JP2018181377A - Relay device, program update system, and program update method - Google Patents

Abstract

The time required for simultaneous update of control programs is shortened. A program update method executed by a relay device that communicates with a plurality of control devices belonging to an in-vehicle network stores a plurality of update programs that require simultaneous update for the plurality of control devices and a topology of the in-vehicle network. And a step (S9, 11, 13) of transmitting a plurality of update programs to the corresponding control devices, respectively, and the steps of transmitting include a plurality of independent units individually connected to the relay device. For a control device belonging to the in-vehicle network, it includes transmitting a plurality of programs corresponding to the control device in parallel. [Selection] Figure 5

Description

  The present invention relates to a relay device, a program update system, and a program update method, and more particularly to a technique for appropriately updating a control program of an on-vehicle control device.

2. Description of the Related Art In recent years, in the technical field of automobiles, vehicles are becoming more sophisticated, and a wide variety of on-vehicle devices are mounted on the vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are on-vehicle control devices for controlling the on-vehicle devices, are mounted on the vehicle.
For example, ECUs related to a travel system that controls the engine, brakes, EPS (Electric Power Steering), etc. in response to accelerator, brake, and steering wheel operation, headlights on / off according to switch operation by the occupant There are some which perform operations of meters disposed near the driver's seat, such as wiper ON / OFF, door lock / unlock, and the like.

Generally, the ECU is configured by an arithmetic processing unit such as a microcomputer, and the control of the on-vehicle device is realized by reading and executing the control program stored in a ROM (Read Only Memory).
The control program of the ECU may differ depending on the destination or grade of the vehicle, and it is necessary to rewrite the control program of the old version to the control program of the new version in response to the upgrade of the control program.

  For example, in Patent Documents 1 and 2, each gateway of a vehicle communication device or the like receives an update program from the management server, and the ECU rewrites the control program from the old version to the new version using the received update program. A technique is disclosed that remotely executes program update to an ECU by wireless communication.

Unexamined-Japanese-Patent No. 2007-65856 JP, 2011-70307, A

  In recent vehicles, many devices move in conjunction. Therefore, in order to guarantee the operation of the vehicle, it may be required to update, at the same timing, a plurality of programs which are control programs of the respective associated ECUs. The control program is updated by passing the update program to the ECU and rewriting the control program in the ECU. Therefore, “the required update time”, which is the time required to update the control program in one ECU, is a time including the time required to transmit the update program to the ECU and the time required to rewrite the control program.

  When there is a need to update the control program of each of the plurality of ECUs at the same timing, each of the plurality of ECUs performs the above-described update operation. In the vehicle, when the update of the control program for a plurality of related ECUs is started, the vehicle can not be operated until the update of the control program is completed in all the ECUs. That is, the time from the start of transmission to the ECU of the first program among the plurality of updating programs for the plurality of control programs updated at the same timing to the completion of the rewriting in the ECU of the last updating program ( Hereinafter, this time is referred to as “simultaneous update required time”), and the vehicle can not be operated.

  When the plurality of ECUs updating the control program at the same timing perform the update in order, the simultaneous update required time becomes the sum of the required time for the update in each of the plurality of ECUs, and becomes longer. The longer the simultaneous update required time, the longer the time when the vehicle can not be operated.

  The present invention has been made in view of such problems, and provides a relay device, a program update system, and a program update method capable of shortening the simultaneous update required time when updating a plurality of programs at the same timing. .

  According to an embodiment, the relay device is a relay device that communicates with the plurality of control devices belonging to the in-vehicle network, and has a plurality of update programs that require simultaneous updating of the plurality of control devices, and the topology of the in-vehicle network Storage units storing in the vehicle, an in-vehicle communication unit transmitting a plurality of update programs to the corresponding control devices, and control devices belonging to a plurality of independent on-vehicle networks individually connected to the own device And a control unit that controls the in-vehicle communication unit to transmit in parallel a plurality of update programs corresponding to.

  According to another embodiment, the program update system includes a plurality of control devices belonging to the in-vehicle network and a relay device communicating with the plurality of control devices, and the relay device needs the simultaneous update to the plurality of control devices Storage units for storing a plurality of update programs having different characteristics, the topology of the in-vehicle network, an in-vehicle communication unit for transmitting the plurality of update programs to the corresponding control device, and The control device that belongs to the plurality of in-vehicle networks includes a control unit that controls the in-vehicle communication unit to transmit the plurality of update programs corresponding to the control device in parallel.

  According to another embodiment, the program updating method is a program updating method executed by a relay device communicating with a plurality of control devices belonging to the in-vehicle network, and a plurality of updates having a need for simultaneous updating of a plurality of control devices Storing the program and the topology of the in-vehicle network; and transmitting each of the plurality of update programs to the corresponding control device, wherein the transmitting includes a plurality of independent transmissions individually connected to the relay device. The control device belonging to the in-vehicle network includes transmitting in parallel a plurality of update programs corresponding to the control device.

  According to the present invention, it is possible to shorten the time required for simultaneous updating of the control program of the control device mounted on the vehicle.

BRIEF DESCRIPTION OF THE DRAWINGS It is a whole block diagram of the program update system which concerns on embodiment of this invention. It is a block diagram which shows the internal structure of a gateway. It is a block diagram which shows the internal structure of ECU. It is a block diagram which shows the internal structure of a management server. FIG. 7 is a sequence diagram showing an example of simultaneous updating of control programs for a plurality of ECUs. It is a flowchart showing the flow of the scheduling process of step S8 of FIG. It is a figure showing the 1st example of the update program which needs the simultaneous update. It is the figure which compared and showed the update schedule (A) when not performing a scheduling process, and the update schedule (B) when performing a scheduling process. It is a figure showing the 2nd example of the update program which needs the simultaneous update. It is the figure which compared and showed the update schedule (A) when not performing a scheduling process, and the update schedule (B) when performing a scheduling process. It is a figure showing the 3rd example of the update program which needs the simultaneous update. It is the figure which compared and showed the update schedule (A) when not performing a scheduling process, and the update schedule (B)-(D) when performing a scheduling process according to each scheduling conditions AC.

[Description of the embodiment]
The present embodiment includes at least the following.
That is, the relay device included in the present embodiment is a relay device that communicates with a plurality of control devices belonging to the in-vehicle network, and has a plurality of update programs that require simultaneous updating of the plurality of control devices; For the storage unit storing the topology, the in-vehicle communication unit transmitting each of the plurality of update programs to the corresponding control device, and the control devices belonging to the plurality of independent on-vehicle networks individually connected to the own device And a control unit that controls the in-vehicle communication unit to transmit a plurality of update programs corresponding to the control device in parallel.
According to this configuration, the update program for the control device belonging to the plurality of independent on-vehicle networks individually connected to the relay device among the plurality of update programs having the need for simultaneous update from the relay device The start of transmission can be done simultaneously. Therefore, the total transmission time of the plurality of update programs can be shortened compared to the case where the plurality of update programs are sequentially transmitted after the end of the rewrite of the control program. As a result, the simultaneous update required time can be shortened.

Preferably, in the relay device, the control unit determines the transmission order of the plurality of update programs according to a predetermined condition.
By setting appropriate conditions in the relay device, it is possible to shorten the total time taken to transmit a plurality of update programs that need simultaneous update. As a result, the simultaneous update required time can be shortened.

Preferably, the predetermined condition is a scheduling condition for shortening the simultaneous update required time which is a combination of update required times including the following first to third times in each control device, and the simultaneous update required time is The end of the third time for the update program for which the rewriting of the control program ends at the end of the plurality of update programs from the start of the first time for the update program transmitted to the control device first among the plurality of update programs It is time to time.
First time: Transmission time of update program Second time: time required to check update program Third time: time required to rewrite control program using update program With this configuration, multiple updates that require simultaneous update The total time taken to transmit the program can be shortened. As a result, the simultaneous update required time can be shortened.

Preferably, the scheduling conditions include, for a plurality of control devices included in one in-vehicle network having a bus topology, a control device having a longer third time has a transmission order of update programs earlier.
With this configuration, the update program with the longer time required to rewrite the control program is transmitted earlier, and the rewriting of the control program is started first. Then, in parallel with the rewriting of the control program, the next update program is transmitted. Therefore, the simultaneous update required period can be shortened rather than transmitting the update program sequentially after the end of the rewriting of each control program.

Preferably, the scheduling condition includes, for a plurality of control devices included in one in-vehicle network having a bus topology, a control device having a shorter first time has an earlier transmission order of update programs.
According to this configuration, the check of the update program and the rewriting of the control program can be quickly started in the corresponding control device for each update program. Further, in parallel with the check of the update program and the rewriting of the control program, the next update program Is transmitted. Therefore, the simultaneous update required period can be shortened more than transmitting the update program sequentially after the end of the rewriting of each control program.

Preferably, the scheduling condition includes determining the transmission order of the plurality of control devices included in one in-vehicle network having a bus topology based on the identification information given to the control devices.
According to this configuration, by previously providing identification information such as a name suitable for each control device, the required update period can be further shortened.

Preferably, in the case where one in-vehicle network includes a main network directly connected to the apparatus itself and a local network that branches the control device included in the main network as a branch node, the scheduling condition belongs to the local network The order of transmission to the control device may be earlier than the transmission order of the control devices included in the main network.
With this configuration, in parallel with transmission of the update program on the local network, the next update program can be transmitted on the main network, and the total transmission time of the plurality of update programs can be shortened. As a result, the simultaneous update required time can be further shortened.

Preferably, the control unit determines the transmission rate of the main network according to whether or not the branch node has a buffer function to absorb the difference between the transmission rate in the main network and the transmission rate in the local network.
With this configuration, transmission of the update program in the main network can be efficiently performed, and the total transmission time of the plurality of update programs can be shortened.

The program update system included in the present embodiment is a program update system including a plurality of control devices belonging to the in-vehicle network and a relay device for communicating with the plurality of control devices, and the relay device is a plurality of control devices Storage unit for storing a plurality of update programs that need simultaneous update for the network, topology of the in-vehicle network, in-vehicle communication unit for transmitting the plurality of update programs to corresponding control devices, and individually connected to own device And a control unit configured to control the in-vehicle communication unit to simultaneously transmit a plurality of update programs corresponding to the plurality of control devices belonging to the plurality of in-vehicle networks independent of each other.
According to this configuration, the update program for the control device belonging to the plurality of independent on-vehicle networks individually connected to the relay device among the plurality of update programs having the need for simultaneous update from the relay device The start of transmission can be done simultaneously. Therefore, the total transmission time of the plurality of update programs can be shortened compared to the case where the plurality of update programs are sequentially transmitted after the end of the rewrite of the control program. As a result, the simultaneous update required time can be shortened.

The program update method included in the present embodiment is a program update method executed by a relay device that communicates with a plurality of control devices belonging to the in-vehicle network, and a plurality of update programs having the necessity of simultaneous update for a plurality of control devices. , Storing the topology of the in-vehicle network, and transmitting each of the plurality of update programs to the corresponding control device, wherein the steps of transmitting include a plurality of mutually independent relay devices individually connected to the relay device. The control device belonging to the in-vehicle network includes transmitting in parallel a plurality of update programs corresponding to the control device.
According to this configuration, the update program for the control device belonging to the plurality of independent on-vehicle networks individually connected to the relay device among the plurality of update programs having the need for simultaneous update from the relay device The start of transmission can be done simultaneously. Therefore, the total transmission time of the plurality of update programs can be shortened compared to the case where the plurality of update programs are sequentially transmitted after the end of the rewrite of the control program. As a result, the simultaneous update required time can be shortened.

[Details of the embodiment]
Hereinafter, preferred embodiments will be described with reference to the drawings. In the following description, the same parts and components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, these descriptions will not be repeated.

First Embodiment
[Whole system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to an embodiment of the present invention.
As shown in FIG. 1, the program update system of the present embodiment includes a vehicle 1 that can communicate via the wide area communication network 2, a management server 5, and a DL (download) server 6.
The management server 5 and the DL server 6 are operated, for example, by a car maker of the vehicle 1 and can communicate with a large number of vehicles 1 owned by a user who has been registered as a member in advance.

The vehicle 1 is mounted with a gateway 10, a wireless communication unit 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the respective ECUs 30.
The vehicle 1 has a communication group (in-vehicle network) by a plurality of ECUs 30 bus-connected to a common in-vehicle communication line, and the gateway 10 relays communication between communication groups and communication between the ECU 30 and devices outside the vehicle. It functions as a relay device. For this reason, a plurality of in-vehicle communication lines are connected to the gateway 10.

  Specifically, a plurality of buses, each of which is connected to one or more ECUs 30 to constitute a communication group, are connected to the gateway 10 to form a network topology. As an example, as shown in FIG. 1, the gateway 10 is connected to a first bus NW1 and a second bus NW2 which are main buses. Three ECUs (ECU_A, ECU_B, and ECU_C) 30 are connected to the bus NW1. One ECU (ECU_F) 30 is connected to the bus NW2. The network topology in which three ECUs (ECU_A, ECU_B, and ECU_C) 30 are connected to the main bus NW1 and the network topology in which one ECU (ECU_F) 30 is connected to the main bus NW2 are bus topology. The main buses NW1 and NW2 as transmission paths can be shared by a plurality of ECUs connected to each. Therefore, in order to collide and interfere the signals, it is necessary to control so that the transmission of the signals is not simultaneously performed.

  Any one of the plurality of ECUs 30 may be further connected to the local bus. For example, in FIG. 1, the bus NW1 branches to a third bus NW3 which is a local bus, with one connected ECU (ECU_C) 30 as a branch node. Two more ECUs (ECU_E, ECU_D) 30 are connected to the bus NW3 to form a bus topology. The ECU_C relays the transmission of signals between the two ECUs (ECU_E and ECU_D) 30 connected to the bus NW3 and the gateway 10.

The wireless communication unit 15 is communicably connected to a wide area communication network 2 such as a cellular phone network, and is connected to the gateway 10 by an in-vehicle communication line. The gateway 10 transmits the information received by the wireless communication unit 15 from the external device such as the management server 5 and the DL server 6 through the wide area communication network 2 to the ECU 30.
The gateway 10 transmits the information acquired from the ECU 30 to the wireless communication unit 15, and the wireless communication unit 15 transmits the information to an external device such as the management server 5 or the like.

  In FIG. 1, the gateway 10 is connected to the wireless communication unit 15 via an in-vehicle communication line, but these may be configured by one device.

  Moreover, in the program update system of FIG. 1, although the management server 5 and the DL server 6 are comprised by a separate server, you may comprise these servers 5 and 6 by one server apparatus.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing an internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a central processing unit (CPU) 11, a random access memory (RAM) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected via the wireless communication unit 15 and the in-vehicle communication line, but these may be configured by one device.

The CPU 11 causes the gateway 10 to function as a relay device for various information by reading out one or more programs stored in the storage unit 13 to the RAM 12 and executing the program.
The CPU 11 can execute a plurality of programs in parallel by switching and executing a plurality of programs in time division, for example. The RAM 12 is configured by a memory element such as an SRAM (Static RAM) or a DRAM (Dynamic RAM), and temporarily stores programs executed by the CPU 11 and data required for the execution.

The storage unit 13 is configured by a non-volatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory).
The storage unit 13 has a storage area for storing a program executed by the CPU 11 and data required for the execution. The storage unit 13 also stores an update program of each ECU 30 received from the DL server 6 and the like. Further, the storage unit 13 also stores a topology formed by each ECU 30 and the buses NW1 to NW3 which are in-vehicle networks. The topology of the in-vehicle network is used in the transmission of the update program and in the scheduling process described later.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1. The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark), etc. The communication with the ECU 30 is performed in accordance with the standard.
The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11. The in-vehicle communication unit 14 may communicate not only with the above communication standard but also with another communication standard used for the in-vehicle network.

The wireless communication unit 15 is a wireless communication device including an antenna and a communication circuit that performs transmission and reception of a wireless signal from the antenna. The wireless communication unit 15 can communicate with an external device by being connected to a wide area communication network 2 such as a cellular phone network.
The wireless communication unit 15 transmits the information given from the CPU 11 to the device outside the vehicle such as the management server 5 via the wide area communication network 2 formed by the base station (not shown), and sends the information received from the device outside the vehicle to the CPU 11 give.

Instead of the wireless communication unit 15 shown in FIG. 2, a wired communication unit functioning as a relay device in the vehicle 1 may be employed. The wired communication unit has a connector to which a communication cable conforming to the standard such as USB (Universal Serial Bus) or RS232C is connected, and performs wired communication with another communication device connected via the communication cable.
When another communication device and an external device such as the management server 5 can wirelessly communicate through the wide area communication network 2, the external device → another communication device → the wired communication unit → the communication path of the gateway 10 Communication between the device and the gateway 10 becomes possible.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing an internal configuration of the ECU 30. As shown in FIG.
As shown in FIG. 3, the ECU 30 includes a CPU 31, a RAM 32, a storage unit 33, a communication unit 34, and the like. The ECU 30 is an on-vehicle control device that individually controls target devices mounted on the vehicle 1. The types of ECUs 30 include, for example, an engine control ECU, a steering control ECU, and a door lock control ECU.

The CPU 31 reads one or more programs stored in advance in the storage unit 33 into the RAM 32 and executes the programs to control the operation of the target device that the CPU 31 takes charge of.
The RAM 32 is configured by a memory element such as an SRAM or a DRAM, and temporarily stores programs executed by the CPU 31 and data necessary for the execution.

The storage unit 33 is configured by a non-volatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The information stored in the storage unit 33 includes, for example, a computer program (hereinafter, referred to as “control program”) for causing the CPU 31 to execute information processing for controlling a target device to be controlled in the vehicle.

A gateway 10 is connected to the communication unit 34 via an in-vehicle communication line disposed in the vehicle 1. Communication unit 34 communicates with gateway 10 in accordance with a standard such as CAN, Ethernet, or MOST, for example.
The communication unit 34 transmits the information given from the CPU 31 to the gateway 10, and gives the information received from the gateway 10 to the CPU 31. The communication unit 34 may communicate not only with the above communication standard but also with another communication standard used for the in-vehicle network.

The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode of the CPU 31 to either the “normal mode” or the “reprogramming mode” (hereinafter also referred to as “repro mode”).
Here, the normal mode refers to a control mode in which the CPU 31 of the ECU 30 executes the inherent control (for example, engine control for the fuel engine, door lock control for the door lock motor, etc.) for the target device.

The reprogramming mode is a control mode in which a control program used to control a target device is updated.
That is, the reprogramming mode is a control mode in which the CPU 31 erases or rewrites the control program with respect to the ROM area of the storage unit 33. The CPU 31 can update the control program stored in the ROM area of the storage unit 33 to a new version only in this control mode.

When the CPU 31 writes the control program of the new version in the storage unit 33 in the repro mode, the activation unit 35 once restarts (resets) the ECU 30 and executes verification processing on the storage area in which the control program of the new version is written. .
The start-up unit 35 operates the CPU 31 with the control program after the update after the completion of the verification process.

[Internal configuration of management server]
FIG. 4 is a block diagram showing an internal configuration of the management server 5.
As illustrated in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads one or a plurality of programs stored in advance in the ROM 52 into the RAM 53 and executes them to control the operation of each hardware, and causes the management server 5 to function as an external device capable of communicating with the gateway 10.
The RAM 53 is configured by a memory element such as an SRAM or a DRAM, and temporarily stores programs executed by the CPU 51 and data required for the execution.

The storage unit 54 is configured of a non-volatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 is a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to a wide area communication network 2 such as a mobile telephone network to execute the communication processing. The communication unit 55 transmits the information provided from the CPU 51 to an external device via the wide area communication network 2, and supplies the information received via the wide area communication network 2 to the CPU 51.

As shown in FIG. 4, in the information stored in the storage unit 54, the ECU 30 mounted on the vehicle 1 (here, the identification numbers of the ECU 30 mounted on the vehicle 1 with VIN = 1 are 1 to 3). A revision table RT in which the version of the control program of.
The revision table RT includes a vehicle identification number (VIN) of the vehicle 1, a revision number which is identification information representing a history of revision upgrade for each vehicle identification number, and a version of ECUs 1 to 3 corresponding to each revision number It consists of a table.

In the revision table RT of FIG. 4, the version of the control program of each of the ECUs 1 to 3 included in the same revision number indicates that the operation confirmation has been obtained in the car maker.
For example, in the case of "R 2.0" which is the current revision number, the operation of the control program of version 1.0 of ECU 1, the control program of version 1.3 of ECU 2, and the control program of version 2.0 of ECU 3 Confirmation has been taken.

In the case of the latest revision number “R2.4”, the operation check of the control program of version 1.2 of ECU 1, the control program of version 2.0 of ECU 2, and the control program of version 2.2 of ECU 3 I can take it.
Therefore, when upgrading the vehicle 1 from R2.0 to R2.4, the ECU 1 is upgraded from 1.0 to 1.2, and the ECU 2 is upgraded from 1.3 to 2.0 (updated) , And version upgrade (update) of ECU 3 from 2.0 to 2.2 at the same time. Here, “same timing” means that the plurality of ECUs 30 shift to the repro mode in response to the request from the gateway 10, and then are reset in response to the request from the gateway 10, and normally after the verification process is completed. Indicates the timing to return to the mode. In the following description, updating a plurality of control programs at the same timing in the above sense is also referred to as “simultaneous updating”.

In the revision table RT of FIG. 4, only version information in the case of the vehicle identification number VIN = 1 is illustrated as an example.
However, version information similar to the above is recorded in the revision table RT held by the management server 5 for each vehicle identification number (VIN) of all the vehicles 1 owned by the registered member of the management server 5. Further, the DL server 6 stores a plurality of update programs related to all the ECUs 30.

When notified of the vehicle identification number and the current control program version of each ECU 1 to 3 from the gateway 10, the CPU 51 collates the notified version information with the latest version of the vehicle identification number included in the revision table RT. .
When the CPU 51 determines that the version information of the ECUs 1 to 3 notified from the gateway 10 is not the latest as a result of the collation, the storage destination URL of the update program for updating to the latest version and the download request are Send.

Sequence of Simultaneous Update of Control Program
FIG. 5 is a sequence diagram showing an example of simultaneous updating of control programs for a plurality of ECUs 1 to 3 executed in the program updating system of the present embodiment. In addition, below, the case where the control program of each ECU1-3 is updated as follows according to the revision table RT of FIG. 4 is assumed.
Revision number: R2.0 → R2.4
ECU1: Version 1.0 → Version 1.2
ECU 2: Version 1.3 → Version 2.0
ECU3: Version 2.0 → Version 2.2

The update program may be a new version of the program itself, but in this embodiment, it is assumed that it is a difference program from the old version. In this case, if the update program Δ including the difference information between the files of the old version and the new version is in the same storage area, the update version Δ can be updated to the new version by applying the update program Δ to the old version.
The update program from version 1.0 to version 1.2 of ECU1 is “Δ1”, the update program from version 1.3 to version 2.0 of ECU 2 is “Δ2”, the version from version 2.0 of ECU 3 is The update program to 2.2 is called "Δ3".

As shown in FIG. 5, in the simultaneous updating of the control program of the present embodiment, as an example, the gateway 10 collects the current version information of the control program of each of the ECUs 1 to 3 (step S1).
In the illustrated example, the current version of the control program of the ECU 1 is "1.0", the current version of the control program of the ECU 2 is "1.3", and the current version of the control program of the ECU 3 is "2.0" It is.

Next, the gateway 10 transmits the collected version information of the control programs of the ECUs 1 to 3 and the vehicle identification number (VIN) of the own vehicle to the management server 5 (step S2).
The management server 5 searches each of the ECUs 1 to 3 for each of the ECUs 1 to 3 of the vehicle 1 by searching the above-mentioned revision table RT (see FIG. 4) based on the version information and the vehicle identification number notified from the gateway 10. It is determined whether it is necessary to update the control program of at the same timing.

Here, since the ECU 1 is version 1.0, the ECU 2 is version 1.3, and the ECU 3 is version 2.0, the management server 5 determines that the vehicle 1 is operating at revision R 2.0. Do.
In addition, since the management server 5 has the latest revision R2.4, the update to the version 1.2 of the ECU 1, the update to the version 2.0 of the ECU 2, and the version 2.2 of the ECU 3 It is determined that the update needs to be performed at the same timing.

Therefore, the management server 5 transmits, to the gateway 10, the storage destination URLs of the update programs Δ1 to Δ3 of the ECUs 1 to 3 and the download request to the gateway 10 that has transmitted the version information (step S3).
Thereby, the gateway 10 downloads the update programs Δ1 to Δ3 for the respective ECUs 1 to 3 from the DL server 6 (step S4). The gateway 10 temporarily stores and stores the received update programs Δ1 to Δ3 in the storage unit 13 of the own device.

When the storage of the update programs Δ1 to Δ3 is completed, the gateway 10 transmits, to the management server 5, that the DL is normally completed (step S5). If the update is to be performed automatically continuously, the management server 5 that has received the DL completion notification transmits a control program update request to the gateway 10. After the DL is completed, the control program update request may be transmitted to the gateway 10 after being temporarily interrupted and receiving an update request from the outside (step S6).
The gateway 10 having received the update request transmits the repro mode shift request to each of the ECUs 1 to 3 in order to update the control program using the update programs Δ1 to Δ3 stored in the storage unit 13 (step S7).

  When receiving the repro mode shift request, each of the ECUs 1 to 3 switches its control mode from the normal mode to the reprogramming mode. As a result, each of the ECUs 1 to 3 is in a state where expansion of the update programs Δ1 to Δ3 and processing for rewriting the current control program into the control program of the new version are possible.

  Here, when there are a plurality of control programs to be simultaneously updated, the gateway 10 executes a scheduling process for determining the transmission order of the update programs Δ1 to Δ3 stored in the storage unit 13 (step S8).

  When the update program Δ is transmitted to the ECU, the ECU performs integrity check using the message digest (MD) 5, cyclic redundancy code (CRC), etc. Then, the original file is confirmed using the digital signature, etc., and after confirmation that no alteration is made, the file is expanded (rewritten) and applied to the old version. That is, for updating the control program, transmission from the gateway 10 to the corresponding ECU (first task), checking of the update file (second task), and development (update) of the program in the ECU (third) There are three tasks: The “time required for updating”, which is the time required to update the control program in each ECU, is the time required for the first task (first time), the time required for the second task (second time), and the third Includes the time taken for the task (third time). When the operation for updating the control program is only the first to third tasks, the update required time is the sum of the first to third time (update required time = first time + second time) Time + third time).

  When simultaneously updating a plurality of control programs for each of a plurality of ECUs, the same timing is from the start of transmission of the first update program to the corresponding ECU to the completion of the rewriting of the control program in the corresponding ECU by the last update program. And “simultaneous update required time” required to update the control program. In other words, the simultaneous update required time is the third time of the update program at the end of the rewrite of the control program from the start of the first time of the update program transmitted to the ECU at the beginning of the plurality of update programs. The time until the end of the

  When there are multiple control programs to be updated simultaneously, all ECUs maintain the repro mode until all control programs have been updated. That is, if at least one of the corresponding plurality of ECUs is updating the control program, the repro mode of all the plurality of ECUs is maintained. Therefore, the return from the repro mode to the normal mode is delayed as the simultaneous update required time lengthens. Since the vehicle 1 can not be used during the repro mode, for example, when the repro mode continues for a long time when the user wants to drive, it causes inconvenience and disadvantage for the user. Therefore, in the program update system according to the present embodiment, when simultaneously updating a plurality of control programs, scheduling processing is performed so as to shorten the required simultaneous update time.

  The scheduling process uses the first to third times of each update program and the topology of the in-vehicle network. The time required for each task of each update program may be passed from the management server 5 to the gateway 10. In this case, the management server 5 obtains information on the update program from the DL server 6, and calculates the time required for each task based on the information. The information on the update program is, for example, the data size of the update program. Alternatively, in the gateway 10, using the update program transmitted from the DL server 6 and the information obtained from each ECU 30, or the information of each part of the vehicle 1 stored in advance, It may be calculated. The gateway 10 transmits the update program stored in the storage unit 13 to each ECU in accordance with the transmission order determined by the scheduling process of step S8 (steps S9, 11, 13).

That is, the gateway 10 transmits the update program Δ1 determined to be transmitted first to the corresponding ECU 1 (step S9).
The ECU 1 rewrites the control program from the old version 1.0 to the new version 1.2 by expanding the received update program Δ1 and applying it to the old version 1.0. When the rewrite is completed, the ECU 1 transmits a rewrite completion notification to the gateway 10 (step S10).

Next, the gateway 10 transmits the update program Δ2 determined to be transmitted next to the corresponding ECU 2 (step S11).
The ECU 2 rewrites the control program from the old version 1.3 to the new version 2.0 by expanding the received update program Δ2 and applying it to the old version 1.3. When the rewriting is completed, the ECU 2 transmits a notification of completion of the rewriting to the gateway 10 (step S12).

Next, the gateway 10 transmits the update program Δ3 determined to be transmitted next to the corresponding ECU 3 (step S13).
The ECU 3 rewrites the control program from the old version 2.0 to the new version 2.2 by expanding the received update program Δ3 and applying it to the old version 2.0. When the rewrite is completed, the ECU 3 transmits a rewrite completion notification to the gateway 10 (step S14).

  The transmission of the update program Δ to each of the plurality of ECUs 30 in steps S9, 11, 13 is performed according to the transmission order determined by the scheduling process in step S8 as described above. The determined transmission order is not necessarily limited to transmission to each of the plurality of ECUs 301. That is, the transmission order in which the respective update programs Δ are simultaneously transmitted to the plurality of ECUs 30 may also be determined. That is, the above steps S9, 11, and 13 do not mean to be executed in this order, but the respective processes are performed in a prescribed transmission order, and are simultaneously executed according to the prescribed transmission order. It is also possible.

When the gateway 10 receives the notification of completion of rewriting from all the ECUs 1 to 3, it transmits a normal mode shift request and a reset request to the respective ECUs 1 to 3 (step S15).
Each of the ECUs 1 to 3 which has received the normal mode shift request switches its control mode from the repro mode to the normal mode, and restarts the system in response to the reset request. Thus, each of the ECUs 1 to 3 operates with the control program of the new version.

In addition, when the gateway 10 receives the notification of completion of rewriting from all the ECUs 1 to 3, the gateway 10 transmits an update completion notification to the management server 5 (step S16).
Thus, the management server 5 detects that all the control programs have been updated for each of the ECUs 1 to 3 of the vehicle 1.

Scheduling process
FIG. 6 is a flowchart showing the flow of the scheduling process of step S8. The scheduling process shown in the flowchart of FIG. 6 is realized by the CPU 11 of the gateway 10 reading out a program for scheduling process execution stored in the storage unit 13 on the RAM 12 and executing the program. At this time, as shown in FIG. 2, the CPU 11 includes a scheduling unit 111 and an update control unit 112 which are functions realized by executing the program. Scheduling processing is realized by the CPU 11 exerting these functions. The operation represented in the flowchart of FIG. 6 is started when a plurality of update programs are obtained from the DL server 6 and there are a plurality of control programs to be updated simultaneously.

  Referring to FIG. 6, CPU 11 of gateway 10 identifies a plurality of main buses NW1 and NW2 connected to gateway 10 based on the topology of the in-vehicle network stored in storage unit 13. The following scheduling processes are executed in parallel (step S101).

  First, based on the destinations of each of the plurality of update programs that need simultaneous update and the topology of the in-vehicle network stored in the storage unit 13, the CPU 11 uses the plurality of update programs for the ECU belonging to the local bus Determine if the update program is included. In the example of FIG. 1, the CPU 11 determines whether the plurality of update programs include an update program for ECU_D or ECU_E.

  When the update programs for the ECUs connected via the local bus are included in the plurality of update programs having the need for simultaneous update (YES in step S103), the CPU 11 further branches the main bus to the local bus The node ECU (ECU_C) determines whether the relay buffer for relaying the transmission of the update program can be used, that is, whether it has a buffer function. The relay buffer is used to absorb the difference in transmission capability (transmission speed) between the main bus and the local bus. In the example of FIG. 1, it is determined whether the ECU_C can use the relay buffer.

  If the ECU that is a branch node can use the relay buffer (has a buffer function) (YES in step S105), the ECU belonging to the local bus in the main bus without considering the transmission speed on the local bus It can transmit updates. In this case, on the premise that transmission of the update program on the main bus (NW1) branched to the local bus is exclusive, that is, the transmission path can not be shared simultaneously for multiple transmissions, the CPU 11 performs subsequent scheduling. A process is performed (step S107). If there is no difference in transmission speed between the main bus and the local bus, or if the transmission speed on the local bus is faster than the transmission speed on the main bus, the ECU that is the branch node can use the relay buffer. Perform the same scheduling process as in the case. Specifically, when the ECU_C can use the relay buffer, the CPU 11 performs the following scheduling processing on the assumption that the main bus NW1 can not be shared for transmission of a plurality of update programs at the same time.

  If the transmission speed on the local bus is slower than the transmission speed on the main bus, and the ECU that is the branch node can not use the relay buffer (does not have a buffer function) (NO in step S105), the local bus Therefore, it is necessary to transmit the update program on the main bus at a speed corresponding to the transmission speed on the local bus in consideration of the transmission speed on the local bus. In this case, the CPU 11 can transmit the update program in parallel on the main bus (NW1), that is, the transmission of the update program to the ECU belonging to the local bus and the transmission of another update program simultaneously On the premise that sharing is possible, the following scheduling process is executed (step S109). Specifically, when the transmission speed on the local bus NW3 is lower than the transmission speed on the main bus NW1 and the ECU_C can not use the relay buffer, the CPU 11 operates the local bus NW3 on the main bus NW1. The following scheduling process is performed on the assumption that the transmission of the update program in step (c) and the transmission of another update program can be performed in parallel.

  In any of the scheduling processes, when the transmission of the update program on a certain bus is completed, the transmission of the next update program is started so as not to generate an idle band in the bus.

  Specifically, the CPU 11 determines the transmission order of a plurality of control programs that need to be updated simultaneously according to each of a plurality of scheduling conditions defined in advance (steps S111 to S115). For example, in the case where the condition “schedule with priority the update program having a long update time” is defined as the condition A, the CPU 11 requires the update requiring the sum of the first time to the third time described above for each update program. The transmission order is determined based on the order of time (step S111). The transmission order determined according to the scheduling condition which is the condition A is set as the transmission order A.

  When the condition “schedule the update program having a short transmission time with priority” is defined as the condition B, the CPU 11 determines the transmission order for each update program based on the order of the first time (step S113). . The transmission order determined according to the scheduling condition which is the condition B is set as the transmission order B.

  In the case where the condition C “scheduling in the order of identification information (for example, name, ID, etc.) given to the ECU” is defined as the condition C, the CPU 11 determines, for each update program, for example, the name The transmission order is determined based on the order (step S115). The transmission order determined according to the scheduling condition which is the condition C is set as the transmission order C.

  The CPU 11 executes the scheduling process according to each of a plurality of scheduling conditions (conditions A to C) defined in advance, determines the transmission order, compares the result (transmission order A to C), and requires simultaneous updating The transmission order with the shortest period is taken as the transmission order of the plurality of update programs (step S117). The CPU 11 executes the above scheduling process in parallel on each of the main buses NW1 and NW2 (step S119), and terminates the series of processes in step S8.

  After executing the above-described scheduling process in step S8, the CPU 11 executes update control in step S9, 11, 13 to transmit an update program to each ECU in the determined transmission order and instruct update. In order to execute the above-described scheduling process and update control, the CPU 11 includes a scheduling unit 111 and an update control unit 112 (FIG. 2). These are functions implemented by the CPU 11 when the CPU 11 reads a program stored in the storage unit 13 and executes the program on the RAM 12.

[Specific Example 1 of Scheduling Process]
FIG. 7 is a diagram showing a first specific example of a plurality of update programs that need simultaneous update. Referring to FIG. 7, in the first example, the first update program Δ1 is an update program for ECU_A, and is transmitted to ECU_A by the first main bus NW1 (first task), and The update file check is executed (second task), and the control program is rewritten in ECU_A (third task). The first to third times are 30 s (seconds), 10 s, and 30 s. The second update program Δ2 is an update program for the ECU_F, and is transmitted to the ECU_F through the second main bus NW2 (first task), and the check of the update file is executed in the ECU_F (second task) , ECU_F rewrites the control program (third task). The first to third times are 10 [s], 10 [s] and 30 [s]. The third update program Δ3 is an update program for ECU_D, transmitted to the ECU_C by the first main bus NW1, transmitted to the ECU_D by the local bus NW3 via the ECU_C (first task), and The update file check is executed (second task), and the control program is rewritten in ECU_D (third task). The first to third times are 60 [s], 10 [s] and 30 [s]. Furthermore, with regard to transmission of the update program Δ3 (first task), the time required for transmission on the first main bus NW1 is 30 [s] and the time required for transmission on the local bus NW3 is 30 [s]. It is. Further, the ECU_C relaying transmission from the main bus NW1 to the local bus NW3 can use a relay buffer, and the relay time of transmission from the main bus NW1 to the local bus NW3 is 10 [s].

  When a plurality of update programs Δ1 to Δ3 having the need for simultaneous update are those shown in FIG. 7, the CPU 11 of the gateway 10 determines YES in step S103 and YES in step S107. Therefore, on the premise that transmission of the update program on the main bus NW1 is exclusive (step S107), scheduling processing using each of the predetermined scheduling conditions (conditions A to C) is executed. .

  FIG. 8 is a diagram showing the update schedule (A) when the scheduling process of step S8 is not performed and the update schedule (B) when the scheduling process is performed. The horizontal axis represents time [s], and one block of (A) and (B) represents 10 [s].

  First, referring to (A), as an example, when the CPU 11 performs update control so that the update process is completed one program at a time in the order of update programs (Δ1 → Δ2 → Δ3), the simultaneous update required time is The time obtained by adding the required time for updating in the ECU, that is, the time obtained by adding the time required for each task shown in FIG. 7 is 230 [s].

  On the other hand, when the schedule processing in step S8 is executed, the transmission of the update program Δ3 transmitted (branched) on the local bus NW3 for the main bus NW1 is not updated (does not branch) on the local bus NW3 The transmission order is determined so as to transmit the update programs Δ3 and Δ1 continuously over the main bus NW1 in preference to Δ1. Further, for the main bus NW2 that can be transmitted in parallel with the main bus NW1, the transmission order is determined so as to transmit the update program Δ2 in parallel with the transmission of the update program on the main bus NW1 (B). This is because the update program is transmitted in parallel to the independent main buses NW1 and NW2 based on the topology of the in-vehicle network, and for the same main bus, a plurality of update programs must be transmitted one by one in order. is there. Therefore, for the main bus (NW1) branched to the local bus, the update program to be branched and transmitted to the local bus (NW3) is transmitted first. As a result, transmission of the update program on the main bus that is not branched and transmitted to the local bus (NW3) can be performed in parallel with transmission of the update program on the local bus (NW3). By doing this, the time required for transmission among the simultaneous update required time can be made shorter than the sum of the first time of each of the plurality of update programs, and as a result, the simultaneous update required time can be shortened. Can. The check (second task) and the update (third task) of the update file following the transmission (first task) are continuously executed after the end of transmission. This is assumed to be the same in the specific example of the subsequent scheduling process.

  When the plurality of update programs Δ1 to Δ3 having the need for simultaneous update are as shown in FIG. 7, the CPU 11 executes the scheduling process of step S8 to determine the schedule shown in FIG. The required time is greatly reduced from 230 s to 110 s.

[Specific Example 2 of Scheduling Process]
FIG. 9 is a diagram showing a second specific example of the update program that needs simultaneous update. Referring to FIG. 9, in the second example, the first update program Δ1 is an update program for ECU_A, and is transmitted to ECU_A through the first main bus NW1 (first task), and The updated file check is executed (second task), and the control program is rewritten in ECU_A (third task). The first to third times are 30 [s], 10 [s] and 30 [s]. The second update program Δ2 is an update program for the ECU_F, and is transmitted to the ECU_F through the second main bus NW2 (first task), and the check of the update file is executed in the ECU_F (second task) , ECU_F rewrites the control program (third task). The first to third times are 10 [s], 10 [s] and 30 [s]. The third update program Δ3 is an update program for ECU_D, transmitted to the ECU_C by the first main bus NW1, transmitted to the ECU_D by the local bus NW3 via the ECU_C (first task), and The update file check is executed (second task), and the control program is rewritten in ECU_D (third task). The first to third times are 120 s, 10 s, and 20 s. In the second example, the ECU_C relaying transmission from the main bus NW1 to the local bus NW3 can not use the relay buffer (does not have a buffer function). Therefore, in the transmission of the update program Δ3 for ECU_D, since the transmission is performed on the first main bus NW1 at the same speed as the transmission speed on the local bus NW3, the time required for transmission on the first main bus NW1 is It is 120 [s] which is the same as the time required for transmission on the local bus NW3.

  If a plurality of update programs Δ1 to Δ3 having the need for simultaneous update are those shown in FIG. 9, the CPU 11 of the gateway 10 determines YES in step S103 and NO in step S107. Therefore, with regard to the update program branched and transmitted to the local bus NW3 on the main bus NW1, it is premised that other update programs can be transmitted in parallel (step S109), each scheduling condition (condition is defined in advance) Execute scheduling processing using A to C).

  FIG. 10 is a diagram showing the update schedule (A) when the scheduling process of step S8 is not performed and the update schedule (B) when the scheduling process is performed. The horizontal axis represents time [s], and one block of (A) and (B) represents 10 [s].

  First, referring to (A), as an example, when the CPU 11 performs update control so that the update process is completed one program at a time in the order of update programs (Δ1 → Δ2 → Δ3), the simultaneous update required time is The time obtained by adding the required time for updating in the ECU, that is, the time obtained by adding the time required for each task shown in FIG. 9 is 270 [s].

  On the other hand, when the schedule processing of step S8 is executed, the transmission of the update program Δ3 which branches and transmits the main bus NW1 to the local bus NW3 is prioritized. Further, for the main bus NW2 that can be transmitted in parallel with the main bus NW1, the transmission order is determined so as to transmit the update program Δ2 in parallel with the transmission of the update program on the main bus NW1. These are based on the same idea as the scheduling process in the first specific example of the scheduling process shown in FIG. Further, for the main bus NW1, the transmission order is determined so as to transmit the update program Δ1 in parallel with the transmission of the update program Δ3 (B). This is because, when transmitting the update program Δ3 through the main bus NW1, the transmission speed or transmission timing according to the transmission speed of the local bus NW3 is used to update the free bandwidth generated on the main bus NW1 which is a transmission path. This is because it is used for transmission of Δ1. In this case, for transmission of the update program Δ1, an available bandwidth of the main bus NW1 when the update program Δ3 is transmitted through the main bus NW1 is used. That is, the transmission band of the main bus NW1 is shared by the update program Δ1 and the update program Δ3. Therefore, normally, the transmission of the update program Δ1 is completed in 30 [s], but 60 [s] is necessary in order to reduce the transmission band by half by sharing with the update program Δ3. By doing this, the time required for transmission of the simultaneous update required time can be made shorter than the total of the times required for transmission of each of the plurality of update programs, and as a result, the simultaneous update required time can be shortened. be able to.

  When a plurality of update programs Δ1 to Δ3 having the need for simultaneous update are as shown in FIG. 9, the CPU 11 executes the scheduling process of step S8 to determine the schedule shown in (B) of FIG. The required time is greatly reduced from 270 s to 150 s.

[Specific Example 3 of Scheduling Process]
FIG. 11 is a diagram illustrating a third specific example of the update program that needs simultaneous update. Referring to FIG. 11, in the third example, the first update program Δ1 is an update program for ECU_A, and is transmitted to ECU_A through the first main bus NW1 (first task), and The update file check is executed (second task), and the control program is rewritten in ECU_A (third task). The first to third times are 30 [s], 20 [s] and 40 [s]. The second update program Δ2 is an update program for the ECU_B, and is transmitted to the ECU_B through the first main bus NW1 (first task), and a check of the update file is executed in the ECU_B (second task) , ECU_B rewrites the control program (third task). The first to third times are 10 [s], 10 [s] and 20 [s]. The third update program Δ3 is an update program for the ECU_C, and is transmitted to the ECU_C through the first main bus NW1 (first task), and the check of the update file is executed in the ECU_C (second task) , ECU_C rewrites the control program (third task). The first to third times are 20 [s], 10 [s] and 50 [s]. That is, the plurality of update programs Δ1 to Δ3 are all for the ECUs belonging to the first main bus NW1, and are transmitted to the respective ECUs only by the main bus NW1.

  In the case where the plurality of update programs Δ1 to Δ3 having the necessity of simultaneous update are those of FIG. 11, the CPU 11 of the gateway 10 determines that the above step S103 is NO, and therefore neither step S107 nor S109 is assumed. The scheduling process is performed using each of the scheduling conditions (conditions A to C) defined in advance.

  FIG. 12 compares the update schedule (A) when the scheduling process in step S8 is not performed with the update schedules (B) through (D) when the scheduling process according to each of the above conditions A through C is performed. Are shown. The horizontal axis represents time [s], and one block of (A) to (D) represents 10 [s].

  First, referring to (A), as an example, when the CPU 11 performs update control so that the update process is completed one program at a time in the order of update programs (Δ1 → Δ2 → Δ3), the simultaneous update required time is The time obtained by adding the update required time in the ECU, that is, the time obtained by adding the time required for each task shown in FIG. 11 is 210 [s].

  On the other hand, when the scheduling process is executed according to the above-mentioned condition A, the transmission order A is such that the update programs are continuously transmitted through the main bus NW1 in order of increasing third time (Δ3 → Δ1 → Δ2). It is determined (B). The above condition A can also be interpreted as “schedule with priority the update program having a long processing time in the received ECU”. The processing in the received ECU is the check of the update file (second task) and the rewriting of the control program (third task). Adopting the above interpretation, the transmission order A may be determined in the descending order (Δ1 → Δ3 → Δ2) of the total time of the second time and the third time which is the time required for these tasks. In this case, while the update file check (second task) and the control program rewrite (third task) are being performed in the corresponding ECU, the other update programs are transmitted in parallel over the main bus NW1. It will be. And in the case of the condition A, the second task and the third task are started earlier as the third time or the total of the second time and the third time is longer. It is likely that the update of the control program using the update program will be completed sooner. In the case of the transmission order A in FIG. 12B, the simultaneous update required time is 110 [s].

  When the scheduling process is executed according to the above-mentioned condition B, the transmission order B is determined so that these update programs are continuously transmitted on the main bus NW1 in the order of shorter first time (Δ2 → Δ3 → Δ1) (C ). Also in this case, while the update file check (second task) and the control program rewrite (third task) are being performed in the ECU to which another update program applies, transmission is simultaneously performed via the main bus NW1. It will be done. Then, in the case of the condition B, for each update program, the start of the second task can be made the earliest after the transmission (the first task). In the case of the transmission order B of FIG. 12C, the simultaneous update required time is 120 [s].

  When the scheduling process is executed according to the above-mentioned condition C, the transmission order C is determined so that these update programs are continuously transmitted by the main bus NW1 in the order of names of corresponding ECUs (Δ1 → Δ2 → Δ3) (D ). Also in this case, while the update file check (second task) and the control program rewrite (third task) are being performed in the ECU to which another update program applies, transmission is simultaneously performed via the main bus NW1. It will be done. In the case of transmission order C in FIG. 12D, the simultaneous update required time is 120 [s].

  As a result of the above scheduling process, in the case where a plurality of update programs Δ1 to Δ3 having the necessity of simultaneous update are as shown in FIG. Therefore, the gateway 10 determines the transmission order A shown in FIG. 12B in step S8 as the transmission order of the update programs Δ1 to Δ3. By this, the simultaneous update required time is greatly reduced from 210 [s] to 110 [s].

<Effect of First Embodiment>
According to the program update system of the first embodiment, when the control programs of the plurality of ECUs are simultaneously updated, transmission of the update program from the DL server 6, which is an external device providing the update program, to the ECU 30 is performed. In the gateway 10 which is a relay apparatus to relay, a scheduling process is performed to determine the transmission order of a plurality of update programs.

  When a plurality of update programs that need to be updated simultaneously include update programs for ECUs belonging to each of the mutually independent in-vehicle networks individually connected to the gateway 10, the gateway 10 carries out these update programs on the main bus ( Send in parallel to NW1 and NW2).

In addition, when a plurality of update programs for a plurality of ECUs belonging to the same in-vehicle network are included, the gateway 10 executes the scheduling process according to each of predetermined conditions (a plurality of scheduling conditions) defined in advance. Then, the transmission order that minimizes the simultaneous update required time among the plurality of transmission orders obtained as a result is determined as the transmission order of the plurality of update programs. For example, when there are a plurality of update programs transmitted by the same main bus (NW1) and the plurality of update programs further include one to be branched and transmitted to the local bus, the gateway 10 is connected to the main bus The update program transmitted to the ECU belonging to the local bus is preferentially transmitted as the branch node to the ECU belonging to the main bus than the update program transmitted to the belonging ECU. At this time, the gateway 10 determines whether transmission of the update program on the same main bus (NW1) is exclusive or parallel-enabled depending on whether or not the branch node ECU has a buffer function. One of them is assumed.
Thereby, the simultaneous update required time can be shortened.

  During the updating process of a plurality of control programs to be simultaneously updated, all the corresponding ECUs are in the repro mode, and do not return to the normal mode until all the updating processes are completed and restarted. Therefore, as the simultaneous update required period becomes longer, for example, it becomes more likely to cause inconveniences and disadvantages of the user, such as being unable to drive at the timing when the user wants to drive. Therefore, as described above, the scheduling process is performed in the gateway 10 to determine the transmission order for terminating the simultaneous update required period earliest, thereby suppressing the inconvenience and disadvantage caused to the user.

Second Embodiment
The above-described scheduling process may be performed by any relay device that relays the update program transmitted from the DL server 6 to the ECU 30. For example, when the update program transmitted from the DL server 6 to the ECU 30 is relayed by a further relay device not shown in FIG. 1 in addition to the gateway 10, the above-mentioned scheduling process is executed in the further relay device It is also good. Alternatively, the scheduling process may be realized by cooperation between the gateway 10 and the additional relay device.

  Further, as shown in FIG. 5, when the update program is transmitted from the DL server 6 to the ECU 30, the management server 5 requests the gateway 10 to download (step S3), and the gateway 10 transmits the DL server according to the request. The update program is sent from the DL server 6 to the gateway 10 by requesting the update program to 6 (step S4). Then, the management server 5 requests the gateway 10 to update the ECUs 30 (step S6), and the gateway 10 requests the ECUs 30 to update according to the request, whereby the gateway 10 transmits the update program to the ECU 30 for control. The program is updated (steps S7, 9, 11, 13). Therefore, according to this flow, it can be said that the management server 5 also functions as a part of a relay apparatus that relays the transmission of the update program from the DL server 6 to the ECU 30.

  Therefore, the above-described scheduling process may be executed in the management server 5 which can be said to be a kind of relay device, and information indicating the transmission order determined together with the update program in step S4 may be transmitted to the gateway 10. Alternatively, as described above, since the management server 5 and the DL server 6 may be realized by the same server device, the scheduling process may be executed in a server having the functions of the servers 5 and 6. In this case, the scheduling unit 111 and the update processing unit 112 (FIG. 2), which are functions for executing the above-mentioned scheduling process, read the program stored in the ROM 52 onto the RAM 53 and execute it Are realized by the CPU 51. That is, the management server 5 obtains the update program or the information on the update program from the DL server 6 and stores the information in the storage unit 54. The scheduling unit 111 of the management server 5 performs a scheduling process using the information on the update program stored in the storage unit 54. The update processing unit 112 passes the transmission order determined by the scheduling unit 111 to the gateway 10 and requests the ECU 30 to perform an update process. The update processing unit 112 of the gateway 10 transmits the update program in the transmission order received from the management server 5 and requests the ECUs 30 to perform the update process, thereby controlling the update process in the simultaneous update.

  Also in the program update system according to the second embodiment, the simultaneous update required time can be shortened when there are a plurality of update programs that need simultaneous update. This makes it possible to reduce the inconvenience and disadvantage caused to the user.

  It should be understood that the embodiments disclosed herein are illustrative and non-restrictive in every respect. The scope of the present invention is indicated not by the above description but by the claims, and is intended to include all the modifications within the meaning and scope equivalent to the claims.

1 vehicle 2 wide area communication network 5 management server (relay device)
6 DL server 10 Gateway (relay device)
11 CPU
12 RAM
13 storage unit 14 in-vehicle communication unit 15 wireless communication unit 30 ECU (control device)
31 CPU
32 RAM
33 storage unit 34 communication unit 35 activation unit 51 CPU
52 ROM
53 RAM
54 storage unit 55 communication unit NW1 to NW3 bus (vehicle-mounted network)
111 scheduling unit 112 update control unit

Claims (10)

A relay device that communicates with a plurality of control devices belonging to an in-vehicle network,
A storage unit that stores a plurality of update programs that require simultaneous update to a plurality of the control devices, and a topology of the in-vehicle network;
An in-vehicle communication unit for transmitting a plurality of the update programs to the corresponding control device;
For the control devices belonging to the plurality of independent in-vehicle networks individually connected to the own device, the in-vehicle communication unit is controlled to transmit in parallel the plurality of update programs corresponding to the control devices. And a control unit.   The relay device according to claim 1, wherein the control unit determines a transmission order of the plurality of update programs according to a predetermined condition. The predetermined condition is a scheduling condition that minimizes the simultaneous update required time, which is a combination of update required times including the following first to third times, in each of the control devices,
Among the plurality of update programs, the simultaneous update required time is from the start of the first time of the update program to be transmitted to the control device, to the end of the plurality of update programs. The relay apparatus according to claim 2, which is a time until the end of the third time for the update program to end.
First time: Transmission time of update program Second time: time required to check update program Third time: time required to rewrite control program using update program The scheduling condition is:
4. The relay according to claim 3, which includes, for the plurality of control devices included in one in-vehicle network having a bus topology, the control device having a longer third time period has a transmission order of the update program earlier. apparatus. The scheduling condition is:
5. The plurality of control devices included in one in-vehicle network having a bus topology, wherein the transmission order of the update program is advanced as the control device in which the first time is shorter is shorter. The relay device described in. The scheduling condition is:
6. The transmission order determination method according to claim 3, further comprising: determining a transmission order of the plurality of control devices included in one in-vehicle network having a bus topology based on identification information given to the control devices. The relay device according to any one of the above.   In the case where one in-vehicle network includes a main network directly connected to the apparatus itself and a local network that branches the control device included in the main network as a branch node, the scheduling condition includes the local network The relay apparatus according to any one of claims 3 to 6, further comprising: advancing the transmission order to the control apparatus belonging to at least the transmission order of the control apparatuses included in the main network.   The control unit determines the transmission rate of the main network according to whether or not the branch node has a buffer function to absorb the difference between the transmission rate in the main network and the transmission rate in the local network. The relay device according to claim 7. A program updating system, comprising: a plurality of control devices belonging to an on-vehicle network; and a relay device communicating with the plurality of control devices,
The relay device is
A storage unit that stores a plurality of update programs that require simultaneous update to a plurality of the control devices, and a topology of the in-vehicle network;
An in-vehicle communication unit for transmitting a plurality of the update programs to the corresponding control device;
For the control devices belonging to the plurality of independent in-vehicle networks individually connected to the own device, the in-vehicle communication unit is controlled to transmit in parallel the plurality of update programs corresponding to the control devices. A program update system comprising: a control unit. A program updating method executed by a relay device communicating with a plurality of control devices belonging to an in-vehicle network,
Storing a plurality of update programs that require simultaneous update for a plurality of the control devices, and the topology of the in-vehicle network;
Sending a plurality of the update programs to the corresponding control device, respectively.
In the transmission step, transmission of the plurality of update programs corresponding to the control device in parallel is performed for the control devices belonging to the plurality of independent on-vehicle networks individually connected to the relay device. Including program update methods.

Images