Software update system and server

• US 10,599,418 B2
• Filed: 09/06/2017
• Issued: 03/24/2020
• Est. Priority Date: 09/15/2016
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Kiyama, Noboru, Katou, Atsushi
• Primary Examiner(s): St Leger, Geoffrey R
• Assistant Examiner(s): Luu, Cuong V
• Application Number:
  US15/696,665
• Publication Number:
  US 20180074811A1
• Time in Patent Office: 930 Days
• CPC Class Codes: B60W 50/0098 Details of control systems ensuring comfort, safety or stability not otherwise provided for
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 8/66 of program code stored in read-only memory [ROM]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1048 Departure or maintenance mechanisms
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A telematics center includes an update software distribution unit that distributes update software for updating software of an ECU to a software updating device. The software updating device includes a storage device that stores update software distributed from the telematics center and stores update information regarding influence on the operation of a vehicle in a case where the updating of the software of the ECU is not successful and an ECU software updating unit that updates the software of the ECU by using the update software stored in the storage device, and controls the operation of the ECU software updating unit on the basis of the update information stored in the storage device.

Claims

1. A software update system that manages updating of software of a control device mounted on a vehicle, the software update system comprising:

a software updating device which is mounted on the vehicle; and

a server which communicates with the software updating device through a network, and

wherein the server is programmed to distribute update software for updating the software of the control device to the software updating device and update information specifying a moving condition and an operational limitation of the vehicle in a case where the updating of the software of the control device is not successful and the control device is in an inoperable state, and to distribute recovery software to the software updating device for returning the software of the control device to a state before the updating,

wherein the software updating device includes a storage device that stores the update software and the update information distributed from the server, and the software updating device is programmed to update the software of the control device by using the update software stored in the storage device,

wherein the software updating device is programmed to;

in the case where the updating of the software of the control device is not successful and the control device is in an inoperable state, perform a recovery process on the basis of the update information, and

wherein, in the recovery process, the software updating device is programmed to;

determine whether or not the software updating device is capable of communicating with the server at a current location,

in a case where the software updating device is determined to be capable of communicating with the server at the current location, request the server to distribute the recovery software,

in a case where the software updating device is determined to be incapable of communicating with the server at the current location, determine whether or not the vehicle is movable on the basis of the moving condition specified in the update information,

in a case where the vehicle is determined to be movable, prompt a user to move the vehicle to a position where the software updating device is capable of communicating with the server and prompt the user of the operational limitation of the vehicle specified in the update information, and

in a case where the software updating device and the server are set to be in a communicable state after moving to the position, request the server to distribute the recovery software, and

receive the recovery software from the server.

2. The software update system according to claim 1,

wherein the software updating device is programmed to:

determine whether or not the vehicle is movable during the updating of the software of the control device on the basis of the update information, and

in a case where the vehicle is determined to be movable, update the software of the control device during traveling of the vehicle.

3. The software update system according to claim 1,

wherein the server is programmed to manage the update software to be distributed to the software updating device on the basis of a processing load of the server and update information stored in the server.

4. The software update system according to claim 1,

wherein a plurality of control devices mounted on the vehicle are grouped into a plurality of function categories in accordance with a respective degree of influence on the operation of the vehicle, and

wherein the update information specifies one of the plurality of function categories to which the control device to be updated by the update software belongs.

5. The software update system according to claim 4,

wherein the server is programmed to display the one of the function categories to which the control device to be updated by the update software belongs on a screen of a display device.

6. The software update system according to claim 1,

wherein the server is programmed to:

in response to receiving the request from the software updating device, distribute the recovery software to the software updating device for returning the software of the control device to the state before the updating, and

wherein, in the recovery process, the software updating device is programmed to;

receive the recovery software from the server,

return the software of the control device to the state before the updating by using the recovery software, and

in a case where the software of the control device fails to return to the state before the updating, display information of a dealer of the vehicle to the user.

7. The software update system according to claim 1,

wherein, in the recovery process, the software updating device is programmed to:

in the case where the software updating device is determined to be incapable of communicating with the server, determine whether or not the vehicle is manually movable by the user on the basis of the update information in the recovery processing.

8. A software update method that manages updating of software of a control device mounted on a vehicle, the software update method executed by a software updating device which is mounted on the vehicle and a server which communicates with the software updating device through a network, the software update method comprising:

distributing, from the server, update software for updating the software of the control device and update information specifying a moving condition and an operational limitation of the vehicle in a case where the updating of the software of the control device is not successful and the control device is in an inoperable state over the network to the software updating device,

storing, by the software updating device, the update software and the update information distributed from the server in a storage device,

updating, by the software updating device, the software of the control device by using the update software stored in the storage device,

in a case where the updating of the software of the control device is not successful and the control device is in an inoperable state, performing, by the software updating device, a recovery process in the case where the updating of the software of the control device is not successful on the basis of the update information, and

wherein the recovery process includes;

determining whether or not the software updating device is capable of communicating with the server at a current location,

in a case where the software updating device is capable of communicating with the server at the current location, requesting the server to distribute the recovery software in the recovery processing, and, receiving, from the server, the recovery software,

in a case where the software updating device is incapable of communicating with the server at the current location;

determining whether or not the vehicle is movable from the current location on the basis of the moving condition specified in the update information,

when the vehicle is determined to be movable, prompting a user to move the vehicle to a position where the software updating device is capable of communicating with the server and prompting the user of the operational limitation of the vehicle specified in the update information,

requesting the server to distribute the recovery software when the software updating device and the server are set to be in a communicable state after moving to the position, and receiving, from the server, the recovery software, and

returning the software of the control device to a state before the updating by using the recovery software.