JP7845341B2 - Control device, vehicle, control method, and program - Google Patents

Description

This invention relates to a control device, a vehicle, a control method, and a program for controlling the display of information related to software updates for in-vehicle equipment.

Vehicles are equipped with various in-vehicle devices that operate through software execution. Over-the-Air (OTA) technology is known, which updates the software of these in-vehicle devices using software downloaded from outside the vehicle via wireless communication. As described in Patent Document 1, software updates are performed through an installation process, which involves writing the downloaded update software to the storage module of the in-vehicle device, and an activation process, which enables the installed update software.

Japanese Patent Publication No. 2022-163396

During the activation process, some vehicle functions may be restricted; therefore, it is desirable to confirm with the user before starting the activation process. On the other hand, the activation process may be performed at different times depending on the type of in-vehicle equipment and software. In such cases, the timing of the vehicle's function restrictions will vary depending on when the activation process is performed. Therefore, it is desirable to display an appropriate confirmation screen according to the timing of the activation process.

The control device for solving the above problems is a control device that controls a display unit that displays information regarding software updates for in-vehicle equipment mounted on a vehicle having multiple switchable power modes. When the software update is performed in a first update procedure, where the activation process for activating the update software installed on the in-vehicle equipment is performed in response to a power mode switch in a first switching pattern, the control device displays a first confirmation image on the display unit before the activation process begins. When the software update is performed in a second update procedure, where the activation process is performed in response to a power mode switch in a second switching pattern different from the first switching pattern, the control device displays a second confirmation image, different from the first confirmation image, on the display unit before the activation process begins.

A vehicle that solves the above problems is equipped with the above-mentioned control device.
A control method for solving the above problems is a control method for a display unit that displays information regarding software updates for in-vehicle equipment mounted in a vehicle, wherein when the software update is performed in a first update procedure in which an activation process to activate update software installed in the in-vehicle equipment is performed in accordance with a first switching pattern of the power mode, a first confirmation image is displayed on the display unit before the activation process starts, and when the software update is performed in a second update procedure in which the activation process is started in accordance with a second switching pattern of the power mode different from the first switching pattern, a second confirmation image different from the first confirmation image is displayed on the display unit before the activation process starts.

The program that solves the above problem is a program executed by a control device that controls a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle. The program causes the control device to execute the following: when the software update is performed in a first update procedure, which involves performing an activation process to activate the update software installed in the in-vehicle equipment in response to a power mode switch in a first switching pattern; when the software update is performed in a second update procedure in response to a power mode switch in a second switching pattern different from the first switching pattern; and when the software update is performed in a second update procedure, which involves displaying a second confirmation image different from the first confirmation image on the display unit before the activation process begins.

The above-described control device, vehicle, control method, and program have the effect of displaying an appropriate confirmation screen according to the timing of the activation process.

This diagram schematically shows the configuration of the control device and vehicle according to the first embodiment. This diagram schematically shows the configuration of an in-vehicle device equipped with a single-bank memory module. This diagram schematically illustrates the configuration of an in-vehicle device equipped with a dual-bank memory module. This is a sequence diagram showing the processing flow of the activation phase when a software update is performed in the first update procedure in the first embodiment. This figure shows an example of the display of the first pre-confirmation image. This figure shows an example of the display of the first final confirmation image. This figure shows an example of how the first guidance image is displayed. This figure shows an example of how the first completion notification image is displayed. This is a sequence diagram showing the processing flow of the activation phase when a software update is performed in the second update procedure in the first embodiment. This figure shows an example of the display of the second pre-confirmation image. This figure shows an example of the display of the second final confirmation image. This figure shows an example of how the second guidance image is displayed. This figure shows an example of how the second completion notification image is displayed. This is a sequence diagram showing the processing flow of the activation phase when a software update is performed in the first update procedure in the second embodiment. This is a sequence diagram showing the processing flow of the activation phase when a software update is performed in the second update procedure in the second embodiment.

(First Embodiment)
Hereinafter, a first embodiment of the control device, vehicle, control method, and program will be described in detail with reference to Figures 1 to 13.

<Control device and vehicle configuration>
First, the configuration of the control device and vehicle in this embodiment will be described with reference to Figure 1. As shown in Figure 1, the vehicle 10 is equipped with in-vehicle devices such as an OTA master 11, DCM 12, ADAS 13, PCU 14, engine ECU 15, transmission ECU 16, brake ECU 17, and HMI 18. These in-vehicle devices are connected to each other so as to be able to communicate with one another via an in-vehicle network 19. The OTA master 11 is responsible for managing software updates for the in-vehicle devices, including itself. The DCM 12 is a data communication module that provides wireless communication functionality with the outside of the vehicle via a mobile communication network 20. In this embodiment, the DCM 12 is responsible for recording the results of self-diagnosis performed by each in-vehicle device of the vehicle 10 and transmitting them to an external data center or the like. The ADAS 13 is an advanced driving assistance system that provides advanced driver assistance functions such as an automatic braking system and a sudden acceleration prevention system. The PCU 14 is a power control unit that controls power inside the vehicle. The engine ECU 15 is an electronic control unit for engine control. The transmission ECU 16 is an electronic control unit for transmission control. The brake ECU 17 is an electronic control unit for brake control. The HMI 18 is a human-machine interface. The HMI 18 includes an input device that accepts operations from the occupant and a display device that displays information to the occupant using images and sound. The HMI 18 may also be configured to include a navigation function that guides the driver along a driving route and an entertainment function that plays music and videos. Each of these in-vehicle devices has a storage module 21 in which software is stored and a processor 22 that executes the software. The OTA master 11 further has a data storage 23 that stores update software acquired from outside the vehicle.

Vehicle 10 has multiple power modes. These multiple power modes include a driving power mode and a parking power mode. For each power mode, the power to which in-vehicle equipment is turned on is defined. When the driving power mode is set, the power to the in-vehicle equipment necessary for driving Vehicle 10 and providing services while driving is turned on. In this embodiment, when the driving power mode is set, the power to all in-vehicle equipment shown in Figure 1 is turned on. When the parking power mode is set, only the in-vehicle equipment that needs to operate even when Vehicle 10 is parked is turned on. The in-vehicle equipment that is powered on in each power mode can be changed depending on the environment and user settings.

Vehicle 10 is equipped with a power switch 24 for switching between a driving power mode and a parking power mode. Switching from the driving power mode to the parking power mode is performed by switching the power switch 24 from on to off. Switching from the parking power mode to the driving power mode is performed by switching the power switch 24 from off to on. In conventional vehicles that use only the engine as a power source, the power switch 24 is sometimes called the ignition switch. In vehicles capable of electric driving, such as BEVs and PHEVs, the power switch 24 is sometimes called the Ready switch.

Vehicle 10 is connected to OTA server 30 via mobile communication network 20. OTA server 30 is a server device that distributes update software for in-vehicle equipment. OTA server 30 includes a storage device 31 for storing programs and data for distributing the update software, and a processor 32 for executing the distribution programs.

The OTA server 30 can communicate with the user's information terminal 40 in the vehicle 10 via the mobile communication network 20. An example of the information terminal 40 is a smartphone. The information terminal 40 may also be a tablet or a PC. The information terminal 40 comprises a storage device 41, a processor 42, and an HMI 43. The processor 42 reads and executes the software stored in the storage device 41. The HMI 43 includes an input device for receiving user input and a display device for displaying information to the user. The software stored in the storage device 41 includes software that provides functions such as checking information about the user's vehicle 10 and remote operation.

<Overview of Software Updates>
Next, an overview of the software update for the in-vehicle equipment in vehicle 10 will be described. The in-vehicle equipment subject to the software update includes the OTA master 11, DCM 12, ADAS 13, PCU 14, engine ECU 15, transmission ECU 16, brake ECU 17, and HMI 18. The software update is performed through a download phase, an installation phase, and an activation phase.

In the download phase, the update software is transmitted from the OTA server 30 to the vehicle 10. The OTA master 11 stores the update software received from the OTA server 30 in the data storage 23. The download phase includes a series of processes related to the download, such as determining whether to proceed with the download and verifying the update data. The transmission of the update software from the OTA server 30 to the OTA master 11 may be performed by transmitting compressed data containing the update software, or by transmitting segmented data containing the update software or compressed data. Furthermore, update software for multiple in-vehicle devices may be transmitted together.

During the installation phase, the update software is installed on the in-vehicle device to be updated. In the installation phase, the OTA master 11 installs the update software on the storage module 21 of the in-vehicle device based on the update data downloaded to the data storage 23. The installation phase includes a series of processes related to installation, such as determining whether installation is feasible, transferring the update data, and verifying the update software. If the update data includes the update software itself, the OTA master 11 transfers the update data to the in-vehicle device during the installation phase. If the update data includes compressed data, differential data, or segmented data of the update software, a process for generating the update software from the update data is performed. This generation process may be performed by the OTA master 11 or by the in-vehicle device to be updated. The update software can be generated by decompressing the compressed data or assembling the differential or segmented data. Note that the update software is deactivated upon completion of the installation phase.

During the activation phase, the update software is activated on the in-vehicle equipment being updated. This activation phase includes a series of activation-related processes, such as determining whether activation is permissible, checking the compatibility of the update software, and verifying the activation results.

<Two methods for updating the software>
There are two procedures for updating the software of in-vehicle equipment: the first update procedure and the second update procedure. In both the first and second update procedures, the software update is performed using the same procedure until the completion of the installation phase. The first and second update procedures differ in the timing at which the activation process begins in the activation phase. The activation process is the process of enabling the update software installed in the memory module 21 of the in-vehicle equipment to be updated.

In the first update procedure, the activation process is performed in response to the switching of the power switch 24 from on to off. That is, in the first update procedure, the activation process is performed in response to the switching from the driving power mode to the parking power mode. When a software update is performed in the first update procedure, switching the power switch 24 back to the on position is prohibited during the period from the start to the completion of the activation process. In other words, when a software update is performed in the first update procedure, switching to the driving power mode is prohibited during the period from the start to the completion of the activation process.

In contrast, in the second update procedure, the activation process is performed in response to the switching of the power switch 24 from off to on. That is, in the second update procedure, the activation process is performed in response to the switching from the parking power mode to the driving power mode. More specifically, in the second update procedure, the activation process begins in response to the switching of the power switch 24 from off to on. Then, after waiting for the activation process to complete, the power mode is switched from the parking power mode to the driving power mode.

The choice between the first and second update procedures for performing a software update is determined, for example, by the type of in-vehicle equipment, hardware configuration, and software type. The decision of which procedure to use may also be based on environmental conditions, user settings, and combinations of other in-vehicle equipment undergoing activation simultaneously.

When performing a software update using the first update procedure, power must be supplied to the in-vehicle equipment during the activation process, even while the vehicle 10 is parked. Therefore, the in-vehicle equipment undergoing the software update using the first update procedure requires a dedicated power line to ensure power supply even while parked. Consequently, it is generally preferable to perform software updates for in-vehicle equipment using the second update procedure, which does not require a dedicated power line.

However, for some in-vehicle devices, it is preferable to perform the software update using the first update procedure rather than the second update procedure. In the first update procedure, the activation process is already completed when the power switch 24 is switched from on to off and then back to on. Therefore, in this case, the in-vehicle device to be updated can start operating immediately after the power switch 24 is switched from off to on. In contrast, in the second update procedure, the activation process begins after the power switch 24 is switched from off to on. Therefore, even if the user switches the power switch 24 from off to on to start driving the vehicle 10, the in-vehicle device to be updated cannot start operating until the activation process is complete. Consequently, for in-vehicle devices that require immediate operation after the vehicle's power switch 24 is switched from off to on, it is preferable to perform the software update using the first update procedure.

In this embodiment, the DCM 12, ADAS 13, and PCU 14 are classified as in-vehicle devices whose software is updated in the first update procedure. The communication function provided by the DCM 12 is used to notify external parties of abnormalities occurring in the vehicle 10. Furthermore, in this embodiment, the DCM 12 also plays a role in recording the results of self-diagnosis of each in-vehicle device. It is desirable that the functions of the DCM 12, such as reporting abnormalities and recording self-diagnosis results, be available immediately after the power switch 24 is switched from off to on. Also, the ADAS 13 needs to provide driving assistance from the moment the vehicle 10 starts moving. Furthermore, while the PCU 14 is stopped, power cannot be supplied to the drive system, preventing the vehicle 10 from starting to move. Thus, the DCM 12, ADAS 13, and PCU 14 are in-vehicle devices that are required to start operating immediately after the power switch 24 is switched from off to on.

Furthermore, depending on the hardware configuration of the memory module 21 installed in the in-vehicle equipment, a software update in the first update procedure may also be required. In this embodiment, among the in-vehicle equipment other than the DCM 12, ADAS 13, and PCU 14 described above, in-vehicle equipment equipped with a single-bank memory module 21 is classified as equipment that undergoes a software update in the first update procedure. And among the in-vehicle equipment other than the DCM 12, ADAS 13, and PCU 14, in-vehicle equipment equipped with a dual-bank memory module 21 is classified as equipment that undergoes a software update in the second update procedure.

Figure 2 shows the configuration of an in-vehicle device D1 equipped with a single-bank memory module 21A. The memory module 21A of this in-vehicle device D1 has only one memory area B for storing the software executed by the processor 32. In the case of such an in-vehicle device D1, the updated software is installed in the same memory area B that stored the software before the update. Therefore, the operation of the in-vehicle device D1 must be stopped during the installation. Furthermore, in the event of activation failure, recovery requires reinstalling the software before the update into memory area B. Such reinstallation for recovery takes a long time. Moreover, if the software before the update is not backed up, it will be necessary to re-download the software before the update. Thus, in the case of an in-vehicle device D1 equipped with a single-bank memory module 21A, considering the recovery process in the event of failure, it may take a very long time from the start of activation until operation can begin. Therefore, in this embodiment, the software update of the in-vehicle device D1 equipped with a single-bank memory module 21A is performed in the first update procedure. Furthermore, in this embodiment, the in-vehicle equipment that performs the software update in the first update procedure has its power switched on and off in conjunction with the on/off state of the power switch 24 of the vehicle 10.

Figure 3 shows the configuration of an in-vehicle device D2 equipped with a dual-bank memory module 21B. The dual-bank memory module 21B has two memory areas B1 and B2. One of the two memory areas B1 and B2 is disabled, and the other is enabled. The processor 22 reads and executes the software from the enabled memory area. In the case of such an in-vehicle device D2, the updated software is installed in the disabled memory area, that is, in a memory area separate from the memory area where the pre-update software was stored. After installation, activation is performed by switching the memory area to be enabled. If activation fails, the system can be quickly restored to its pre-update state by switching the memory area to be enabled again. Therefore, in the case of an in-vehicle device D2 equipped with a dual-bank memory module 21B, even considering recovery in case of failure, it does not take very long from the start of activation until the system can begin operation. Therefore, in this embodiment, the software update using the second update procedure is limited to in-vehicle devices D2 equipped with a dual-bank memory module 21B.

Furthermore, many in-vehicle devices may have multiple software programs installed that provide different functions. Among these programs, some may need to be executed immediately after the power switch 24 is switched from off to on, while others do not. If the software needs to be executed immediately after the power switch 24 is switched from off to on, performing the update using the second update procedure may not be completed in time. Therefore, even for the same in-vehicle device, it may be advisable to differentiate between updating using the first or second update procedure depending on the type of software being updated.

The OTA master 11 determines, at least by the start of the activation phase, whether the software update will be performed using the first or second update procedure. For example, the OTA master 11 makes this determination based on campaign information. In this case, the campaign information includes information indicating whether the software update procedure is the first or second update procedure. Alternatively, the determination may be made in the following manner: First, the classification information of the types of in-vehicle devices and software to be updated using the first update procedure, and the types of in-vehicle devices and software to be updated using the second update procedure, is pre-stored in the storage module 21 of the OTA master 11. When updating the software, the OTA master 11 obtains the types of in-vehicle devices and software to be updated from the campaign information or the target in-vehicle device. Then, the OTA master 11 refers to the classification information stored in the storage module 21 to determine which update procedure the obtained type belongs to.

<Activation process in the first update procedure>
Next, with reference to Figures 4 to 8, the details of the activation process in the first update procedure will be explained. The storage module 21 of the OTA master 11 stores a program for managing software updates and a program for controlling the display of information related to software updates. The processing of the OTA master 11 shown in Figure 4 and Figure 9 described later is performed by the processor 22 of the OTA master 11 reading and executing these programs.

Figure 4 shows the processing flow of the activation phase when a software update is performed using the first update procedure. Once the installation phase is complete, the OTA master 11 instructs the HMI 18 to display a first pre-confirmation image to confirm the user's consent to the activation process (S10). The HMI 18, in response to the instruction, displays a first pre-confirmation image as illustrated in Figure 5 (S11).

Figure 5 shows an example of the display of the first pre-confirmation image. The first pre-confirmation image includes a prompt to select whether or not to allow the activation process. Specifically, the first pre-confirmation image displays buttons for selecting to allow the activation process and for selecting to postpone the activation process. These buttons are disabled while the vehicle 10 is in motion and are only enabled when parked.

Furthermore, the first pre-confirmation image displays information regarding the functional limitations of the vehicle 10 during the activation process. Specifically, it displays that the power switch 24 cannot be switched back to the ON position during the activation process. This functional limitation indicates that the vehicle cannot switch to the driving power mode. Additionally, the first pre-confirmation image displays information regarding the estimated activation time. This estimated activation time is the estimated time required from when the power switch 24 is switched from ON to ON until the activation process is completed and the power switch 24 can be switched back to the ON position. The OTA master 11 obtains the estimated time, for example, from campaign information. The OTA master 11 may also calculate the estimated time based on the data size of the update software and the type of in-vehicle equipment being updated.

The first pre-check image also displays information such as warnings to the user regarding the activation process. This warning information may include, for example, that the power switch 24 must be turned off for the software update, that activation should be performed in a safe location, and that some functions of the vehicle 10 will be disabled the next time the power switch 24 is turned on.

When the user selects permission to execute the activation process on the HMI 18 displaying the first pre-confirmation image (S12), the HMI 18 notifies the OTA master 11 that permission to execute the activation process has been granted (S13). Upon confirming permission to execute the activation process, the OTA master 11 instructs the HMI 18 to display the first final confirmation image when it becomes possible to switch the power switch 24 from on to off (S14). The HMI 18 displays the first final confirmation image, as illustrated in Figure 6, in response to the instruction (S15). The OTA master 11 determines that the power switch 24 is in a state where it can be switched from on to off based on conditions such as the vehicle 10 being stopped, the parking shift operation being performed, and the parking brake being engaged.

Figure 6 shows an example of the display of the first final confirmation image. Similar to the first pre-confirmation image, the first final confirmation image displays information regarding the functional limitations of the vehicle 10 due to the activation process. Specifically, the first final confirmation image displays information indicating that if the power switch 24 is turned off, it will not be possible to turn the power switch 24 back on and drive the vehicle 10 until the activation process is complete. The first final confirmation image also displays information indicating the estimated time for the activation process. Furthermore, the first final confirmation image displays information indicating that it is possible to turn off the power switch 24 after confirming a safe location, and to resume driving, in which case the software update will resume with the display of the first final confirmation image at the next stop. Additionally, the first final confirmation image displays an indication that a temporary suspension of the software update has been accepted. The activation phase process continues if the user does not select to temporarily suspend the software update in the first final confirmation image. On the other hand, if the user selects to temporarily suspend the software update in the first final confirmation image, the activation phase process is temporarily stopped. The activation phase process then resumes when the vehicle 10 becomes capable of being switched off.

If the activation phase processing continues, and the user then switches the power switch 24 from on to off (S16), the OTA master 11 starts the activation process (S17). Simultaneously, the OTA master 11 instructs the HMI 18 to display the first guide image, as illustrated in Figure 7 (S18). The HMI 18 displays the first guide image in response to the instruction (S19).

As shown in Figure 7, the first guidance image displays information indicating that the power switch 24 cannot be switched on, and information indicating the estimated time until the power switch 24 can be switched on. The OTA master 11 calculates the estimated time for displaying the information in the first guidance image by subtracting the time elapsed from the start of the activation process to the present from the estimated time required from the start to the completion of the activation process. The HMI 18 temporarily darkens the screen in response to locking the vehicle 10 or the passage of a certain amount of time, but displays the first guidance image again in response to unlocking the vehicle 10 or operation of the HMI 18.

When the activation process is complete, the OTA master 11 instructs the HMI 18 to display a first completion notification image, as illustrated in Figure 8 (S20). The HMI 18 displays the first completion notification image in response to the instruction (S21). As shown in Figure 8, the first completion notification image displays information indicating that the software update is complete and information indicating that the power switch 24 can now be switched on.

<Activation process in the second update procedure>
Next, the details of the activation process in the second update procedure will be explained with reference to Figures 9 to 11. Figure 9 shows the flow of the activation phase when a software update is performed in the second update procedure.

In this case, once the installation phase is complete, the OTA master 11 instructs the HMI 18 to display a second pre-confirmation image to confirm the user's confirmation of the activation process (S30). The HMI 18, in response to the instruction, displays a second pre-confirmation image as illustrated in Figure 10 (S31).

Figure 10 shows an example of the second pre-confirmation image. Similar to the first pre-confirmation image, the second pre-confirmation image includes a prompt to select whether or not to proceed with the activation process. The second pre-confirmation image also indicates that the activation process will be performed when the power switch 24 is next switched to the ON position. Furthermore, the second pre-confirmation image displays information about the estimated time from when the power switch 24 is switched from OFF to ON until the activation process is completed.

When the user selects permission to execute the activation process on the HMI 18 displaying the second pre-confirmation image (S32), the HMI 18 notifies the OTA master 11 that permission to execute the activation process has been granted (S33). Upon confirming permission to execute the activation process, the OTA master 11 instructs the HMI 18 to display the second final confirmation image when the vehicle 10 becomes capable of switching from power on to power off (S34). In response to the instruction, the HMI 18 displays the second final confirmation image as illustrated in Figure 11 (S35).

Figure 11 shows an example of the second final confirmation image. The second final confirmation image displays information indicating that the activation process is ready, and information indicating that the software update will resume when the power switch 24 is next switched from off to on.

Subsequently, when the power switch 24 switches from on to off and then back to on, the OTA master 11 begins the activation process (S36). In addition, the OTA master 11 instructs the HMI 18 to display a second guidance image, as illustrated in Figure 12 (S37). The HMI 18 displays the second guidance image in response to the instruction (S38).

As shown in Figure 12, the second guidance image displays information indicating that a software update is in progress, as well as the estimated time until the update is completed. The OTA master 11 calculates the estimated time for displaying the information in the second guidance image by subtracting the time elapsed from the start of the activation process to the present from the estimated time required from the start to the completion of the activation process.

Upon completion of the activation process, the OTA master 11 instructs the HMI 18 to display a second completion notification image, as illustrated in Figure 13 (S39). The HMI 18 displays the second completion notification image in response to the instruction (S40). As shown in Figure 13, the second completion notification image displays information indicating that the software update is complete. It also displays information indicating that the functional restrictions associated with the activation process have been lifted. For example, if the vehicle 10 was prohibited from driving during the activation process, information indicating that the vehicle 10 is now able to drive will be displayed in the second completion notification image.

<Effects and Effects of the Embodiment>
The OTA master 11 controls the display of the HMI 18, which displays information regarding software updates for in-vehicle equipment installed in the vehicle 10. Software updates for in-vehicle equipment are performed using either a first update procedure or a second update procedure. In the first update procedure, an activation process to enable the update software installed on the in-vehicle equipment is performed in accordance with the switch from the driving power mode to the parking power mode. In the second update procedure, the activation process is performed in accordance with the switch from the parking power mode to the driving power mode. When a software update is performed using the first update procedure, the OTA master 11 displays a first pre-confirmation image and a first final confirmation image on the HMI 18 before the activation process begins. Conversely, when a software update is performed using the second update procedure, the OTA master 11 displays a second pre-confirmation image and a second final confirmation image, which are different from the first pre-confirmation image and the first final confirmation image, on the HMI 18 before the activation process begins.

The timing and nature of the functional limitations imposed on the vehicle 10 during the activation process differ depending on whether the software update is performed using the first or second update procedure. Therefore, simply notifying the user of the activation process may lead to unexpected functional limitations, potentially confusing the user. In this embodiment, the user can confirm whether the software update will be performed using the first or second update procedure by observing the difference in the confirmation image displayed on the HMI 18 before the activation process begins.

The control device, vehicle, control method, and program of this embodiment described above can achieve the following effects.
(1) The confirmation image displayed on the HMI 18 before the activation process begins differs depending on whether the software update is performed using the first update procedure or the second update procedure. Therefore, this embodiment has the effect of being able to display an appropriate confirmation screen according to the timing of the activation process.

(2) Users can decide whether or not to perform the activation process after confirming the timing of the process. This improves user convenience.
(3) If the timing of the activation process differs, the timing and content of the functional restrictions on the vehicle 10 that accompany the process will also differ. In response to this, the OTA master 11 displays information about the functional restrictions on the vehicle 10 that accompany the activation process in the first pre-/final confirmation image. In addition, the OTA master 11 displays information different from the information displayed in the first pre-/final confirmation image as functional restriction information in the second pre-/final confirmation image. As a result, the functional restrictions on the vehicle 10 that accompany the activation process can be accurately notified to the user.

(4) The OTA master 11 displays information in the first pre- and final confirmation images regarding the period during which the functions of the vehicle 10 will be restricted due to the activation process. Furthermore, the OTA master 11 displays information in the second pre- and final confirmation images regarding a different period during which the functions of the vehicle 10 will be restricted, as information for a different period than that displayed in the first pre- and final confirmation images. Therefore, the user can be accurately notified of the period during which the functions of the vehicle 10 will be restricted due to the activation process.

(5) The OTA master 11 displays information in the first pre-/final confirmation image indicating the estimated time from when the power switch 24 is switched from on to off until it can be switched back to on. Therefore, the user can confirm the period during which the power switch 24 cannot be turned on due to the activation process, and then decide whether or not to perform the activation process.

(6) The OTA master 11 displays information in the second pre-confirmation image indicating the estimated time from when the power switch 24 is switched from off to on until the activation process is completed. Therefore, the user can check the period during which the activation process will result in functional limitations before deciding whether or not to perform the activation process when driving the vehicle 10 next.

(7) The first pre-/final confirmation image and the second pre-confirmation image include a display indicating whether or not to allow the activation process to begin. Therefore, the user can decide whether or not to proceed with the activation process while confirming the timing of the activation process and the content and timing of any functional restrictions associated with it.

(8) The functional limitations of the vehicle 10 resulting from the activation process differ between the first update procedure and the second update procedure. Therefore, simply knowing that the activation process is underway may not allow the user to understand the situation. To address this, the OTA master 11 displays a first guidance image on the HMI 18 during the activation process when a software update is performed using the first update procedure. Furthermore, when a software update is performed using the second update procedure, the OTA master 11 displays a second guidance image, different from the first guidance image, on the HMI 18 during the activation process. Therefore, the user can more easily understand the effects of the activation process.

(9) The OTA Master 11 displays information in the first guidance image indicating that the power switch 24 cannot be switched to the ON position, that is, that it cannot be switched to the power mode for driving. Furthermore, the OTA Master 11 displays information in the first guidance image indicating the estimated time until the power switch 24 can be switched to the ON position. This makes it easier for the user to understand the situation.

(10) The OTA master 11 displays information about the estimated time until the activation process is completed within the second guidance image. Therefore, the user can understand when the updated software's functions will become available.

(11) The functions of the vehicle 10 whose restrictions are lifted upon completion of the activation process differ depending on whether the software update is performed using the first update procedure or the second update procedure. In response to this, when the software update is performed using the first update procedure, the OTA master 11 displays a first completion notification image on the HMI 18 after the activation process is completed. Furthermore, when the software update is performed using the second update procedure, the OTA master 11 displays a second completion notification image on the HMI 18, which is different from the first completion notification image, after the activation process is completed. Specifically, the OTA master 11 displays in the first completion notification image that the power switch 24 can now be switched on, while displaying in the second completion notification image that the functions of the in-vehicle equipment that were restricted due to the activation process are now usable. Therefore, the user can easily understand which functions of the vehicle 10 whose restrictions are lifted upon completion of the activation process.

(12) The DCM 12, ADAS 13, and PCU 14 are required to start operating immediately after the power switch 24 is switched from off to on. In this embodiment, the software update of the DCM 12, ADAS 13, and PCU 14 is performed in a first update procedure, which involves activation processing while the power switch 24 is off. Therefore, the time from when the power switch 24 is switched from off to on until the DCM 12, ADAS 13, and PCU 14 start operating is avoided to be extended due to the activation process. In this embodiment, the in-vehicle equipment whose software is updated in the first update procedure and the in-vehicle equipment whose software is updated in the second update procedure are classified according to the function of the in-vehicle equipment.

(13) In-vehicle device D1 equipped with a single-bank memory module 21A requires a longer activation process than in-vehicle device D2 equipped with a dual-bank memory module 21B. Therefore, if the activation process is started after the power switch 24 is switched from off to on, the functions of in-vehicle device D1 may be unavailable for a long period until the process is completed. In this embodiment, however, among the in-vehicle devices other than the DCM 12, ADAS 13, and PCU 14, in-vehicle device D1 equipped with the single-bank memory module 21A undergoes a software update using the first update procedure. In contrast, among the other in-vehicle devices, in-vehicle device D2 equipped with the dual-bank memory module 21B undergoes a software update using the second update procedure. Therefore, by performing the activation process, it is possible to avoid prolonged functional limitations of the in-vehicle device after the power switch 24 is switched from off to on.

(14) When a software update is performed in the first update procedure, the OTA master 11 initiates the activation process of the in-vehicle equipment in response to the power switch 24 switching from on to off. Furthermore, when a software update is performed in the second update procedure, the OTA master 11 initiates the activation process of the in-vehicle equipment in response to the power switch 24 switching from off to on. Thus, in this embodiment, the OTA master 11, which manages the software update, controls the display of information. Therefore, it is possible to accurately display information according to the progress of the software update.

(15) The OTA master 11 displays the first pre- and second confirmation images on the HMI 18 when the installation phase is complete. Furthermore, the OTA master 11 displays the first and second final confirmation images on the HMI 18 when the vehicle 10 is in a state where the power switch 24 can be switched from on to off. Therefore, the user can easily confirm that the activation process will be performed afterward.

<Correspondence>
In this embodiment, the first pre-confirmation image and the first final confirmation image correspond to the first confirmation image, and the second pre-confirmation image and the second final confirmation image correspond to the second confirmation image. In this embodiment, the HMI 18 installed in the vehicle 10 corresponds to the display unit, and the OTA master 11 mounted on the vehicle 10 corresponds to the control unit.

Furthermore, in this embodiment, the power mode for driving corresponds to the first power mode and the power mode in which the vehicle 10 is capable of driving. The power mode for parking corresponds to the second power mode and the power mode in which the vehicle 10 is not capable of driving. Switching from the driving power mode to the parking power mode corresponds to the power mode switching in the first switching pattern, and switching from the parking power mode to the driving power mode corresponds to the power mode switching in the second switching pattern. Furthermore, in Figure 4, processes S10 and S14 correspond to the first display process, process S18 to the third display process, and process S20 to the fifth display process. Also, in Figure 9, processes S30 and S34 correspond to the second display process, process S37 to the fourth display process, and process S39 to the sixth display process.

(Second Embodiment)
Next, a second embodiment of the control device, control method, and program will be described in detail with reference to Figures 14 and 15. In this embodiment, components common to the above embodiment are denoted by the same reference numerals, and their detailed descriptions are omitted.

In the first embodiment, the display control of software update information on the HMI 18 installed in the vehicle 10 was performed by an OTA master 11 also installed in the same vehicle 10. In this embodiment, the software update information is displayed on the HMI 43 of the user-owned information terminal 40 in the vehicle 10. The display control is performed by the OTA server 30 in the data center.

<Activation process in the first update procedure>
Figure 14 shows the processing flow of the activation phase when a software update is performed in the first update procedure in this embodiment. As shown in Figure 14, when the installation phase is completed, the OTA master 11 notifies the OTA server 30 (S50). When the OTA server 30 confirms the completion of the installation phase, it instructs the information terminal 40 to display the first pre-confirmation image (S51). The information terminal 40 displays the first pre-confirmation image on its HMI 43 in response to the instruction (S52). The first pre-confirmation image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 5.

When the user selects permission to execute the activation process on the information terminal 40 (S53), the information terminal 40 notifies the OTA server 30 that permission to execute the activation process has been granted (S54). Furthermore, the OTA server 30 notifies the vehicle 10's OTA master 11 that permission to execute the activation process has been granted (S55).

The OTA master 11 then notifies the OTA server 30 of the state in which the power switch 24 can be switched from on to off (S56). In response to this notification, the OTA server 30 instructs the information terminal 40 to display the first final confirmation image (S57). The information terminal 40 displays the first final confirmation image on its HMI 43 in response to the instruction (S58). The first final confirmation image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 6.

Subsequently, when the power switch 24 is switched from on to off, the OTA master 11 starts the activation process (S59). The OTA master 11 also notifies the OTA server 30 of the start of the activation process (S60). Upon confirming the start of the activation process, the OTA server 30 instructs the information terminal 40 to display the first guidance image (S61). In response to this instruction, the information terminal 40 displays the first guidance image on its HMI 43 (S62). The first guidance image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 7.

The OTA master 11 notifies the OTA server 30 when the activation process is complete (S63). Upon confirming the completion of the activation process, the OTA server 30 instructs the information terminal 40 to display the first completion notification image (S64). The information terminal 40 displays the first completion notification image on its HMI 43 in response to the instruction (S65). The first completion notification image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 8.

<Activation process in the second update procedure>
Figure 15 shows the processing flow of the activation phase when a software update is performed in the second update procedure in this embodiment. As shown in Figure 15, when the installation phase is completed, the OTA master 11 notifies the OTA server 30 (S70). When the OTA server 30 confirms the completion of the installation phase, it instructs the information terminal 40 to display the second pre-confirmation image (S71). The information terminal 40 displays the first pre-confirmation image on its HMI 43 in response to the instruction (S72). The first pre-confirmation image displayed on the HMI 43 of the information terminal 40 is similar to that shown in Figure 10.

When the user selects permission to perform the activation process on the information terminal 40 (S73), the information terminal 40 notifies the OTA server 30 that permission to perform the activation process has been granted (S74). The OTA server 30 then notifies the vehicle 10's OTA master 11 that permission to perform the activation process has been granted (S75).

The OTA master 11 then notifies the OTA server 30 (S76) when it becomes possible to switch the power switch 24 from on to off. The OTA server 30, in response to the notification, instructs the information terminal 40 to display the second final confirmation image (S77). The information terminal 40, in response to the instruction, displays the second final confirmation image on its HMI 43 (S78). The second final confirmation image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 11.

Subsequently, when the power switch 24 switches from on to off and then back to on, the OTA master 11 starts the activation process (S79). The OTA master 11 also notifies the OTA server 30 of the start of the activation process (S80). Upon confirming the start of the activation process, the OTA server 30 instructs the information terminal 40 to display the second guidance image (S81). In response to this instruction, the information terminal 40 displays the second guidance image on its HMI 43 (S82). The second guidance image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 12.

The OTA master 11 notifies the OTA master 11 of the completion of the activation process (S83). The OTA server 30, upon confirming the completion of the activation process, instructs the information terminal 40 to display the second completion notification image (S84). The information terminal 40 displays the second completion notification image on its HMI 43 in response to the instruction (S85). The first completion notification image displayed on the HMI 43 of the information terminal 40 is as shown in Figure 13.

In this embodiment, the HMI 43 of the information terminal 40 corresponds to the display unit, and the OTA server 30 corresponds to the control device. This embodiment provides the same or similar functions and effects as the first embodiment.

(Other embodiments)
The above embodiment can be implemented with the following modifications. The above embodiment and the following modifications can be combined with each other to the extent that they do not contradict each other technically.

In the first embodiment, the OTA master 11 controls the display of the vehicle 10's HMI 18, and in the second embodiment, the OTA server 30 controls the display of the information terminal 40. In this case, both the OTA master 11 and the OTA server 30 correspond to control devices.

- The display control of the HMI 18 of the vehicle 10 in the first embodiment may be performed by the OTA server 30.
- The display control of the information terminal 40 in the second embodiment may be performed by the OTA master 11.

- The in-vehicle equipment that is subject to a software update may be configured to control the display of information related to the software update.
The display examples shown in Figures 5 to 8 and Figures 10 to 13 were configured to display information within the images using text. However, information may also be displayed within these images using non-textual methods such as still images or videos.

- The configuration of the first completion notification image (Figure 8) and the second completion notification image (Figure 13) can be changed as appropriate. In the above embodiment, information indicating that the power switch 24 can be switched on was displayed in the first completion notification image, but this information may be omitted. Also, in the above embodiment, information indicating that the functions of the in-vehicle equipment that were restricted due to the activation process have become available, specifically information indicating that the vehicle 10 is now drivable, was displayed in the second completion notification image, but this display may be omitted. It is assumed that the user knows the content of the function restrictions during the activation process in both cases, whether the software update was performed using the first update procedure or the second update procedure. In this case, if the user knows whether the software update was performed using the first update procedure or the second update procedure, they can know which functions of the vehicle 10 will be unlocked and available upon completion of the activation process. Therefore, it is preferable that the first completion notification image and the second completion notification image be configured so that the user can understand that they are notifying the user of the completion of the activation process and can distinguish between the two images. With the first and second completion notification images configured in this way, it becomes less likely that unexpected functional limitations will occur during the activation process, causing user confusion.

Regardless of whether the software update is performed using the first or second update procedure, a common completion image may be displayed after the activation process is complete.
- You may choose not to display the completion image after the activation process is finished.

The configuration of the first guidance image (Figure 7) and the second guidance image (Figure 12) can be modified as appropriate. For example, the display of information indicating the estimated time until the activation process is completed in the first/second guidance image may be omitted, or the display of information indicating that the power switch 24 cannot be switched to the ON position in the first guidance image may be omitted. The first and second guidance images should be configured so that the user understands that the activation process is in progress and can distinguish between the two images.

Regardless of whether the software update is performed using the first or second update procedure, a common guidance image may be displayed during the activation process.
- You may choose not to display the guidance image while the activation process is running.

The configurations of the first pre-confirmation image (Figure 5) and the second pre-confirmation image (Figure 10) can be modified as appropriate. For example, the display of information regarding the estimated activation time in the first/second pre-confirmation images may be omitted. Furthermore, information regarding functional limitations associated with the activation process may be displayed differently from the examples provided, or the display of functional limitation information may be omitted. Additionally, in cases where the activation process is automatically executed without user permission, or where user permission has been obtained before the completion of the installation phase, the display of the prompt to allow or deny the activation process may be omitted. In any case, it is sufficient that the user can recognize that the activation process is being notified in advance, and that the first and second pre-confirmation images are configured as different images so that the user can distinguish between them. The same applies to the first final confirmation image (Figure 6) and the second final confirmation image (Figure 11).

In the above embodiment, the first and second pre-confirmation images were displayed upon completion of the installation phase, and the first and second final confirmation images were displayed when the power switch 24 could be switched from on to off. Alternatively, only one of the first and second pre-confirmation images, or the first and second final confirmation images, may be displayed.

• The OTA master 11, which manages software updates, controlled the display of information related to software updates. Alternatively, software update management and the display control of information related to software updates could be handled by a separate in-vehicle device.

In the above embodiment, the activation process was performed either when switching from the driving power mode to the parking power mode, or when switching from the parking power mode to the driving power mode. If the vehicle 10's power modes include power modes other than the two described above, the activation process may be performed in accordance with the power mode switching in a switching pattern other than those described above. If the power mode switching pattern for which the activation process is performed is different, the timing of the activation process will be different, resulting in differences in the tolerance and content of the functional limitations of the vehicle 10 that accompany its implementation. Therefore, it is desirable to display a different confirmation image for each power mode switching pattern for which the activation process is performed. Examples of power modes other than driving and parking include power modes that provide functions that cannot be provided in the normal parking power mode, such as entertainment functions and external power supply functions, while the vehicle is parked. In addition, multiple power modes may be included, including power modes corresponding to the following states: IG (ignition) on state, ACC (accessory power) on state, and vehicle power off state. The ignition (IG) on state means the vehicle's engine is running and multiple ECUs are powered on. The ACC (Accessory) on state means only some of the ECUs are powered on compared to the ignition on state. The vehicle power off state means almost all ECUs are powered off.

The control device may be configured as a circuit including one or more processors that operate according to a computer program, one or more dedicated hardware circuits that perform at least some of the various processes, or a combination thereof. Examples of dedicated hardware include application-specific integrated circuits (ASICs). The processor includes a CPU and memory such as RAM and ROM, where memory stores program code or instructions configured to cause the CPU to execute processes. Memory, i.e., storage media, includes any available media accessible by a general-purpose or dedicated computer.

<Additional Notes>
[Note 1] A control device for controlling a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle having multiple switchable power modes, wherein when the software update is performed in a first update procedure in which an activation process to activate update software installed in the in-vehicle equipment is performed in accordance with the switching of the power mode in a first switching pattern, the control device displays a first confirmation image on the display unit before the start of the activation process, and when the software update is performed in a second update procedure in which the activation process is performed in accordance with the switching of the power mode in a second switching pattern different from the first switching pattern, the control device displays a second confirmation image different from the first confirmation image on the display unit before the start of the activation process.

[Note 2] The control device according to Note 1, which displays information regarding the functional limitations of the vehicle resulting from the activation process within the first confirmation image, and displays information different from the information displayed within the first confirmation image as information regarding the functional limitations within the second confirmation image.

[Note 3] The control device according to Note 1 or Note 2, which displays information in the first confirmation image regarding the period during which the vehicle's functions are restricted due to the activation process, and also displays information in the second confirmation image regarding a period different from the period for which information is displayed in the first confirmation image, as information regarding the period during which the vehicle's functions are restricted.

[Note 4] The control device according to any one of Notes 1 to 3, wherein the first and second confirmation images include a display indicating whether or not to allow the start of the activation process.

[Note 5] A control device according to any one of Notes 1 to 4, which determines whether the software update is performed using the first update procedure or the second update procedure, based on the type of in-vehicle equipment to which the software update is to be performed.

[Note 6] A control device according to any one of Notes 1 to 5, which determines whether the software update is performed using the first update procedure or the second update procedure, based on the type of software to be updated.

[Note 7] The in-vehicle device on which the software update is performed in the first update procedure and the in-vehicle device on which the software update is performed in the second update procedure are control devices as described in any of Notes 1 to 6, classified according to the function of the in-vehicle device.

[Note 8] A control device according to any one of Notes 1 to 7, wherein, when the software update is performed in the first update procedure, the activation process of the in-vehicle device is started in response to the switching of the power mode in the first switching pattern; and when the software update is performed in the second update procedure, the activation process of the in-vehicle device is started in response to the switching of the power mode in the second switching pattern.

[Note 9] The control device according to any one of Notes 1 to 8, wherein the switching of the power supply mode in the first switching pattern is a switch from a first power supply mode in which the vehicle is drivable to a second power supply mode in which the vehicle is not drivable, and the switching of the power supply mode in the second switching pattern is a switch from the second power supply mode to the first power supply mode.

[Note 10] The control device described in Note 9, wherein the switching of the power mode in the first switching pattern is performed in accordance with the switching of the vehicle's power switch from on to off, and the switching of the power mode in the second switching pattern is performed in accordance with the switching of the power switch from off to on.

[Note 11] The control device according to Note 9 or Note 10, which displays information about the estimated time from when the power mode is switched to the second power mode until the power mode can be switched back to the first power mode within the first confirmation image.

[Note 12] A control device according to any one of Notes 9 to 11, which displays information about the estimated time from when the power mode switching from the second power mode to the first power mode is instructed until the activation process is completed, within the second confirmation image.

[Note 13] A control device according to any one of Notes 9 to 12, wherein, when the software update is performed in the first update procedure, the first guidance image is displayed on the display unit during the activation process, and when the software update is performed in the second update procedure, a second guidance image different from the first guidance image is displayed on the display unit during the activation process.

[Note 14] The control device according to Note 13, which displays information in the first guide image indicating that the power mode cannot be switched to the first power mode.
[Note 15] The control device according to Note 13 or Note 14, which displays information about the estimated time until the power mode can be switched to the first power mode in the first guide image.

[Note 16] A control device according to any one of Notes 13 to 15, wherein information on the estimated time until the completion of the activation process is displayed in the second guidance image.
[Note 17] A control device according to any one of Notes 9 to 16, wherein, when the software update is performed in the first update procedure, a first completion notification image is displayed on the display unit after the activation process is completed, and when the software update is performed in the second update procedure, a second completion notification image different from the first completion notification image is displayed on the display unit after the activation process is completed.

[Note 18] The control device according to Note 17, which displays information in the first completion notification image indicating that the power mode can be switched to the first power mode.
[Note 19] The control device according to Note 17 or Note 18, which displays information in the second completion notification image indicating that the functions of the in-vehicle equipment that were restricted as a result of the activation process have become available.

[Note 20] The control device according to any one of Notes 9 to 19, wherein the in-vehicle device in which the software update is performed in the first update procedure is equipped with a single-bank storage module in which the updated software is installed in a storage area that stores the software before the update, and the in-vehicle device in which the software update is performed in the second update procedure is equipped with a dual-bank storage module in which the updated software is installed in a storage area separate from the storage area that stores the software before the update.

[Note 21] The data communication module for external vehicle communication is the control device described in any of Notes 9 to 20, which is the in-vehicle device on which the software update is performed in the second update procedure.
[Note 22] The advanced driver assistance system is the control device described in any of Notes 9 to 21, which is the in-vehicle device on which the software update is performed in the second update procedure.

[Note 23] The power control unit of the vehicle is the control device described in any of Notes 9 to 22, which is the in-vehicle device on which the software update is performed in the second update procedure.
[Note 24] The display unit is a control device described in any of Notes 1 to 23, which is installed in the vehicle.

[Note 25] The display unit is a control device according to any one of Notes 1 to 23, provided on an information terminal independent of the vehicle.
[Note 26] The control device is a server device independent of the vehicle, as described in any of Notes 1 to 25.

[Note 27] A vehicle equipped with a control device as described in any one of the items 1 to 25.
[Note 28] A control method for a display unit that displays progress information of software updates for in-vehicle equipment installed in a vehicle having a plurality of switchable power modes, wherein when the software update is performed in a first update procedure in which an activation process to activate update software installed in the in-vehicle equipment is performed in accordance with the switching of the power mode in a first switching pattern, a first confirmation image is displayed on the display unit before the start of the activation process, and when the software update is performed in a second update procedure in which the activation process is performed in accordance with the switching of the power mode in a second switching pattern different from the first switching pattern, a second confirmation image different from the first confirmation image is displayed on the display unit before the start of the activation process.

[Note 29] The control method described in Note 28, wherein information regarding the functional limitations of the vehicle resulting from the activation process is displayed in the first confirmation image, and information different from the information displayed in the first confirmation image is displayed in the second confirmation image as information regarding the functional limitations.

[Note 30] The control method according to Note 28 or Note 29, wherein information regarding the period during which the vehicle's functions are restricted due to the activation process is displayed in the first confirmation image, and information regarding a period different from the period for which information is displayed in the first confirmation image is displayed in the second confirmation image as information regarding the period during which the vehicle's functions are restricted.

[Note 31] The control method according to any one of Notes 28 to 30, wherein the first and second confirmation images include a display indicating whether or not to allow the start of the activation process.

[Note 32] A control method according to any one of Notes 28 to 31, which determines whether the software update is performed using the first update procedure or the second update procedure, based on the type of in-vehicle device to which the software update is to be performed.

[Note 33] A control method according to any one of Notes 28 to 32, which determines whether the software update is performed using the first update procedure or the second update procedure, based on the type of software to be updated.

[Note 34] The in-vehicle device on which the software update is performed in the first update procedure and the in-vehicle device on which the software update is performed in the second update procedure are the control methods described in any of Notes 28 to 33, which are classified according to the function of the in-vehicle device.

[Note 35] The control method according to any one of Notes 28 to 34, wherein, when the software update is performed in the first update procedure, the activation process of the in-vehicle device is started in response to the switching of the power mode in the first switching pattern; and when the software update is performed in the second update procedure, the activation process of the in-vehicle device is started in response to the switching of the power mode in the second switching pattern.

[Note 36] The control method according to any one of Notes 28 to 35, wherein the switching of the power supply mode in the first switching pattern is a switch from a first power supply mode in which the vehicle is drivable to a second power supply mode in which the vehicle is not drivable, and the switching of the power supply mode in the second switching pattern is a switch from the second power supply mode to the first power supply mode.

[Note 37] The control method described in Note 36, wherein the switching of the power mode in the first switching pattern is performed in accordance with the switching of the vehicle's power switch from on to off, and the switching of the power mode in the second switching pattern is performed in accordance with the switching of the power switch from off to on.

[Note 38] The control method according to Note 36 or Note 37, wherein information regarding the estimated time from when the power supply mode is switched to the second power supply mode until the power supply mode can be switched back to the first power supply mode is displayed within the first confirmation image.

[Note 39] The control method according to any one of Notes 36 to 38, wherein information regarding the estimated time from when the power mode switching from the second power mode to the first power mode is instructed until the activation process is completed is displayed within the second confirmation image.

[Note 40] The control method according to any one of Notes 36 to 39, wherein, when the software update is performed in the first update procedure, the first guidance image is displayed on the display unit during the activation process, and when the software update is performed in the second update procedure, a second guidance image different from the first guidance image is displayed on the display unit during the activation process.

[Note 41] The control method according to Note 40, wherein information indicating that the power mode cannot be switched to the first power mode is displayed in the first guide image.
[Note 42] The control method according to Note 40 or Note 41, wherein information on the estimated time until the power supply mode can be switched to the first power supply mode is displayed in the first guide image.

[Note 43] The control method according to any one of Notes 40 to 42, wherein information on the estimated time until the activation process is completed is displayed in the second guide image.
[Note 44] The control method according to any one of Notes 36 to 43, wherein when the software update is performed in the first update procedure, a first completion notification image is displayed on the display unit after the activation process is completed, and when the software update is performed in the second update procedure, a second completion notification image different from the first completion notification image is displayed on the display unit after the activation process is completed.

[Note 45] The control method according to Note 44, wherein information indicating that the power mode can be switched to the first power mode is displayed in the first completion notification image.
[Note 46] The control method according to Note 44 or Note 45, wherein information indicating that the functions of the in-vehicle equipment that were restricted as a result of the activation process have become available is displayed in the second completion notification image.

[Note 47] The control method according to any one of Notes 36 to 46, wherein the in-vehicle device in which the software update is performed in the first update procedure is equipped with a single-bank storage module in which the updated software is installed in a storage area that stores the software before the update, and the in-vehicle device in which the software update is performed in the second update procedure is equipped with a dual-bank storage module in which the updated software is installed in a storage area separate from the storage area that stores the software before the update.

[Note 48] The control method described in any of Notes 36 to 47, wherein the data communication module for external vehicle communication is the in-vehicle device on which the software update is performed in the second update procedure.

[Note 49] The advanced driver assistance system is the in-vehicle device on which the software update is performed in the second update procedure, as described in any of Notes 36 to 48.
[Note 50] The power control unit of the vehicle is the in-vehicle device on which the software update is performed in the second update procedure, as described in any of Notes 36 to 49.

[Note 51] The display unit is the control method described in any of Notes 28 to 50 installed in the vehicle.
[Note 52] The control method described in any of Notes 28 to 51, wherein the display unit is provided on an information terminal independent of the vehicle.

[Note 53] A program executed by a control device that controls a display unit that displays progress information of software updates for in-vehicle equipment installed in a vehicle having multiple switchable power modes, wherein, when the software update is performed in a first update procedure in which an activation process to activate the update software installed in the in-vehicle equipment is performed in accordance with the switching of the power mode in a first switching pattern, the program causes the control device to execute: a first display process that displays a first confirmation image on the display unit before the start of the activation process; and when the software update is performed in a second update procedure in which the activation process is performed in accordance with the switching of the power mode in a second switching pattern different from the first switching pattern, the program causes the control device to execute a second display process that displays a second confirmation image different from the first confirmation image on the display unit before the start of the activation process.

[Note 54] The program described in Note 53, wherein the first display process is a process of displaying information regarding the functional limitations of the vehicle resulting from the activation process within the first confirmation image, and the second display process is a process of displaying information different from the information displayed within the first confirmation image as the functional limitation information within the second confirmation image.

[Note 55] The program described in Note 53 or Note 54, wherein the first display process is a process that displays information in the first confirmation image regarding the period during which the vehicle's functions are restricted due to the execution of the activation process, and the second display process is a process that displays information in the second confirmation image as information regarding the period during which the vehicle's functions are restricted, for a period different from the period for which information is displayed in the first confirmation image.

[Note 56] The program described in any of Notes 53 to 55, wherein the first display process is a process of displaying a confirmation of the selection operation to allow or deny the start of the activation process within the first confirmation image, and the second display process is a process of displaying the confirmation confirmation within the second confirmation image.

[Note 57] A program described in any of Notes 53 to 56 that causes the control device to execute a process to determine whether the software update is performed using the first update procedure or the second update procedure, based on the type of in-vehicle device to which the software update is to be performed.

[Note 58] A program described in any of Notes 53 to 57 that causes the control device to execute a process to determine whether the software update is performed using the first update procedure or the second update procedure, based on the type of software to be updated.

[Note 59] When the software update is performed in the first update procedure, the program described in any of Notes 53 to 58 is to be executed by the control device. This program includes: a process to initiate the activation process of the in-vehicle device in response to the switching of the power mode in the first switching pattern; when the software update is performed in the second update procedure, a process to initiate the activation process of the in-vehicle device in response to the switching of the power mode in the second switching pattern; and a program described in any of Notes 53 to 58.

[Note 60] The program described in any of Notes 53 to 59, wherein the power mode switching in the first switching pattern is a switch from a first power mode in which the vehicle is drivable to a second power mode in which the vehicle is not drivable, and the power mode switching in the second switching pattern is a switch from the second power mode to the first power mode.

[Note 61] The program described in Note 60, wherein the power mode switching in the first switching pattern is performed in accordance with the switching of the vehicle's power switch from on to off, and the power mode switching in the second switching pattern is performed in accordance with the switching of the power switch from off to on.

[Note 62] The first display process is the program described in Note 60 or Note 61, which displays information about the estimated time from when the power mode is switched to the second power mode until the power mode can be switched back to the first power mode within the first confirmation image.

[Note 62] The second display process is a program described in any of Notes 60 to 62, which displays information about the estimated time from when the power mode switching from the second power mode to the first power mode is instructed until the activation process is completed, within the second confirmation image.

[Note 63] A program according to any one of Notes 53 to 62 that causes the control device to perform a third display process, which displays a first guidance image on the display unit during the activation process, when the software update is performed in the first update procedure, and a fourth display process, which displays a second guidance image different from the first guidance image on the display unit during the activation process, when the software update is performed in the second update procedure.

[Note 64] The third display process is the program described in Note 63, which displays information indicating that the power mode cannot be switched to the first power mode within the first guide image.

[Note 65] The third display process is the program described in Note 63 or Note 64, which displays information about the estimated time until the power mode can be switched to the first power mode within the first guidance image.

[Note 66] The fourth display process is a program described in any of Notes 63 to 65, which displays information about the estimated time until the activation process is completed within the second guidance image.

[Note 67] A program according to any one of Notes 53 to 66 that causes the control device to perform a fifth display process to display a first completion notification image on the display unit after the activation process is completed, when the software update is performed in the first update procedure, and a sixth display process to display a second completion notification image different from the first completion notification image on the display unit after the activation process is completed, when the software update is performed in the second update procedure.

[Note 68] The fifth display process is the program described in Note 67, which displays information indicating that the power mode can be switched to the first power mode within the first completion notification image.

[Note 69] The sixth display process is the program described in Note 67 or Note 68, which displays information in the second completion notification image indicating that the restricted functions of the in-vehicle device have become available following the execution of the activation process.

[Note 70] A storage medium containing the program described in any of Notes 53 to 69.

10. Vehicle 11. OTA Master (Control device, in-vehicle equipment)
12 DCM (vehicle equipment)
13 ADAS (vehicle equipment)
14 PCU (vehicle equipment)
15. Engine ECU (Onboard Equipment)
16. Transmission ECU (On-board equipment)
17. Brake ECU (On-board equipment)
18 HMI (vehicle equipment)
19 In-vehicle network 20 Mobile communication network 21 Memory module 22 Processor 23 Data storage 24 Power switch 30 OTA server 31 Storage device 32 Processor 40 Information terminal 41 Storage device 42 Processor 43 HMI
B, B1, B2 storage area

Claims (29)

A control device that controls a display unit that displays information regarding software updates for in-vehicle equipment installed in a vehicle having multiple switchable power modes,
When the software update is performed in a first update procedure in which an activation process to enable the update software installed on the in-vehicle device is performed in accordance with the switching of the power mode in the first switching pattern, a first confirmation image is displayed on the display unit before the start of the activation process.
When the software update is performed in a second update procedure that performs the activation process in response to the switching of the power mode in a second switching pattern different from the first switching pattern, a second confirmation image different from the first confirmation image is displayed on the display unit before the start of the activation process.
A control device that performs this function. The control device according to claim 1, wherein information regarding the functional limitations of the vehicle resulting from the activation process is displayed in the first confirmation image, and information different from the information displayed in the first confirmation image is displayed in the second confirmation image as information regarding the functional limitations. The control device according to claim 1, wherein information regarding the period during which the vehicle's functions are restricted due to the activation process is displayed in the first confirmation image, and information regarding a period different from the period for which information is displayed in the first confirmation image is displayed in the second confirmation image as information regarding the period during which the vehicle's functions are restricted. The control device according to claim 1, wherein the first and second confirmation images include a display indicating acceptance of a selection operation to permit or deny the start of the activation process. The control device according to claim 1, which determines whether the software update is performed using the first update procedure or the second update procedure, based on the type of in-vehicle device to which the software update is to be performed. The control device according to claim 1, which determines whether the software update is performed using the first update procedure or the second update procedure, based on the type of software to be updated. The control device according to claim 1, wherein the in-vehicle device on which the software update is performed in the first update procedure and the in-vehicle device on which the software update is performed in the second update procedure are classified according to the function of the in-vehicle device. When the software update is performed in the first update procedure, the activation process of the in-vehicle device is started in response to the switching of the power mode in the first switching pattern.
When the software update is performed in the second update procedure, the activation process of the in-vehicle device is started in response to the switching of the power mode in the second switching pattern.
The control device according to claim 1, which performs the following: The switching of the power mode in the first switching pattern is a switch from a first power mode in which the vehicle is in a state where it can run to a second power mode in which the vehicle is in a state where it cannot run.
The control device according to claim 1, wherein the switching of the power supply mode in the second switching pattern is a switching from the second power supply mode to the first power supply mode. The switching of the power mode in the first switching pattern is performed in accordance with the switching of the vehicle's power switch from on to off.
The control device according to claim 9, wherein the switching of the power mode in the second switching pattern is performed in accordance with the switching of the power switch from off to on. The control device according to claim 9, wherein information regarding the estimated time from when the power mode is switched to the second power mode until the power mode can be switched back to the first power mode is displayed within the first confirmation image. The control device according to claim 9, wherein information regarding the estimated time from when the power mode switching from the second power mode to the first power mode is instructed until the activation process is completed is displayed within the second confirmation image. When the software update is performed in the first update procedure, the first guidance image is displayed on the display unit during the activation process.
When the software update is performed in the second update procedure, a second guide image different from the first guide image is displayed on the display unit during the activation process.
The control device according to claim 9, which performs the following: The control device according to claim 13, wherein information indicating that the power mode cannot be switched to the first power mode is displayed within the first guide image. The control device according to claim 13, wherein information regarding the estimated time until the power mode can be switched to the first power mode is displayed within the first guidance image. The control device according to claim 13, wherein information regarding the estimated time until the completion of the activation process is displayed within the second guidance image. When the software update is performed in the first update procedure, the first completion notification image is displayed on the display unit after the activation process is completed.
When the software update is performed in the second update procedure, a second completion notification image different from the first completion notification image is displayed on the display unit after the activation process is completed.
The control device according to claim 9, which performs the following: The control device according to claim 17, wherein information indicating that the power mode can be switched to the first power mode is displayed within the first completion notification image. The control device according to claim 17, wherein information indicating that the functions of the in-vehicle device, which were restricted as a result of the activation process, have become available is displayed within the second completion notification image. The in-vehicle device on which the software update is performed in the first update procedure includes a single-bank storage module in which the updated software is installed in a storage area that stores the software before the update.
The control device according to claim 9 or 10, wherein the in-vehicle device on which the software update is performed in the second update procedure is equipped with a dual-bank storage module in which the updated software is installed in a storage area separate from the storage area in which the software before the update is stored. The control device according to claim 9, wherein the data communication module for external vehicle communication is the in-vehicle device on which the software update is performed in the second update procedure. The control device according to claim 9, wherein the advanced driver assistance system is the in-vehicle device on which the software update is performed in the second update procedure. The control device according to claim 9, wherein the vehicle's power control unit is the in-vehicle device on which the software update is performed in the second update procedure. The control device according to claim 1, wherein the display unit is installed in the vehicle. The control device according to claim 1, wherein the display unit is provided on an information terminal independent of the vehicle. The control device according to claim 1, wherein the control device is a server device independent of the vehicle. A vehicle equipped with the control device described in claim 1. A control method for a display unit that displays progress information of software updates for in-vehicle equipment installed in a vehicle having multiple switchable power modes,
When the software update is performed in a first update procedure in which the activation process for enabling the update software installed on the in-vehicle device is performed in accordance with the switching of the power mode in the first switching pattern, a first confirmation image is displayed on the display unit before the start of the activation process.
A control method in which, when the software update is performed in a second update procedure that performs the activation process in response to the switching of the power mode in a second switching pattern different from the first switching pattern, a second confirmation image different from the first confirmation image is displayed on the display unit before the start of the activation process. A program executed by a control device that controls a display unit that displays progress information for software updates of in-vehicle equipment installed in a vehicle having multiple switchable power modes,
When the software update is performed in a first update procedure in which an activation process to enable the update software installed on the in-vehicle device is performed in accordance with the switching of the power mode in a first switching pattern, a first display process is performed to display a first confirmation image on the display unit before the start of the activation process,
When the software update is performed in a second update procedure that performs the activation process in response to the switching of the power mode in a second switching pattern different from the first switching pattern, a second display process is performed to display a second confirmation image different from the first confirmation image on the display unit before the start of the activation process.
A program that causes the control device to execute the following.