JP7331989B2 - Apparatus for verifying consistency of software, vehicle equipped with the same, method and program for verifying consistency of software - Google Patents

Description

TECHNICAL FIELD The present invention relates to a device capable of confirming compatibility of software in a vehicle-mounted device, a vehicle equipped with the same, and a method and program for confirming software compatibility.

Patent Literature 1 describes a system for updating an ECU program with a version upgrade program transmitted from a server. In the system of Patent Literature 1, in order to prevent the occurrence of malfunction due to version mismatch between the programs of the ECUs, before the program is updated, the version upgrade program of the ECU to be updated and the programs of other ECUs are updated. Dependency information is referenced to determine whether the program can be updated.

Japanese Patent Application Laid-Open No. 2009-53920

Unexpected vehicle control may occur if there is a version inconsistency in the programs of multiple in-vehicle devices. In the system of Patent Document 1, dependencies with other programs are checked when a program is updated, but there is a possibility that unexpected vehicle control cannot be sufficiently eliminated simply by checking dependencies when a program is updated. .

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide an apparatus and the like that can further reduce the possibility of unexpected vehicle control being performed due to version mismatch of software of a plurality of vehicle-mounted devices.

An apparatus according to an embodiment of the present invention includes: a first instruction unit for instructing switching of software of a plurality of vehicle-mounted devices; a confirmation unit that confirms that the versions of the software of the multiple on-board devices are consistent based on the version information acquired by the acquisition unit; a second instruction unit that instructs the plurality of vehicle-mounted devices to return from the software after the switching to the software before the switching based on the switching.

Advantageous Effects of Invention According to the present invention, it is possible to further reduce the possibility that unexpected vehicle control is performed due to version mismatch of software of a plurality of vehicle-mounted devices.

1 is a block diagram showing a schematic configuration of a vehicle control system according to a first embodiment; FIG. Functional block diagram of the vehicle control system shown in FIG. 3 is a diagram showing an example of a matching table stored in the matching information storage unit shown in FIG. 2; FIG. 3 is a flowchart showing an example of consistency confirmation processing executed by a representative vehicle-mounted device in the vehicle control system according to the first embodiment; Functional block diagram of a vehicle control system according to a second embodiment 10 is a flowchart showing an example of consistency confirmation processing executed by a representative vehicle-mounted device in a vehicle control system according to a second embodiment; Schematic diagram for explaining the background of the vehicle control system according to the third embodiment Functional block diagram of a vehicle control system according to a third embodiment 10 is a flowchart showing an example of software acquisition processing executed by a representative vehicle-mounted device in a vehicle control system according to a third embodiment; 10 is a flowchart showing an example of consistency confirmation processing executed by a representative vehicle-mounted device in a vehicle control system according to a third embodiment;

(overview)
In the vehicle control system according to the present invention, each time the vehicle is powered on, one of the plurality of in-vehicle devices constituting the vehicle control system confirms the consistency of the software version, thereby preventing software version mismatch. reduce the possibility of unexpected vehicle control caused by

(First embodiment)
<Configuration>
FIG. 1 is a block diagram showing a schematic configuration of a vehicle control system according to the first embodiment.

The vehicle control system 100 is a system that is composed of vehicle-mounted devices A to D that can communicate with each other, and realizes predetermined vehicle control by combining the respective functions of the vehicle-mounted devices A to D. In the example of FIG. 1, the vehicle control system 100 is composed of four vehicle-mounted devices A to D, but the number of vehicle-mounted devices constituting the vehicle control system 100 is not limited to four. Examples of predetermined vehicle control realized by the vehicle control system 100 include automatic driving. The in-vehicle units A to D correspond to an ECU that controls vehicle travel such as acceleration, deceleration, and steering, and an ECU that provides travel assistance by combining these ECUs that control vehicle travel. Further, the vehicle-mounted devices A to D can communicate with the external server 2 via the wireless communication device 1 . In the following description, a specific vehicle-mounted device A, which is one of the plurality of vehicle-mounted devices A to D constituting the vehicle control system, is referred to as a "representative vehicle-mounted device A."

FIG. 2 is a functional block diagram of the vehicle control system shown in FIG. 1, and FIG. 3 is a diagram showing an example of a matching table stored in the matching information storage section shown in FIG.

[Representative in-vehicle unit A]
The representative vehicle-mounted device A is one of the vehicle-mounted devices that provide the control function of the vehicle control system 100, and functions as a master device in the consistency confirmation process of the software versions of the vehicle-mounted devices AD. The representative vehicle-mounted device A confirms the consistency of the software versions of all the vehicle-mounted devices AD constituting the vehicle control system 100 when the power of the vehicle is turned on. The representative vehicle-mounted device A includes a software storage unit 10, a compatibility information storage unit 11, a version acquisition unit 12, a determination unit 13, a transmission unit 14, a reception unit 15, a compatibility information update unit 16, and an update instruction unit. 17.

The software storage unit 10 stores software for operating the representative vehicle-mounted device A. FIG. The representative vehicle-mounted device A implements a predetermined function for controlling the operation of the vehicle by executing software stored in the software storage unit 10 .

The matching information storage unit 11 stores in advance a matching table that defines combinations of software versions of all the vehicle-mounted devices A to D constituting the vehicle control system 100 . The combination of versions of the software of the vehicle-mounted devices A to D defined in the matching table is a combination of versions for which it has been confirmed that the vehicle control system 100 operates normally, and simultaneous execution is permitted. For example, as shown in FIG. 3, the matching table can include the system number specifying the vehicle control system 100 and the software version of each of the vehicle-mounted devices AD. As the system number, an identifier for specifying the vehicle control system 100 may be used, or the version of the vehicle control system 100 may be used. In addition, in the example of the matching table in FIG. 3, a single version is defined as the version of each vehicle-mounted device, but a range of versions of each vehicle-mounted device that can be combined may be defined. In addition, multiple sets of combinations of versions (or ranges of versions) that are allowed to be executed simultaneously may be defined in the consistency table. When one vehicle-mounted device holds a plurality of pieces of software, the matching table defines permitted versions of each of the plurality of pieces of software. The matching table is used as matching information (first matching information) for determining whether or not the versions of the software of the vehicle-mounted devices A to D are compatible with each other.

The version acquiring unit 12 acquires the software version of each of the other vehicle-mounted devices B to D through communication each time the power of the vehicle is turned on. If there is an on-vehicle device holding a plurality of pieces of software among the on-board devices B to D, the version acquiring unit 12 acquires the versions of all the software held by the on-board device.

Each time the version acquisition unit 12 acquires the software versions from the other vehicle units B to D, the determination unit 13 determines whether the versions of the software of all the vehicle units A to D constituting the vehicle control system 100 are consistent. Determine whether or not there is This judgment is performed by the judging section 13 storing the version of the software stored in the software storage section 10 of the representative vehicle-mounted device A and the version of the software acquired from the other vehicle-mounted devices B to D by the version acquisition unit 12 as matching information. This is done by matching with matching information stored in the unit 11 . Based on the matching table stored in the matching information storage unit 11, the determining unit 13 determines that the versions of the software of all the onboard units A to D constituting the vehicle control system 100 are consistent. Execution of predetermined vehicle control realized by combining the functions of machines A to D is permitted.

If the determination unit 13 determines that the software versions of all the vehicle units A to D constituting the vehicle control system 100 do not match, the transmission unit 14 includes the software versions of the vehicle units A to D. Send the version information to the external server 2 . The version information transmitted by the transmission unit 14 is used by the external server 2 to reconfirm whether or not the software versions of the vehicle-mounted devices A to D are consistent.

The receiving unit 15 receives various information transmitted from the external server 2 . One of the information that the receiving unit 15 receives from the external server 2 is determination result information. The judgment result information is information indicating whether or not the versions of the software of the vehicle-mounted devices A to D are compatible, and is obtained by the external server 2 making a judgment based on the version information received from the transmission unit 14. can be done.

The transmitting unit 14 and the receiving unit 15 communicate with the external server 2 via the wireless communication device 1 shown in FIG.

The consistency information update unit 16 updates the consistency information stored in the consistency information storage unit 11 when the determination result information received by the reception unit 15 indicates that the versions of the software of the vehicle-mounted devices A to D are consistent. do. When updating the matching information, the matching information update unit 16 updates the combination of software versions included in the matching table (first matching information) stored in the matching information storage unit 11 to the current software of the onboard units A to D. or by adding the combination of the current software versions of the vehicle-mounted devices A to D to the matching table stored in the matching information storage unit 11 . The matching information updating unit 16 may acquire the updated matching table from the external server 2 and replace the matching table stored in the matching information storage unit 11 with the matching table acquired from the external server 2 .

When the determination result information received by the receiving unit 15 indicates that the versions of the software of the vehicle-mounted devices A to D are not compatible, the update instruction unit 17 holds the software that is not compatible with the permitted version combination. Instructs the onboard device to update the software.

[In-vehicle device B to D]
Vehicle-mounted devices B to D include a software storage unit 20 , a transmission unit 21 and a reception unit 22 .

The software storage unit 20 stores software for operating each of the vehicle-mounted devices BD. By executing the software stored in the software storage unit 10, the vehicle-mounted devices B to D each realize a predetermined function for controlling the operation of the vehicle.

The transmission unit 21 transmits the version of the software stored in the software storage unit 20 to the representative vehicle-mounted device A. FIG. The transmission unit 21 may transmit the version of the software to the representative vehicle-mounted device A when the power of the vehicle is turned on. The version of the software may be transmitted to the representative vehicle-mounted device A in response to the request from the representative vehicle-mounted device A.

The receiving unit 22 receives various information transmitted from the representative vehicle-mounted device A or the external server 2 .

[External server 2]
The external server 2 includes a matching information storage unit 30 , a determination unit 31 , a transmission unit 32 and a reception unit 33 .

The matching information storage unit 30 stores in advance a matching table that defines combinations of software versions of all the vehicle-mounted devices A to D constituting the vehicle control system 100 . A combination of versions of the onboard units A to D defined in the matching table is a combination that has been confirmed to allow the vehicle control system 100 to operate normally and that is permitted to be executed simultaneously. The matching table stored in the matching information storage unit 30 may include the system number specifying the vehicle control system 100 and the software version of each of the vehicle-mounted devices A to D in the same manner as shown in FIG. can. The matching table is used as matching information (second matching information) for determining whether or not the versions of the software of the vehicle-mounted devices A to D are compatible with each other by the determination unit 31, which will be described later.

The determination unit 31 determines whether or not the software versions of all the vehicle-mounted devices A to D constituting the vehicle control system 100 are consistent. This determination is made by the determination unit 31 checking the versions of the software of the vehicle units A to D included in the version information received from the representative vehicle unit A with the matching table stored in the matching information storage unit 30 . The external server 2 can manage software of all versions of the in-vehicle units AD. Therefore, compared to the matching table stored in the matching information storage unit 11 of the representative vehicle unit A, the matching table stored in the matching information storage unit 30 has more permitted combinations of software versions of the vehicle units A to D than the matching table stored in the matching information storage unit 11. can be defined more. Therefore, even if the consistency of the software version cannot be confirmed in the representative vehicle-mounted device A, the compatibility of the software versions of the vehicle-mounted devices A to D can be accurately determined by performing the determination again in the external server 2. can be done.

The transmitting unit 32 transmits, to the representative vehicle unit A, determination result information indicating whether or not the versions of the software of the vehicle units A to D are compatible, which is the determination result of the determination unit 31 .

The receiving unit 33 receives various information transmitted from the representative vehicle-mounted device A.

<Control processing>
Hereinafter, control processing executed by the representative vehicle-mounted device A will be described with reference to FIGS. 2 and 4. FIG.

FIG. 4 is a flowchart showing an example of consistency confirmation processing executed by the representative vehicle-mounted device in the vehicle control system according to the first embodiment. The control process shown in FIG. 4 is executed when the power of the vehicle is turned on.

Step S1: The version acquisition section 12 acquires the software versions of the other vehicle-mounted devices B to D. After that, the process moves to step S2.

Step S2: The determination unit 13 collates the software version of the representative vehicle unit A and the software versions acquired from the other vehicle units B to D with the matching table stored in the matching information storage unit 11. It is determined whether or not the software versions of the machines A to D are consistent. If the determination in step S2 is YES, the process moves to step S3, otherwise the process moves to step S4.

Step S3: The determination unit 13 permits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process ends.

Step S4: The transmitting unit 14 transmits to the external server 2 version information including the software version of the representative vehicle-mounted device A and the software versions obtained from the other vehicle-mounted devices BD. After that, the process moves to step S5.

Step S<b>5 : The receiving unit 15 determines whether the determination result information has been received from the external server 2 . If the determination in step S5 is YES, the process proceeds to step S6. Otherwise, after waiting for a predetermined time, the determination in step S5 is performed again. In step S5, if the state in which the receiving unit 15 cannot receive the determination result information from the external server 2 continues for a predetermined time (timeout time), the receiving unit 15 determines that it is timed out and performs the process of step S5. Terminates and the process proceeds to step S6.

Step S6: Based on the determination result information received from the external server 2, the determination unit 13 determines whether or not the software versions of the vehicle-mounted devices A to D are consistent. If the determination in step S6 is YES, the process moves to step S7, otherwise the process moves to step S9. If the receiving unit 15 determines in step S5 that a timeout has occurred, then in step S6 it determines that the software versions of the vehicle-mounted devices A to D do not match.

Step S7: The determination unit 13 permits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process moves to step S8.

Step S8: The matching information updating unit 16 updates the matching table stored in the matching information storage unit 11. FIG. As described above, the matching table may be updated using the software version used for the determination in step S2, or may be updated using the matching table obtained from the external server 2 via the receiving unit 15. . After that, the process ends.

Step S9: The determination unit 13 prohibits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process moves to step S10.

Step S<b>10 : The update instruction unit 17 instructs the vehicle-mounted device holding the version of the software that does not match the matching table stored in the matching information storage unit 11 to update the software. After that, the process ends.

When the update instruction unit 17 instructs to update the software, the software to be executed is updated from the current version of the software when the on-vehicle device to be updated completes receiving the updated software from the server 2. In order to switch to the new software, the user may be prompted to turn the vehicle power off and then on again.

Further, when the software of any vehicle-mounted device is updated based on the update instruction in step S10, the matching information updating unit 16 updates the matching table stored in the matching information storage unit 11 as necessary. good.

<Effects, etc.>
In the vehicle control system 100 according to the present embodiment, when the power of the vehicle is turned on, the representative vehicle-mounted device A acquires the software versions of the vehicle-mounted devices B to D, and based on a matching table prepared in advance, , whether or not the software versions of the in-vehicle units A to D are consistent. Since the consistency of the software version is checked every time the vehicle is turned on, there is a possibility that unexpected vehicle control will be executed due to the version mismatch of the onboard units A to D. can be further reduced.

Further, in the vehicle control system 100 according to the present embodiment, when it is determined that there is no consistency in the consistency check (primary check) of the software version by the representative vehicle device A, the software of the vehicle devices A to D The version is sent to the external server 2, and the consistency check of the software version is performed again using the consistency table held by the external server 2 (secondary check). Even if the consistency cannot be confirmed with the information held by the representative onboard device A, the information held by the external server 2 can be used to check the consistency again, so that the version of the software of the onboard devices A to D can be checked. Whether or not there is consistency can be determined with higher accuracy.

In addition, in the vehicle control system 100 according to the present embodiment, whether or not the software versions of the vehicle-mounted devices A to D are compatible is determined by matching with a matching table prepared in advance. , it is possible to identify which on-vehicle device software version is inconsistent with the matching table. Information that identifies inconsistent in-vehicle units with the matching table can be used for software updates and in-vehicle unit repairs. Become.

Further, in the vehicle control system 100 according to the present embodiment, after the representative vehicle device A determines that the versions of the software of the vehicle devices A to D are inconsistent, the external server 2 updates the software of the vehicle devices A to D. When it is determined that the versions are consistent, the consistency table stored in the consistency information storage unit 11 of the representative vehicle-mounted device A can be updated. If the matching table stored in the matching information storage unit 11 is updated, the software version will be updated only by the representative vehicle unit A the next time the vehicle is turned on unless the software of the vehicle units A to D is changed. can be checked for consistency, it is possible to shorten the time required for checking the consistency.

Of the functional blocks of the representative vehicle-mounted device A shown in FIG. It is also possible to configure a simple vehicle control system that can judge only the consistency of the software versions of the vehicle-mounted units A to D when the power of the vehicle-mounted units A to D is turned on. Further, the transmitting unit 14 and the receiving unit 15 may be added to this configuration to configure a vehicle control system in which the primary check in the representative vehicle-mounted device A and the secondary check in the external server 2 are possible. Further, the vehicle control system may be constructed by omitting the matching information updating unit 16 or the update instructing unit 17 from among the functional blocks of the representative vehicle-mounted device A shown in FIG.

(Second embodiment)
<Configuration>
FIG. 5 is a functional block diagram of a vehicle control system according to the second embodiment.

In the vehicle control system 200 according to the second embodiment, after the representative vehicle-mounted device A determines that the versions of the software of the vehicle-mounted devices A to D are inconsistent, the representative vehicle-mounted device A cannot communicate with the external server 2. It is characterized in that the consistency of the software versions of the on-vehicle units A to D can be ensured even when in the state. The following description focuses on differences between the present embodiment and the first embodiment.

[Representative in-vehicle unit A]
The software storage unit 10 of the representative vehicle-mounted device A stores a current version of software Sa_cur and an old version of software Sa_old as software for operating the representative vehicle-mounted device A. FIG. The current version of the software Sa_cur and the old version of the software Sa_old are stored in different storage areas of the software storage unit 10. When updating the software, the old version of the software Sa_old is deleted and the current version of the software is replaced with the old version. and the updated software is newly stored as the current version of the software.

The consistency information storage unit 11 stores a current version consistency table T_cur and an old version consistency table T_old as consistency information. When updating the consistency information, the old version consistency table T_old is deleted, the current version consistency table is retained as the old version consistency table, and the updated consistency table is newly stored as the current version consistency table. .

The representative vehicle-mounted device A further includes a switching instruction unit 18 and a software switching unit 19 .

When the determination unit 13 determines that the versions of the software of the vehicle units A to D are inconsistent and the representative vehicle unit A is in a state where communication with the external server 2 is not possible, the switching instruction unit 18 switches the vehicle unit. Each of A to D is instructed to switch the software to be executed from the current version software to the old version software. When the switching instruction unit 18 instructs the vehicle-mounted devices A to D to switch the software, the user may be notified that the software is to be switched to the old version by display on the display unit or by voice.

When the switching instruction unit 18 issues a software switching instruction, the software switching unit 19 switches the software to be executed from the current version of the software Sa_cur to the old version of the software Sa_old. Switch the information from the current version of the reconciliation table T_cur to the old version reconciliation table T_old. The switching of the software by the software switching unit 19 is executed before the process of confirming the consistency of the software versions of the vehicle-mounted devices A to D when the power of the vehicle is next turned on.

When the switching instruction unit 18 issues a software switching instruction, the version acquisition unit 12 and the determination unit 13 determine the software versions of the on-vehicle units A to D when the vehicle is turned on next time. are checked for consistency. The processing executed by the version acquisition unit 12 and the determination unit 13 is the same as the processing during normal operation when the power is turned on. , and the determination unit 13 compares the version of the software after switching of the representative vehicle-mounted device A and the version of the software after switching acquired from the other vehicle-mounted devices B to D to a matching table of old versions. , the consistency of the software versions is confirmed.

[In-vehicle device B to D]
In the software storage unit 20 of the vehicle-mounted devices B, C and D, current version software Sb_cur, Sc_cur and Sd_cur and old-version software Sb_old, Sc_old and Sd_old are stored respectively. In the in-vehicle units B to D, the current version software and the old version software are stored in different storage areas of the software storage unit 20, and when the software is updated, the old version software is deleted and updated. The software is newly stored as the current version of the software, and the current version of the software is retained as the old version of the software. The old versions of the software Sa_old to Sd_old are combinations of software that were used before the current versions of the software Sa_cur to Sa_cur, and are versions compatible.

Further, each of the vehicle-mounted devices B to D further includes a software switching unit 23 . When the switching instruction unit 18 issues a software switching instruction, the software switching unit 23 changes the software to be executed from the current version software Sb_cur, Sc_cur, and Sd_cur to the old version software Sb_old, Sc_old, and Sd_old, respectively. switch. The switching of the software by the software switching unit 23 is also performed before the process of confirming the consistency of the software versions of the vehicle-mounted devices A to D when the power of the vehicle is next turned on.

<Control processing>
Hereinafter, the control processing executed by the representative vehicle-mounted device A will be described with reference to FIGS. 5 and 6. FIG.

FIG. 6 is a flowchart showing an example of consistency confirmation processing executed by the representative vehicle-mounted device in the vehicle control system according to the second embodiment. The control process shown in FIG. 6 is executed when the power of the vehicle is turned on.

Step S21: The software switching unit 19 determines whether or not an instruction to switch software has been issued before the power of the vehicle is turned on. This step S21 is the first power-on after the instruction to switch the current version of the software of the vehicle-mounted devices A to D to the old version is given in step S28, which will be described later. This determination is necessary to switch the software with the . It can be determined by a flag or the like set in a non-volatile storage area that a software switching instruction has been issued before the power of the vehicle is turned on. If the determination in step S21 is YES, the process moves to step S22, otherwise the process moves to step S23.

Step S22: When it is determined in step S21 that there is a software switching instruction, the software switching unit 19 switches the software to be executed from the current version of the software Sa_cur to the old version of the software Sa_old. The software switching unit 19 also switches the matching information used by the determination unit 13 from the current matching table T_cur to the old version matching table T_old.

Although illustration is omitted, in the other vehicle-mounted devices instructed to switch the software, the software switching unit 23 is executed at the same timing as the software switching in the representative vehicle-mounted device A. switch from the current version of the software to the previous version of the software.

Step S23: The version acquisition section 12 acquires the software versions of the other vehicle-mounted devices BD. After that, the process moves to step S24.

Step S24: The determination unit 13 collates the software version of the representative vehicle unit A and the software versions acquired from the other vehicle units B to D with the matching table stored in the matching information storage unit 11. It is determined whether or not the software versions of the machines A to D are consistent. If the determination in step S24 is YES, the process moves to step S25; otherwise, the process moves to step S26.

Step S25: The determination unit 13 permits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process ends.

Step S26: The transmission unit 14 determines whether communication with the external server 2 is possible. Whether communication with the external server 2 is possible can be determined, for example, based on the signal strength of the radio signal received by the receiving unit 15 . If the determination in step S26 is YES, the process moves to step S29; otherwise, the process moves to step S27.

Step S27: The determination unit 13 prohibits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process moves to step S28.

Step S28: The switching instruction unit 18 instructs the vehicle-mounted device that needs to switch from the current version of the software to the old version of the software to switch the current version of the software to the old version of the software. After that, the process ends.

When the switching instruction unit 18 instructs the onboard devices A to D to switch the software, the representative onboard device A may notify the user that the software will be switched. Further, the representative vehicle-mounted device A may urge the user to turn off the power of the vehicle once and then turn it on again when the preparation for the software switching process is completed.

Step S29: The transmitting unit 14 transmits to the external server 2 version information including the software version of the representative vehicle-mounted device A and the software versions acquired from the other vehicle-mounted devices BD. After that, the process moves to step S30.

Step S<b>30 : The receiving unit 15 determines whether or not the determination result information has been received from the external server 2 . If the determination in step S30 is YES, the process proceeds to step S31. Otherwise, after waiting for a predetermined time, the determination in step S30 is performed again. In step S30, if the state in which the reception unit 15 cannot receive the determination result information from the external server 2 continues for a predetermined time (timeout time), the reception unit 15 determines that the timeout has occurred, and performs the processing of step S30. Terminates and the process proceeds to step S31.

Step S31: Based on the determination result information received from the external server 2, the determination unit 13 determines whether or not the software versions of the vehicle-mounted devices A to D are consistent. If the determination in step S31 is YES, the process proceeds to step S32; otherwise, the process proceeds to step S34. If the receiving unit 15 determines in step S30 that a timeout has occurred, it determines in step S31 that the software versions of the vehicle-mounted devices A to D do not match.

Step S32: The determination unit 13 permits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process moves to step S33.

Step S<b>33 : The matching information updating unit 16 updates the matching information stored in the matching information storage unit 11 . After that, the process ends.

Step S34: The determination unit 13 prohibits execution of vehicle control using a combination of the vehicle-mounted devices A to D. After that, the process moves to step S35.

Step S<b>35 : The update instruction unit 17 instructs the vehicle-mounted device holding the version of the software that does not match the matching table stored in the matching information storage unit 11 to update the software. After that, the process ends.

When the update instruction unit 17 instructs to update the software, the software to be executed is updated from the current version of the software when the on-vehicle device to be updated completes receiving the updated software from the server 2. In order to switch to the new software, the user may be prompted to turn the vehicle power off and then on again.

<Effects, etc.>
In the vehicle control system 200 according to the present embodiment, as in the first embodiment, when the power of the vehicle is turned on, it is determined whether or not the software versions of the onboard units A to D are consistent. Therefore, it is possible to further reduce the possibility that unexpected vehicle control is executed due to version mismatch of the software of the vehicle-mounted devices A to D.

In addition to this, in the vehicle control system 200 according to the present embodiment, each vehicle-mounted device holds the software of the old version, and the representative vehicle-mounted device A holds the matching table of the old version. Therefore, if the representative onboard unit A determines that the software versions of the onboard units A to D are inconsistent, but communication between the representative onboard unit A and the external server 2 is not possible, the old version of the software can be switched to According to this configuration, even if the latest software version is inconsistent and the representative vehicle-mounted device A cannot communicate with the external server, it is possible to ensure the consistency of the software versions of the vehicle-mounted devices A to D. .

Note that the vehicle control system may be constructed by omitting the matching information updating unit 16 or the update instructing unit 17 from among the functional blocks of the representative vehicle-mounted device A shown in FIG.

(Third embodiment)
<Configuration>
FIG. 7 is a schematic diagram for explaining the background of the vehicle control system according to the third embodiment.

Versions Sa to Sd of the software of vehicle-mounted devices A to D constituting vehicle control system 300 are matched at the time of shipment of the vehicle (left column in FIG. 7). As a cause of the collapse of the consistency of the software versions of the onboard units A to D, it is possible that the onboard units A to D are replaced, or the versions are shifted due to the replacement of parts such as substrates included in the onboard units A to D. For example, the vehicle-mounted device C breaks down (the middle column in FIG. 7), and as a result of replacing the failed vehicle-mounted device C with a new one, the version of the software Sc' of the new vehicle-mounted device C changes from the version of the software Sc before the replacement. (right column in Fig. 7). In this case, the new software version Sc' of the vehicle-mounted device C does not necessarily match the software versions of the vehicle-mounted devices A, B, and D. It is conceivable that the compatibility of the software of the vehicle-mounted devices A to D cannot be confirmed only by the consistency confirmation processing by A. When the vehicle is used in places where the wireless communication environment is not well established, such as underground or mountainous areas, it is not possible to check consistency by communicating with an external server. It is assumed that the vehicle control functions that can be used by the user will be limited, and it will take time to update the software, which may reduce user convenience.

Assuming such a problem, in the vehicle control system according to the third embodiment, even if the onboard units A to D need to be repaired or replaced, the consistency of the software versions of the onboard units A to D can be quickly verified. It is characterized in that it can ensure The following description focuses on differences between the present embodiment and the first embodiment.

FIG. 8 is a functional block diagram of a vehicle control system according to the third embodiment.

[Representative in-vehicle unit A]
In addition to the software storage unit 10, the compatibility information storage unit 11, the version acquisition unit 12, the determination unit 13, the transmission unit 14, and the reception unit 15, the representative vehicle-mounted device A has , a software acquisition unit 40 and a software update unit 41 .

If any one of the other on-vehicle devices B to D breaks down and needs to be replaced or repaired, the software acquisition unit 40 receives the failed on-vehicle information from the external server 2 while communication with the external server 2 is possible. Receive and store the current version of software on the machine. The software acquisition unit 40 can detect that a failure has occurred in any one of the on-vehicle devices BD from a failure notification output from the failed on-board device. 7 and 8 show an example in which the in-vehicle device C has failed. The software Sc of C is acquired from the external server 2 and stored. The software version that the software acquisition unit 40 acquires from the external server 2 may be acquired from the failed vehicle-mounted device C through communication, or may be acquired from the matching table stored in the matching information storage unit 11 .

After replacement or repair of the failed vehicle-mounted device, the software update unit 41 determines that the versions of the software of the vehicle-mounted devices A to D are inconsistent by the determination unit 13 and that they are not consistent with the matching table. When the vehicle-mounted device holding the updated version of the software is determined to be the replaced or repaired vehicle-mounted device, the software acquisition unit 40 stores the software in the software storage unit 20 of the replaced or repaired vehicle-mounted device. write software. After that, the software update unit 41 instructs the replaced or repaired vehicle-mounted device to switch the software.

When the software update unit 41 issues a software switching instruction, the version acquisition unit 12 and the determination unit 13 determine the software versions of the on-vehicle units A to D when the vehicle is turned on next time. are checked for consistency. The processing executed by the version acquiring unit 12 and the determining unit 13 is the same as the normal processing when the power is turned on.

[In-vehicle device B to D]
Further, each of the vehicle-mounted devices B to D further includes a software switching unit 23 similar to that described in the second embodiment. When the software updater 41 issues a software switching instruction, the software switching unit 23 switches the software to be executed from the current version of the software to the software written by the software updater 41 . The switching of the software by the software switching unit 23 is executed before the process of confirming the consistency of the software versions of the vehicle-mounted devices A to D when the power of the vehicle is next turned on.

<Control processing>
Hereinafter, control processing executed by the representative vehicle-mounted device A will be described with reference to FIGS. 8 to 10 as well.

FIG. 9 is a flowchart showing an example of software acquisition processing executed by the representative vehicle-mounted device in the vehicle control system according to the third embodiment.

Step S41: The receiving unit 15 determines whether or not a failure notification has been received from another vehicle-mounted device BD. If the determination in step S41 is YES, the process proceeds to step S42, otherwise the process ends.

Step S42: The software acquisition unit 40 acquires the current version of the software of the failed vehicle-mounted device from the external server 2 and stores it. After that, the process ends.

FIG. 10 is a flowchart showing an example of consistency confirmation processing executed by the representative vehicle-mounted device in the vehicle control system according to the third embodiment. The control process shown in FIG. 10 is executed when the power of the vehicle is turned on.

Step S51: The version acquisition section 12 acquires the software versions of the other vehicle-mounted devices B to D. After that, the process moves to step S52.

Step S52: The determination unit 13 collates the software version of the representative vehicle unit A and the software versions acquired from the other vehicle units B to D with the matching table stored in the matching information storage unit 11, It is determined whether or not the software versions of the machines A to D are consistent. If the determination in step S52 is YES, the process proceeds to step S54; otherwise, the process proceeds to step S53.

Step S53: The determination unit 13 permits execution of vehicle control using a combination of the onboard units A to D. After that, the process ends.

Step S54: The determination unit 13 determines whether or not the vehicle-mounted device having the version of the software that does not match the matching table is the vehicle-mounted device that has been replaced or repaired. Whether or not the vehicle-mounted device has been replaced or repaired can be specified based on the failure notification received in step S41 of FIG. If the determination in step S54 is YES, the process moves to step S55; otherwise, the process moves to step S56.

Step S55: The software update section 41 writes the software stored in the software acquisition section 40 to a predetermined area of the software storage section 20 of the replaced or repaired vehicle-mounted device. Then, the software update unit 41 instructs the replaced or repaired vehicle-mounted device to switch the software. After that, the process ends.

Step S56: The determination unit 13 prohibits execution of vehicle control using a combination of the onboard units A to D. After that, the process ends.

When the software update unit 41 instructs to switch the software, the power of the vehicle is temporarily turned off in order to switch the software to be executed by the replaced or repaired vehicle-mounted device from the current version of the software to the updated software. After that, the user may be prompted to turn it on again. Further, the representative vehicle-mounted device A may once turn off the power of the vehicle-mounted device for which the software update unit 41 has instructed to switch the software, and then turn it on again. When the vehicle-mounted device instructed to switch the software by the software updating unit 41 is turned on next time, the software switching unit 23 causes the software to be executed to be stored in the software storage unit 20 by the software updating unit 41. Switch to written software.

<Effects, etc.>
In the vehicle control system 300 according to the present embodiment, as in the first embodiment, when the vehicle is powered on, it is determined whether or not the software versions of the onboard units A to D are compatible. Therefore, it is possible to further reduce the possibility that unexpected vehicle control is executed due to version mismatch of the software of the vehicle-mounted devices A to D.

In addition to this, in the vehicle control system 300 according to the present embodiment, when replacement or repair of the on-vehicle units B to D becomes necessary due to a failure, the failed on-board unit whose compatibility has been confirmed in advance software from the external server 2 in advance by the representative vehicle-mounted device A. Then, after replacing or repairing the failed vehicle-mounted device, if the version of the software of the replaced or repaired vehicle-mounted device does not match the matching table, the representative vehicle-mounted device A pre-obtained software from the external server 2. switch to Therefore, even if the software versions of the onboard units A to D cannot be matched due to the replacement or repair of the onboard units and the wireless communication environment of the vehicle is not ready, the onboard units A to D can be quickly matched. It can be restored to a healthy state. As a result, the restrictions on the vehicle control functions realized by the combination of the on-vehicle units A to D can be quickly eliminated, and the user's convenience can be improved.

The software consistency confirmation method according to the third embodiment may be combined with the vehicle control system 100 according to the first embodiment or the vehicle control system 200 according to the second embodiment. Specifically, the vehicle control system 100 according to the first embodiment or the vehicle control system 200 according to the second embodiment is further provided with a software acquisition unit 40 and a software update unit 41, and the steps shown in FIG. The representative vehicle-mounted device A may be configured so as to be able to execute the processing of S41 and S42 and the processing of steps S54 and S55 shown in FIG. The processing of steps S54 and S55 shown in FIG. 10 can be executed after the primary check by the determination unit 13 determines that the software versions are not consistent and before the external server 2 executes the secondary check. preferable. With this configuration, the consistency determination using the information held by the representative vehicle-mounted device A is preferentially executed, and if the determination cannot be made only by the representative vehicle-mounted device A, the external server 2 performs a secondary check. Therefore, it is possible to efficiently perform software consistency determination processing without communication. If there is a step of determining whether communication between the vehicle and the external server 2 is possible (S26 in FIG. 6), the processing of steps S54 and S55 in FIG. 10 may be executed when the vehicle cannot communicate with the external server 2.

(Other modifications, etc.)
4, 6, 9 and 10 described above may be realized by a dedicated circuit. It may be realized by executing the processing of the steps. 4, 6, 9 and 10 are executed by a computer such as an ECU, a program in which these control processes can be executed is stored in advance in a storage device such as a ROM or hard disk. , the processor of the computer may be caused to read the program from the storage device and execute it.

Further, in each of the above embodiments, an example in which one of the vehicle-mounted devices that provide the control function of the vehicle control system confirms the consistency of the software version as the representative vehicle-mounted device has been described. The above control processing may be executed by a dedicated vehicle-mounted device for the purpose.

INDUSTRIAL APPLICABILITY The present invention can be used for a vehicle control system that realizes a predetermined vehicle control function by combining a plurality of vehicle-mounted devices.

2 External server 10 Software storage unit 11 Consistency information storage unit 12 Version acquisition unit 13 Judgment unit 14 Transmission unit 15 Reception unit 16 Consistency information update unit 17 Update instruction unit 18 Switching instruction unit 19 Software switching unit 20 Software storage unit 30 Consistency information storage Unit 31 Determination unit 32 Transmission unit 33 Reception unit 40 Software acquisition unit 41 Software update units 100, 200, 300 Vehicle control system A Representative vehicle-mounted devices B to D Vehicle-mounted devices

Claims (8)

A device mounted on a vehicle,
a first instruction unit that instructs switching of software of a plurality of in-vehicle devices;
an acquisition unit that acquires version information of software after switching of the plurality of in-vehicle devices according to the switching instruction;
a confirmation unit that confirms that versions of the software of the plurality of vehicle-mounted devices are consistent based on the version information acquired by the acquisition unit;
A second instruction for instructing the plurality of vehicle-mounted devices to return from the post-switching software to the pre-switching software based on confirmation that the versions of the software of the plurality of vehicle-mounted devices are inconsistent. A device comprising: a storage unit that stores an allowed combination of software versions before switching and an allowed combination of software versions after switching;
After the software switching instruction by the second instruction unit,
The acquisition unit acquires version information of software of the plurality of in-vehicle devices,
The confirmation unit checks the version information of the software acquired by the acquisition unit against the permitted combination of versions of the pre-switching software to confirm that the versions of the software of the plurality of vehicle-mounted devices are consistent. 11. The device of claim 1, for checking if there is. a transmission unit capable of transmitting the version information acquired by the acquisition unit to an external server;
If it is confirmed that the versions of the software after the switching of the plurality of vehicle-mounted devices are inconsistent and the transmission unit cannot communicate with the external server, the second instruction unit instructs the plurality of vehicle-mounted devices to 2. The device according to claim 1, wherein the software after the switching is instructed to return to the software before the switching. confirmation result information confirmed by the external server based on the version information transmitted by the transmission unit, the confirmation result information indicating whether or not the versions of the software of the plurality of vehicle-mounted devices are consistent; , a receiving unit capable of receiving from the external server,
When it is confirmed that the versions of the software after switching of the plurality of vehicle-mounted devices are inconsistent, and the transmission unit can communicate with the external server,
The transmission unit transmits the version information acquired by the acquisition unit to the external server,
The receiving unit receives the confirmation result information from the external server,
4. The device according to claim 3, wherein said confirmation unit confirms that versions of software of said plurality of vehicle-mounted devices are consistent based on said confirmation result information received by said reception unit. 5. The method of claims 1 to 4, wherein the confirmation unit permits execution of predetermined vehicle control implemented by the plurality of vehicle-mounted devices when it is confirmed that the versions of the software of the plurality of vehicle-mounted devices are compatible. A device according to any one of the preceding claims. A vehicle comprising the apparatus of claim 1 . A method executed by a computer of a device mounted on a vehicle, comprising:
a step of instructing switching of software of a plurality of in-vehicle devices;
a step of acquiring version information of software after switching of the plurality of vehicle-mounted devices according to the switching instruction;
confirming that the software versions of the plurality of vehicle-mounted devices are consistent based on the acquired version information;
and instructing the plurality of vehicle-mounted devices to return from the post-switching software to the pre-switching software based on confirmation that the versions of the software of the plurality of vehicle-mounted devices are inconsistent. ,Method. A method executed by a computer of a device mounted on a vehicle, comprising the step of instructing the computer to switch software of a plurality of onboard devices;
a step of acquiring version information of software after switching of the plurality of vehicle-mounted devices according to the switching instruction;
confirming that the software versions of the plurality of vehicle-mounted devices are consistent based on the acquired version information;
and instructing the plurality of vehicle-mounted devices to return from the post-switching software to the pre-switching software based on confirmation that the versions of the software of the plurality of vehicle-mounted devices are inconsistent. program.

Images