Software update system and server

Patent metadata

Field	Value
Publication number	US-10599418-B2
Application number	US-201715696665-A
Country	US
Kind code	B2
Filing date	Sep 6, 2017
Priority date	Sep 15, 2016
Publication date	Mar 24, 2020
Grant date	Mar 24, 2020

Abstract

A telematics center includes an update software distribution unit that distributes update software for updating software of an ECU to a software updating device. The software updating device includes a storage device that stores update software distributed from the telematics center and stores update information regarding influence on the operation of a vehicle in a case where the updating of the software of the ECU is not successful and an ECU software updating unit that updates the software of the ECU by using the update software stored in the storage device, and controls the operation of the ECU software updating unit on the basis of the update information stored in the storage device.

First claim

What is claimed is:

1. A software update system that manages updating of software of a control device mounted on a vehicle, the software update system comprising:
a software updating device which is mounted on the vehicle; and
a server which communicates with the software updating device through a network, and
wherein the server is programmed to distribute update software for updating the software of the control device to the software updating device and update information specifying a moving condition and an operational limitation of the vehicle in a case where the updating of the software of the control device is not successful and the control device is in an inoperable state, and to distribute recovery software to the software updating device for returning the software of the control device to a state before the updating,
wherein the software updating device includes a storage device that stores the update software and the update information distributed from the server, and the software updating device is programmed to update the software of the control device by using the update software stored in the storage device,
wherein the software updating device is programmed to:
in the case where the updating of the software of the control device is not successful and the control device is in an inoperable state, perform a recovery process on the basis of the update information, and
wherein, in the recovery process, the software updating device is programmed to:
determine whether or not the software updating device is capable of communicating with the server at a current location,
in a case where the software updating device is determined to be capable of communicating with the server at the current location, request the server to distribute the recovery software,
in a case where the software updating device is determined to be incapable of communicating with the server at the current location, determine whether or not the vehicle is movable on the basis of the moving condition specified in the update information,
in a case where the vehicle is determined to be movable, prompt a user to move the vehicle to a position where the software updating device is capable of communicating with the server and prompt the user of the operational limitation of the vehicle specified in the update information, and
in a case where the software updating device and the server are set to be in a communicable state after moving to the position, request the server to distribute the recovery software, and
receive the recovery software from the server.

2. The software update system according to claim 1 ,
wherein the software updating device is programmed to:
determine whether or not the vehicle is movable during the updating of the software of the control device on the basis of the update information, and
in a case where the vehicle is determined to be movable, update the software of the control device during traveling of the vehicle.

3. The software update system according to claim 1 ,
wherein the server is programmed to manage the update software to be distributed to the software updating device on the basis of a processing load of the server and update information stored in the server.

4. The software update system according to claim 1 ,
wherein a plurality of control devices mounted on the vehicle are grouped into a plurality of function categories in accordance with a respective degree of influence on the operation of the vehicle, and
wherein the update information specifies one of the plurality of function categories to which the control device to be updated by the update software belongs.

5. The software update system according to claim 4 ,
wherein the server is programmed to display the one of the function categories to which the control device to be updated by the update software belongs on a screen of a display device.

6. The software update system according to claim 1 ,
wherein the server is programmed to:
in response to receiving the request from the software updating device, distribute the recovery software to the software updating device for returning the software of the control device to the state before the updating, and
wherein, in the recovery process, the software updating device is programmed to:
receive the recovery software from the server,
return the software of the control device to the state before the updating by using the recovery software, and
in a case where the software of the control device fails to return to the state before the updating, display information of a dealer of the vehicle to the user.

7. The software update system according to claim 1 ,
wherein, in the recovery process, the software updating device is programmed to:
in the case where the software updating device is determined to be incapable of communicating with the server, determine whether or not the vehicle is manually movable by the user on the basis of the update information in the recovery processing.

8. A software update method that manages updating of software of a control device mounted on a vehicle, the software update method executed by a software updating device which is mounted on the vehicle and a server which communicates with the software updating device through a network, the software update method comprising:
distributing, from the server, update software for updating the software of the control device and update information specifying a moving condition and an operational limitation of the vehicle in a case where the updating of the software of the control device is not successful and the control device is in an inoperable state over the network to the software updating device,
storing, by the software updating device, the update software and the update information distributed from the server in a storage device,
updating, by the software updating device, the software of the control device by using the update software stored in the storage device,
in a case where the updating of the software of the control device is not successful and the control device is in an inoperable state, performing, by the software updating device, a recovery process in the case where the updating of the software of the control device is not successful on the basis of the update information, and
wherein the recovery process includes:
determining whether or not the software updating device is capable of communicating with the server at a current location,
in a case where the software updating device is capable of communicating with the server at the current location, requesting the server to distribute the recovery software in the recovery processing, and, receiving, from the server, the recovery software,
in a case where the software updating device is incapable of communicating with the server at the current location:
determining whether or not the vehicle is movable from the current location on the basis of the moving condition specified in the update information,
when the vehicle is determined to be movable, prompting a user to move the vehicle to a position where the software updating device is capable of communicating with the server and prompting the user of the operational limitation of the vehicle specified in the update information,
requesting the server to distribute the recovery software when the software updating device and the server are set to be in a communicable state after moving to the position, and receiving, from the server, the recovery software, and

returning the software of the control device to a state before the updating by using the recovery software.

Assignees

• Hitachi Ltd

Inventors

• Kiyama Noboru
• Katou Atsushi

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L67/34 Primary

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F11/1433

  during software upgrading · CPC title