measures for the modified reprogramming data from which the defect is detected. In the above, the auto-braking function of the brake ECU, the auto-steering function of the autonomous driving ECU, and the auto-acceleration function of the accelerator ECU are turned on step by step. However, other functions of another ECU may be turned on.

Further, in the center device <NUM>, the modified reprogramming data or the setting change instruction is distributed to each of the vehicle master devices <NUM> of the vehicles that have transmitted the vehicle information. However, the data and the instruction may be distributed to the vehicle master devices <NUM> of the vehicles that have not transmitted the vehicle information. As shown in <FIG>, at the center device <NUM>, when expanding the distribution destination for the modified reprogramming data or the distribution amount of the modified reprogramming data, the control unit <NUM> distributes the modified reprogramming data with the same data structure to the vehicles A to C and the vehicles P to R, and then receives the vehicle information from the vehicles A to C. However, even if the center device <NUM> does not receive the vehicle information from the vehicles P to R for some reason, the control unit <NUM> may transmit the modified reprogramming data to the vehicles P to R in addition to the vehicles A to C.

As shown in <FIG>, at the center device <NUM>, when expanding functions or performance of the distributed, modified reprogramming data, the control unit <NUM> distributes the modified reprogramming data with the same data structure to the vehicles A to C and the vehicles P to R, and then receives the vehicle information from the vehicles A to C. However, even if the center device <NUM> does not receive the vehicle information from the vehicles P to R for some reason, the control unit <NUM> may transmit the setting change instruction to the vehicles P to R in addition to the vehicles A to C.

As described above, the present embodiment may provide the following technical advantages. When the center device <NUM> distributes the modified reprogramming data to a vehicle and when the center device <NUM> determines that the operation of the distributed, modified reprogramming data on the vehicle is normal, the center device <NUM> expands the distribution target for the modified reprogramming data. By expanding the distribution target for the modified reprogramming data after confirming that the operation of the distributed, modified reprogramming data on the vehicle is normal, the range of influence associated with the distributed data can be appropriately narrowed.

At the center device <NUM>, the control unit <NUM> expands the distribution target for the modified reprogramming data by increasing the number of the distribution destinations for the modified reprogramming data. After confirming that the operation of the distributed, modified reprogramming data on the vehicle is normal, the distribution destinations for the modified reprogramming data can be increased.

At the center device <NUM>, the control unit <NUM> expands the distribution target for the modified reprogramming data by increasing the distribution amount of the modified reprogramming data. After confirming that the operation of the distributed, modified reprogramming data on the vehicle is normal, the distribution amount of the modified reprogramming data can be increased.

At the center device <NUM>, the distribution target for the modified reprogramming data is expanded by controlling the vehicle master device <NUM> to expand functions or performance of the distributed, modified reprogramming data. After confirming that the operation of the distributed, modified reprogramming data on the vehicle is normal, functions or performance of the distributed, modified reprogramming data can be extended.

At the center device <NUM>, by distributing a command to the vehicle that indicates to expand functions or performance of the distributed, modified reprogramming data, the vehicle master device <NUM> is controlled to expand functions or performance of the distributed, modified reprogramming data. In a configuration where the modified reprogramming data with expanded functions or performance is distributed, a distribution amount of the data would increase, data communication time would increase, and the expansion of the functions or performance would not be executed quickly. However, according to the present embodiment, the data transmission amount from the center device <NUM> to the vehicle can be reduced, data communication time can be shortened, and the expansion of the functions or performance can be executed quickly by distributing the command (not the data itself) to the vehicle.

The distribution targets for data are divided into groups, and the data distribution targets are expanded according to the groups. Thus, the distribution targets for the modified reprogramming data can be expanded step by step for each group unit.

At the center device <NUM>, the vehicle information is acquired from the vehicle and is analyzed, and the analysis result is used to determine whether the operation of the distributed, modified reprogramming data on the vehicle is normal. By acquiring and analyzing the vehicle information, it is possible to determine whether the operation of the distributed, modified reprogramming data on the vehicle is normal based on an actual vehicle operation.

At the center device <NUM>, the external information such as map information, weather
information, and road information is acquired and is analyzed, and the analysis result is used to determine whether the operation of the distributed, modified reprogramming data on the vehicle is normal. By acquiring and analyzing the map information, the weather information, the road information, etc. as the external information, it is possible to monitor the operation of the distributed, modified reprogramming data on the vehicle in association with the external information.

In the above-described embodiment, although the distribution target for the modified reprogramming data is expanded, the distribution target for non-modified reprogramming data, that is, a first reprogramming data to be distributed to vehicles may be expanded. The data distributed from the center device <NUM> to the vehicle is not necessarily limited to the reprogramming data for updating an application program of the ECU, and may be map data or the like.

In the above-description, a function is turned on as extension (expansion) of a function or performance of the distributed, modified reprogramming data. Alternatively, a threshold value as a criterion for enabling a function may be changed, or the performance by the data may be enhanced.

The pattern where the distribution destinations for the modified reprogramming data is increased, the pattern where a distribution amount of the modified reprogramming data is increased, and the pattern where functionality and performance of the distributed, modified reprogramming data is extended can be combined. For example, the function
and performance of the distributed, modified reprogramming data may be expanded step by step while the amount of the modified reprogramming data is increased step by step.

Claim 1:
A center device, comprising:
a distribution control unit (14a) that is configured to control distribution of data to a vehicle via a communication network (<NUM>), said vehicle including an electronic control unit (<NUM>) as a target for a program update and a vehicle master device (<NUM>) that is configured to distribute data for the program update to the electronic control unit
a normal operation determination unit (14f) that is configured to determine whether operation of distributed data on a vehicle is normal based on information received from the vehicle; and
a distribution target expansion unit (<NUM>) that is configured to expand a distribution target for the data when the normal operation determination unit determines that operation of the distributed data on the vehicle is normal after the data was distributed to the vehicle;
characterized by
the distribution target expansion unit is configured to expand the data distribution target for the data by causing the vehicle master device to expand a function or performance of the distributed data,
the distribution target expansion unit is configured to cause the vehicle master device to expand the function or performance of the distributed data by transmitting, to the vehicle for which the function or performance of the distributed data has not been expanded, a command for instructing the vehicle master device to expand the function or performance of the distributed data when the normal operation determination unit determines that the operation of the distributed data is normal, and
the distribution target expansion unit is configured to not transmit the command for instructing the vehicle master device to expand the function or performance when the normal operation determination unit determines that the operation of the distributed data is not normal.