Forwarding device, electronic control unit and vehicle-integrated system

Abstract

Forwarding device (10), comprising: a procurement unit (S114, S314, S435) that obtains data from an upgrade tool (30) necessary to perform an upgrade processing operation (S114, S314, S435), wherein the upgrade tool performs the upgrade processing operation to upgrade ECUs (20, 40) connected to a vehicle-integrated network (2, 3), and the ECUs (20, 40) include a target ECU which is the subject of the upgrade processing operation and a non-target ECU which is not the subject of the upgrade processing operation; a forwarding unit (S114, S314, S435) which provides the data procured by the procurement unit to the target ECU via the vehicle-integrated network; an interrupt instruction unit (S108, S308, S420) that transmits an interrupt command via the vehicle-integrated network, which instructs the non-target ECU to enter an interrupt state when responding to the start of upgrade processing, wherein the interrupt state is a state in which the transmission of other data to the non-target ECU via the vehicle-integrated network is interrupted; and a cancellation instruction unit (S116, S120, S124, S136, S316, S320, S324, S338, S465, S530, S535, S625, S630) which, via the vehicle-integrated network, instructs the non-target ECU to clear the interrupt state when the upgrade processing is complete.

Description

TECHNICAL FIELD

[0001] The invention relates to a relay device and an electronic control unit (hereinafter abbreviated as ECU) connected to a vehicle-mounted or in-vehicle network, and further relates to a vehicle-mounted system including the relay device and the electronic control unit. TECHNICAL BACKGROUND

[0002] A related art technique makes it possible to write a program into an ECU by allowing the ECU to communicate with a device outside a vehicle via an ECU interface and an on-vehicle LAN (see JP 2003-46536 A). DE 11 2013 005 705 T5 relates to an in-vehicle program updating device that updates a program installed in an electronic control unit mounted on a vehicle. DE 11 2007 002 812 T5 relates to a relay connection unit mounted on a vehicle and a communication system mounted on a vehicle and including the relay connection unit. BRIEF DESCRIPTION OF THE INVENTION

[0003] However, if another ECU sends data to the vehicle's LAN while a program is being written to the ECU, a data transmission rate decreases and writing of the program slows down.

[0004] In view of the foregoing disadvantage, it is an object of the invention to provide a technique that enables an ECU to be easily upgraded via a vehicle-mounted network.

[0005] According to one aspect of the present disclosure, a relay device includes an acquisition unit, a relay unit, a suspension instruction unit, and a cancellation instruction unit. The acquisition unit acquires data necessary for performing upgrade processing from an upgrade tool. The upgrade tool performs the upgrade processing to upgrade ECUs connected via an in-vehicle network, and the ECUs include a target ECU that is subject to the upgrade processing and a non-target ECU that is not subject to the upgrade processing. The relay unit provides the data acquired by the acquisition unit to the target ECU via the in-vehicle network.In response to the start of upgrade processing, the interruption command unit transmits an interruption command via the in-vehicle network, instructing the non-target ECU to enter an interruption state. The interruption state is a state in which transmission of other data to the non-target ECU via the in-vehicle network is interrupted. The cancellation command instructs the non-target ECU to cancel the interruption state when upgrade processing is completed, via the in-vehicle network.

[0006] According to the configuration as above, when the upgrade processing of the target ECU is performed by the upgrade tool via the in-vehicle network, the non-target ECU (an ECU other than the target ECU) interrupts the transmission of other data to the in-vehicle network. Therefore, a communication load on the in-vehicle network is limited during execution of the upgrade processing, and data necessary for the upgrade processing is quickly transmitted and received. The non-target ECU resumes the transmission of data via the in-vehicle network after the upgrade processing is completed. Therefore, the non-target ECU executes the processing without any interference after the upgrade processing is completed. As a result, the ECUs can be smoothly upgraded via the in-vehicle network.

[0007] According to another aspect of the present disclosure, an ECU includes an acquisition unit, an upgrade unit, an interruption unit, and an interruption cancellation unit. The acquisition unit acquires, via a vehicle-mounted network, data necessary to perform upgrade processing of its own ECU from an upgrade tool via a relay device. The upgrade unit performs processing associated with the upgrade processing in accordance with the data acquired by the acquisition unit. The interruption unit, upon receiving an interruption command from the relay device via the vehicle-mounted network, switches its own ECU to an interruption state in which data transmission via the vehicle-mounted network is interrupted when the upgrade processing is started.The interruption cancellation unit cancels the interruption state upon receiving a command from the relay device via the in-vehicle network when the upgrade processing is completed or ended.

[0008] According to the configuration above, the ECU pauses the transmission of data to the in-vehicle network while the upgrade tool performs upgrade processing on the target ECU via the in-vehicle network. Therefore, data necessary for upgrade processing is transmitted and received quickly. The ECU reliably resumes the transmission of data via the in-vehicle network after the upgrade processing is completed. Therefore, the ECU performs processing without any interference after the upgrade processing is completed. As a result, the ECU can be smoothly upgraded via the in-vehicle network.

[0009] In accordance with another aspect of the present disclosure, a vehicle-mounted system includes a plurality of ECUs (20, 40) connected to a vehicle-mounted network, and a relay device connected to the vehicle-mounted network. The relay device includes a relay device-side acquisition unit, a relay unit, an interruption instruction unit, and a cancellation instruction unit. The relay device-side acquisition unit acquires data necessary to perform upgrade processing from an upgrade tool. The upgrade tool performs upgrade processing to upgrade the plurality of ECUs, and the plurality of ECUs includes a target ECU that is subject to the upgrade processing and a non-target ECU that is not subject to the upgrade processing.The relay unit provides the data acquired by the relay device-side acquisition unit to the target ECU via the in-vehicle network. The interruption instruction unit transmits an interruption command, instructing the non-target ECU to enter an interruption state, in response to the start of the upgrade processing via the in-vehicle network. The interruption state is a state in which transmission of other data to the non-target ECU via the in-vehicle network is interrupted. The cancellation instruction unit instructs the non-target ECU to cancel the interruption state when the upgrade processing is completed, via the in-vehicle network.

[0010] Each of the plurality of ECUs includes an ECU-side acquisition unit, an upgrade unit, an interruption unit, and an interruption cancellation unit. The ECU-side acquisition unit acquires, from the relay device via the in-vehicle network, data necessary to perform upgrade processing of its own ECU, which is transmitted from the upgrade tool via the relay device. The upgrade unit performs processing associated with the upgrade processing in accordance with the data acquired by the ECU-side acquisition unit. The interruption unit, upon receiving the interruption command from the relay device via the in-vehicle network, switches its own ECU to the interruption state when the upgrade processing is started.The interrupt cancellation unit cancels the interrupt state upon receiving a command from the forwarding device when the upgrade processing is completed.

[0011] According to the configuration as above, when the upgrade processing is performed on the target ECU constituting the in-vehicle system by the upgrade tool via the in-vehicle network, the non-target ECU interrupts the transmission of other data to the in-vehicle network. Therefore, during the upgrade tool, a communication load on the in-vehicle network is limited, and data necessary for the upgrade processing is quickly transmitted and received. The non-target ECU reliably resumes the transmission of data via the in-vehicle network after the upgrade processing of the target ECU is completed. Therefore, the non-target ECU can perform processing without any interference after the upgrade processing is completed. As a result, the target ECU can be smoothly upgraded via the in-vehicle network.be updated. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other objects, features, and advantages of the invention will become more apparent from the following detailed description with reference to the accompanying drawings. In the drawings: Fig. 1 is a block diagram showing a vehicle-mounted system of a first embodiment; Fig. 2 is another block diagram showing the vehicle-mounted system of the first embodiment; Fig. 3 is a block diagram of a forwarding device of the first embodiment; Fig. 4 is a block diagram of an A-ECU of the first embodiment; Fig. 5 is a block diagram of a communication ECU of the first embodiment; Fig. 6 is a view used to describe processing (reprogramming sequence) performed by a rewriting tool, the relay device, and ECUs when reprogramming is performed in the first embodiment; Fig. 7 is a flowchart showing abnormality detection processing of the first embodiment; Fig. 8 is a view used to describe a reprogramming sequence of a second embodiment; Fig. 9 is a view used to describe a reprogramming sequence of a third embodiment; Fig. 10 is a flowchart illustrating reprogramming monitoring processing of the third embodiment; and Fig. 11 is a flowchart illustrating reprogramming monitoring processing of a fourth embodiment. EMBODIMENTS FOR IMPLEMENTING THE INVENTION

[0013] Embodiments are described below using the drawings. (First embodiment)(Configuration)

[0014] An in-vehicle system 1 of a first embodiment includes a relay device 10 and a plurality of ECUs capable of performing communication via an in-vehicle network.

[0015] More specifically, as an example, the vehicle-mounted system 1 may include an A-network 2 to which the relay device 10 and a plurality of A-ECUs 20 are connected, and a B-network 3 to which a plurality of B-ECUs 40 are connected. One of the A-ECUs 20 may be provided as an interface (gateway) connected to the B-network 3 ( Fig. 1). Hereinafter, the example as above is referred to as Case 1. In Case 1, the A-ECU 20 serving as the interface relays communication between the relay device 10 or other A-ECUs 20 connected to the A network 2 and the B-ECUs 40 connected to the B network 3.

[0016] Alternatively, a network identical to the B network 3 may be additionally provided, or one of the B-ECUs 40 connected to the B network 3 may be provided as an interface connected to another network. Furthermore, the vehicle-mounted system 1 may include only the relay device 10 and the A-ECUs 20 connected to the A network 2, without the B network 3.

[0017] As another example, the vehicle-mounted system 1 may include an A-network 2 to which the relay device 10 and a plurality of A-ECUs 20 are connected, and a C-network 4 to which the relay device 10 and a plurality of C-ECUs 50 are connected, wherein the relay device serves as an interface ( Fig. 2). Hereinafter, the example as above is referred to as Case 2.

[0018] In Case 2, the relay device 10 (interface or gateway) relays communication between the A-ECU 20 connected to the A-network 2 and the C-ECU 50 connected to the C-network 4. One of the C-ECUs 50 connected to the C-network 4 is provided as a communication ECU 60, which communicates with a rewriting tool 30 described below.

[0019] Needless to say, the ECUs connected to the A-network 2 and the C-network 4 may be provided as interfaces connected to other networks. A communication ECU is not necessarily provided for the C-network 4, and may be provided for a network interfaced to the C-network 4 or another network connected to the network connected to the C-network 4. In this configuration, the relay device 10 can communicate with a communication ECU via the C-network 4 and a network to which the communication ECU is connected.

[0020] Each of the A-network 2 to C-network 4 may be a vehicle-mounted network in accordance with protocols such as the CAN, FlexRay (registered trademark) or Lin protocol.

[0021] The ECUs are configured to perform various types of processing involved in driving the vehicle.

[0022] The relay device 10 is configured to communicate with the rewriting tool 30, which rewrites programs stored in the ECUs (hereinafter, rewriting a program may also be referred to as reprogramming or performing reprogramming). When the rewriting tool 30 performs reprogramming, the relay device 10 relays communication between the rewriting tool 30 and an ECU to be reprogrammed (target ECU).

[0023] More precisely, in this case 1 ( Fig. 1) The relay device 10 directly communicates with the rewriting tool 30 through wired or wireless communication, and relays the communication between the rewriting tool 30 and a target ECU connected to the A network 2 or the B network 3 during reprogramming. An ECU connected to another vehicle-mounted network connected to the A network 2 or the B network 3 can be reprogrammed as the target ECU. In such a case, the relay device 10 relays the communication in the same manner as above. In the following description, "wireless communication" means wireless communication performed between the relay device 10 and the rewriting tool 30, either directly or via a network such as a mobile phone connection or the Internet.

[0024] Meanwhile, in case 2 ( Fig. 2) The relay device 10 communicates with the rewriting tool 30 via the C-network. That is, the communication ECU 60 connected to the C-network 4 communicates directly with the rewriting tool 30 through wired or wireless communication, and relays the communication between the rewriting tool 30 and the relay device 10 through the C-network 4. That is, the communication ECU 60 connected to the C-network 4 communicates directly with the rewriting tool 30 through wired or wireless communication, and relays the communication between the rewriting tool 30 and the relay device 10 through the C-network 4.When one of the A-ECUs 20 connected to the A-network 2 is reprogrammed as a target ECU, the relay device 10 relays the communication between the rewriting tool 30 and the target ECU by communicating with the rewriting tool 30 via the communication ECU 60 and the C-network 4. An ECU connected to another vehicle-mounted network connected to the A-network 2 can be reprogrammed as a target ECU. In such a case, the relay device 10 relays the communication in the same manner as above.

[0025] Now, configurations of the relay device 10 and the ECUs will be described.

[0026] The relay device 10 includes an in-vehicle communication section 11, an external communication section 12, a control device 13 and a memory 14 (as shown in Fig. 3 shown).

[0027] The in-vehicle communication section 11 is a section that communicates with the A-ECUs 20 via the A-network 2.

[0028] The external communication section 12 is a section that communicates with the rewriting tool 30.

[0029] More precisely, in this case 1 ( Fig. 1) The external communication section 12 may be provided as, for example, a section that wirelessly communicates with the rewriting tool 30 via an unillustrated antenna or the like. Alternatively, the external communication section 12 may be provided as, for example, a section that communicates with the rewriting tool 30 via a communication line temporarily connected between the relay device 10 and the rewriting tool 30.

[0030] However, in case 2 ( Fig. 2) the external communication section 12 is provided as a section that communicates with the C-ECUs 50 via the C-network 4, and communicates with the communication ECU 60 to communicate with the rewriting tool 30 via the communication ECU 60.

[0031] The control device 13 mainly consists of a typical microcomputer including a CPU, a ROM, a RAM, an input / output module, a bus connecting the foregoing components, and so on. The control device 13 performs various types of processing in accordance with programs previously stored in the ROM and programs loaded into the RAM.

[0032] The memory 14 is provided by a data-rewritable, non-volatile memory, such as a flash memory or a hard disk drive (HDD). Programs and various types of data necessary for controlling the relay device 10 are stored in the memory 14.

[0033] Each A-ECU 20 connected to the A-network 2 includes an in-vehicle communication section 21, a memory 22, and a control device 23 ( Fig. 4).

[0034] The in-vehicle communication section 21 is a section that communicates with the ECUs or the like connected to an in-vehicle network to which an own device is connected, by performing communication via the in-vehicle network. Specifically, when the own device is connected to the A network 2, the in-vehicle communication section 21 communicates with the other A-ECUs connected to the A network 2. When the own device is connected to the A network 2 and the B network 3 (provided as the interface), the in-vehicle communication section 21 communicates with the other A-ECUs 20 connected to the A network 2, and also communicates with the B-ECUs 40 connected to the B network 3.

[0035] The memory 22 is provided by a data-rewritable, non-volatile memory, such as a flash memory or a hard disk (HDD). Programs and various types of data necessary for controlling the A-ECU 20 are stored in the memory 22.

[0036] The control device 23 mainly consists of a typical microcomputer including a CPU, a ROM, a RAM, an input / output device, a bus connecting the foregoing components, and so on. The control device 23 performs various types of processing in accordance with programs pre-stored in the ROM, programs pre-stored in the memory 22 provided as a flash memory, and programs loaded into the RAM.

[0037] The ECUs connected to the B network 3 and the C network 4 are of a same configuration as the A ECUs 20, so a detailed description is omitted herein.

[0038] However, as an exception, the communication ECU 60 connected to the E-network 4 is configured as follows. That is, the communication ECU 60 includes an in-vehicle communication section 61, a memory 62, a control device 63, and an external communication section 64 ( Fig. 5).

[0039] The in-vehicle communication section 61, the memory 62, and the control device 63 are each configured in a similar manner to the in-vehicle communication section 21, the memory 22, and the control device 23 included in the A-ECU 20 connected to the A-network 2.

[0040] The external communication section 64 is a section that communicates with the rewriting tool 30. For example, the external communication section 64 may wirelessly communicate with the rewriting tool 30 via an antenna (not shown), or may communicate with the rewriting tool 30 via a communication line temporarily connected between the communication ECU 60 and the rewriting tool 30. (Processing)

[0041] Next, processing when the rewriting tool 30 reprograms an ECU will be described. As described, the relay device 10 relays communication between the rewriting tool 30 and a target ECU (an ECU to be reprogrammed) during reprogramming. (1) General outline

[0042] Upon receiving an instruction from a user to reprogram one of the ECUs as a target ECU, the rewriting tool 30 transmits a reprogramming mode change request, which is a command indicating reprogramming, to the target ECU via the relay device 10. When the reprogramming is completed, the rewriting tool 30 transmits a reprogramming mode end request, which is a command notifying the completion of the reprogramming, to the target ECU.

[0043] The rewriting tool 30 is capable of simultaneously reprogramming multiple target ECUs in parallel. In such a case, the rewriting tool 30 transmits the reprogramming mode change request individually to the respective target ECUs along with data (rewriting data) constituting a new program. The rewriting tool 30 also transmits a reprogramming end request, which is a command indicating the completion of the reprogramming, to the target ECUs on which programming is completed.

[0044] The following will describe processing (reprogramming sequence) performed by the rewriting tool 30, the relay device 10, and the ECUs when reprogramming is performed ( Fig. 6).

[0045] In S100, in response to an instruction from the user, the rewriting tool 30 transmits a reprogramming mode change request, which is a command instructing a target ECU to start reprogramming (a command directed to the target ECU as a receiver), to the relay device 10. As described, in Case 1 ( Fig. 1) the rewriting tool 30 communicates directly with the forwarding device 10 via wired or wireless communication, and in case 2 ( Fig. 2) the rewriting tool 30 via the communication ECU 60 and the C-network 4 with the relay device 10.

[0046] In S102, the relay device 10 forwards the reprogramming mode change request to the target ECU. In case 1, the target ECU is one of the A-ECUs 20 or the B-ECUs 40. If the target ECU is one of the A-ECUs 20, the relay device 10 communicates with the target ECU via the A-network 2. If the target ECU is one of the B-ECUs 40, the relay device 10 communicates with the target ECU via the A-network 2, with the A-ECU 20 serving as the interface, and the B-network 3 communicating with the target ECU. In case 2, the target ECU is one of the A-ECUs 20, and the relay device communicates with the target ECU via the A-network 2.

[0047] In S104, in response to the reprogramming mode change request, the target ECU transmits a command indicating a response of the reprogramming start (a command directed to the rewriting tool 30 as a receiver) to the relay device 10.

[0048] In S106, the forwarding device 10 forwards the response to the rewriting tool 30.

[0049] In S108, the relay device 10 transmits a data transmission interruption request to non-target ECUs for which reprogramming is not requested.

[0050] The data transmission interruption request is a command that instructs the non-target ECU to interrupt the transmission of data to the vehicle-mounted network for a predetermined interruption period (e.g., 5 seconds). The data transmission interruption request may be an instruction to interrupt the transmission of all data or a portion of data (e.g., data of low importance) to the vehicle-mounted network during reprogramming. The data transmission interruption request instructs the non-target ECU not to determine a failure to receive necessary data from the vehicle-mounted network during reprogramming as an abnormality (hereinafter referred to as masking a diagnosis).

[0051] The non-target ECU may include all of the ECUs constituting the in-vehicle system 1 except the target ECU. Alternatively, a part of the ECUs other than the target ECU may be selected as the non-target ECUs by considering a communication load on the in-vehicle network or the like.

[0052] That is, for example, all of the other ECUs connected to an in-vehicle network to which the target ECU is connected may be the non-target ECUs. Specifically, if the target ECU is one of the A-ECUs 20 in Cases 1 and 2, the remaining A-ECUs 20 other than the target ECU may be the non-target ECUs. If the target ECU is one of the A-ECUs 20 in Case 2, the remaining A-ECUs 20 other than the target ECU may be the non-target ECUs.

[0053] In another example, ECUs connected to an in-vehicle network through which communication is performed between the relay device 10 and the target ECU may be the non-target ECUs. To be more specific, when the target ECU is one of the B-ECUs 40 in Case 1, the A-ECUs 20 and the remaining B-ECUs 40 other than the target ECU are the non-target ECUs.

[0054] In Case 2, too, the ECUs connected to an in-vehicle network through which communication is performed between the relay device 10 and the communication ECU 60 may be the non-target ECUs. To be more specific, in Case 2, in addition to the remaining A-ECUs 20 other than the target ECU, the C-ECUs 50 are the non-target ECUs.

[0055] When the non-target ECUs are determined for each in-vehicle network in the manner described above, some ECUs that satisfy a predetermined condition among the ECUs connected to the corresponding in-vehicle network may be designated as the non-target ECUs. When some of the ECUs are selected as the non-target ECUs in the manner described above, it is preferable to transmit a diagnosis masking instruction to all ECUs configured to communicate with the non-target ECUs when transmitting the data transmission interruption request to the non-target ECUs.

[0056] In S110, the relay device 10 interrupts the transmission of a portion of data to the vehicle-mounted network. More specifically, the relay device 10 may interrupt the transmission of data other than data required for reprogramming, for example.

[0057] In S112, in response to the data transmission interruption request, the non-target ECU interrupts the transmission of data to the in-vehicle network for the interruption period. The non-target ECU may prohibit the transmission of data to the in-vehicle network either entirely or partially. All or some of the functions provided to the non-target ECU may be disabled by cutting off a power supply to the non-target ECU to prohibit the transmission of data to the in-vehicle network. The non-target ECU masks a diagnosis for the interruption period in response to the data transmission interruption request. Specifically, the non-target ECU is prohibited from performing abnormality detection processing related to data reception from the in-vehicle network so as not to perform processing for addressing an abnormality in the data reception.Hereinafter, a condition in which the transmission of all or part of data to the vehicle-mounted network is interrupted while a diagnosis is masked may also be referred to as an interrupt condition.

[0058] In S114, the rewriting tool 30 communicates with the target ECU via the relay device 10 to perform the reprogramming processing to reprogram the target ECU.

[0059] Specifically, authentication processing is first performed between the rewriting tool 30 and the target ECU to determine whether authorized reprogramming is being performed by the rewriting tool 30. If the authentication processing is successful, the target ECU erases a program stored in the memory, acquires rewriting data from the rewriting tool 30 via the relay device 10 or the like, and writes the acquired data into the memory. When the rewriting data writing is completed, the written data is verified to check whether the data has been written correctly. If it is determined that the data has been written correctly, the reprogramming processing is terminated.

[0060] While the reprogramming processing is being performed, the relay device 10 acquires data necessary to perform the reprogramming processing (data necessary to perform the above-described authentication processing, rewriting data, etc.) from the rewriting tool 30 and provides the acquired data to the target ECU. The relay device 10 further acquires data necessary to perform the reprogramming processing from the target ECU and provides the acquired data to the rewriting tool 30.

[0061] Furthermore, while the reprogramming processing is being performed, the relay device 10 repeatedly transmits the data transmission interruption request to the non-target ECU at periodic timings (for example, once every 2.5 seconds) (S116, S120, and S124). Upon receiving the data transmission interruption request, the non-target ECU enters the interruption state, starting from a time of reception as a start time, for the interruption period, in the same manner as in S112. In other words, the interruption state is extended by a further interruption period, starting from a reception time of the data transmission interruption request as a start time (S118, S122, and S126).

[0062] In S128, the rewriting tool 30 transmits a reprogramming mode end request, which is a command instructing the target ECU to end the reprogramming (a command directed to the target ECU as a recipient), to the relay device 10.

[0063] In S130, the relay device 10 relays the reprogramming mode end request to the target ECU.

[0064] In S132, in response to the reprogramming mode end request, the target ECU transmits a command indicating a response of the reprogramming end (a command directed to the rewriting tool 30 as a receiver) to the relay device 10.

[0065] In S134, the forwarding device 10 forwards the response to the rewriting tool 30.

[0066] In S136, the relay device 10 resumes the transmission of data via the vehicle-mounted network and stops the transmission of the data transmission interruption request.

[0067] In S138, when 5 seconds elapse after receiving the last data transmission interruption request, the non-target ECU resumes transmitting data to the vehicle-mounted network and cancels the masking of a diagnosis (in other words, cancels the interruption state). (2) Abnormality detection processing

[0068] Now, an abnormality detection processing is described ( Fig. 7) Abnormality detection processing is processing for allowing the non-target ECU to resume communication when data transmission from the rewriting tool 30 is suspended during reprogramming. Abnormality detection processing is periodically performed by the relay device 10.

[0069] In S200, the relay device 10 determines whether reprogramming is currently being performed. To be more specific, for example, a determination may be made according to whether a reprogramming counter has a value of 1 or greater. If a positive determination is obtained (S200: YES), the process proceeds to S205. If a negative determination is obtained (S200: NO), the abnormality detection processing is terminated.

[0070] In S205, the relay device 10 determines whether a predetermined abnormality detection period has elapsed since the last time data was received from the rewriting tool 30. If an affirmative determination is obtained (S205: YES), the process proceeds to S210. If a negative determination is obtained (S205: NO), the abnormality detection processing is terminated.

[0071] In S210, the relay device 10 releases the interruption state (a state in which the transmission of data to the in-vehicle network is interrupted while a diagnosis is masked) of the non-target ECU, and the abnormality detection processing is terminated. Specifically, for example, the relay device 10 may release the interruption state by canceling the transmission of the data transmission interruption request to the non-target ECU. In another example, the relay device 10 may transmit a data transmission interruption cancellation request, which is a command instructing to cancel the interruption state, to the non-target ECU. The non-target ECU may release the interruption state in response to the received data transmission interruption cancellation request.

[0072] In S205 and S210, the relay device 10 may determine in the same manner whether the predetermined abnormality detection period has elapsed since the last time data was received from the target ECU. The interruption state of the non-target ECU may be released when elapse of the abnormality detection period is determined. (effects)

[0073] In accordance with the first embodiment, effects as follows can be obtained.

[0074] (1) According to the in-vehicle system 1, the data transmission interruption request is periodically transmitted from the relay device 10 to the non-target ECU while the target ECU is being reprogrammed by the rewriting tool 30 via the in-vehicle network. When the non-target ECU receives the data transmission interruption request for the first time, the non-target ECU enters the interruption state (a state in which the transmission of data to the in-vehicle network is interrupted while a diagnosis is masked) for the interruption period. Thereafter, the interruption state is extended each time the data transmission interruption request is received. When the reprogramming is completed, the interruption state of the non-target ECU is canceled by canceling the transmission of the data transmission interruption request from the relay device 10 to the non-target ECU.

[0075] Therefore, the communication load on the in-vehicle network is limited during reprogramming, and data necessary for reprogramming is transmitted and received quickly. Consequently, the ECUs included in the in-vehicle system 1 can be reprogrammed at high speed by an external device. After the reprogramming processing is completed, the interruption state of the non-target ECU is reliably released. After the reprogramming processing is completed, the non-target ECU can perform processing without any interference. Consequently, the ECUs can be smoothly reprogrammed via the in-vehicle network.

[0076] (2) The non-target ECU in the interrupted state not only interrupts the transmission of data to the vehicle-mounted network, but also masks a diagnosis. The configuration as above can prevent a disadvantage in that an interruption of data transmission by the non-target ECU is mistakenly detected as an abnormal condition such as a malfunction, and processing for handling the abnormal condition is performed.

[0077] (3) The non-target ECU that received the data transmission interruption request extends the interruption state for a further interruption period. Therefore, the non-target ECU releases the interruption state even when the transmission of the data transmission interruption request from the relay device 10 ends during the reprogramming processing. With this configuration, even if an abnormality occurs in the relay device 10 during the reprogramming processing, the non-target ECU reliably returns from the interruption state to a previous state and is thus able to operate in the same manner as before the reprogramming.

[0078] (4) The processing for causing the non-target ECU to enter the interrupt state is performed by the relay device 10 installed on the vehicle. Therefore, compared with a case where the same processing is performed by a device installed outside a vehicle, such as the rewriting tool 30, a risk that the same processing is performed without authorization can be reduced, and security can be further ensured. In a case where the same processing is performed by a device installed outside the vehicle, authentication processing is considered essential. According to the present invention, by having the relay device 10 perform the processing for causing the non-target ECU to enter the interrupt state, a need for authentication processing is eliminated. Consequently, costs can be reduced.

[0079] (5) A low-performance ECU that is unable to communicate with a device installed outside the vehicle may be installed on the vehicle. According to the present invention, the relay device 10 installed on the vehicle is also capable of communicating with such an ECU. Therefore, by transmitting the data transmission interrupt request during reprogramming, the relay device 10 is also capable of causing the low-performance ECU to enter the interrupt state.

[0080] (6) During reprogramming, the relay device 10 releases the interruption state of the non-target ECU when no new data is received from the rewriting tool 30 after the abnormality detection period has elapsed since the last data reception from the rewriting tool 30. Therefore, the interruption state of the non-target ECUs can be reliably released when the transmission of data from the rewriting tool 30 to the target ECU is stopped due to an abnormality.

[0081] The relay device 10 is capable of easily detecting a communication interruption from the rewriting tool 30 during reprogramming. According to the invention, the interruption state of the non-target ECUs is canceled by the relay device 10. Consequently, the communication interruption from the rewriting tool 30 during reprogramming can be easily detected and appropriately handled. (Second embodiment)

[0082] A vehicle-mounted system 1 of a second embodiment will be described below. The vehicle-mounted system 1 of the second embodiment has the same configuration as its counterpart in the above first embodiment, and performs a reprogramming sequence and abnormality detection processing in the same manner as in the above first embodiment, except that an interruption state is released in a different manner after the reprogramming processing in the reprogramming sequence is completed.

[0083] Specifically, in the above first embodiment, the interruption state is canceled by canceling the transmission of the data interruption request after the reprogramming processing is completed. In the second embodiment, the interruption state is canceled by transmitting a data interruption cancellation request from a relay device 10 to a non-target ECU.

[0084] The following will mainly describe a difference from the above first embodiment with respect to the reprogramming sequence of the second embodiment ( Fig. 8).

[0085] S300 to S336 are respectively the same as S100 to S136 in the reprogramming of the above first embodiment, so a description is omitted herein.

[0086] In S338, the relay device 10 transmits a data transmission interruption cancellation request to the non-target ECU.

[0087] In S340, the non-target ECU cancels the interruption state in response to the received data transmission interruption cancellation request. (effects)

[0088] According to the second embodiment, in addition to the effects obtained in the above first embodiment, an effect as follows can be obtained.

[0089] In the second embodiment, the data transmission interruption cancellation request is transmitted from the relay device 10 to the non-target ECU when the reprogramming is completed, and the non-target ECU cancels the interruption state in response to the received request. Therefore, the interruption state of the non-target ECU can be canceled once the reprogramming processing is completed. (Third embodiment)

[0090] A vehicle-mounted system 1 of a third embodiment will be described below. The vehicle-mounted system 1 of the third embodiment has the same configuration as its counterpart in the above first embodiment, except for part of the content of a reprogramming sequence. Specifically, processing for causing a non-target ECU to enter a suspended state when reprogramming is started and processing for releasing the suspended state when reprogramming is completed are different. The following will mainly describe a difference from the above first embodiment. (1) General outline

[0091] First, a difference of the reprogramming sequence of the third embodiment from the reprogramming sequence of the first embodiment will be mainly described ( Fig. 9).

[0092] S400 to S415 are respectively the same as S100 to S106 in the reprogramming of the above first embodiment, so a description is omitted herein.

[0093] In S420, a relay device 10 transmits a data transmission interruption request to a non-target ECU. S420 corresponds to S525 of reprogramming monitoring processing described below.

[0094] As in the above first embodiment, the data transmission interrupt request of the third embodiment may instruct the non-target ECU to enter the interrupt state only for an interrupt period. Alternatively, and unlike the above first embodiment, the data transmission interrupt request may instruct the non-target ECU to enter the interrupt state without limiting a time to the interrupt period.

[0095] S425 is the same as S110 in the reprogramming of the above first embodiment, so a description is omitted herein.

[0096] In S430, the non-target ECU enters the interrupt state in a similar manner to S112 of the above first embodiment. In a case where the interrupt period is specified in the data transmission interrupt request, the non-target ECU enters the interrupt state only for the interrupt period.

[0097] In S435, the reprogramming processing is performed in a similar manner to the above first embodiment. In a case where the interruption period is specified in the data transmission interruption request, the relay device 10 periodically transmits the data transmission interruption request to the non-target ECU during the reprogramming processing in the same manner as the above first embodiment. Otherwise, the relay device 10 does not repeatedly transmit the data transmission interruption request.

[0098] S440 to S455 are respectively the same as S128 to S134 in the reprogramming of the above first embodiment, so a description is omitted herein.

[0099] In S460, the relay device 10 resumes the transmission of data via a vehicle-mounted network.

[0100] Subsequently, the relay device 10 transmits a data transmission interruption cancellation request to the non-target ECU (S465). S465 corresponds to S535 of the reprogramming monitoring processing described below. The non-target ECU cancels the interruption state in response to the received data transmission interruption cancellation request (S470).

[0101] When the interruption period is set in the data transmission interruption request, the interruption state can be canceled by canceling the transmission of the data transmission interruption request from the relay device 10. (2) Reprogramming monitoring processing

[0102] A reprogramming monitoring processing performed by the relay device 10 will be described below ( Fig. 10). The reprogramming monitoring processing is processing for causing the non-target ECU to enter the suspended state when reprogramming is started and releasing the suspended state of the non-target ECU when reprogramming is completed. The reprogramming monitoring processing is periodically performed by the relay device 10.

[0103] In S500, the relay device 10 determines, in accordance with a command received from a rewriting tool 30, whether reprogramming of a new target ECU is started during reprogramming of a current target ECU. Specifically, for example, when the relay device 10 receives a reprogramming mode change request for an ECU on which reprogramming is not currently being performed as a target ECU, it may be determined that reprogramming of a new target ECU is started. If an affirmative determination is obtained (S500: YES), the process proceeds to S505. If a negative determination is obtained (S500: NO), the process proceeds to S510.

[0104] In S505, the relay device 10 increments a reprogramming counter indicating the number of ECUs on which reprogramming is currently being performed, and proceeds to S510.

[0105] In S510, the relay device 10 determines whether reprogramming of the target ECU is complete in accordance with a command received from the rewriting tool 30. Specifically, for example, when the relay device 10 receives a reprogramming mode end request for the target ECU, it may determine that reprogramming of the target ECU is complete. If an affirmative determination is obtained (S510: YES), the process proceeds to S515. If a negative determination is obtained (S510: NO), the process proceeds to S520.

[0106] In S515, the forwarding device 10 decrements the reprogramming counter and proceeds to S520.

[0107] In S520, the relay device 10 determines whether a value of the reprogramming counter has changed from 0 to 1 (in other words, determines whether reprogramming is restarted while none of the ECUs is in reprogramming). If an affirmative determination is obtained (S520: YES), the process proceeds to S525. If a negative determination is obtained (S520: NO), the process proceeds to S530.

[0108] In S525, the forwarding device 10 transmits the data transmission interruption request in a similar manner as in S420 from Fig. 9 described above to the non-target ECU, and proceeds to S530.

[0109] Depending on the method for determining which ECU to select as a non-target ECU, the data transmission interruption request may not be transmitted to ECUs connected to an in-vehicle network corresponding to a new target ECU. Here, the new target ECU is an ECU whose reprogramming is initiated during the reprogramming of another target ECU whose reprogramming is currently being performed. In such a case, it is preferable to transmit the data transmission interruption request to the ECUs connected to the in-vehicle network corresponding to the new target ECU for designation as non-target ECUs.

[0110] In S530, the relay device 10 determines whether the value of the reprogramming counter has changed from 1 to 0 (in other words, determines whether the reprogramming of all target ECUs is completed). If an affirmative determination is obtained (S530: YES), it proceeds to S535. If a negative determination is obtained (S530: NO), the reprogramming monitoring processing is terminated.

[0111] In S535, the relay device 10 releases the interruption state of the non-target ECU, and the reprogramming monitoring processing is ended.

[0112] Specifically, if the interruption period is not specified in the data transmission interruption request, the relay device 10 may transmit the data transmission interruption cancellation request to the non-target ECU. Meanwhile, if the interruption period is specified in the data transmission interruption request, the interruption state of the non-target ECU may be canceled by canceling the transmission of the data transmission interruption request, or the interruption state may be canceled by transmitting the data transmission interruption cancellation request to the non-target ECU. (effects)

[0113] According to the third embodiment, in addition to the effects obtained in the above first embodiment, an effect as follows can be obtained.

[0114] That is, while the rewriting tool 30 is capable of reprogramming multiple target ECUs in parallel at the same time, the relay device 10 counts the number of target ECUs performing reprogramming and releases the interruption state of the non-target ECU when the number of target ECUs decreases to 0. Therefore, even when multiple ECUs are reprogrammed in parallel at the same time, the interruption state of the non-target ECU is reliably released when the reprogramming of all the target ECUs is completed, allowing the non-target ECU to operate in the same manner as before the reprogramming. (Fourth embodiment)

[0115] A vehicle-mounted system 1 of a fourth embodiment will be described below. The vehicle-mounted system of the fourth embodiment has a similar configuration to the counterpart of the above third embodiment, except for processing for canceling an interruption state of a non-target ECU when reprogramming is completed. Specifically, a content of reprogramming monitoring processing performed by a relay device 10 differs from that of the above third embodiment. The following will describe the difference, that is, the reprogramming monitoring processing, while omitting a description of common portions. Fig. 11).

[0116] In S600, the relay device 10 determines whether reprogramming of a new target ECU is started in the same manner as in S500 of the reprogramming monitoring processing of the above third embodiment. If an affirmative determination is obtained (S600: YES), the process proceeds to S605. If a negative determination is obtained (S600: NO), the process proceeds to S615.

[0117] In S605, the relay device 10 increments a reprogramming counter indicating the number of ECUs currently performing reprogramming, and proceeds to S610.

[0118] In S610, the relay device 10 begins measuring a reprogramming duration, and proceeds to S615. The reprogramming duration is a period of time that has elapsed since the start of a recently initiated reprogramming of the target ECU. Through the processing in S610, each time reprogramming of a new target ECU is started, a measured value of the reprogramming duration is reset, and a time that has elapsed since the start of a most recent reprogramming is again measured as the reprogramming duration.

[0119] S615 and S620 are the same as S520 and S525, respectively, of the reprogramming monitoring processing of the above third embodiment, so a description is omitted herein.

[0120] In S625, the relay device 10 determines whether the reprogramming duration exceeds a predetermined end duration. If a positive determination is obtained (S625: YES), the process proceeds to S630. If a negative determination is obtained (S625: NO), the reprogramming monitoring processing is terminated.

[0121] In S630, processing which is the same as the processing in S535 of the reprogramming monitoring processing of the above third embodiment is performed, and subsequently, the reprogramming monitoring processing is ended. (effects)

[0122] According to the fourth embodiment, in addition to the effects obtained in the above third embodiment, an effect as follows can be obtained.

[0123] That is, as described, in a case where the rewriting tool 30 is capable of reprogramming multiple target ECUs in parallel at the same time, the relay device 10 measures the reprogramming duration, which is a time elapsed after the start of a most recently started reprogramming of the target ECU. The relay device 10 releases the suspended state of the non-target ECU when the last reprogramming duration reaches the predetermined end duration. Therefore, by setting the end time to an appropriate duration, even when multiple ECUs are reprogrammed in parallel at the same time, the suspended state of the non-target ECUs can be reliably released after the reprogramming of all the target ECUs is completed, allowing the non-target ECU to operate in the same manner as before the reprogramming. (Other embodiments)

[0124] While the embodiments have been described above by way of example, the invention can be implemented in various other embodiments.

[0125] (1) In the above first to fourth embodiments, a program stored in a target ECU is rewritten by the reprogramming sequence. Alternatively, the subject to be rewritten is not limited to programs. For example, data (various parameters or the like) stored in a target ECU may be rewritten by the reprogramming sequence.

[0126] The rewriting tool 30 can perform fault diagnosis on a target ECU by communicating with the target ECU via the vehicle-mounted network. By performing processing that is the same as the reprogramming sequence, a non-target ECU can be placed in the suspended state during a fault diagnosis on the ECU, and the suspended state can be released when the fault diagnosis is completed. To be more specific, the rewriting tool 30 can perform fault diagnosis on a target ECU during the reprogramming processing in the reprogramming sequence.

[0127] (2) In the above first to fourth embodiments, a non-target ECU is placed in the suspended state by transmitting the data transmission suspend request from the relay device 10 to the non-target ECU. However, the invention is not limited to the above configuration. A command instructing to suspend the transmission of data to the in-vehicle system and a command instructing to mask a diagnosis may be separately transmitted from the relay device 10 to the non-target ECU. The non-target ECU may enter or extend the suspended state by suspending the transmission of data to the in-vehicle network and masking a diagnosis in separate response to the respective received commands.

[0128] In the above second to fourth embodiments, the interruption state of the non-target ECU is canceled by transmitting the data transmission interruption cancellation request from the relay device 10 to the non-target ECU. However, the invention is not limited to the above configuration. A command instructing to cancel the interruption of transmission of data to the in-vehicle network and a command instructing to cancel the masking of a diagnosis may be separately transmitted from the relay device 10 to the non-target ECU. The non-target ECU can cancel the interruption state by canceling the transmission of data to the in-vehicle network and canceling the masking of a diagnosis in separate response to the respective received commands.

[0129] (3) Functions provided to a single component in the respective above embodiments may be assigned to more than one component, or functions provided to multiple components may be intensively allocated to a single component. At least part of the configurations of the respective above embodiments may be replaced with a configuration provided with a similar function. Part of the configurations of the respective above embodiments may be omitted. At least part of the configurations of the respective above embodiments may be added to or replaced by the configurations of any other above embodiments.

[0130] (4) In addition to the above-described vehicle-mounted systems 1, a technical concept of the invention can be implemented by various embodiments, such as the rewriting tool 30 and the relay device 10, and the ECUs that constitute the vehicle-mounted system 1. Furthermore, a technical concept of the invention can be implemented by various other embodiments, such as a program that controls a computer to operate as the relay device 10, the ECUs, and the rewriting tool 30, a medium that stores the above-described program, and a method corresponding to the processing performed by the relay device 10, the ECUs, and the rewriting tool 30.

[0131] The rewriting tool 30 of the respective above embodiments corresponds to an example of an update or upgrade tool.

[0132] In the reprogramming sequence of the above first embodiment, S108 corresponds to an example of an interruption instruction unit, S112 corresponds to an example of an interruption unit, S114 corresponds to examples of update processing, a relay-side acquisition unit, a relay device, an ECU-side acquisition unit, and an update processing unit. Furthermore, S116, S120, S124, and S136 correspond to an example of a cancellation instruction unit, S118, S122, and S126 correspond to an example of an interruption extension unit, and S138 corresponds to an example of an interruption cancellation unit. According to the present invention, updating the ECU may include, for example, diagnosis, maintenance, speed-up, equipment, repair, and updating of the ECU.

[0133] The data transmission interruption request in S108 corresponds to an example of a cancellation command, and the data transmission interruption request in S116, S120, and S124 corresponds to an example of an interruption extension command.

[0134] In addition, the abnormality detection processing corresponds to an example of an abnormality treatment unit.

[0135] In the reprogramming sequence of the above second embodiment, S308 corresponds to an example of the interruption instruction unit, S312 corresponds to an example of the interruption unit, S314 corresponds to examples of the upgrade processing, the relay-side acquisition unit, the relay device, the ECU-side acquisition unit, and the upgrade unit. Furthermore, S316, S320, S324, and S338 correspond to an example of the cancellation instruction unit, and S340 corresponds to an example of the interruption cancellation unit.

[0136] The data transmission interruption request in S308 corresponds to an example of the cancellation command, the data transmission interruption request in S316, S320, and S324 corresponds to an example of the interruption extension command, and the data transmission interruption cancellation request in S338 corresponds to an example of an interruption cancellation command.

[0137] In the reprogramming sequence of the above third embodiment, S420 corresponds to an example of the cancellation instruction unit, S430 corresponds to an example of the cancellation unit, S435 corresponds to examples of the upgrade processing, the relay-device-side acquisition unit, the relay device, the ECU-side acquisition unit, and the upgrade unit. Furthermore, S465 corresponds to an example of the cancellation instruction unit, and S470 corresponds to an example of the interruption cancellation unit.

[0138] The data transmission interruption request in S420 corresponds to an example of the interruption command, and the data transmission interruption cancellation request in S465 corresponds to an example of the interruption cancellation command.

[0139] In the reprogramming monitoring processing, S500 corresponds to an example of a start determination unit, S505 and S515 correspond to an example of a counting unit, S510 corresponds to an example of an end determination unit, and S530 and S535 correspond to an example of the cancellation instruction unit.

[0140] In the reprogramming monitoring processing of the above fourth embodiment, S600 corresponds to an example of the start determination unit, and S625 and S630 correspond to an example of the cancellation instruction unit.

Claims

[1] Forwarding device (10) comprising: an acquisition unit (S114, S314, S435) that acquires data necessary for performing upgrade processing (S114, S314, S435) from an upgrade tool (30), wherein the upgrade tool performs the upgrade processing to upgrade ECUs (20, 40) connected to a vehicle-mounted network (2, 3), and the ECUs (20, 40) include a target ECU that is the subject of the upgrade processing and a non-target ECU that is not the subject of the upgrade processing; a forwarding unit (S114, S314, S435) that provides the data acquired by the acquisition unit to the target ECU via the vehicle-mounted network; an interruption instruction unit (S108, S308, S420) that transmits, via the in-vehicle network, an interruption command that instructs the non-target ECU to enter an interruption state in response to a start of the upgrade processing, the interruption state being a state in which transmission of other data to the non-target ECU via the in-vehicle network is interrupted; and a cancellation instruction unit (S116, S120, S124, S136, S316, S320, S324, S338, S465, S530, S535, S625, S630) that instructs the non-target ECU to cancel the interruption state when the upgrade processing is completed via the vehicle-mounted network. [2] Forwarding device according to claim 1, wherein the cancellation instruction unit periodically transmits, via the vehicle-mounted network, an interruption extension command instructing the non-target ECU to extend the interruption state by a predetermined period of time during execution of the upgrade processing, and the cancellation instruction unit instructs cancellation of the interruption state of the non-target ECU by canceling transmission of the interruption extension command. [3] Forwarding device according to claim 1, wherein the cancellation instruction unit periodically transmits, via the vehicle-mounted network, an interruption extension command instructing the non-target ECU to extend the interruption state by a predetermined period of time during execution of the upgrade processing, and when the upgrade processing is completed, the cancellation instruction unit instructs cancellation of the interruption state of the non-target ECU by transmitting an interruption cancellation command instructing the non-target ECU to cancel the interruption state via the vehicle-mounted network. [4] A relay device according to claim 1, wherein the ECUs include one or more target ECUs, and the relay device further comprises: a start determination unit (S500) that determines whether the upgrade processing for upgrading one of the one or more target ECUs has started in accordance with the data acquired from the upgrade tool; an end determination unit (S510) that determines, in accordance with the data acquired from the upgrade tool, whether the upgrade processing for upgrading the one of the one or more target ECUs has ended; and a counting unit (S505, S515) that counts a total number of the one or more target ECUs on which the upgrade processing is currently being performed, in accordance with a determination result of the start determination unit and a determination result of the end determination unit, wherein the cancellation instruction unit instructs cancellation of the interruption state of the non-target ECU via the vehicle-mounted network when the total number of the one or more target ECUs counted by the counting unit decreases to zero. [5] The forwarding device according to claim 1, further comprising a start determination unit (S600) that determines whether the upgrade processing for the target ECU has started in accordance with the data acquired from the upgrade tool, where a time at which the start determination unit determines that the upgrade processing has started is defined as a start time, and the cancellation instruction unit instructs cancellation of the interruption state of the non-target ECU via the vehicle-mounted network when a predetermined end time elapses from the start time. [6] The relay device according to any one of claims 1 to 5, further comprising an abnormality treatment unit (S210) that instructs the non-target ECU to release the interruption state via the in-vehicle network when the acquisition unit does not acquire the data necessary for performing the upgrade processing for a period equal to or longer than a predetermined abnormality detection period during execution of the upgrade processing. [7] Forwarding device according to one of claims 1 to 6, in which the non-target ECU in the interruption state does not treat an error in data acquisition via the vehicle-mounted network as an abnormality. [8] Electronic control unit (20, 40) comprising: an acquisition unit (S114, S314, S435) that acquires data necessary for performing an upgrade processing (S114, S314, S435) of a self-ECU from an upgrade tool (30) via a vehicle-mounted network (2, 3) through a relay device (10); an upgrade unit (S114, S314, S435) that performs processing associated with the upgrade processing in accordance with the data acquired by the acquisition unit; an interruption unit (S112, S312, S430) which, when the upgrade processing is started, brings the own ECU into an interruption state in which data transmission via the vehicle-mounted network is interrupted upon receipt of an interruption command from the relay device via the vehicle-mounted network; and an interruption cancellation unit (S138, S340, S470) which, when the upgrade processing is completed, cancels the interruption state upon receiving a command from the relay device via the vehicle-mounted network. [9] Electronic control unit according to claim 8, further comprising: an interruption extension unit (S118, S122, S126) which, upon receiving an interruption extension command from the relay device via the vehicle-mounted network during execution of the upgrade processing, extends the interruption state by a predetermined interruption period, wherein the interruption extension command instructs an extension of the interruption state by the predetermined interruption period, wherein, when the interrupt cancellation unit receives the command to cancel the interrupt state from the relay device, the interrupt cancellation unit cancels the interrupt state under a condition that the predetermined interrupt period has elapsed after receiving the interrupt extension command from the interrupt extension unit. [10] Vehicle-mounted system (1), comprising: a plurality of ECUs (20, 40) connected to a vehicle-mounted network (2, 3); and a forwarding device (10) connected to a vehicle-mounted network (2, 3), wherein the forwarding device includes: a relay device-side acquisition unit (S114, S314, S435) that acquires data necessary for performing upgrade processing (S114, S314, S435) from an upgrade tool (30), wherein the upgrade tool performs the upgrade processing to upgrade the plurality of ECUs, and the plurality of ECUs (20, 40) include a target ECU that is subject to the upgrade processing and a non-target ECU that is not subject to the upgrade processing; a forwarding unit (S114, S314, S435) that provides the data acquired by the forwarding device-side acquisition unit to the target ECU via the vehicle-mounted network; an interruption instruction unit (S108, S308, S420) that transmits, via the in-vehicle network, an interruption command that instructs the non-target ECU to enter an interruption state in response to a start of the upgrade processing, the interruption state being a state in which transmission of other data to the non-target ECU via the in-vehicle network is interrupted; and a cancellation instruction unit (S116, S120, S124, S136, S316, S320, S324, S338, S465, S530, S535, S625, S630) that instructs the non-target ECU to cancel the interruption state via the vehicle-mounted network when the upgrade processing is completed, and Each of the variety of ECUs includes: an ECU-side acquisition unit (S114, S314, S435) that acquires, from the relay device via the vehicle-mounted network, data necessary for performing the upgrade processing of a self-ECU and transmitted from the upgrade tool via the relay device; an upgrade unit (S114, S314, S435) that performs processing associated with the upgrade processing in accordance with the data acquired by the ECU-side acquisition unit; an interrupt unit (S112, S312, S430) which, upon receiving the interrupt command from the relay device via the vehicle-mounted network, switches the own ECU to the interrupt state when the upgrade processing is started; and an interruption cancellation unit (S138, S340, S470) that cancels the interruption state upon receiving a command from the forwarding device when the upgrade processing is completed. [11] Vehicle-mounted system according to claim 10, wherein the cancellation instruction unit periodically transmits an interruption extension command via the vehicle-mounted network, which instructs the non-target ECU to extend the interruption state by a predetermined period of time during execution of the upgrade processing, the cancellation instruction unit instructs the non-target ECU to cancel the cancellation state by canceling a transmission of the interruption extension command, each of the plurality of ECUs further includes an interruption extension unit (S118, S122, S126) which, upon receiving the interruption extension command from the relay device via the vehicle-mounted network during the execution of the upgrade processing, extends the interruption state by the predetermined interruption period, and when the interrupt cancellation unit receives the command instructing cancellation of the interrupt state from the relay device, the interrupt cancellation unit cancels the interrupt state after the predetermined interrupt period elapses after the reception time of the interrupt extension command.

Images