WO2024070483A1

WO2024070483A1 - Control system

Info

Publication number: WO2024070483A1
Application number: PCT/JP2023/031869
Authority: WO
Inventors: 僚一朗矢船; 肇小堀
Original assignee: 株式会社アドヴィックス
Priority date: 2022-09-27
Filing date: 2023-08-31
Publication date: 2024-04-04
Also published as: JP2024048009A

Abstract

This control system 15 comprises an information processing device 30, a plurality of ECUs 50, 60, 70, and a global network 42. When updating software in a storage device 62 of a first control ECU 60, the information processing device 30 divides update software into a plurality of pieces and transmits the divided pieces of the update software to the global network 42. A first divided piece of update software, which is one of the pieces of update software divided and transmitted by the information processing device 30, is decoded by an execution device 61. A second divided piece of update software, which is one of the pieces of update software divided and transmitted by the information processing device 30, is decoded by the execution device 71. Each of the first and second decoded and divided pieces of update software is written in the storage device 62.

Description

Control System

The present invention relates to a control system installed in a vehicle.

Patent Document 1 discloses a system that has the function of updating software in a storage device provided in an in-vehicle electronic control device. In this system, when updating software, a Tester is connected to an in-vehicle network to which multiple electronic control devices are connected. The Tester pre-stores update software for the electronic control device to be updated. Therefore, when the Tester is connected to the in-vehicle network, the Tester transmits the update software to the electronic control device to be updated via the in-vehicle network. As a result, the software in the storage device in the electronic control device is rewritten with the update software.

JP 2018-120438 A

In recent years, a system has been developed that updates the software in a storage device provided in an electronic control device with update software transmitted to the vehicle by wireless communication from a data center outside the vehicle. The system includes an information processing device that acquires the update software transmitted to the vehicle from the data center. When updating software, the information processing device transmits the update software to the electronic control device to be updated via an in-vehicle network. At this time, the information processing device transmits encrypted update software to the electronic control device to increase the confidentiality of the information. Therefore, the execution device of the electronic control device decrypts the received update software and writes the decrypted update software to the storage device. The object of the present invention is to prevent the time required for software update from increasing when the information processing device transmits encrypted update software to the electronic control device via an in-vehicle network to update the software in the storage device of the electronic control device.

A control system for solving the above problem includes an information processing device that acquires update software transmitted to the vehicle from outside the vehicle by wireless communication, and a global network that communicatively connects a plurality of electronic control devices to the information processing device, and is configured to be able to update software in a storage device provided in a first electronic control device among the plurality of electronic control devices. The control system includes a first execution device and a second execution device. When updating the software in the storage device of the first electronic control device to update software for the first electronic control device acquired by the information processing device, the information processing device divides the update software into multiple pieces and transmits the divided update software to the global network in an encrypted state. The first execution device decrypts the first divided update software, which is one of the pieces of update software divided and transmitted by the information processing device to the global network. The second execution device decrypts the second divided update software, which is one of the pieces of update software divided and transmitted by the information processing device to the global network. The first update divided software decrypted by the first execution device and the second update divided software decrypted by the second execution device are each written to the storage device of the first electronic control device.

Consider a case where the information processing device divides the update software acquired by the information processing device into multiple pieces, and transmits the divided update software, which is the update split software, to the first electronic control device via a global network. In this case, when the first electronic control device receives the first update split software from the multiple update split software, the execution device decrypts the first update split software. The execution device then writes the decrypted first update split software to the storage device. During this time, even if the execution device of the first electronic control device receives the second update split software, which is the next update software, it cannot execute the process of decrypting the second update split software. Therefore, the information processing device cannot transmit the second update split software. In other words, the information processing device goes into a standby state. The longer the information processing device goes into a standby state in this way, the longer it takes to update the software in the storage device of the first electronic control device.

In the above control system, when the information processing device transmits the first update divided software to the global network, the first execution device decrypts the first update divided software. While the first execution device is decrypting the first update divided software in this manner, the second execution device waits for the second update divided software from the information processing device. Therefore, while the first execution device is decrypting the first update divided software, the second execution device can decrypt the second update divided software transmitted from the information processing device. As a result, the time that the information processing device is in the above-mentioned standby state can be shortened.

Therefore, when updating software in the storage device of the first electronic control device, the control system described above can prevent the time required for software update from becoming long.

FIG. 1 is a schematic configuration diagram showing a vehicle equipped with a control system according to a first embodiment and a data center provided outside the vehicle. In Figure 2, (A) is a diagram showing the first half of the processing flow executed by the information processing device of the control system of the first embodiment, (B) is a diagram showing the first half of the processing flow executed by the first electronic control device of the control system, and (C) is a diagram showing the first half of the processing flow executed by the second electronic control device of the control system. In Figure 3, (A) is a diagram showing the latter half of the processing flow executed by the information processing device, (B) is a diagram showing the latter half of the processing flow executed by the first electronic control device, and (C) is a diagram showing the latter half of the processing flow executed by the second electronic control device. In FIG. 4, (A) to (D) are timing charts showing how software in a storage device included in a first brake ECU corresponding to the first electronic control device is updated. In Figure 5, (A) is a diagram showing a part of the processing flow executed by an information processing device of the control system of the second embodiment, (B) is a diagram showing a part of the processing flow executed by a first electronic control device of the control system, and (C) is a diagram showing a part of the processing flow executed by a second electronic control device of the control system. FIG. 6 is a schematic diagram showing the configuration of a control system according to the third embodiment. In Figure 7, (A) is a diagram showing the processing flow executed by the information processing device of the control system of the third embodiment, (B) is a diagram showing the processing flow executed by the first execution device of the first electronic control device of the control system, and (C) is a diagram showing the processing flow executed by the second execution device of the first electronic control device. FIG. 8 is a schematic diagram showing the configuration of a control system according to the fourth embodiment. In Figure 9, (A) is a diagram showing a part of the processing flow executed by an information processing device of the control system of the fourth embodiment, (B) is a diagram showing a part of the processing flow executed by a first electronic control device of the control system, and (C) is a diagram showing a part of the processing flow executed by a second electronic control device of the control system.

First Embodiment
A first embodiment of the control system will be described below with reference to Figures 1 to 4. In this specification, the electronic control unit is referred to as "ECU.""ECU" is an abbreviation of "Electronic Control Unit."

FIG. 1 illustrates a vehicle 10 and a data center 100 provided outside the vehicle 10 .
<Data Center>
The data center 100 is configured to be able to transmit and receive various types of information to and from the vehicle 10 via the external vehicle network 200. That is, the data center 100 transmits and receives various types of information to and from the vehicle 10 by wireless communication.

The vehicle 10 is equipped with multiple ECUs, which will be described in more detail later. When update software is prepared to update the software in the storage device of one of the multiple ECUs, the data center 100 transmits the update software to the vehicle 10 via the external vehicle network 200. Of the multiple ECUs provided in the vehicle 10, the ECU whose software is to be updated is referred to as the "ECU to be updated."

<Vehicles>
The vehicle 10 includes a control system 15 and an actuator. The actuators of the vehicle 10 include a first actuator 11 and a second actuator 12. The first actuator 11 and the second actuator 12 operate to adjust the braking force generated in the vehicle 10.

<Control System>
The control system 15 includes a communication device 20 and an information processing device 30. The communication device 20 is an interface on the vehicle side for transmitting and receiving information to and from the data center 100.

The information processing device 30 is configured to be able to communicate with the communication device 20 via the local network 41. The local network 41 is a network for transmitting and receiving information only between the information processing device 30 and the communication device 20.

The information processing device 30 acquires the update software transmitted from the data center 100 to the vehicle 10 by wireless communication. Specifically, the information processing device 30 includes an execution device 31, a storage device 32, and a storage device 33. For example, the execution device 31 is a CPU, the storage device 32 is a non-volatile memory, and the storage device 33 is a volatile memory. The storage device 32 stores the software executed by the execution device 31. The storage device 33 temporarily stores the information transmitted from the communication device 20 via the local network 41. That is, when the data center 100 transmits information identifying the ECU to be updated and the update software to the vehicle 10, the communication device 20 receives the information transmitted by the data center 100. The communication device 20 then transmits the received information to the information processing device 30 via the local network 41. Then, the execution device 31 of the information processing device 30 stores the information received via the local network 41, i.e., the information identifying the ECU to be updated and the update software, in the storage device 33.

The control system 15 includes a global network 42 and multiple ECUs. The global network 42 is an in-vehicle network that connects the information processing device 30 and the multiple ECUs so that they can communicate with each other. For example, the global network 42 is a CAN bus. CAN is an abbreviation for "Controller Area Network."

The multiple ECUs include a first braking ECU 60 and a second braking ECU 70. The first braking ECU 60 and the second braking ECU 70 are ECUs that adjust the braking force generated in the vehicle 10. The first braking ECU 60 operates the first actuator 11. The second braking ECU 70 operates the second actuator 12. The multiple ECUs also include ECUs 50 other than the braking ECU 60.

The control system 15 is equipped with a local network 43 for transmitting and receiving information only between the first brake ECU 60 and the second brake ECU 70. The local network 43 is configured so that its communication speed is higher than the communication speed of the global network 42. Therefore, when transmitting and receiving information between the first brake ECU 60 and the second brake ECU 70, the control system 15 can use either the global network 42 or the local network 43.

<ECU>
Each of the ECUs includes an execution device, a storage device, and a storage unit. For example, the execution device is a CPU, the storage device is a non-volatile memory, and the storage device is a volatile memory. The storage device stores software executed by the execution device. The storage device temporarily stores the results of calculations by the execution device, etc.

In more detail, the execution device 61 of the first brake ECU 60 controls the first actuator 11 by executing software in the memory device 62. The execution device 61 temporarily stores the results of calculations performed to control the first actuator 11 in the storage device 63.

The execution device 71 of the second brake ECU 70 controls the second actuator 12 by executing software in the memory device 72. The execution device 71 temporarily stores the results of calculations performed to control the second actuator 12 in the storage device 73.

<Software update process>
In this embodiment, a method of updating software in a storage device provided in a brake ECU will be described. When the ECU to be updated is the first brake ECU 60, the first brake ECU 60 corresponds to the "first electronic control device" and the second brake ECU 70 corresponds to the "second electronic control device." In addition, the execution device 61 of the first brake ECU 60 corresponds to the "first execution device" and the execution device 71 of the second brake ECU 70 corresponds to the "second execution device."

With reference to Figures 2 and 3, a series of processing steps when updating the software of the storage device 62 of the first brake ECU 60 will be described. Figures 2(A) and 3(A) show the processing routine executed by the execution device 31 of the information processing device 30. Figures 2(B) and 3(B) show the processing routine executed by the execution device 61 of the first brake ECU 60. Figures 2(C) and 3(C) show the processing routine executed by the execution device 71 of the second brake ECU 70. In other words, it can be said that the processing routine shown in Figures 2(B) and 3(B) is the processing routine executed by the first electronic control device, and the processing routine shown in Figures 2(C) and 3(C) is the processing routine executed by the second electronic control device.

When the execution unit 31 of the information processing device 30 acquires the update software for the first brake ECU 60, it starts executing the processing routine shown in FIG. 2(A) and FIG. 3(A). In step S11, the execution unit 31 requests both the first brake ECU 60 and the second brake ECU 70 to change the control mode of the execution unit from normal mode to update mode. The normal mode is the control mode when controlling the actuator. The update mode is the control mode when updating the software of the storage device.

In the next step S13, the execution device 31 of the information processing device 30 determines whether or not it has received a notification from both the first brake ECU 60 and the second brake ECU 70 that the mode change has been completed. If the execution device 31 has received the notification from both the first brake ECU 60 and the second brake ECU 70 (S13: YES), the process proceeds to step S15. On the other hand, if the execution device 31 has not received the notification from at least one of the first brake ECU 60 and the second brake ECU 70 (S13: NO), the process returns to step S11. In other words, the execution device 31 continues to request the first brake ECU 60 and the second brake ECU 70 to change the mode until it receives the notification from both the first brake ECU 60 and the second brake ECU 70.

2(B) and 3(B), in step S101, the execution device 61 of the first brake ECU 60 judges whether or not a mode change request has been received from the information processing device 30. If the execution device 61 receives a mode change request (S101: YES), the process proceeds to step S103. On the other hand, if the execution device 61 has not received a mode change request (S101: NO), the execution device 61 repeats the judgment of step S101 until the request is received. In step S103, the execution device 61 resets itself, changes the control mode to the update mode, and restarts. Then, in step S105, the execution device 61 transmits a notification to the information processing device 30 that the change from the normal mode to the update mode has been completed. Specifically, the execution device 61 transmits the notification to the information processing device 30 via the global network 42. In the next step S107, the execution device 61 starts erasing the pre-update software from the storage device 62. The execution device 61 then transitions to step S109.

2(C) and 3(C), in step S201, the execution device 71 of the second brake ECU 70 judges whether or not a mode change request has been received from the information processing device 30. If the execution device 71 receives a mode change request (S201: YES), the process proceeds to step S203. On the other hand, if the execution device 71 has not received a mode change request (S201: NO), the execution device 71 repeats the judgment of step S201 until the request is received. In step S203, the execution device 71 resets itself, changes the control mode to the update mode, and restarts. Next, in step S205, the execution device 71 transmits a notification to the information processing device 30 that the change from the normal mode to the update mode has been completed. Specifically, the execution device 71 transmits the notification to the information processing device 30 via the global network 42. Then, the execution device 71 transitions the process to step S207.

2(A) and 3(A), in step S15, the execution unit 31 of the information processing device 30 sets a count M to 1. The execution unit 31 then divides the update software for the first brake ECU 60 into N pieces, where "N" is an integer equal to or greater than 3. In step S17, the execution unit 31 transmits the Mth update split software, which is one of the N pieces of update software, to the first brake ECU 60 via the global network 42. At this time, the execution unit 31 transmits the encrypted Mth update split software to the first brake ECU 60 via the global network 42. Note that if the count M is 1, the execution unit 31 transmits the encrypted first update split software to the first brake ECU 60.

In step S19, the execution unit 31 of the information processing device 30 increments the count M by 1. In the next step S21, the execution unit 31 transmits the Mth update split software, which is one of the N pieces of divided update software, to the second brake ECU 70 via the global network 42. At this time, the execution unit 31 transmits the encrypted Mth update split software to the second brake ECU 70 via the global network 42. The update split software transmitted to the second brake ECU 70 here is different from the update split software transmitted to the first brake ECU 60 in step S17. Note that if the count M is 2, the execution unit 31 transmits the encrypted second update split software to the second brake ECU 70.

In step S23, the execution unit 31 of the information processing device 30 increments the count M by 1. In the next step S25, the execution unit 31 determines whether the transmission of the update divided software has been completed. In this embodiment, if the count M is greater than the number of divisions N, the execution unit 31 determines that the transmission of N pieces of update divided software has been completed. On the other hand, if the count M is equal to or less than the number of divisions N, the execution unit 31 determines that the transmission of the update divided software has not been completed because there is update divided software among the N pieces of update divided software that has not yet been transmitted. Then, if the execution unit 31 has completed the transmission of the update divided software (S25: YES), the processing proceeds to step S27. On the other hand, if the execution unit 31 has not completed the transmission of the update divided software (S25: NO), the processing returns to step S17. That is, the execution unit 31 continues the transmission of the update divided software.

As shown in Figures 2 (B) and 3 (B), in step S109, the execution unit 61 of the first brake ECU 60 determines whether or not it has received the Mth update divided software from the global network 42. If the count M is 1, the execution unit 61 determines whether or not it has received the first update divided software. If the execution unit 61 has received the Mth update divided software (S109: YES), it transitions to step S111. On the other hand, if the execution unit 61 has not received the Mth update divided software (S109: NO), it repeats the determination in step S109 until it receives the Mth update divided software.

In step S111, the execution device 61 of the first brake ECU 60 decrypts the Mth update split software received from the information processing device 30. Then, in step S113, the execution device 61 writes the Mth update split software that it has decrypted into the storage device 62. For example, if the count M is 1, the execution device 61 decrypts the first update split software and writes the decrypted first update split software into the storage device 62. The execution device 61 then transitions to step S115.

As shown in Figures 2 (C) and 3 (C), in step S207, the execution unit 71 of the second brake ECU 70 determines whether or not it has received the Mth update divided software from the global network 42. If the count M is 2, the execution unit 71 determines whether or not it has received the second update divided software. If the execution unit 71 has received the Mth update divided software (S207: YES), the process proceeds to step S209. On the other hand, if the execution unit 71 has not received the Mth update divided software (S207: NO), the execution unit 71 repeatedly executes the determination in step S207 until it receives the Mth update divided software.

In step S209, the execution unit 71 of the second brake ECU 70 decrypts the Mth update split software received from the information processing device 30. Then, in step S211, the execution unit 71 transmits the decrypted Mth update split software to the first brake ECU 60 via the local network 43. For example, when the count M is 2, the execution unit 71 decrypts the second update split software and transmits the decrypted second update split software to the first brake ECU 60 via the local network 43. The execution unit 71 then transitions to step S213.

In step S213, the execution unit 71 of the second brake ECU 70 determines whether the software update of the storage device 62 of the first brake ECU 60 has been completed. If the update has been completed (S213: YES), the execution unit 71 proceeds to step S215. On the other hand, if the update has not been completed (S213: NO), the execution unit 71 returns the process to step S207. In other words, the execution unit 71 repeatedly executes the processes from step S207 to step S211 until the software update of the storage device 62 has been completed.

As shown in Figures 2 (B) and 3 (B), in step S115, the execution device 61 of the first brake ECU 60 determines whether or not it has received the decrypted Mth update split software from the second brake ECU 70 via the local network 43. If the execution device 61 has received the Mth update split software from the second brake ECU 70 (S115: YES), the processing proceeds to step S117. On the other hand, if the execution device 61 has not received the Mth update split software from the second brake ECU 70 (S115: NO), the execution device 61 repeatedly executes the determination of step S115 until it receives the Mth update split software from the second brake ECU 70. In step S117, the execution device 61 writes the decrypted Mth update split software received from the second brake ECU 70 to the storage device 62. For example, if the count M is 2, when the execution device 61 receives the decrypted second update divided software from the second brake ECU 70 via the local network 43, it writes the second update divided software to the storage device 62. After that, the execution device 61 transitions the process to step S119.

In step S119, the execution unit 61 of the first brake ECU 60 determines whether the software update of the storage device 62 has been completed. If the update has been completed (S119: YES), the execution unit 61 proceeds to step S121. On the other hand, if the update has not been completed (S119: NO), the execution unit 61 returns the process to step S109. In other words, the execution unit 61 repeatedly executes the processes from step S109 to step S117 until the software update of the storage device 62 is completed.

As shown in Figures 2(A) and 3(A), in step S27, the execution device 31 of the information processing device 30 requests both the first brake ECU 60 and the second brake ECU 70 to change the control mode of the execution device from the update mode to the normal mode. In step S29, the execution device 31 determines whether or not it has received a notification from both the first brake ECU 60 and the second brake ECU 70 that the mode change has been completed. If the execution device 31 has received the above notification from both the first brake ECU 60 and the second brake ECU 70 (S29: YES), it ends the processing routine shown in Figures 2(A) and 3(A). On the other hand, if the execution device 31 has not received the above notification from at least one of the first brake ECU 60 and the second brake ECU 70 (S29: NO), it returns the processing to step S27. That is, the execution device 31 continues to request the first brake ECU 60 and the second brake ECU 70 to change modes until the execution device 31 receives the above notification from both the first brake ECU 60 and the second brake ECU 70.

2(B) and 3(B), in step S121, the execution device 61 of the first brake ECU 60 judges whether or not a mode change request has been received from the information processing device 30. If the execution device 61 receives a mode change request (S121: YES), the process proceeds to step S123. On the other hand, if the execution device 61 has not received a mode change request (S121: NO), the execution device 61 repeats the judgment of step S121 until a request is received. In step S123, the execution device 61 resets itself, changes the control mode from the update mode to the normal mode, and restarts. Next, in step S125, the execution device 61 transmits a notification to the information processing device 30 that the change from the update mode to the normal mode has been completed. Thereafter, the execution device 61 ends the processing routine shown in FIG. 2(B) and FIG. 3(B).

2(C) and 3(C), in step S215, the execution device 71 of the second brake ECU 70 determines whether or not a mode change request has been received from the information processing device 30. If the execution device 71 receives a mode change request (S215: YES), the process proceeds to step S217. On the other hand, if the execution device 71 has not received a mode change request (S215: NO), the execution device 71 repeats the determination in step S215 until a request is received. In step S217, the execution device 71 resets itself, changes the control mode from the update mode to the normal mode, and restarts. Next, in step S219, the execution device 71 transmits a notification to the information processing device 30 that the change from the update mode to the normal mode has been completed. Thereafter, the execution device 71 ends the processing routine shown in FIG. 2(C) and FIG. 3(C).

In addition, in the control system 15, the software of the storage device 72 of the second brake ECU 70 may be updated. In this case, since the second brake ECU 70 is the ECU to be updated, the second brake ECU 70 corresponds to the "first electronic control device" and the first brake ECU 60 corresponds to the "second electronic control device." In addition, the execution device 71 of the second brake ECU 70 corresponds to the "first execution device" and the execution device 61 of the first brake ECU 60 corresponds to the "second execution device." Therefore, the execution device 71 of the second brake ECU 70 executes the processing routines shown in Figures 2(B) and 3(B), and the execution device 61 of the first brake ECU 60 executes the processing routines shown in Figures 2(C) and 3(C).

<Actions and Effects of the Present Embodiment>
4, a description will be given of an operation when updating the software in the storage device 62 of the first brake ECU 60. For ease of understanding, it is assumed here that the division number N of the divided software for updating is six.

When updating the software in the storage device 62, as shown in FIG. 4(C), in the first brake ECU 60, from timing t11, the pre-update software begins to be erased from the storage device 62. Then, in the information processing device 30, the update software is divided into six pieces. That is, six pieces of update divided software A1 to A6 are generated. Then, as shown in FIGS. 4(A) and (B), from timing t12, the encrypted first update divided software A1 is transmitted to the first brake ECU 60 via the global network 42. Next, as shown in FIGS. 4(A) and (D), in the information processing device 30, from timing t13, the encrypted second update divided software A2 is transmitted to the second brake ECU 70 via the global network 42.

When the first brake ECU 60 receives the first update divided software A1, the first update divided software A1 is decrypted. In the example shown in FIG. 4, the process of deleting the update divided software is executed until timing t15. Therefore, from timing t15, writing of the decrypted first update divided software A1 to the storage device 62 begins.

On the other hand, when the second brake ECU 70 receives the second update divided software A2 via the global network 42, the second brake ECU 70 decodes the second update divided software A2. That is, even while the first brake ECU 60 is decoding the first update divided software A1, the second brake ECU 70 can decode the second update divided software A2. When the second brake ECU 70 decodes the second update divided software A2, as shown in FIGS. 4(B) and (D), the decoded second update divided software A2 is transmitted to the first brake ECU 60 via the local network 43 from timing t14. As shown in FIG. 4(C), the first brake ECU 60 writes the first update divided software A1 to the storage device 62, and then starts writing the second update divided software A2 to the storage device 62.

When the writing of the second update divided software A2 to the storage device 62 in the first brake ECU 60 is completed, the information processing device 30 transmits the encrypted third update divided software A3 to the first brake ECU 60. At this time, the third update divided software A3 is also transmitted to the first brake ECU 60 via the global network 42. Next, the information processing device 30 transmits the encrypted fourth update divided software A4 to the second brake ECU 70. At this time, the fourth update divided software A4 is also transmitted to the second brake ECU 70 via the global network 42.

When the first brake ECU 60 receives the third update divided software A3, the third update divided software A3 is decrypted. Then, the decrypted third update divided software A3 is written to the storage device 62.

When the second brake ECU 70 receives the fourth update divided software A4, it decodes the fourth update divided software A4. That is, even while the first brake ECU 60 is decoded the third update divided software A3, the second brake ECU 70 can decode the fourth update divided software A4. When the fourth update divided software A4 is decoded, the decoded fourth update divided software A4 is transmitted to the first brake ECU 60 via the local network 43. In the first brake ECU 60, the third update divided software A3 is written to the storage device 62, and then the fourth update divided software A4 is written to the storage device 62.

When the first brake ECU 60 has completed writing the fourth update divided software A4 to the storage device 62, the information processing device 30 transmits the encrypted fifth update divided software A5 to the first brake ECU 60. At this time, the fifth update divided software A5 is also transmitted to the first brake ECU 60 via the global network 42. After the fifth update divided software A5 is transmitted, the information processing device 30 transmits the encrypted sixth update divided software A6 to the second brake ECU 70. At this time, the sixth update divided software A6 is also transmitted to the second brake ECU 70 via the global network 42.

When the first brake ECU 60 receives the fifth update divided software A5, the fifth update divided software A5 is decrypted. Then, the decrypted fifth update divided software A5 is written to the storage device 62.

When the second brake ECU 70 receives the sixth update divided software A6, it decodes the sixth update divided software A6. That is, even while the first brake ECU 60 is decoded the fifth update divided software A5, the second brake ECU 70 can decode the sixth update divided software A6. When the sixth update divided software A6 is decoded, the decoded sixth update divided software A6 is transmitted to the first brake ECU 60 via the local network 43. In the first brake ECU 60, the fifth update divided software A5 is written to the storage device 62, and then the sixth update divided software A6 is written to the storage device 62. This completes the software update of the storage device 62.

In this embodiment, the following effects can be obtained.
(1-1) When the information processing device 30 transmits the first update divided software A1 to the first brake ECU 60, it transmits the next update divided software (in this case, the second update divided software A2) to the second brake ECU 70. Then, while the execution device 61 of the first brake ECU 60 is decrypting the first update divided software A1, the execution device 71 of the second brake ECU 70 can decrypt the second update divided software A2. That is, the information processing device 30 does not need to wait for the transmission of the second update divided software A2 until the decoding of the first update divided software A1 is completed. That is, the time during which the information processing device 30 is in a state of waiting for the transmission of the update divided software can be shortened. Therefore, when updating the software of the storage device 62 of the first brake ECU 60, the control system 15 can suppress the time required for updating the software from becoming long.

(1-2) In the control system 15,

multiple execution devices

61, 71 share the task of decrypting the update divided software. Therefore, the burden on the execution devices during software updates can be reduced compared to when only one execution device decrypts N pieces of update divided software.

(1-3) The second brake ECU 70 transmits the decrypted divided update software to the first brake ECU 60 via the local network 43. This reduces the time required for transmission compared to transmitting the divided update software between the second brake ECU 70 and the first brake ECU 60 via the global network 42. This contributes to reducing the time required for software updates.

Second Embodiment
A second embodiment of the control system will be described with reference to Fig. 5. The second embodiment differs from the first embodiment in that the update division software is not directly transmitted from the information processing device to the second electronic control unit. In the following description, the differences from the first embodiment will be mainly described, and the same reference numerals will be used to designate the same components as those in the first embodiment, and duplicated description will be omitted.

With reference to Figure 5, a series of processing steps when updating software in the memory device 62 of the first brake ECU 60 will be described. Figure 5(A) shows a portion of the processing routine executed by the execution device 31 of the information processing device 30. Figure 5(B) shows a portion of the processing routine executed by the execution device 61 of the first brake ECU 60. Figure 5(C) shows a portion of the processing routine executed by the execution device 71 of the second brake ECU 70. In other words, it can be said that the processing routine shown in Figure 5(B) is a portion of the processing routine executed by the first electronic control device, and the processing routine shown in Figure 5(C) is a portion of the processing routine executed by the second electronic control device.

When the execution device 31 of the information processing device 30 acquires the update software for the first brake ECU 60, it sequentially executes the processes of steps S11 and S13 shown in FIG. 2(A) and FIG. 3(A). Next, in step S15A as shown in FIG. 5(A), the execution device 31 of the information processing device 30 sets a count M to 1. Then, the execution device 31 divides the update software for the first brake ECU 60 into N pieces. "N" is an integer equal to or greater than 3. Then, in step S17A, the execution device 31 transmits the Mth update divided software, which is one of the N pieces of update software, to the first brake ECU 60 via the global network 42. At this time, the execution device 31 transmits the encrypted Mth update divided software to the first brake ECU 60 via the global network 42. Note that if the count M is 1, the execution device 31 transmits the encrypted first update divided software to the first brake ECU 60.

In step S19A, the execution unit 31 of the information processing device 30 increments the count M by 1. In the next step S21A, the execution unit 31 transmits the Mth update split software, which is one of the divided update software, to the first brake ECU 60 via the global network 42. At this time, the execution unit 31 transmits the encrypted Mth update split software to the first brake ECU 60 via the global network 42. The update split software transmitted to the first brake ECU 60 here is different from the update split software transmitted to the first brake ECU 60 in step S17A. Note that if the count M is 2, the execution unit 31 transmits the encrypted second update split software to the second brake ECU 70.

In step S23A, the execution unit 31 of the information processing device 30 increments the counter M by 1. In the next step S25A, the execution unit 31 determines whether or not the transmission of the N pieces of update divided software has been completed, similar to step S25 shown in FIG. 2(A) and FIG. 3(A). If there is any update divided software among the N pieces of update divided software that has not yet been transmitted (S25A: NO), the execution unit 31 returns the process to step S17A. That is, the execution unit 31 continues transmitting the update divided software. On the other hand, if the execution unit 31 has completed the transmission of the N pieces of update divided software (S25A: YES), the process proceeds to step S27 shown in FIG. 2(A) and FIG. 3(A). The process flow from step S27 onwards is the same as in the first embodiment.

The execution device 61 of the first brake ECU 60 sequentially executes the processes from step S101 to step S107 shown in FIG. 2(B) and FIG. 3(B). Then, in step S131 as shown in FIG. 5(B), the execution device 61 judges whether or not the Mth update divided software transmitted by the information processing device 30 in step S17A has been received from the global network 42. If the count M is 1, the execution device 61 judges whether or not the first update divided software A1 has been received. If the execution device 61 has received the Mth update divided software (S131: YES), the process proceeds to step S133. On the other hand, if the execution device 61 has not received the Mth update divided software (S131: NO), the execution device 61 repeatedly executes the judgment of step S131 until the Mth update divided software is received.

In step S133, the execution unit 61 of the first brake ECU 60 determines whether or not it has received the Mth update divided software transmitted by the information processing unit 30 in step S21A from the global network 42. If the count M is 2, the execution unit 61 determines whether or not it has received the second update divided software A2. If the execution unit 61 has received the Mth update divided software (S133: YES), it transitions to step S135. On the other hand, if the execution unit 61 has not received the Mth update divided software (S133: NO), it repeats the determination of step S133 until it receives the Mth update divided software.

In step S135, the execution device 61 of the first brake ECU 60 transmits the Mth update divided software received in step S133 to the second brake ECU 70 via the local network 43. For example, if the first brake ECU 60 receives the first update divided software A1 and the second update divided software A2, the execution device 61 transmits only the second update divided software A2 of the first update divided software A1 and the second update divided software A2 to the second brake ECU 70 via the local network 43.

In step S137, the execution device 61 of the first brake ECU 60 decrypts the Mth update split software received in step S131. That is, of the two update split software received from the information processing device 30, the execution device 61 decrypts the update split software that has not been transmitted to the second brake ECU 70. In the next step S139, the execution device 61 writes the Mth update split software that it has decrypted into the storage device 62. The execution device 61 then transitions to step S141.

The execution unit 71 of the second brake ECU 70 sequentially executes the processes from step S201 to S205 shown in FIG. 2(C) and FIG. 3(C). Then, in step S231 as shown in FIG. 5(C), the execution unit 71 judges whether or not the Mth update divided software has been received via the local network 43. If the count M is 2, the execution unit 71 judges whether or not the second update divided software A2 has been received. The update divided software received here is the update divided software transmitted by the information processing device 30 in step S21A. If the execution unit 71 receives the Mth update divided software (S231: YES), the process proceeds to step S233. On the other hand, if the execution unit 71 has not received the Mth update divided software (S231: NO), the execution unit 71 repeatedly executes the judgment of step S231 until the Mth update divided software is received.

In step S233, the execution device 71 of the second brake ECU 70 decrypts the received Mth update split software. Then, in step S235, the execution device 71 transmits the decrypted Mth update split software to the first brake ECU 60 via the local network 43. For example, if the count M is 2, the execution device 71 decrypts the second update split software A2 and transmits the decrypted second update split software A2 to the first brake ECU 60 via the local network 43. The execution device 71 then transitions to step S237.

In step S237, the execution unit 71 of the second brake ECU 70 determines whether the software update of the storage device 62 of the first brake ECU 60 has been completed. If the update has not been completed (S237: NO), the execution unit 71 returns the process to step S231. That is, the execution unit 71 repeatedly executes the processes from step S231 to step S235 until the software update of the storage device 62 is completed. On the other hand, if the update has been completed (S237: YES), the execution unit 71 transitions the process to step S215 shown in FIG. 2(C) and FIG. 3(C). The process flow from step S215 onwards is the same as in the first embodiment.

As shown in FIG. 5(B), in step S141, the execution device 61 of the first brake ECU 60 determines whether or not it has received the Mth update divided software from the second brake ECU 70 via the local network 43. If the execution device 61 has received the Mth update divided software (S141: YES), the process proceeds to step S143. On the other hand, if the execution device 61 has not received the Mth update divided software (S141: NO), the execution device 61 repeatedly executes the determination of step S141 until it receives the Mth update divided software.

In step S143, the execution device 61 of the first brake ECU 60 writes the Mth update divided software received in step S141 to the storage device 62. That is, the execution device 61 writes the decoded Mth update divided software transmitted from the second brake ECU 70 to the storage device 62. Then, in step S145, the execution device 61 determines whether the software update of the storage device 62 is complete. If the update is not complete (S145: NO), the execution device 61 returns the process to step S131. That is, the execution device 61 repeatedly executes the processes from step S131 to step S143 until the software update of the storage device 62 is complete. On the other hand, if the update is complete (S145: YES), the execution device 61 transitions the process to step S121 shown in FIG. 2(B) and FIG. 3(B). The process flow from step S121 onwards is the same as that in the first embodiment.

<Actions and Effects of the Present Embodiment>
Among the functions and effects of this embodiment, the following description will focus on the differences from the first embodiment.
When updating the software in the storage device 62 of the first brake ECU 60, the information processing device 30 divides the update software into N pieces. The information processing device 30 transmits the N pieces of update divided software to the first brake ECU 60, which is the ECU to be updated, via the global network 42. In this embodiment, two pieces of update divided software are transmitted to the first brake ECU 60 via the global network 42.

The first brake ECU 60 transmits one of the two pieces of update split software received to the second brake ECU 70 via the local network 43. The first brake ECU 60 also decrypts the update split software that was not transmitted to the second brake ECU 70. The update split software decrypted by the execution device 61 is then written to the storage device 62.

Meanwhile, the second brake ECU 70 decodes the update split software received via the local network 43. The decoded update split software is then sent to the first brake ECU 60 via the local network 43. The first brake ECU 60 writes the decoded update split software received via the local network 43 to the storage device 62.

By repeating this series of processes, the software in the storage device 62 of the first brake ECU 60 is updated.
In this embodiment, while the first update divided software A1 is being decoded in the first brake ECU 60, the second update divided software A2 can also be decoded in the second brake ECU 70. That is, the information processing device 30 does not need to wait for the transmission of the second update divided software A2 until the decoding of the first update divided software A1 is completed. That is, the time during which the information processing device 30 is in a state of waiting for the transmission of update divided software can be shortened. Therefore, when updating the software of the storage device 62 of the first brake ECU 60, the control system 15 can prevent the time required for the software update from becoming long.

Furthermore, in this embodiment, the information processing device 30 does not need to directly transmit some of the N pieces of divided software updates to the second brake ECU 70 that is not the ECU to be updated.
Furthermore, in this embodiment, it is possible to obtain effects equivalent to the effects (1-2) and (1-3) of the first embodiment.

Third Embodiment
A third embodiment of the control system will be described with reference to Figures 6 and 7. The third embodiment differs from the first embodiment in that the ECU to be updated is a multi-core processor equipped with multiple execution devices. In the following description, differences from the above embodiments will be mainly described, and the same reference numerals will be used to designate the same components as those in the above embodiments, and duplicated descriptions will be omitted.

<Control System>
The control system 15B of this embodiment will be described with reference to FIG.
The control system 15B includes a communication device 20, an information processing device 30, and a plurality of ECUs. The plurality of ECUs are configured to be able to communicate with the information processing device 30 via a global network 42. The plurality of ECUs include an ECU 80 and an ECU 50. For example, the ECU 80 is a braking ECU that controls an actuator to adjust the braking force generated in the vehicle 10.

The ECU 80 is a multi-core processor. The ECU 80 includes a first execution unit 81A, a second execution unit 81B, a memory device 82, and a storage unit 83. For example, the first execution unit 81A and the second execution unit 81B are CPUs, the memory device 82 is a non-volatile memory, and the storage device 83 is a volatile memory. The storage unit 82 stores software executed by the first execution unit 81A and the second execution unit 81B.

<Software update process>
A flow of a series of processes for updating software in the storage device 82 of the ECU 80 will be described with reference to Fig. 7. Fig. 7(A) shows a processing routine executed by the execution unit 31 of the information processing device 30. Fig. 7(B) shows a processing routine executed by the first execution unit 81A of the ECU 80. Fig. 7(C) shows a processing routine executed by the second execution unit 81B of the ECU 80.

When the execution unit 31 of the information processing device 30 acquires the update software for the ECU 80, it starts executing the processing routine shown in FIG. 7(A). In step S41, the execution unit 31 requests the ECU 80 to change the control mode of the execution unit from the normal mode to the update mode. In the next step S43, the execution unit 31 determines whether it has received both a first notification that the control mode of the first execution unit 81A has been changed to the update mode and a second notification that the control mode of the second execution unit 81B has been changed to the update mode. If the execution unit 31 has received both the first notification and the second notification (S43: YES), it proceeds to step S45. On the other hand, if the execution unit 31 has not received at least one of the first notification and the second notification (S43: NO), it returns the processing to step S41. That is, the execution unit 31 continues to request the ECU 80 to change the mode until it receives both the first notification and the second notification.

7B, in step S151A, the first execution unit 81A of the ECU 80 judges whether the ECU 80 has received a mode change request from the information processing device 30. If the ECU 80 has received a mode change request (S151A: YES), the first execution unit 81A shifts the process to step S153A. On the other hand, if the ECU 80 has not received a mode change request (S151A: NO), the first execution unit 81A repeats the judgment of step S151A until the ECU 80 receives the request. In step S153A, the first execution unit 81A resets itself, changes the control mode to the update mode, and restarts. Next, in step S155A, the first execution unit 81A transmits a first notification to the information processing device 30 indicating that the change from the normal mode to the update mode has been completed. In the next step S157A, the first execution unit 81A starts erasing the pre-update software from the storage device 82. The first execution unit 81A then transitions to step S159A.

As shown in FIG. 7(C), in step S151B, the second execution unit 81B of the ECU 80 judges whether the ECU 80 has received a mode change request from the information processing device 30. If the ECU 80 has received a mode change request (S151B: YES), the second execution unit 81B shifts the process to step S153B. On the other hand, if the ECU 80 has not received a mode change request (S151B: NO), the second execution unit 81B repeats the judgment of step S151B until the ECU 80 receives the request. In step S153B, the second execution unit 81B resets itself, changes the control mode to the update mode, and restarts. Next, in step S155B, the second execution unit 81B transmits a second notification to the information processing device 30 indicating that the change from the normal mode to the update mode has been completed. Then, the second execution unit 81B shifts the process to step S159B.

As shown in FIG. 7(A), in step S45, the execution unit 31 of the information processing device 30 sets a count M to 1. The execution unit 31 then divides the update software for the ECU 80 into N pieces, where "N" is an integer equal to or greater than 3. Then, in step S47, the execution unit 31 transmits the Mth update divided software, which is one of the divided update software, to the ECU 80 via the global network 42. At this time, the execution unit 31 transmits the encrypted Mth update divided software to the ECU 80 via the global network 42. Note that if the count M is 1, the execution unit 31 transmits the encrypted first update divided software A1 to the ECU 80.

In step S49, the execution unit 31 of the information processing device 30 increments the count M by 1. In the next step S51, the execution unit 31 transmits the Mth update split software, which is one of the divided update software, to the ECU 80 via the global network 42. At this time, the execution unit 31 transmits the encrypted Mth update split software to the ECU 80 via the global network 42. The update split software transmitted to the ECU 80 here is different from the update split software transmitted to the ECU 80 in step S47. Note that if the count M is 2, the execution unit 31 transmits the encrypted second update split software A2 to the ECU 80.

In step S53, the execution unit 31 of the information processing device 30 increments the counter M by 1. In the next step S55, the execution unit 31 determines whether or not the transmission of the update split software has been completed, similar to step S25 shown in Figures 2 (A) and 3 (A). If the transmission of the update split software has been completed (S55: YES), the execution unit 31 proceeds to step S57. On the other hand, if the transmission of the update split software has not been completed (S55: NO), the execution unit 31 returns the process to step S47. That is, the execution unit 31 continues transmitting the update split software to the ECU 80.

As shown in FIG. 7B, in step S159A, the first execution unit 81A of the ECU 80 determines whether the ECU 80 has received the Mth update divided software. The update divided software received here is the Mth update divided software transmitted by the information processing device 30 in step S47. If the count M is 1, the first execution unit 81A determines whether the first update divided software has been received. If the ECU 80 has received the Mth update divided software (S159A: YES), the first execution unit 81A transitions the process to step S161A. On the other hand, if the ECU 80 has not received the Mth update divided software (S159A: NO), the first execution unit 81A repeats the determination of step S159A until the Mth update divided software is received.

In step S161A, the first execution unit 81A of the ECU 80 decrypts the Mth update split software received by the ECU 80 in step S159A. Then, in step S163A, the first execution unit 81A writes the Mth update split software that it has decrypted to the storage device 82. For example, if the count M is 1, the first execution unit 81A decrypts the first update split software A1 and writes the decrypted first update split software A1 to the storage device 82.

In step S165A, the first execution unit 81A of the ECU 80 determines whether the software update of the storage device 82 is complete. If the update is complete (S165A: YES), the first execution unit 81A proceeds to step S167A. On the other hand, if the update is not complete (S165A: NO), the first execution unit 81A returns to step S159A. In other words, the first execution unit 81A repeatedly executes steps S159A to S163A until the software update of the storage device 82 is complete.

As shown in FIG. 7(C), in step S159B, the second execution unit 81B of the ECU 80 determines whether the ECU 80 has received the Mth update split software. The update split software received here is the Mth update split software transmitted by the information processing device 30 in step S51. If the count M is 2, the second execution unit 81B determines whether the ECU 80 has received the second update split software. If the ECU 80 has received the Mth update split software (S159B: YES), the second execution unit 81B transitions the process to step S161B. On the other hand, if the ECU 80 has not received the Mth update split software (S159B: NO), the second execution unit 81B repeatedly executes the determination of step S159B until the ECU 80 receives the Mth update split software.

In step S161B, the second execution unit 81B of the ECU 80 decrypts the Mth update split software received in step S159B. Then, in step S161B, the second execution unit 81B writes the Mth update split software that it has decrypted to the storage device 62. For example, if the count M is 2, the second execution unit 81B decrypts the second update split software A2 and writes the decrypted second update split software A2 to the storage device 62.

In step S165B, the second execution unit 81B of the ECU 80 determines whether the software update of the storage device 82 has been completed. If the update has been completed (S165B: YES), the second execution unit 81B proceeds to step S167B. On the other hand, if the update has not been completed (S165B: NO), the second execution unit 81B returns the process to step S159B. In other words, the second execution unit 81B repeatedly executes the processes from step S159B to step S163B until the software update of the storage device 82 is completed.

7(A), in step S57, the execution unit 31 of the information processing device 30 requests the ECU 80 to change the control mode of the execution unit from the update mode to the normal mode. In step S59, the execution unit 31 determines whether or not it has received both the third notification that the control mode of the first execution unit 81A has been changed to the normal mode and the fourth notification that the control mode of the second execution unit 81B has been changed to the normal mode. If the execution unit 31 has received both the third notification and the fourth notification from the ECU 80 (S59: YES), it ends the processing routine shown in FIG. 7(A). On the other hand, if the execution unit 31 has not received at least one of the third notification and the fourth notification (S59: NO), it returns the processing to step S57. That is, the execution unit 31 continues to request the ECU 80 to change the mode until it receives both the third notification and the fourth notification.

As shown in FIG. 7(B), when the ECU 80 receives a request to change modes, the first execution unit 81A of the ECU 80 transitions to step S167A. In step S167A, the first execution unit 81A resets itself, changes the control mode from update mode to normal mode, and restarts. Then, in step S169A, the first execution unit 81A transmits a third notification to the information processing device 30 indicating that the change from update mode to normal mode has been completed. Thereafter, the first execution unit 81A ends the processing routine shown in FIG. 7(B).

As shown in FIG. 7(C), when the ECU 80 receives a request to change the mode, the second execution unit 81B of the ECU 80 transitions to step S167B. In step S167B, the second execution unit 81B resets itself, changes the control mode from the update mode to the normal mode, and restarts. Then, in step S169B, the second execution unit 81B transmits a fourth notification to the information processing device 30 indicating that the change from the update mode to the normal mode has been completed. Thereafter, the second execution unit 81B ends the processing routine shown in FIG. 7(C).

<Actions and Effects of the Present Embodiment>
Among the functions and effects of this embodiment, the following description will focus on the differences from the first embodiment.
When updating software in the storage device 82 of the ECU 80, the information processing device 30 divides the update software into N pieces. The information processing device 30 transmits the N pieces of update divided software to the ECU 80 via the global network 42. In this embodiment, two pieces of update divided software are transmitted to the ECU 80 via the global network 42.

In the ECU 80, one of the two received update split software is processed by the first execution unit 81A, while the remaining one is processed by the second execution unit 81B. That is, the first execution unit 81A decrypts one of the two update split software and writes it to the storage device 82. The second execution unit 81B decrypts the other of the two update split software and writes it to the storage device 82. By repeating this series of processes, the software in the storage device 82 of the ECU 80 is updated.

In this embodiment, the ECU 80, which is the ECU to be updated, is a multi-core processor. Therefore, for example, while the first execution unit 81A is decrypting the first update divided software A1, the second execution unit 81B can update the second update divided software A2. Therefore, the information processing device 30 does not have to wait for the transmission of the second update divided software A2 until the decryption of the first update divided software A1 is complete. In other words, the time that the information processing device 30 is in a state waiting for the transmission of update divided software can be shortened. Therefore, when updating software in the storage device 82 of the ECU 80, the control system 15B can prevent the time required for the software update from becoming long.

Furthermore, in this embodiment, it is not necessary to use multiple ECUs to decrypt N pieces of divided software for updating. Therefore, it is not necessary to communicate using a local network between the ECU to be updated and the ECU that assists in updating the software.

Fourth Embodiment
A fourth embodiment of the control system will be described with reference to Figures 8 and 9. In the following description, differences from the above-described embodiments will be mainly described, and the same components as those in the above-described embodiments will be denoted by the same reference numerals and will not be described again.

<Control System>
A control system 15C of this embodiment will be described with reference to FIG.
The control system 15C includes a communication device 20, an information processing device 30, and a plurality of ECUs. The plurality of ECUs are configured to be able to communicate with the information processing device 30 via a global network 42. The plurality of ECUs include a first braking ECU 60 and a second braking ECU 90. The first braking ECU 60 operates the first actuator 11. The second braking ECU 90 operates the second actuator 12. The plurality of ECUs may include ECUs other than the first braking ECU 60 and the second braking ECU 90.

The first brake ECU 60 and the second brake ECU 90 can transmit and receive various information via the local network 43C. The communication speed of the local network 43C is higher than the communication speed of the global network 42.

The first brake ECU 60 includes an execution device 61 , a memory device 62 , and a storage device 63 .
The second brake ECU 90 includes an execution device 91, a storage device 92, and a storage device 93. For example, the execution device 91 is a CPU, the storage device 92 is a non-volatile memory, and the storage device 93 is a volatile memory. The storage device 92 is divided into a first storage unit 921 and a second storage unit 922. The first storage unit 921 stores software executed by the execution device 91. The second storage unit 922 does not store software executed by the execution device 91.

<Software update process>
In this embodiment, a method of updating software in a storage device provided in a brake ECU will be described. When the ECU to be updated is the first brake ECU 60, the first brake ECU 60 corresponds to the "first electronic control device", and the second brake ECU 90 corresponds to the "second electronic control device". In addition, the execution device 61 of the first brake ECU 60 corresponds to the "first execution device", and the execution device 91 of the second brake ECU 90 corresponds to the "second execution device".

With reference to Figure 9, the flow of a series of processes when updating the software of the memory device 62 of the first brake ECU 60 will be described. Figure 9 (A) shows a part of the processing routine executed by the execution device 31 of the information processing device 30. Figure 9 (B) shows a part of the processing routine executed by the execution device 61 of the first brake ECU 60. Figure 9 (C) shows a part of the processing routine executed by the execution device 91 of the second brake ECU 90. In other words, the processing routine shown in Figure 9 (B) is a part of the processing routine executed by the first electronic control device, and the processing routine shown in Figure 9 (C) is a part of the processing routine executed by the second electronic control device.

When the execution unit 31 of the information processing device 30 acquires the update software for the first brake ECU 60, it starts executing the processing routine shown in FIG. 9(A). In step S81, the execution unit 31 requests both the first brake ECU 60 and the second brake ECU 90 to change the control mode of the execution unit from the normal mode to the update mode.

In the next step S83, the execution device 31 of the information processing device 30 determines whether or not it has received a notification from both the first brake ECU 60 and the second brake ECU 90 that the mode change has been completed. If the execution device 31 has received the notification from both the first brake ECU 60 and the second brake ECU 90 (S83: YES), the process proceeds to step S85. On the other hand, if the execution device 31 has not received the notification from at least one of the first brake ECU 60 and the second brake ECU 90 (S83: NO), the process returns to step S81. In other words, the execution device 31 continues to request the first brake ECU 60 and the second brake ECU 90 to change the mode until it receives the notification from both the first brake ECU 60 and the second brake ECU 90.

As shown in FIG. 9B, in step S181, the execution device 61 of the first brake ECU 60 judges whether or not a mode change request has been received from the information processing device 30. If the execution device 61 receives a mode change request (S181: YES), the process proceeds to step S183. On the other hand, if the execution device 61 has not received a mode change request (S181: NO), the execution device 61 repeats the judgment of step S181 until a request is received. In step S183, the execution device 61 resets itself, changes the control mode to the update mode, and restarts. Then, in step S185, the execution device 61 transmits a notification to the information processing device 30 that the change from the normal mode to the update mode has been completed. In the next step S187, the execution device 61 starts erasing the pre-update software from the storage device 62. After that, the execution device 61 proceeds to step S189.

As shown in FIG. 9(C), in step S281, the execution device 91 of the second brake ECU 90 determines whether or not a mode change request has been received from the information processing device 30. If the execution device 91 receives a mode change request (S281: YES), the process proceeds to step S283. On the other hand, if the execution device 91 has not received a mode change request (S281: NO), the execution device 91 repeatedly executes the determination of step S281 until a request is received. In step S283, the execution device 91 resets itself, changes the control mode to the update mode, and restarts. Next, in step S285, the execution device 91 transmits a notification to the information processing device 30 that the change from normal mode to update mode has been completed. Then, the execution device 91 proceeds to step S287.

As shown in FIG. 9 (A), in step S85, the execution unit 31 of the information processing device 30 sets a counter M to 1. The execution unit 31 then divides the update software for the first brake ECU 60 into N pieces, where "N" is an integer equal to or greater than 3. Then, in step S87, the execution unit 31 transmits the Mth update divided software, which is one of the N pieces of update software, to the second brake ECU 90 via the global network 42. At this time, the execution unit 31 transmits the encrypted Mth update divided software to the second brake ECU 90 via the global network 42.

In step S89, the execution unit 31 of the information processing device 30 increments the counter M by 1. In the next step S91, the execution unit 31 determines whether the transmission of the update split software has been completed, similar to step S25 shown in FIG. 2(A) and FIG. 3(A). If the transmission of the update split software has been completed (S91: YES), the execution unit 31 proceeds to step S27 shown in FIG. 2(A) and FIG. 3(A). The flow of processing from step S27 onwards is the same as in the first embodiment. On the other hand, if the transmission of the update split software has not been completed (S91: NO), the execution unit 31 returns the processing to step S87. That is, the execution unit 31 continues transmitting the update split software to the second brake ECU 90.

As shown in FIG. 9(C), in step S287, the execution device 91 of the second brake ECU 90 determines whether or not the Mth update divided software has been received from the global network 42. If the execution device 91 has received the Mth update divided software (S287: YES), the execution device 91 writes the Mth update divided software to the second storage unit 922 and proceeds to step S289. On the other hand, if the execution device 91 has not received the Mth update divided software (S287: NO), the execution device 91 repeatedly executes the determination of step S287 until the Mth update divided software is received.

In step S289, the execution device 91 of the second brake ECU 90 decrypts the Mth update divided software stored in the second storage unit 922. Then, in step S291, the execution device 91 transmits the decrypted Mth update divided software to the first brake ECU 60 via the local network 43. Then, the execution device 91 transitions the process to step S293.

In step S293, the execution unit 91 of the second brake ECU 90 determines whether the software update of the storage device 62 of the first brake ECU 60 has been completed. If the update has not been completed (S293: NO), the execution unit 91 returns the process to step S287. That is, the execution unit 91 repeatedly executes the processes from step S287 to step S291 until the software update of the storage device 62 is completed. On the other hand, if the update has been completed (S293: YES), the execution unit 91 proceeds to step S215 shown in Figures 2 (C) and 3 (C). The process flow from step S215 onwards is the same as in the first embodiment.

As shown in FIG. 9B, in step S189, the execution device 61 of the first brake ECU 60 determines whether or not it has received the decoded Mth update divided software from the second brake ECU 90 via the local network 43. If the execution device 61 has received the Mth update divided software from the second brake ECU 90 (S189: YES), the process proceeds to step S191. On the other hand, if the execution device 61 has not received the Mth update divided software from the second brake ECU 90 (S189: NO), the execution device 61 repeats the determination of step S189 until it receives the Mth update divided software from the second brake ECU 90. In step S191, the execution device 61 writes the decoded Mth update divided software received from the second brake ECU 90 to the storage device 62. Then, the execution device 61 proceeds to step S193.

In step S193, the execution unit 61 of the first brake ECU 60 determines whether the software update of the storage device 62 has been completed. If the update has not been completed (S193: NO), the execution unit 61 returns the process to step S189. That is, the execution unit 61 repeatedly executes the processes of steps S189 and S191 until the software update of the storage device 62 is completed. On the other hand, if the update has been completed (S193: YES), the execution unit 61 proceeds to step S121 shown in Figures 2 (B) and 3 (B). The process flow from step S121 onwards is the same as in the first embodiment.

<Actions and Effects of the Present Embodiment>
The second brake ECU 90 corresponding to the second electronic control device includes not only the first storage unit 921 but also the second storage unit 922 as a storage unit. Therefore, the information processing device 30 transmits the encrypted update software to the second brake ECU 90 via the global network 42. In the second brake ECU 90, the received update software is stored in the second storage unit 922. When updating the software of the storage unit 62 of the first brake ECU 60, the execution device 91 of the second brake ECU 90 decrypts the update software stored in the second storage unit 922 and transmits the decrypted update software to the first brake ECU 60 via the local network 43C. In the first brake ECU 60, the decrypted update software received via the local network 43C is written to the storage unit 62.

Here, the communication speed of the local network 43C is higher than the communication speed of the global network 42.
Therefore, the time required to update the software in the storage device 62 of the first brake ECU 60 can be shortened by the time required to transmit the update software to the first brake ECU 60 via the local network 43 .

<Example of change>
The above-described embodiments may be modified as follows: The above-described embodiments and the following modifications may be combined with each other to the extent that they are not technically inconsistent.

- In the fourth embodiment, if the storage capacity of the second storage unit 922 of the second brake ECU 90 is large, the information processing device 30 may transmit the update software to the second brake ECU 90 without dividing it.

In the above embodiments, the division number N, which is the number into which the information processing device 30 divides the update software, may be any even number other than 2 as long as it is equal to or greater than 2.
In the above embodiments, the division number N, which is the number into which the information processing device 30 divides the update software, may be an odd number equal to or greater than 2. For example, in the first embodiment, while the execution device 71 of the second brake ECU 70 is repeating the determination of step S207, the information processing device 30 may complete transmission of N pieces of update divided software. In such a case, the execution device 71 of the second brake ECU 70 may transition to step S215 in response to a request from the information processing device 30 to return the control mode to the normal mode.

- In the third embodiment, the number of execution devices provided in the ECU 80 may be three or more. For example, if the ECU 80 also includes a third execution device, while the first execution device 81A is decrypting the first update divided software A1 and the second execution device 81B is decrypting the second update divided software A2, the third execution device can also decrypt the third update divided software A3.

- In the second embodiment, the number of ECUs that can communicate with the ECU to be updated (first ECU) via the local network is only one. However, the number of ECUs that can communicate with the first ECU via the local network may be two or more. An example will be described in which a second ECU and a third ECU are provided as ECUs that can communicate with the first ECU via the local network. In this case, the information processing device 30 can also transmit three pieces of update split software to the ECU to be updated. Then, of the three pieces of update split software, the ECU to be updated transmits the second update split software A2 to the second ECU via the local network, and transmits the third update split software A3 to the third ECU via the local network. The second ECU and the third ECU decrypt the update split software received via the local network, and transmit the decrypted update split software to the first ECU via the local network. The first ECU decrypts the first update split software A1 of the three pieces of update split software, and writes the first update split software A1 to its own storage device. Additionally, the first ECU writes the decrypted update split software received via the local network to its own storage device.

In the first embodiment, the number of ECUs that can communicate with the ECU to be updated (first ECU) via the local network is only one. However, the number of ECUs that can communicate with the first ECU via the local network may be two or more. An example will be described in which a second ECU and a third ECU are provided as ECUs that can communicate with the first ECU via the local network. In this case, the information processing device 30 transmits the first update divided software A1 to the first ECU, transmits the second update divided software A2 to the second ECU, and transmits the third update divided software A3 to the third ECU. In the first ECU, the first update divided software A1 is decrypted and the first update divided software A1 is written to its own storage device. In the second ECU and the third ECU, the update divided software received via the global network 42 is decrypted, and the decrypted update divided software is sent to the first ECU via the local network. Then, in the first ECU, the decrypted update divided software received via the local network is also written to its own storage device.

- In the above embodiments, the ECU to be updated is a braking ECU that adjusts the braking force generated by the vehicle 10, but this is not limited to the above. Any ECU other than a braking ECU may be the ECU to be updated as long as it is capable of communicating with the information processing device 30 via the global network 42. For example, a drive ECU that controls the power source of the vehicle 10, such as an engine or a driving motor, may be the ECU to be updated, or an ECU that controls an actuator that adjusts the steering angle of the wheels may be the ECU to be updated. In addition, an ADASECU may be the ECU to be updated. "ADAS" stands for "Advanced Driver Assistance System."

The information processing device 30 and ECU that make up the control system are not limited to those equipped with a CPU and ROM and that execute software processing. In other words, the information processing device 30 and ECU may have any of the following configurations (a) to (c).

(a) Having one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program code or instructions configured to cause the CPU to execute processes. Memory, i.e., computer-readable media, includes any available media that can be accessed by a general-purpose or special-purpose computer.

(b) Equipped with one or more dedicated hardware circuits that execute various processes. Examples of dedicated hardware circuits include application specific integrated circuits, i.e. ASIC or FPGA. ASIC is an abbreviation for "Application Specific Integrated Circuit" and FPGA is an abbreviation for "Field Programmable Gate Array."

(c) Equipped with a processor that executes part of the various processes in accordance with a computer program, and a dedicated hardware circuit that executes the remaining part of the various processes.
The term "at least one" used in this specification means "one or more" of the desired options. As an example, the term "at least one" used in this specification means "only one option" or "both of two options" if the number of options is two. As another example, the term "at least one" used in this specification means "only one option" or "any combination of two or more options" if the number of options is three or more.

<Other technical ideas>
The technical ideas that can be understood from the above-described embodiments and modifications will be described as supplementary notes.
(Supplementary Note 1) An information processing device that acquires update software transmitted to the vehicle from outside the vehicle via wireless communication;
A plurality of electronic control units;
a global network that connects the plurality of electronic control devices and the information processing device in a communicable state;
a local network for transmitting and receiving information only between a first electronic control unit and a second electronic control unit among the plurality of electronic control units,
the communication speed of the local network is faster than the communication speed of the global network;
The first electronic control unit has a first execution device and a storage device in which software executed by the first execution device is written,
the second electronic control unit has a second execution device, a first storage unit in which software to be executed by the second execution device is written, and a second storage unit in which the software to be executed by the second execution device is not written,
When updating the software of the storage device of the first electronic control device to update software for the first electronic control device acquired by the information processing device,
The information processing device transmits the update software to the second electronic control device via the global network,
the second execution device writes the update software received via the global network into the second storage unit, decrypts the update software written in the second storage unit, and transmits the decrypted update software to the first electronic control device via the local network;
The first execution device writes the update software received via the local network into the storage device.

The second electronic control device has not only a first memory unit but also a second memory unit as a memory unit. Therefore, the information processing device transmits the encrypted update software to the second electronic control device via the global network. In the second electronic control device, the received update software is stored in the second memory unit. Then, when updating the software in the memory device of the first electronic control device, the execution device of the second electronic control device decrypts the update software stored in the second memory unit and transmits the decrypted update software to the first electronic control device via the local network. The communication speed of the local network is higher than the communication speed of the global network. Therefore, the time required to update the software in the memory device of the first electronic control device can be shortened by the amount of time required to transmit the update software to the first electronic control device via the local network.

Claims

An information processing device that acquires update software transmitted to the vehicle from outside the vehicle by wireless communication; and a global network that communicatively connects a plurality of electronic control devices and the information processing device,
A control system configured to be able to update software of a storage device included in a first electronic control device among the plurality of electronic control devices,
A first execution device and a second execution device,
When updating the software of the storage device of the first electronic control device to update software for the first electronic control device acquired by the information processing device,
the information processing device divides the update software into a plurality of pieces, and transmits the divided update software in an encrypted state to the global network;
the first execution device decrypts a first divided update software, which is one of the update software pieces divided and transmitted to the global network by the information processing device;
the second execution device decrypts a second divided update software, which is one of the update software pieces divided and transmitted to the global network by the information processing device;
a control system that writes, into the storage device of the first electronic control device, each of the first update divided software decrypted by the first execution device and the second update divided software decrypted by the second execution device.
the first execution unit is an execution unit of the first electronic control unit;
the second execution device is an execution device of a second electronic control device among the plurality of electronic control devices;
The control system further includes a local network for transmitting and receiving information only between the first electronic control unit and the second electronic control unit,
the second execution device decrypts the second update divided software received by the second electronic control device and transmits the decrypted second update divided software to the first electronic control device via the local network;
The control system of claim 1, wherein the first execution device decrypts the first update split software received by the first electronic control device, writes the decrypted first update split software to the storage device, and writes the second update split software received via the local network to the storage device.
the information processing device transmits the first update divided software to the first electronic control unit via the global network, and transmits the second update divided software to the second electronic control unit via the global network;
The control system described in claim 2, wherein the first execution device writes the first update split software that it has decrypted into the storage device, and then writes the second update split software that the second electronic control device sent to the first electronic control device via the local network into the storage device.
after writing of the second divided software update to the storage device is completed, the information processing device transmits a third divided software update, which is one of the divided software updates, to the first electronic control unit via the global network;
The control system of claim 3 , wherein the first execution device decrypts the third update split software and writes the third update split software to the storage device after writing of the second update split software to the storage device is completed.
the information processing device transmits both the first update divided software and the second update divided software to the first electronic control device via the global network;
The first execution device is
decrypting the first update divided software received via the global network and writing the first update divided software into the storage device;
The second update divided software received via the global network is transmitted to the second electronic control unit via the local network;
writing the second update divided software received from the second electronic control unit via the local network into the storage device;
The control system described in claim 2, wherein the second execution device decrypts the second update split software received from the first electronic control device via the local network, and transmits the decrypted second update split software to the first electronic control device via the local network.
the first electronic control unit has the first execution unit and the second execution unit,
the first execution device decrypts the first update divided software and writes the first update divided software into the storage device;
The control system according to claim 1 , wherein the second execution device decrypts the second update divided software and writes the second update divided software into the storage device.