Electronic control unit, software update method, software update program product and electronic control system

A non-transitory, computer readable, tangible storage medium storing a software update program executable on an electronic control unit including at least one processor, the software update program, when executed by the at least one processor, causing the at least one processor to serve as:

• a first virtual machine;
• a second virtual machine connected to the first virtual machine;
• a third virtual machine connected to the first virtual machine;
• a file acquisition portion that is configured to acquire a file to update software from an outside of the electronic control unit;
• an update management portion that is configured to manage updates of the software;
• a first update portion configured to update software of the first virtual machine;
• a second update portion configured to update software of the second virtual machine;
• and
• a third update portion configured to update software of the third virtual machine;
• the software update program, when executed by the at least one processor, causing the at least one processor to perform:
• accepting the file from the file acquisition portion;
• instructing one or more of the first update portion, in response to communication between the first update portion and the update management portion being established, to perform a software update using the file accepted from the file acquisition portion;
• instructing the second update portion, in response to communication between the second update portion and the update management portion being established, to perform a software update using the file accepted from the file acquisition portion;
• transmitting, with the at least one processor executing the software update program to serve as the update management portion, a search signal at a predetermined timing to each of the first and second update portions;
• transmitting, with the at least one processor executing the software update program to serve as the first update portion, a response signal to the update management portion if the first update portion receives the search signal from the update management portion;
• transmitting, with the at least one processor executing the software update program to serve as the second update portion, a response signal to the update management portion if the second update portion receives the search signal from the update management portion;
• instructing the first update portion to perform the software update if the update management portion receives the response signal from the first update portion;
• instructing the second update portion to perform the software update if the update management portion receives the response signal from the second update portion;
• and
• not instructing the second update portion and the third update portion to perform a software update using the accepted file, even if the communication between the update management portion and the third update portion is established, in response to the communication between the update management portion and the second update portion being not established and that in response to the software update for the second virtual machine being associated with the software update for the third virtual machine.

A method performed by

• a first electronic control unit having at least one first processor and at least one first memory storing first computer program code that, when executed by the at least one first processor, causes the at least one first processor to serve as a first virtual machine and a first update portion configured to update software of the first virtual machine;
• a second electronic control unit having at least one second processor and at least one second memory storing second computer program code that, when executed by the at least one second processor, causes the at least one second processor to serve as a second virtual machine and a second update portion configured to update software of the second virtual machine connected to the first virtual machine;
• and
• a third electronic control unit have at least one third processor and at least one third memory storing third computer program code that, when executed by the at least one third processor, causes the at least one third processor to serve as a third virtual machine and a third update portion configured to update software of the third virtual machine connected to the first virtual machine;
• the first computer program code, when executed by the at least one first processor, further configures the first virtual machine to serve as
• a file acquisition portion that is configured to acquire a file to update software from an outside of the first electronic control unit;
• and
• an update management portion that is configured to manage updates of the software;
• the first computer program code, when executed by the at least one first processor, further configures the first virtual machine, as the update management portion, to serve as:
• an acceptance portion that is configured to accept the file from the file acquisition portion;
• and
• an update instruction portion that is configured to instruct the second update portion, in response to communication between the second update portion and the update management portion being established, to perform a software update using the file accepted by the acceptance portion;
• and
• the method comprising:
• transmitting, with the at least one first processor executing the first computer program code as the update management portion, a search signal at a predetermined timing to the second update portion;
• transmitting, with the at least one second processor executing the second computer program code as the second update portion, a response signal to the update management portion if the second update portion receives the search signal from the update management portion;
• instructing, with the at least one first processor executing the first computer program code as the update management portion, the first update portion to perform the software update if the update management portion receives the response signal from the second update portion;
• not instructing, with the at least one first processor executing the first computer program code as the update instruction portion, not to instruct the second update portion and the third update portion to perform a software update using the file accepted by the acceptance portion, even if the communication between the update management portion and the third update portion is determined to be established, in response to the communication between the update management portion and the second update portion not being established and in response to the software update for the second virtual machine being associated with the software update for the third virtual machine.