JP6562134B2 - Relay device, program update system, and program update method - Google Patents

Description

  The present invention relates to a relay device, a program update system, and a program update method, and more particularly to a technique for appropriately updating a control program of an in-vehicle control device.

In recent years, in the technical field of automobiles, functions of vehicles have been advanced, and a wide variety of in-vehicle devices are mounted on vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are vehicle-mounted control devices for controlling each vehicle-mounted device, are mounted on the vehicle.
The ECU includes, for example, an engine, a brake, an EPS (Electric Power Steering) control for the operation of an accelerator, a brake, and a steering wheel, and a headlight is turned on / off according to a switch operation by an occupant. Some of them operate the meters arranged near the driver's seat, such as wiper ON / OFF and door lock / unlock.

In general, the ECU is configured by an arithmetic processing device such as a microcomputer, and the control of the in-vehicle device is realized by reading and executing a control program stored in a ROM (Read Only Memory).
The control program of the ECU may differ depending on the destination and grade of the vehicle, and it is necessary to rewrite the old version control program to the new version control program in response to the upgrade of the control program.

  For example, in Patent Documents 1 and 2, a gateway such as an in-vehicle communication device receives an update program from a management server, and an ECU rewrites a control program from an old version to a new version using the received update program. A technique for remotely executing program update for an ECU by wireless communication is disclosed.

JP 2007-65856 A JP 2011-70307 A

  In today's vehicles, many devices are moving together. Therefore, in order to guarantee the operation of the vehicle, it may be required to update a plurality of programs that are control programs of each of a plurality of related ECUs at the same timing. The control program is updated by passing an update program to the ECU and rewriting the control program in the ECU. Therefore, “update required time”, which is the time required for updating the control program in one ECU, is the time including the time required to transmit the update program to the ECU and the time required to rewrite the control program.

  When there is a need to update the control program of each of the plurality of ECUs at the same timing, each of the plurality of ECUs executes the above update operation. In the vehicle, when the update of the control program is started for a plurality of related ECUs, the vehicle cannot be operated until the update of the control program is completed in all the ECUs. That is, the time from the start of transmission of the first program among the plurality of update programs for the plurality of control programs updated at the same timing to the completion of rewriting in the ECU of the last update program ( Hereinafter, this time is referred to as “simultaneous update required time”), and the vehicle cannot be operated.

  When the plurality of ECUs that update the control program at the same timing update sequentially, the time required for simultaneous update becomes the sum of the time required for updating in each of the plurality of ECUs and becomes longer. The longer the time required for simultaneous update, the longer the time during which the vehicle cannot be operated.

  The present invention has been made in view of such a problem, and provides a relay device, a program update system, and a program update method capable of shortening the time required for simultaneous update when a plurality of programs are updated at the same timing. .

  According to an embodiment, the relay device is a relay device that communicates with a plurality of control devices belonging to the in-vehicle network, the plurality of update programs that need to be simultaneously updated for the plurality of control devices, the topology of the in-vehicle network, A control unit for a storage unit that stores a plurality of update programs, an in-vehicle communication unit that transmits a plurality of update programs to a corresponding control unit, and a control unit that belongs to a plurality of independent in-vehicle networks that are individually connected to the own unit And a control unit that controls the in-vehicle communication unit so as to transmit a plurality of update programs corresponding to the above in parallel.

  According to another embodiment, the program update system includes a plurality of control devices belonging to the in-vehicle network and a relay device that communicates with the plurality of control devices, and the relay device needs to be simultaneously updated to the plurality of control devices. A storage unit that stores a plurality of update programs and a topology of an in-vehicle network, an in-vehicle communication unit that transmits the plurality of update programs to a corresponding control device, and independent from each other connected to the own device The control device belonging to the plurality of in-vehicle networks includes a control unit that controls the in-vehicle communication unit so as to transmit a plurality of update programs corresponding to the control device in parallel.

  According to another embodiment, the program update method is a program update method executed by a relay device that communicates with a plurality of control devices belonging to an in-vehicle network, and a plurality of updates that require simultaneous update to the plurality of control devices. A step of storing the program and the topology of the in-vehicle network, and a step of transmitting a plurality of update programs to the corresponding control devices, respectively, wherein the plurality of independent steps connected to the relay device are independent of each other. For the control device belonging to the in-vehicle network, it includes transmitting a plurality of update programs corresponding to the control device in parallel.

  According to the present invention, it is possible to shorten the time required for simultaneous update of the control program of the control device mounted on the vehicle.

1 is an overall configuration diagram of a program update system according to an embodiment of the present invention. It is a block diagram which shows the internal structure of a gateway. It is a block diagram which shows the internal structure of ECU. It is a block diagram which shows the internal structure of a management server. It is a sequence diagram which shows an example of the simultaneous update of the control program with respect to several ECU. It is a flowchart showing the flow of the scheduling process of step S8 of FIG. It is a figure showing the 1st specific example of the update program with the necessity of simultaneous update. It is the figure which compared and showed the update schedule (A) when not performing a scheduling process, and the update schedule (B) when performing a scheduling process. It is a figure showing the 2nd specific example of the update program with the necessity of simultaneous update. It is the figure which compared and showed the update schedule (A) when not performing a scheduling process, and the update schedule (B) when performing a scheduling process. It is a figure showing the 3rd specific example of the update program with the necessity of simultaneous update. It is the figure which compared and showed the update schedule (A) when not performing a scheduling process, and the update schedules (B)-(D) when performing the scheduling process according to each of the scheduling conditions AC.

[Description of Embodiment]
This embodiment includes at least the following.
That is, the relay device included in the present embodiment is a relay device that communicates with a plurality of control devices belonging to the in-vehicle network, and includes a plurality of update programs that require simultaneous update for the plurality of control devices, and the in-vehicle network. For the storage unit that stores the topology, the in-vehicle communication unit that respectively transmits a plurality of update programs to the corresponding control device, and the control devices that belong to a plurality of independent in-vehicle networks that are individually connected to the own device, A control unit that controls the in-vehicle communication unit so as to transmit a plurality of update programs corresponding to the control device in parallel.
According to this configuration, an update program for a control device belonging to a plurality of independent in-vehicle networks that are individually connected to the relay device among the plurality of update programs that need to be updated simultaneously is received from the relay device. Transmission can be started at the same time. For this reason, the total transmission time of the plurality of update programs can be shortened compared to the case where these plurality of update programs are transmitted in sequence after the completion of rewriting of the control program. As a result, the time required for simultaneous update can be shortened.

Preferably, in the relay device, the control unit determines a transmission order of the plurality of update programs according to a predetermined condition.
By setting appropriate conditions in the relay apparatus, the total time required for transmission of a plurality of update programs that need to be updated simultaneously can be shortened. As a result, the time required for simultaneous update can be shortened.

Preferably, the predetermined condition is a scheduling condition for shortening the simultaneous update required time which is a combination of the update required times including the following first time to third time in each control device, and the simultaneous update required time is The end of the third time for the update program in which rewriting of the control program ends at the end of the plurality of update programs from the start of the first time for the update program transmitted to the control device first among the plurality of update programs Time to time.
1st time: Update program transmission time 2nd time: Time required for checking update program 3rd time: Time required for rewriting control program using update program This configuration allows multiple updates that need to be updated simultaneously The total time required for program transmission can be shortened. As a result, the time required for simultaneous update can be shortened.

Preferably, the scheduling condition includes that, for a plurality of control devices included in one in-vehicle network having a bus topology, a control device having a longer third time advances the transmission order of update programs.
With this configuration, an update program having a longer time required for rewriting the control program is transmitted earlier, and rewriting of the control program is started first. Then, in parallel with the rewriting of the control program, the next update program is transmitted. For this reason, it is possible to shorten the time required for the simultaneous update, compared with the case where the update program is transmitted sequentially after the completion of rewriting of each control program.

Preferably, the scheduling condition includes that, for a plurality of control devices included in one in-vehicle network having a bus topology, a control device having a shorter first time advances the transmission order of update programs.
With this configuration, it is possible to quickly start checking the update program and rewriting the control program in the corresponding control device for each update program, and in addition to the next update program in parallel with the check of the update program and the rewrite of the control program Is transmitted. For this reason, it is possible to further shorten the time required for simultaneous update than transmitting update programs in order after rewriting of each control program is completed.

Preferably, the scheduling condition includes determining a transmission order for a plurality of control devices included in one in-vehicle network having a bus topology based on identification information given to the control device.
With this configuration, by providing identification information such as a name suitable for each control device in advance, the update required period can be further shortened.

Preferably, when one in-vehicle network includes a main network directly connected to the own device and a local network that branches using a control device included in the main network as a branch node, the scheduling condition belongs to the local network This includes sending the transmission order to the control device earlier than the transmission order of the control devices included in the main network.
With this configuration, in parallel with the transmission of the update program in the local network, the next update program can be transmitted through the main network, and the total transmission time of the plurality of update programs can be shortened. As a result, the time required for simultaneous update can be further shortened.

Preferably, the control unit determines the transmission rate of the main network according to whether the branch node has a buffer function that absorbs a difference between the transmission rate of the main network and the transmission rate of the local network.
With this configuration, it is possible to efficiently transmit update programs in the main network, and to reduce the total transmission time of a plurality of update programs.

The program update system included in the present embodiment is a program update system that includes a plurality of control devices belonging to an in-vehicle network and a relay device that communicates with the plurality of control devices. The relay device includes a plurality of control devices. A storage unit that stores multiple update programs that need to be updated simultaneously, the topology of the in-vehicle network, an in-vehicle communication unit that transmits the multiple update programs to the corresponding control device, and an individual connection to the device itself The control devices belonging to the plurality of in-vehicle networks that are independent of each other include a control unit that controls the in-vehicle communication unit so as to transmit a plurality of update programs corresponding to the control device in parallel.
According to this configuration, an update program for a control device belonging to a plurality of independent in-vehicle networks that are individually connected to the relay device among the plurality of update programs that need to be updated simultaneously is received from the relay device. Transmission can be started at the same time. For this reason, the total transmission time of the plurality of update programs can be shortened compared to the case where these plurality of update programs are transmitted in sequence after the completion of rewriting of the control program. As a result, the time required for simultaneous update can be shortened.

The program update method included in the present embodiment is a program update method executed by a relay device that communicates with a plurality of control devices belonging to an in-vehicle network, and a plurality of update programs that require simultaneous update for the plurality of control devices And a step of storing the topology of the in-vehicle network, and a step of transmitting a plurality of update programs to the corresponding control devices, respectively, and the step of transmitting includes a plurality of independent connections individually connected to the relay device. For a control device belonging to the in-vehicle network, it includes transmitting a plurality of update programs corresponding to the control device in parallel.
According to this configuration, an update program for a control device belonging to a plurality of independent in-vehicle networks that are individually connected to the relay device among the plurality of update programs that need to be updated simultaneously is received from the relay device. Transmission can be started at the same time. For this reason, the total transmission time of the plurality of update programs can be shortened compared to the case where these plurality of update programs are transmitted in sequence after the completion of rewriting of the control program. As a result, the time required for simultaneous update can be shortened.

[Details of the embodiment]
Hereinafter, preferred embodiments will be described with reference to the drawings. In the following description, the same parts and components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, these descriptions will not be repeated.

<First Embodiment>
[Overall system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to an embodiment of the present invention.
As shown in FIG. 1, the program update system of this embodiment includes a vehicle 1, a management server 5, and a DL (download) server 6 that can communicate via a wide area communication network 2.
The management server 5 and the DL server 6 are operated by, for example, a car manufacturer of the vehicle 1 and can communicate with a large number of vehicles 1 owned by users who are registered as members in advance.

The vehicle 1 is equipped with a gateway 10, a wireless communication unit 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the ECUs 30.
The vehicle 1 has a communication group (in-vehicle network) by a plurality of ECUs 30 connected to a common in-vehicle communication line by a bus, and the gateway 10 relays communication between the communication groups and communication between the ECU 30 and devices outside the vehicle. Functions as a relay device. Therefore, a plurality of in-vehicle communication lines are connected to the gateway 10.

  Specifically, the gateway 10 is connected with a plurality of buses, each of which is connected to one or more ECUs 30 to form a communication group, thereby forming a network topology. As an example, as illustrated in FIG. 1, a first bus NW1 and a second bus NW2 that are main buses are connected to the gateway 10. Three ECUs (ECU_A, ECU_B, ECU_C) 30 are connected to the bus NW1. One ECU (ECU_F) 30 is connected to the bus NW2. A network topology in which three ECUs (ECU_A, ECU_B, ECU_C) 30 are connected to the main bus NW1 and a network topology in which one ECU (ECU_F) 30 is connected to the main bus NW2 are bus topology. The main buses NW1 and NW2 serving as transmission paths can be shared by a plurality of ECUs connected thereto. Therefore, in order to collide and interfere with signals, it is necessary to control so that signals are not transmitted at the same time.

  Any of the plurality of ECUs 30 may be further connected to a local bus. For example, in FIG. 1, the bus NW1 branches to a third bus NW3, which is a local bus, using one connected ECU (ECU_C) 30 as a branch node. Two more ECUs (ECU_E, ECU_D) 30 are connected to the bus NW3 to form a bus topology. The ECU_C relays signal transmission between the two ECUs (ECU_E, ECU_D) 30 connected to the bus NW3 and the gateway 10.

The wireless communication unit 15 is communicably connected to a wide area communication network 2 such as a mobile phone network, and is connected to the gateway 10 via an in-vehicle communication line. The gateway 10 transmits information received by the wireless communication unit 15 from the external devices such as the management server 5 and the DL server 6 to the ECU 30 through the wide area communication network 2.
The gateway 10 transmits information acquired from the ECU 30 to the wireless communication unit 15, and the wireless communication unit 15 transmits the information to an external device such as the management server 5.

  In FIG. 1, the gateway 10 is connected to the wireless communication unit 15 via the in-vehicle communication line, but these may be configured as one device.

  In the program update system of FIG. 1, the management server 5 and the DL server 6 are configured as separate servers, but the servers 5 and 6 may be configured as a single server device.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing the internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected via the wireless communication unit 15 and the in-vehicle communication line, but these may be configured by a single device.

The CPU 11 causes the gateway 10 to function as a relay device for various types of information by reading one or more programs stored in the storage unit 13 into the RAM 12 and executing them.
The CPU 11 can execute a plurality of programs in parallel, for example, by switching and executing a plurality of programs in a time division manner. The RAM 12 is composed of a memory element such as SRAM (Static RAM) or DRAM (Dynamic RAM), and temporarily stores programs executed by the CPU 11, data necessary for execution, and the like.

The storage unit 13 includes a nonvolatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory).
The storage unit 13 has a storage area for storing programs executed by the CPU 11 and data necessary for execution. The storage unit 13 also stores an update program for each ECU 30 received from the DL server 6. The storage unit 13 also stores the topology formed by each ECU 30 and the buses NW1 to NW3, which is an in-vehicle network. The topology of the in-vehicle network is used in transmission of update programs and scheduling processing described later.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1. The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark). Communication with the ECU 30 is performed according to the standard.
The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11. The in-vehicle communication unit 14 may communicate according to other communication standards used for the in-vehicle network as well as the above communication standards.

The wireless communication unit 15 includes a wireless communication device including an antenna and a communication circuit that performs transmission / reception of a wireless signal from the antenna. The wireless communication unit 15 can communicate with an external device by being connected to a wide area communication network 2 such as a mobile phone network.
The wireless communication unit 15 transmits information given from the CPU 11 to an external device such as the management server 5 via the wide area communication network 2 formed by a base station (not shown), and receives information received from the external device to the CPU 11. give.

Instead of the wireless communication unit 15 illustrated in FIG. 2, a wired communication unit that functions as a relay device in the vehicle 1 may be employed. The wired communication unit has a connector to which a communication cable conforming to a standard such as USB (Universal Serial Bus) or RS232C is connected, and performs wired communication with another communication device connected via the communication cable.
When another communication device and an outside device such as the management server 5 are capable of wireless communication through the wide area communication network 2, the outside of the vehicle depends on the communication path of the outside device → another communication device → the wired communication unit → the gateway 10. The apparatus and the gateway 10 can communicate with each other.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing an internal configuration of the ECU 30.
As shown in FIG. 3, the ECU 30 includes a CPU 31, a RAM 32, a storage unit 33, a communication unit 34, and the like. The ECU 30 is an in-vehicle control device that individually controls target devices mounted on the vehicle 1. Examples of the ECU 30 include an engine control ECU, a steering control ECU, and a door lock control ECU.

The CPU 31 controls the operation of the target device that it is in charge of by reading one or more programs stored in advance in the storage unit 33 into the RAM 32 and executing them.
The RAM 32 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 31, data necessary for execution, and the like.

The storage unit 33 is configured by a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The information stored in the storage unit 33 includes, for example, a computer program (hereinafter referred to as “control program”) for causing the CPU 31 to perform information processing for controlling a target device that is a control target in the vehicle.

The communication unit 34 is connected to the gateway 10 via an in-vehicle communication line disposed in the vehicle 1. The communication unit 34 communicates with the gateway 10 according to a standard such as CAN, Ethernet, or MOST.
The communication unit 34 transmits the information given from the CPU 31 to the gateway 10 and gives the information received from the gateway 10 to the CPU 31. The communication unit 34 may communicate according to other communication standards used for the in-vehicle network, in addition to the above communication standards.

The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode by the CPU 31 to either “normal mode” or “reprogramming mode” (hereinafter also referred to as “repro mode”).
Here, the normal mode is a control mode in which the CPU 31 of the ECU 30 executes an original control for the target device (for example, engine control for the fuel engine, door lock control for the door lock motor, etc.).

The reprogramming mode is a control mode in which a control program used for controlling the target device is updated.
That is, the reprogramming mode is a control mode in which the CPU 31 erases or rewrites the control program in the ROM area of the storage unit 33. Only in this control mode, the CPU 31 can update the control program stored in the ROM area of the storage unit 33 to a new version.

When the CPU 31 writes the new version of the control program in the storage unit 33 in the repro mode, the activation unit 35 once restarts (resets) the ECU 30 and executes the verify process on the storage area in which the new version of the control program is written. .
The activation unit 35 causes the CPU 31 to operate according to the updated control program after the above-described verification processing is completed.

[Management Server internal configuration]
FIG. 4 is a block diagram showing the internal configuration of the management server 5.
As shown in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads one or more programs stored in advance in the ROM 52 into the RAM 53 and executes them, thereby controlling the operation of each hardware and causing the management server 5 to function as an external device that can communicate with the gateway 10.
The RAM 53 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 51 and data necessary for execution.

The storage unit 54 includes a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 includes a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to the wide area communication network 2 such as a mobile phone network to execute the communication processing. The communication unit 55 transmits the information given from the CPU 51 to the external device via the wide area communication network 2 and gives the information received via the wide area communication network 2 to the CPU 51.

As shown in FIG. 4, the information stored in the storage unit 54 includes the ECU 30 mounted on the vehicle 1 (here, the identification numbers of the ECU 30 mounted on the vehicle 1 with VIN = 1 are 1 to 3). A revision table RT in which the versions of the control programs are recorded is included.
The revision table RT summarizes the vehicle identification number (VIN) of the vehicle 1, the revision number that is identification information indicating the revision history for each vehicle identification number, and the versions of the ECUs 1 to 3 corresponding to each revision number. It consists of a table.

In the revision table RT of FIG. 4, the versions of the control programs of the ECUs 1 to 3 included in the same revision number indicate that the operation of the car manufacturer has been confirmed.
For example, in the case of “R2.0” which is the current revision number, the operation of the control program of version 1.0 of ECU1, the control program of version 1.3 of ECU2, and the control program of version 2.0 of ECU3 Confirmed.

In the case of the latest revision number “R2.4”, the operation check of the control program of version 1.2 of ECU1, the control program of version 2.0 of ECU2, and the control program of version 2.2 of ECU3 is performed. It is taken.
Therefore, when the vehicle 1 is upgraded from R2.0 to R2.4, the ECU 1 is upgraded from 1.0 to 1.2, and the ECU 2 is upgraded from 1.3 to 2.0 (updated). And the upgrade (update) of the ECU 3 from 2.0 to 2.2 must be performed at the same timing. Here, “same timing” means that after a plurality of ECUs 30 shift to the repro mode in response to a request from the gateway 10, the reset is performed in response to a request from the gateway 10 and the verification process is completed. The timing until returning to the mode. In the following description, updating a plurality of control programs at the same timing in the above sense is also referred to as “simultaneous update”.

In the revision table RT of FIG. 4, only version information in the case of the vehicle identification number VIN = 1 is illustrated as an example.
However, version information similar to the above is recorded in the revision table RT held by the management server 5 for each vehicle identification number (VIN) of all vehicles 1 owned by registered members of the management server 5. The DL server 6 stores a plurality of update programs related to all the ECUs 30.

When the vehicle identification number and the current control program version of each ECU 1 to 3 are notified from the gateway 10, the CPU 51 checks the notified version information with the latest version of the vehicle identification number included in the revision table RT. .
If the CPU 51 determines that the version information of the ECUs 1 to 3 notified from the gateway 10 is not the latest as a result of the collation, the CPU 51 sends the update program storage destination URL and the download request for updating to the latest version to the gateway 10. Send.

[Sequence of simultaneous update of control program]
FIG. 5 is a sequence diagram illustrating an example of simultaneous update of control programs for the plurality of ECUs 1 to 3 executed in the program update system of the present embodiment. In the following, it is assumed that the control programs of the ECUs 1 to 3 are updated as follows according to the revision table RT of FIG.
Revision number: R2.0 → R2.4
ECU1: Version 1.0-> Version 1.2
ECU2: Version 1.3 → Version 2.0
ECU3: Version 2.0 → Version 2.2

The update program may be the new version of the program itself, but in the present embodiment, it is assumed that the update program is a differential program from the old version. In this case, if the update program Δ including the difference information of the file between the old version and the new version is in the same storage area, it can be updated to the new version by applying the update program Δ to the old version.
The update program from ECU 1.0 version 1.0 to version 1.2 is “Δ1”, the update program from ECU 1.3 version 1.3 to version 2.0 is “Δ2”, and ECU 3 version 2.0 to version 2.0 The update program to 2.2 is “Δ3”.

As shown in FIG. 5, in the simultaneous update of the control program of this embodiment, as an example, the gateway 10 collects the current version information of the control programs of the ECUs 1 to 3 (step S1).
In the illustrated example, the current version of the control program of the ECU 1 is “1.0”, the current version of the control program of the ECU 2 is “1.3”, and the current version of the control program of the ECU 3 is “2.0”. It is.

Next, the gateway 10 transmits the collected version information of the control programs of the ECUs 1 to 3 and the vehicle identification number (VIN) of the host vehicle to the management server 5 (step S2).
The management server 5 searches the above-described revision table RT (see FIG. 4) based on the version information and the vehicle identification number notified from the gateway 10, so that each ECU 1 to ECU 3 of the vehicle 1 is searched. It is determined whether it is necessary to update the control program at the same timing.

Here, since ECU 1 is version 1.0, ECU 2 is version 1.3, and ECU 3 is version 2.0, management server 5 determines that vehicle 1 is operating at revision R2.0. To do.
Further, since the latest version revision R2.4 exists, the management server 5 updates the ECU 1 to the version 1.2, updates the ECU 2 to the version 2.0, and updates the ECU 3 to the version 2.2. It is determined that the update needs to be performed at the same timing.

Therefore, the management server 5 sends the storage destination URLs and download requests for the update programs Δ1 to Δ3 of the ECUs 1 to 3 to the gateway 10 that has transmitted the version information (step S3).
Thereby, the gateway 10 downloads the update programs Δ1 to Δ3 for the ECUs 1 to 3 from the DL server 6 (step S4). The gateway 10 temporarily stores and stores the received update programs Δ1 to Δ3 in the storage unit 13 of its own device.

When the saving of the update programs Δ1 to Δ3 is completed, the gateway 10 transmits to the management server 5 that the DL has been normally completed (step S5). When the update is continuously performed automatically, the management server 5 that has received the DL completion notification transmits a control program update request to the gateway 10. After the DL is completed, the control program update request may be transmitted to the gateway 10 after being temporarily interrupted and receiving an update request from the outside (step S6).
The gateway 10 that has received the update request transmits a repro mode transition request to each of the ECUs 1 to 3 in order to update the control program using the update programs Δ1 to Δ3 stored in the storage unit 13 (step S7).

  When receiving the repro mode transition request, each of the ECUs 1 to 3 switches its control mode from the normal mode to the reprogramming mode. As a result, the ECUs 1 to 3 are in a state in which the update programs Δ1 to Δ3 can be developed and the current control program can be rewritten to a new version of the control program.

  Here, when there are a plurality of control programs to be simultaneously updated, the gateway 10 executes a scheduling process for determining the transmission order of the update programs Δ1 to Δ3 stored in the storage unit 13 (step S8).

  When the update program Δ is transmitted to the ECU, the ECU checks whether the update program is missing in the transmission path or checks the integrity using MD (Message Digest) 5, CRC (Cyclic Redundancy Code), etc. After confirming the owner of the original file using a digital signature or the like and confirming that there is no tampering, the file is expanded (rewritten) and applied to the old version. That is, the update of the control program includes transmission from the gateway 10 to the corresponding ECU (first task), check of the update file (second task), and deployment (update) of the program in the ECU (third). There are three tasks. The “update required time”, which is the time required for updating the control program in each ECU, is the time required for the first task (first time), the time required for the second task (second time), and the third time. It includes the time required for the task (third time). When the operation for updating the control program is only the first to third tasks, the update required time is obtained by adding the first to third time (update required time = first time + second Time + third time).

  When simultaneously updating a plurality of control programs of a plurality of ECUs, the same timing is given from the start of transmission of the first update program to the corresponding ECU until the last update program completes rewriting of the control program in the corresponding ECU This is the “simultaneous update required time” required for updating the control program. In other words, the time required for the simultaneous update is the third time of the update program in which the rewriting of the control program ends last from the start of the first time of the update program transmitted to the ECU first among the plurality of update programs. Is the time until the end of.

  When there are a plurality of control programs to be updated simultaneously, the repro mode is maintained in all ECUs until the update of all the control programs is completed. That is, if at least one of the corresponding ECUs is updating the control program, the repro mode of all the plurality of ECUs is maintained. Accordingly, when the time required for simultaneous update becomes longer, the return from the repro mode to the normal mode is delayed. Since the vehicle 1 cannot be used during the repro mode, for example, when the repro mode continues for a long time when the user wants to drive, inconvenience and disadvantage are caused to the user. Therefore, in the program update system according to the present embodiment, when a plurality of control programs are updated simultaneously, scheduling processing is performed so as to shorten the time required for simultaneous update.

  For the scheduling process, the first to third times of each update program and the topology of the in-vehicle network are used. The time required for each task of each update program may be passed from the management server 5 to the gateway 10. In this case, the management server 5 obtains information related to the update program from the DL server 6 and calculates the time required for each task based on the information. The information related to the update program is, for example, the data size of the update program. Alternatively, in the first to third times, the gateway 10 uses the update program transmitted from the DL server 6 and the information obtained from each ECU 30 or the information of each part of the vehicle 1 stored in advance. It may be calculated. The gateway 10 transmits the update program stored in the storage unit 13 to each ECU according to the transmission order determined by the scheduling process in step S8 (steps S9, 11, 13).

That is, the gateway 10 transmits the update program Δ1 determined to be transmitted first to the corresponding ECU 1 (step S9).
The ECU 1 expands the received update program Δ1 and applies it to the old version 1.0, thereby rewriting the control program from the old version 1.0 to the new version 1.2. When the rewriting is completed, the ECU 1 transmits a rewriting completion notification to the gateway 10 (step S10).

Next, the gateway 10 transmits the update program Δ2 determined to be transmitted next to the corresponding ECU 2 (step S11).
The ECU 2 expands the received update program Δ2 and applies it to the old version 1.3, thereby rewriting the control program from the old version 1.3 to the new version 2.0. When the rewriting is completed, the ECU 2 transmits a rewriting completion notification to the gateway 10 (step S12).

Next, the gateway 10 transmits the update program Δ3 determined to be transmitted next to the corresponding ECU 3 (step S13).
The ECU 3 rewrites the received update program Δ3 and applies it to the old version 2.0, thereby rewriting the control program from the old version 2.0 to the new version 2.2. When the rewriting is completed, the ECU 3 transmits a rewriting completion notification to the gateway 10 (step S14).

  Note that the transmission of the update program Δ to each of the plurality of ECUs 30 in steps S9, 11, and 13 is performed according to the transmission order determined by the scheduling process in step S8 as described above. The determined transmission order is not necessarily limited to transmission to each of the plurality of ECUs 301. That is, the transmission order for transmitting each update program Δ to a plurality of ECUs 30 at the same time can be determined. That is, the above steps S9, 11, and 13 are not meant to be executed in this order, and the respective processes are performed in a prescribed transmission order and are executed simultaneously depending on the prescribed transmission order. There is also a possibility.

When the gateway 10 receives the rewriting completion notification from all the ECUs 1 to 3, it transmits a normal mode transition request and a reset request to each ECU 1 to 3 (step S15).
Receiving the normal mode transition request, each ECU 1 to 3 switches its control mode from the repro mode to the normal mode, and restarts the system in response to the reset request. Thereby, each ECU1-3 operate | moves by a new version control program, respectively.

Further, when the gateway 10 receives the rewriting completion notification from all the ECUs 1 to 3, the gateway 10 transmits the update completion notification to the management server 5 (step S16).
Thereby, the management server 5 senses that the update of the control program is completed for each of the ECUs 1 to 3 of the vehicle 1.

[Scheduling processing]
FIG. 6 is a flowchart showing the scheduling process in step S8. The scheduling process shown in the flowchart of FIG. 6 is realized by the CPU 11 of the gateway 10 reading out and executing the scheduling process execution program stored in the storage unit 13 on the RAM 12. At this time, as shown in FIG. 2, the CPU 11 includes a scheduling unit 111 and an update control unit 112 that are functions realized by executing the program. The scheduling process is realized by the CPU 11 exhibiting these functions. The operation shown in the flowchart of FIG. 6 is started when a plurality of update programs are acquired from the DL server 6 and there are a plurality of control programs to be updated simultaneously.

  Referring to FIG. 6, CPU 11 of gateway 10 identifies a plurality of main buses NW1, NW2 connected to gateway 10 based on the topology of the in-vehicle network stored in storage unit 13, and for each of them In parallel, the subsequent scheduling process is executed (step S101).

  First, the CPU 11 uses a plurality of update programs for ECUs belonging to a local bus based on the destinations of each of the plurality of update programs that need to be updated simultaneously and the topology of the in-vehicle network stored in the storage unit 13. It is determined whether the update program is included. In the example of FIG. 1, the CPU 11 determines whether or not an update program for ECU_D or ECU_E is included in the plurality of update programs.

  When an update program for ECU connected via a local bus is included in a plurality of update programs that need to be updated simultaneously (YES in step S103), the CPU 11 further branches to branch the main bus to the local bus It is determined whether an ECU (ECU_C) as a node can use a relay buffer for relaying transmission of the update program, that is, has a buffer function. The relay buffer is used to absorb a difference in transmission capability (transmission speed) between the main bus and the local bus. In the example of FIG. 1, the ECU_C determines whether or not the relay buffer can be used.

  If the branch node ECU can use the relay buffer (has a buffer function) (YES in step S105), the ECU belonging to the local bus on the main bus without considering the transmission speed on the local bus Update program can be transmitted. In this case, the CPU 11 assumes that the transmission of the update program on the main bus (NW1) branching to the local bus is exclusive, that is, assuming that the transmission path cannot be shared simultaneously for a plurality of transmissions. Processing is executed (step S107). If there is no difference in transmission speed between the main bus and the local bus, or the transmission speed on the local bus is faster than the transmission speed on the main bus, the ECU that is the branch node can use the relay buffer. The same scheduling process is performed. Specifically, when the ECU_C can use the relay buffer, the CPU 11 performs the subsequent scheduling process assuming that the main bus NW1 cannot be shared simultaneously for transmission of a plurality of update programs.

  If the transmission speed on the local bus is slower than the transmission speed on the main bus and the ECU as the branch node cannot use the relay buffer (does not have a buffer function) (NO in step S105), the local bus Therefore, it is necessary to transmit the update program on the main bus at a speed corresponding to the transmission speed on the local bus. In this case, the CPU 11 can transmit the update program in parallel on the main bus (NW1), that is, the transmission of the update program to the ECU belonging to the local bus and the transmission of the other update program simultaneously through the main bus. On the assumption that sharing is possible, the subsequent scheduling processing is executed (step S109). Specifically, when the transmission speed on the local bus NW3 is slower than the transmission speed on the main bus NW1 and the ECU_C cannot use the relay buffer, the CPU 11 uses the local bus NW3 in the main bus NW1. Assuming that the transmission of the update program and the transmission of other update programs can be performed in parallel, the subsequent scheduling process is performed.

  In any scheduling process, when transmission of an update program on a certain bus is completed, transmission of the next update program is started so as not to generate a free bandwidth on the bus.

  Specifically, the CPU 11 determines the transmission order of a plurality of control programs that need to be updated simultaneously according to each of a plurality of predetermined scheduling conditions (steps S111 to S115). For example, when the condition A “schedule an update program with a long update time is given priority” is defined as the condition A, the CPU 11 requires the update that is the sum of the first to third times for each update program. The transmission order is determined based on the order of time (step S111). The transmission order determined according to the scheduling condition which is condition A is defined as transmission order A.

  When the condition that “schedule an update program with a short transmission time is preferentially scheduled” is defined as the condition B, the CPU 11 determines the transmission order based on the order of the first time for each update program (step S113). . The transmission order determined according to the scheduling condition which is condition B is defined as transmission order B.

  When the condition “schedule in the order of identification information (for example, name, ID, etc.) given to ECU” is defined as the condition C, the CPU 11 determines, for example, the name of the ECU corresponding to the update program for each update program. Based on the order, the transmission order is determined (step S115). The transmission order determined according to the scheduling condition which is condition C is defined as transmission order C.

  The CPU 11 executes scheduling processing according to each of a plurality of predetermined scheduling conditions (conditions A to C), determines the transmission order, compares the results (transmission order A to C), and requires simultaneous update. The transmission order with the shortest period is set as the transmission order of the plurality of update programs (step S117). The CPU 11 executes the above scheduling process on the main buses NW1 and NW2 in parallel (step S119), and ends the series of processes at step S8.

  After executing the above scheduling process in step S8, in steps S9, 11, and 13, the CPU 11 executes an update control in which the update program is transmitted to each ECU in the determined transmission order to instruct the update. In order to execute the scheduling process and the update control, the CPU 11 includes a scheduling unit 111 and an update control unit 112 (FIG. 2). These are functions realized in the CPU 11 when the CPU 11 reads out a program stored in the storage unit 13 and executes it on the RAM 12.

[Specific example 1 of scheduling process]
FIG. 7 is a diagram showing a first specific example of a plurality of update programs that need to be updated simultaneously. Referring to FIG. 7, in the first example, first update program Δ1 is an update program for ECU_A, which is transmitted to ECU_A via first main bus NW1 (first task), and in ECU_A The update file is checked (second task), and the control program is rewritten by the ECU_A (third task). The first time to the third time are 30 [s (seconds)], 10 [s], and 30 [s]. The second update program Δ2 is an update program for ECU_F, which is transmitted to ECU_F via the second main bus NW2 (first task), and an update file is checked in ECU_F (second task). , ECU_F rewrites the control program (third task). The first to third times are 10 [s], 10 [s], and 30 [s]. The third update program Δ3 is an update program for ECU_D, which is transmitted to ECU_C via the first main bus NW1, and transmitted to ECU_D via the local bus NW3 via the ECU_C (first task). The update file is checked (second task), and the control program is rewritten by the ECU_D (third task). The first to third hours are 60 [s], 10 [s], and 30 [s]. For the transmission (first task) of the update program Δ3, the time required for transmission on the first main bus NW1 is 30 [s] and the time required for transmission on the local bus NW3 is 30 [s]. It is. The ECU_C that relays transmission from the main bus NW1 to the local bus NW3 can use a relay buffer, and the relay time of transmission from the main bus NW1 to the local bus NW3 is 10 [s].

  If the plurality of update programs Δ1 to Δ3 that need to be updated simultaneously are those in FIG. 7, the CPU 11 of the gateway 10 determines YES in step S103 and YES in step S107. Therefore, on the premise that transmission of the update program on the main bus NW1 is exclusive (step S107), scheduling processing using each of the predetermined scheduling conditions (conditions A to C) is executed. .

  FIG. 8 is a diagram comparing the update schedule (A) when the scheduling process of step S8 is not performed and the update schedule (B) when the scheduling process is performed. The horizontal axis represents time [s], and one block of (A) and (B) represents 10 [s].

  First, referring to (A), as an example, when the CPU 11 performs update control so that update processing is completed for each program in the order of update programs (Δ1 → Δ2 → Δ3), The time required for updating in the ECU, that is, 230 [s], which is the time required for each task shown in FIG. 7, is added.

  On the other hand, when the schedule process in step S8 is executed, the update program Δ3 that is transmitted (branched) by the local bus NW3 for the main bus NW1 is not used (not branched) for transmission of the update program Δ3. The transmission order is determined so that the update programs Δ3 and Δ1 are continuously transmitted via the main bus NW1 with priority over Δ1. For the main bus NW2 that can be transmitted in parallel with the main bus NW1, the transmission order is determined so as to transmit the update program Δ2 in parallel with the transmission of the update program on the main bus NW1 (B). This is because the update program is transmitted in parallel to the independent main buses NW1 and NW2 based on the topology of the in-vehicle network, and a plurality of update programs must be transmitted one by one for the same main bus. is there. Therefore, for the main bus (NW1) branched to the local bus, the update program to be further branched to the local bus (NW3) and transmitted is transmitted first. Thereby, transmission of the update program not branched and transmitted to the local bus (NW3) on the main bus and transmission of the update program on the local bus (NW3) can be performed in parallel. By doing in this way, the time required for transmission in the time required for simultaneous update can be made shorter than the sum of the first times of each of the plurality of update programs, and as a result, the time required for simultaneous update can be shortened. Can do. Note that the update file check (second task) and update (third task) following the transmission (first task) are continuously executed after the transmission is completed. The same applies to the specific examples of the scheduling process that follows.

  When a plurality of update programs Δ1 to Δ3 that need to be updated simultaneously are shown in FIG. 7, the CPU 11 executes the scheduling process in step S8 to determine the schedule shown in FIG. The required time is greatly reduced from 230 [s] to 110 [s].

[Specific example 2 of scheduling processing]
FIG. 9 is a diagram showing a second specific example of an update program that needs to be updated simultaneously. Referring to FIG. 9, in the second example, first update program Δ1 is an update program for ECU_A, which is transmitted to ECU_A via first main bus NW1 (first task), and in ECU_A. The update file is checked (second task), and the control program is rewritten by ECU_A (third task). The first time to the third time are 30 [s], 10 [s], and 30 [s]. The second update program Δ2 is an update program for ECU_F, which is transmitted to ECU_F via the second main bus NW2 (first task), and an update file is checked in ECU_F (second task). , ECU_F rewrites the control program (third task). The first to third times are 10 [s], 10 [s], and 30 [s]. The third update program Δ3 is an update program for ECU_D, which is transmitted to ECU_C via the first main bus NW1, and transmitted to ECU_D via the local bus NW3 via the ECU_C (first task). The update file is checked (second task), and the control program is rewritten by the ECU_D (third task). The first time to the third time are 120 [s], 10 [s], and 20 [s]. In the second example, the ECU_C that relays transmission from the main bus NW1 to the local bus NW3 cannot use the relay buffer (does not have a buffer function). Therefore, in the transmission of the update program Δ3 for ECU_D, since the transmission is performed on the first main bus NW1 at the same speed as the transmission speed on the local bus NW3, the time required for transmission on the first main bus NW1 is 120 [s], which is the same as the time required for transmission on the local bus NW3.

  If the plurality of update programs Δ1 to Δ3 that need to be updated simultaneously are those in FIG. 9, the CPU 11 of the gateway 10 determines YES in step S103 and NO in step S107. Therefore, with respect to the update program branched and transmitted to the local bus NW3 in the main bus NW1, it is assumed that other update programs can be transmitted in parallel (step S109), and each scheduling condition (conditions) defined in advance. A scheduling process using A to C) is executed.

  FIG. 10 is a diagram comparing the update schedule (A) when the scheduling process of step S8 is not performed and the update schedule (B) when the scheduling process is performed. The horizontal axis represents time [s], and one block of (A) and (B) represents 10 [s].

  First, referring to (A), as an example, when the CPU 11 performs update control so that update processing is completed for each program in the order of update programs (Δ1 → Δ2 → Δ3), This is 270 [s], which is the time required for the update in the ECU, that is, the time required for each task shown in FIG.

  On the other hand, when the schedule process of step S8 is executed, priority is given to transmission of the update program Δ3 that branches to the local bus NW3 and transmits the main bus NW1. For the main bus NW2 that can be transmitted in parallel with the main bus NW1, the transmission order is determined so that the update program Δ2 is transmitted in parallel with the transmission of the update program on the main bus NW1. These are based on the same idea as the scheduling process in the first specific example of the scheduling process shown in FIG. Further, for the main bus NW1, the transmission order is determined so as to transmit the update program Δ1 in parallel with the transmission of the update program Δ3 (B). This is because when the update program Δ3 is transmitted by the main bus NW1, the free bandwidth generated in the main bus NW1, which is the transmission path, is updated by setting the transmission speed or transmission timing in accordance with the transmission speed of the local bus NW3. This is because it is used for transmission of Δ1. In this case, the vacant bandwidth of the main bus NW1 when the update program Δ3 is transmitted by the main bus NW1 is used for transmission of the update program Δ1. That is, the transmission band of the main bus NW1 is shared between the update program Δ1 and the update program Δ3. Therefore, normally, transmission of the update program Δ1 is completed in 30 [s], but 60 [s] is required in order to halve the transmission band by sharing with the update program Δ3. In this way, the time required for transmission of the time required for simultaneous update can be made shorter than the total time required for transmission of each of the plurality of update programs, and as a result, the time required for simultaneous update is shortened. be able to.

  When a plurality of update programs Δ1 to Δ3 that need to be updated simultaneously are shown in FIG. 9, the CPU 11 executes the scheduling process in step S8 to determine the schedule shown in FIG. The required time is greatly reduced from 270 [s] to 150 [s].

[Specific example 3 of scheduling process]
FIG. 11 is a diagram showing a third specific example of an update program that needs to be updated simultaneously. Referring to FIG. 11, in the third example, the first update program Δ1 is an update program for ECU_A, which is transmitted to ECU_A via first main bus NW1 (first task), and in ECU_A The update file is checked (second task), and the control program is rewritten by the ECU_A (third task). The first time to the third time are 30 [s], 20 [s], and 40 [s]. The second update program Δ2 is an update program for ECU_B, which is transmitted to ECU_B via the first main bus NW1 (first task), and an update file is checked in ECU_B (second task). , ECU_B rewrites the control program (third task). The first to third times are 10 [s], 10 [s], and 20 [s]. The third update program Δ3 is an update program for ECU_C, which is transmitted to ECU_C via the first main bus NW1 (first task), and the update file is checked in ECU_C (second task). The ECU_C rewrites the control program (third task). The first time to the third time are 20 [s], 10 [s], and 50 [s]. That is, the plurality of update programs Δ1 to Δ3 are all for the ECU belonging to the first main bus NW1, and are transmitted to each ECU only by the main bus NW1.

  When the plurality of update programs Δ1 to Δ3 that need to be updated at the same time are those shown in FIG. 11, the CPU 11 of the gateway 10 determines NO in step S103. Therefore, neither of steps S107 and S109 is assumed. The scheduling process using each scheduling condition (conditions A to C) defined in advance is executed.

  FIG. 12 compares the update schedule (A) when the scheduling process of step S8 is not performed and the update schedules (B) to (D) when the scheduling process according to each of the above conditions A to C is performed. FIG. The horizontal axis represents time [s], and one block of (A) to (D) represents 10 [s].

  First, referring to (A), as an example, when the CPU 11 performs update control so that update processing is completed for each program in the order of update programs (Δ1 → Δ2 → Δ3), The time required for updating in the ECU, that is, 210 [s], which is the time required for each task shown in FIG. 11, is added.

  On the other hand, when the scheduling process is executed according to the above condition A, the transmission order A is set so that these update programs are continuously transmitted on the main bus NW1 in the order of the longest third time (Δ3 → Δ1 → Δ2). Determined (B). The condition A can also be interpreted as “schedule an update program with a long processing time in the received ECU with priority”. The processing in the received ECU is an update file check (second task) and a control program rewrite (third task). When the above-described interpretation is adopted, the transmission order A may be determined in the order of the longest total time of the second time and the third time (Δ1 → Δ3 → Δ2) required for these tasks. In this case, another update program is transmitted on the main bus NW1 in parallel while checking the update file (second task) and rewriting the control program (third task) in the corresponding ECU. It will be. In the case of the condition A, the second task and the third task are started earlier as the third time or the total time of the second time and the third time is longer. There is a high possibility that the update of the control program using the update program will be completed earlier. In the case of the transmission order A in FIG. 12B, the time required for simultaneous update is 110 [s].

  When the scheduling process is executed according to the condition B, the transmission order B is determined so that these update programs are continuously transmitted on the main bus NW1 in the order of the short first time (Δ2 → Δ3 → Δ1) (C ). Also in this case, another update program is transmitted on the main bus NW1 in parallel while the update file is checked (second task) and the control program is rewritten (third task) in the corresponding ECU. Will be. In the case of condition B, the start of the second task can be made earliest after transmission (first task) for each update program. In the case of the transmission order B in FIG. 12C, the time required for simultaneous update is 120 [s].

  When the scheduling process is executed according to the above condition C, the transmission order C is determined so that these update programs are continuously transmitted on the main bus NW1 in the order of the names of the corresponding ECUs (Δ1 → Δ2 → Δ3) (D ). Also in this case, another update program is transmitted on the main bus NW1 in parallel while the update file is checked (second task) and the control program is rewritten (third task) in the corresponding ECU. Will be. In the case of the transmission order C in FIG. 12D, the required time for simultaneous update is 120 [s].

  As a result of the scheduling process described above, when a plurality of update programs Δ1 to Δ3 that need to be updated simultaneously are shown in FIG. Therefore, the gateway 10 determines the transmission order A shown in FIG. 12B as the transmission order of the update programs Δ1 to Δ3 in step S8. As a result, the time required for simultaneous update is greatly reduced from 210 [s] to 110 [s].

<Effect of the first embodiment>
According to the program update system according to the first embodiment, when the control programs of the plurality of ECUs are simultaneously updated, the update program is transmitted from the DL server 6 which is an external device that provides the update program to the ECU 30. In the gateway 10, which is a relay device that relays, scheduling processing for determining the transmission order of a plurality of update programs is executed.

  When the plurality of update programs that need to be updated at the same time include update programs for ECUs belonging to each of the independent in-vehicle networks that are individually connected to the gateway 10, the gateway 10 stores these update programs on the main bus ( NW1, NW2).

When a plurality of update programs for a plurality of ECUs belonging to the same in-vehicle network are included, the gateway 10 executes a scheduling process according to each predetermined condition (a plurality of scheduling conditions). Then, the transmission order that minimizes the time required for simultaneous update among the plurality of transmission orders obtained as a result is determined as the transmission order of the plurality of update programs. For example, when there are a plurality of update programs transmitted through the same main bus (NW1), and the plurality of update programs include those transmitted by branching to the local bus, the gateway 10 is connected to the main bus. The update program transmitted to the ECU belonging to the local bus is preferentially transmitted with the ECU belonging to the main bus as a branch node over the update program transmitted to the belonging ECU. At this time, the gateway 10 determines whether the transmission of the update program on the same main bus (NW1) is exclusive or parallel depending on whether or not the ECU that is the branch node has a buffer function. Either one is assumed.
Thereby, the time required for simultaneous update can be shortened.

  During the update process of a plurality of control programs to be updated simultaneously, all corresponding ECUs are in the repro mode, and do not return to the normal mode until all the update processes are completed and restarted. For this reason, as the simultaneous update required period becomes longer, inconveniences and disadvantages of the user are more likely to occur, for example, it is impossible to drive at the timing of driving. Therefore, the scheduling process is executed in the gateway 10 as described above and the transmission order for ending the simultaneous update required period earliest is determined, so that inconveniences and disadvantages caused to the user can be suppressed.

<Second Embodiment>
The scheduling process described above may be performed by any relay device that relays the update program transmitted from the DL server 6 to the ECU 30. For example, when the update program transmitted from the DL server 6 to the ECU 30 is relayed by a further relay device not shown in FIG. 1 in addition to the gateway 10, the above-described scheduling process is executed in the further relay device. Also good. Alternatively, the scheduling process may be realized by cooperation between the gateway 10 and the further relay device.

  Further, as shown in FIG. 5, when the update program is transmitted from the DL server 6 to the ECU 30, the management server 5 requests the gateway 10 to download (step S3), and the gateway 10 transmits the DL server in accordance with the request. The update program is transmitted from the DL server 6 to the gateway 10 by requesting the update program to 6 (step S4). Then, the management server 5 requests the gateway 10 to update each ECU 30 (step S6), and the gateway 10 requests each ECU 30 to update in accordance with the request, whereby the update program is transmitted from the gateway 10 to the ECU 30 and controlled. The program is updated (steps S7, 9, 11, 13). Therefore, according to this flow, it can be said that the management server 5 also functions as a part of a relay device that relays transmission of the update program from the DL server 6 to the ECU 30.

  Therefore, the scheduling process described above may be executed in the management server 5 that can be said to be a kind of relay apparatus, and information indicating the transmission order determined together with the update program in step S4 may be transmitted to the gateway 10. Or since the management server 5 and DL server 6 may be implement | achieved by the same server apparatus as mentioned above, a scheduling process may be performed in the server which has the function of the servers 5 and 6. FIG. In this case, the scheduling unit 111 and the update processing unit 112 (FIG. 2), which are functions for executing the above-described scheduling process, read and execute the program stored in the ROM 52 on the RAM 53 by the CPU 51 of the management server 5. This is realized by the CPU 51. That is, the management server 5 obtains an update program or information related to the update program from the DL server 6 and stores it in the storage unit 54. The scheduling unit 111 of the management server 5 performs scheduling processing using information related to the update program stored in the storage unit 54. The update processing unit 112 passes the transmission order determined by the scheduling unit 111 to the gateway 10 and requests an update process in the ECU 30. The update processing unit 112 of the gateway 10 controls the update process in the simultaneous update by transmitting the update program in the transmission order delivered from the management server 5 and requesting each ECU 30 to perform the update process.

  Also in the program update system according to the second embodiment, the time required for simultaneous update can be shortened when there are a plurality of update programs that need to be updated simultaneously. Thereby, the inconvenience and disadvantage which arise to a user can be suppressed.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 Vehicle 2 Wide Area Communication Network 5 Management Server (Relay Device)
6 DL server 10 Gateway (relay device)
11 CPU
12 RAM
13 Storage Unit 14 In-Vehicle Communication Unit 15 Wireless Communication Unit 30 ECU (Control Device)
31 CPU
32 RAM
33 Storage Unit 34 Communication Unit 35 Start-up Unit 51 CPU
52 ROM
53 RAM
54 storage unit 55 communication unit NW1-NW3 bus (in-vehicle network)
111 Scheduling unit 112 Update control unit

Claims (11)

A relay device that communicates with a plurality of control devices belonging to an in-vehicle network,
For each of the plurality of control devices, a plurality of update programs to be applied at mutually overlapping timings, a storage unit that stores the topology of the in-vehicle network,
An in-vehicle communication unit that transmits a plurality of the update programs to the corresponding control devices, and
For the control device belonging to a plurality of the in-vehicle network independent of each other which are individually connected to the own device, a plurality of the update program corresponding to each of the control device, to transmit in parallel on the basis of the topology A control unit that controls the in-vehicle communication unit,
In the case where the control unit includes a single in-vehicle network that includes a main network directly connected to the own device and a local network that branches from the main network using the control device connected to the main network as a branch node. Transmits a second update program for the control device connected to the main network in the main network in parallel with transmission of the first update program for the control device connected to the local network to the local network. Let
The first update program and the second update program are update programs different from each other.
Relay device.   The relay device according to claim 1, wherein the control unit determines a transmission order of the plurality of update programs according to a predetermined condition. The predetermined condition is a scheduling condition that minimizes the simultaneous update required time that is a combination of update required times including the following first time to third time in each of the control devices,
The time required for the simultaneous update is that the control program is rewritten at the end of the plurality of update programs from the start of the first time for the update program transmitted to the control device first among the plurality of update programs. The relay device according to claim 2, wherein the relay device is a time until the end of the third time for an update program to be ended.
1st time: Transmission time of update program 2nd time: Time required for checking update program 3rd time: Time required for rewriting control program using update program The scheduling condition includes
4. The relay according to claim 3, wherein for a plurality of the control devices included in one in-vehicle network having a bus topology, the control device having a longer third time includes an earlier transmission order of the update program. 5. apparatus. The scheduling condition includes
5. The plurality of control devices included in one in-vehicle network that has a bus topology includes that the transmission time of the update program is advanced as the control device has a shorter first time. The relay device described in 1. The scheduling condition includes
The method according to claim 3, further comprising: determining a transmission order for a plurality of the control devices included in one vehicle-mounted network having a bus topology based on identification information given to the control device. The relay device according to any one of the above. The front Symbol scheduling conditions, the transmission order to the control device connected to a local network, wherein involves expedite than the transmission order of the connected the controller to the main network, claims 3 The relay device according to any one of 6. Wherein the control unit, the branch node, depending on whether a buffer function for relaying a transmission from said main network of the first update to the local network, determines the transmission speed of the main network The relay device according to claim 7.
The branch node has a buffer function for relaying transmission of the first update program from the main network to the local network.
The relay apparatus of any one of Claims 1-8. A program update system including a plurality of control devices belonging to an in-vehicle network and a relay device communicating with the plurality of control devices,
The relay device is
For each of the plurality of control devices, a plurality of update programs to be applied at mutually overlapping timings, a storage unit that stores the topology of the in-vehicle network,
An in-vehicle communication unit that transmits a plurality of the update programs to the corresponding control devices, and
For the control device belonging to a plurality of the in-vehicle network independent of each other which are individually connected to the own device, a plurality of the update program corresponding to each of the control device, to transmit in parallel on the basis of the topology A control unit that controls the in-vehicle communication unit,
In the case where the control unit includes a single in-vehicle network that includes a main network directly connected to the own device and a local network that branches from the main network using the control device connected to the main network as a branch node. Transmits a second update program for the control device connected to the main network in the main network in parallel with transmission of the first update program for the control device connected to the local network to the local network. Let
The first update program and the second update program are update programs different from each other.
Program update system. A program update method executed by a relay device that communicates with a plurality of control devices belonging to an in-vehicle network,
Storing a plurality of update programs to be applied at overlapping timings with respect to each of the plurality of control devices , and the topology of the in-vehicle network;
Transmitting a plurality of the update programs to the corresponding control devices, respectively,
Said transmitting step is for the controller belonging to a plurality of the in-vehicle network independent of each other which are individually connected to the relay device, a plurality of the update program corresponding to each of the control device, the topology only it contains to be sent on the basis of parallel,
The transmitting step includes a main network directly connected to the own device in one in-vehicle network, and a local network branched from the main network with the control device connected to the main network as a branch node. In this case, in parallel with the transmission of the first update program for the control device connected to the local network on the local network, the second update program for the control device connected to the main network is transmitted on the main network. Including sending,
The first update program and the second update program are update programs different from each other.
Program update method.

Images