vehicle

Abstract

To prevent inconsistency in program versions in a vehicle in which programs executed by a plurality of electronic control units that are started or restarted at different timings are updated. [Solution] The vehicle is equipped with a plurality of electronic control devices that perform specified controls, and an update management device that requests the plurality of electronic control devices to update their programs and stores the update results of the programs notified by the plurality of electronic control devices, and is equipped with a memory unit that stores the updated program in response to a request from the update management device, a startup unit that starts the electronic control devices using the updated program, and a notification unit that notifies a result indicating failure to store at least part of the updated program when at least one electronic control device among the plurality of electronic control devices fails to store at least part of the updated program.

Description

[Technical field]

[0001] The present invention relates to vehicle Regarding. [Background technology]

[0002] 2. Description of the Related Art In a computer system including a plurality of computers, techniques are known for preventing inconsistencies in firmware versions among the plurality of computers.

[0003] For example, Patent Document 1 discloses that in a computer system, two computers are provided with two storage media, one for an active system and one for a standby system, and when the power supply of the system is turned off, the firmware stored in the standby system of one computer is loaded into the standby system of the other computer. Also, when the power supply of the computer system is turned on, the active system and the standby system of the two computers are switched, and the two computers are started with the firmware stored in the standby system. As a result, the active system and the standby system of the two computers are not switched until the power supply of the computer system is turned on, and thus it is possible to prevent a mismatch in the firmware versions of the two computers. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2011-86150 A Summary of the Invention [Problem to be solved by the invention]

[0005] For example, a vehicle such as an automobile is equipped with a plurality of electronic control devices that perform predetermined control. These electronic control devices are connected to different power supply systems, such as an ignition power supply, a continuous power supply, and an accessory power supply, and the timing of starting or restarting each electronic control device differs.

[0006] In the technology disclosed in Patent Document 1, in a system including multiple electronic control devices that are started or restarted at different times, such as a vehicle, it is difficult to prevent version inconsistencies when updating programs executed by the multiple electronic control devices.

[0007] An embodiment of the present invention has been made in consideration of the above-mentioned problems, and prevents inconsistencies in program versions in a vehicle that updates programs executed by multiple electronic control devices that are started or restarted at different times. [Means for solving the problem]

[0008] In order to solve the above problems, a vehicle according to an embodiment of the present invention includes a plurality of electronic control units, A request unit that requests the plurality of electronic control units to update their programs; Requesting the plurality of electronic control units to update their programs, and storing the results of the program updates notified from the plurality of electronic control units. an update result storage unit, which, when the update result stored in the update storage unit indicates that updating of the programs in the plurality of electronic control units has been completed, notifies the plurality of electronic control units of a first start request requesting starting of a predetermined control using the updated program, and, when the update result indicates that at least a part of updating of the programs in the plurality of electronic control units has failed, notifies the plurality of electronic control units of a switch request to a program before the update, and, upon receiving a completion notification from the plurality of electronic control units indicating that switching in response to the switch request has been completed, notifies the plurality of electronic control units of a second start request requesting starting of a predetermined control using the program before the update and an update management device, wherein each of the plurality of electronic control devices, in response to a request from the update management device, The above a storage unit that stores an updated program; a startup unit that starts up the updated program; and a notification unit that, when a failure occurs in storing at least a part of the updated program, issues a notification indicating a failure in storing the updated program; In response to the first start request notified from the update management device, the predetermined control by the updated program is started, and When any one of the plurality of electronic control devices has made the notification, even if the storage of the updated program in the electronic control device has been successful, Based on the second start request, and an execution unit that executes the program before the update. Effect of the Invention

[0009] According to an embodiment of the present invention, in a vehicle in which programs executed by a plurality of electronic control units that are started or restarted at different times are updated, inconsistencies in program versions can be prevented. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a system configuration of an update system according to an embodiment. [Diagram 2] 1 is a diagram illustrating an example of a hardware configuration of an update management device and an ECU according to an embodiment. [Diagram 3] 1 is a diagram illustrating an example of a functional configuration of an update management device and an ECU according to a first embodiment. [Figure 4] 4 is a diagram showing an example of an update result stored in an update result storage unit according to the first embodiment; FIG. [Diagram 5] FIG. 4 is a diagram for explaining boot information according to the first embodiment. [Figure 6] 5 is a flowchart showing an example of processing of the update management device according to the first embodiment. [Figure 7] 5 is a flowchart showing an example of processing of an ECU according to the first embodiment. [Figure 8] FIG. 1 is a sequence diagram (1) showing an example of processing of the update system according to the first embodiment. [Figure 9] FIG. 2 is a sequence diagram (2) showing an example of the process of the update system according to the first embodiment. [Figure 10] FIG. 11 is a diagram showing an image of a configuration of an ECU according to a second embodiment. [Figure 11] FIG. 11 is a sequence diagram showing an example of a process of an update system according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the invention will be described with reference to the drawings.

[0012] <System configuration> 1 is a diagram showing an example of a system configuration of an update system according to an embodiment. The update system 1 includes a plurality of ECUs (Electronic Control Units) 111a, 111b, 111c, 112a, and 112b that perform predetermined control, and an update management device 100 that manages program updates in the plurality of ECUs.

[0013] 1, a plurality of ECUs and the update management device 100 are mounted on a vehicle 10 such as an automobile, and are communicatively connected to each other via an in-vehicle network 140. The plurality of ECUs include ECUs 111a, 111b, 111c, ... connected to an ignition power supply (IG power supply) of the vehicle 10, and ECUs 112a, 112b, ... connected to a continuous power supply (+B power supply).

[0014] In the following description, "ECU111" will be used to refer to any of the ECUs 111a, 111b, 111c, etc. that is connected to the ignition power supply. "ECU112" will be used to refer to any of the ECUs 112a, 112b, etc. that is connected to the continuous power supply.

[0015] The ECU 111 (first electronic control unit) is, for example, an ECU of a vehicle control system that controls the engine, brakes, etc. of the vehicle 10, and is activated in response to the ignition-on (hereinafter referred to as IG-ON) of the vehicle 10 to perform predetermined control such as engine control, brake control, etc. Also, the ECU 111 is stopped, for example, when the ignition-off (hereinafter referred to as IG-OFF) of the vehicle 10 is turned on.

[0016] ECU (second electronic control unit) 112 is, for example, a body-system ECU that controls keyless entry, doors, etc., and continues to operate using the constant power supply of vehicle 10, for example, even when vehicle 10 is in an ignition-off state.

[0017] In this way, the vehicle 10 (and the update system 1) includes a plurality of ECUs 111 and ECUs 112 that are started or restarted at different times. Furthermore, the vehicle 10 also includes a multimedia ECU that operates using an accessory power source, but for ease of explanation, the following explanation will be given assuming that the vehicle 10 is equipped with the ECU 111 and the ECU 112.

[0018] The update management device 100 is, for example, an electronic control device such as a multi-protocol gateway that supports a plurality of communication protocols. The update management device 100 is capable of communicating with a plurality of ECUs 111 and 112 using a predetermined communication protocol, and is also capable of communicating with the management server 20 using a communication device 150. Here, the communication device 150 is a device for performing wireless communication 40 using an antenna 151 mounted on the vehicle 10 or the communication device 150 or the like, and for connecting to the communication network 30, and is realized by, for example, a DCM (Data Communication Module) or the like.

[0019] In the above configuration, the update management device 100 acquires update information of programs (firmware, software, etc.) in multiple ECUs mounted on the vehicle 10 from the management server 20 via the communication device 150. This update information includes, for example, identification information for identifying the ECU to be updated, the updated program, etc.

[0020] The update management device 100 notifies the ECUs 111 and 112, which are to be updated, of an update request for updating the program in accordance with the update information acquired from the management server 20. The update request includes, for example, the updated program (or information indicating the source from which the program is acquired, etc.).

[0021] The ECUs 111 and 112 have a first storage area for storing a program before the update and a second storage area for storing a program after the update, and store the program after the update in the second storage area in response to an update request from the update management device 100. Furthermore, the ECUs 111 and 112 start processing using the program after the update when booting or restarting.

[0022] However, as described above, the ECU 111 and the ECU 112 have different power supply systems and different start-up and restart timings, so if the ECU 111 and the ECU 112 start predetermined control at their respective timings, a version mismatch occurs. In this case, the vehicle 10 as a whole will not be controlled normally, and in the worst case, this may adversely affect the behavior of the vehicle 10.

[0023] Therefore, the update management device 100 stores the update results of the programs notified from the multiple ECUs to be updated in a storage unit. In addition, for example, when IG-ON is turned on, the update management device 100 checks the update results stored in the storage unit, and if the program updates in the multiple ECUs are completed, requests the multiple ECUs to start control using the updated programs.

[0024] Preferably, the update management device 100 checks the update results stored in the memory unit, for example, when IG-ON is turned on, and if the program updates in the multiple ECUs are not complete, requests the multiple ECUs to switch to control using the programs before the update.

[0025] On the other hand, when the ECUs 111 and 112 are started or restarted after storing the updated program in the second storage area, they prohibit (or suspend) a predetermined control by the updated program. Furthermore, when the ECUs 111 and 112 are requested by the update management device 100 to start control by the updated program, they start control by the updated program.

[0026] Preferably, after ECUs 111 and 112 are started up or restarted using the updated program, if the update management device 100 requests them to switch to control using the pre-update program, they restart using the pre-update program.

[0027] In this manner, when the update system 1 completes updating the programs in all the ECUs 111 and 112 to be updated, the ECUs 111 and 112 perform predetermined control using the updated programs.

[0028] As a result, according to the update system 1 of this embodiment, inconsistencies in program versions can be prevented in the update system 1 that updates programs executed by multiple ECUs 111 and ECUs 112 that are started or restarted at different times.

[0029] Furthermore, in the update system 1, if the program update in all of the ECUs 111 and 112 to be updated is not completed, the ECUs 111 and 112 are restarted using the programs before the update and perform predetermined control.

[0030] As a result, according to the update system 1 of this embodiment, even if the program updates in all of the ECUs 111 and 112 to be updated are not completed, the ECUs 111 and 112 can perform predetermined control.

[0031] 1 is an example of the system configuration of the update system 1. For example, the ECU 111 and the ECU 112 are not limited to ECUs mounted on the vehicle 10, and may be other information processing systems including multiple electronic control devices that are started or restarted at different times.

[0032] The functions of the update management device 100 may be included in the management server 20. For example, in Fig. 1, the vehicle 10 may have a multi-protocol gateway that relays communications between the management server 20 and a plurality of ECUs, instead of the update management device 100, and the management server 20 may execute the functions of the update management device.

[0033] <Hardware configuration> (Update management device and ECU hardware configuration) The update management device 100 and ECUs 111 and 112 have a typical computer configuration and include, for example, a CPU (Central Processing Unit) 201, a RAM (Random Access Memory) 202, a ROM (Read Only Memory) 203, a storage device 204, a communication I / F (Interface) 205, an external connection I / F 206, and a system bus 207.

[0034] The CPU 201 is a calculation device that realizes each function of the update management device 100 (or ECUs 111, 112) by reading programs, data, etc. stored in the ROM 203, storage device 204, etc. onto the RAM 202 and executing processing. The RAM 202 is a volatile memory used as a work area, etc. for the CPU 201. The ROM 203 is a non-volatile memory that retains programs and data even when the power is turned off. The storage device 204 is a large-capacity storage device such as a flash ROM, for example, and stores an OS (Operating System), programs, various data, etc.

[0035] The communication I / F 205 is a communication interface for connecting the update management device 100 (or the ECUs 111 and 112) to an in-vehicle network such as a Controller Area Network (CAN) and communicating with other ECUs and the like.

[0036] The external connection I / F 206 is an interface for connecting an external device to the update management device 100 (or the ECUs 111 and 112). The external device may include, for example, a storage medium, a communication device 150, or an actuator controlled by each of the ECUs 111 and 112. The system bus 207 is commonly connected to each of the above components and transmits, for example, an address signal, a data signal, and various control signals.

[0037] [First embodiment] <Functional configuration> 3 is a diagram showing an example of a functional configuration of the update management device and the ECU according to the first embodiment. In FIG. 3, the ECU 112 has the same functional configuration as the ECU 111.

[0038] (Functional configuration of the update management device) The update management device 100 includes, for example, an update information acquisition unit 311, a communication unit 312, an update request unit 313, an update result storage unit 314, and a switching control unit 315.

[0039] The update management device 100 realizes each of the above functional configurations by, for example, executing a predetermined program stored in the storage device 204, the ROM 203, etc. shown in Fig. 2 by the CPU 201. Also, at least a part of each of the above functional configurations may be realized by hardware.

[0040] The update information acquisition unit 311 communicates with the management server 20 via the communication device 150 and acquires update information of the ECUs 111, 112 to be updated. For example, the update information acquisition unit 311 inquires of the management server 20 whether or not there is update information for the multiple ECUs 111, 112 mounted on the vehicle 10, and acquires the update information if there is. Alternatively, the update information acquisition unit 311 may acquire update information that is automatically notified from the management server 20, for example. Note that the update information acquired by the update information acquisition unit 311 from the management server 20 includes, for example, identification information for identifying the ECUs 111, 112 to be updated, the updated program, and the like.

[0041] The communication unit 312 connects the update management device 100 to the in-vehicle network 140 using, for example, the communication I / F 205 in FIG. 2, and communicates with the ECUs 111, 112, and the like.

[0042] When the update information acquisition unit 311 acquires the update information, the update request unit (request unit) 313 notifies the ECUs 111 and 112 to be updated of an update request for requesting a program update via the communication unit 312. This update request includes, for example, the updated program and information about the updated program (for example, version information, etc.).

[0043] The update result storage unit (storage unit) 314 is realized by, for example, a program executed by the CPU 201, the storage device 204, etc., and stores the update results notified from the ECUs 111 and 112 to be updated.

[0044] 4A and 4B are diagrams illustrating an example of an update result stored in the update result storage unit according to the first embodiment. For example, as shown in FIG. 4A, the update result 401 stored in the update result storage unit 314 includes information such as "ECU", "presence or absence of update", and "update result".

[0045] “ECU” is information such as an ECU name and identification information for identifying the ECUs 111 and 112.

[0046] "Updated or not" is information indicating the presence or absence of update information acquired by the update information acquisition unit 311, and is set to "Present" if there is update information, and "Not" if there is no update information. For example, the update information acquisition unit 311 checks the presence or absence of update information, and if there is no update information corresponding to the ECUs 111a to 111c and the ECUs 112a and 112b, sets "Not" to "Updated or not" corresponding to each ECU as shown in FIG. 4(a). Also, the update information acquisition unit 311 checks the presence or absence of update information, and if there is update information corresponding to the ECUs 111a to 111c and the ECUs 112a and 112b, sets "Present" to "Updated or not" corresponding to each ECU as shown in update information 402 in FIG. 4(b).

[0047] The "update result" is information indicating the update result of the ECUs 111, 112 to be updated, and is set to "completed" if the update is completed, and "updating" if the update is not completed. For example, when the update request unit 313 notifies the ECUs 111, 112 to be updated of an update request, it sets the "update result" corresponding to the ECUs 111, 112 to be updated to "updating". Furthermore, when the update result storage unit 314 receives an update result indicating that the update is completed from the ECUs 111, 112 to be updated, it sets the "update result" corresponding to the ECUs 111, 112 whose updates have been completed to "completed".

[0048] The example of the update result 403 shown in Fig. 4(c) indicates that the updates of the ECUs 111a, 111b, and 112b have been completed. When the updates of the ECUs 111a to 111c and the ECUs 112a and 112b to be updated are completed, the "update result" of each ECU becomes "completed", for example, as shown in the update result 404 in Fig. 4(d). This enables the update management device 100 to determine that the updates of the programs in the ECUs 111a to 111c and the ECUs 112a and 112b to be updated have been completed.

[0049] Returning now to FIG. 3, the explanation of the functional configuration of the update management device 100 will be continued.

[0050] The switching control unit 315, for example, when the IG-ON (an example of a predetermined timing) is turned on, checks the update results stored in the update result memory unit 314 and determines whether the "update results" for the multiple ECUs 111, 112 to be updated have become "completed."

[0051] When the "update results" of all of the multiple ECUs 111, 112 to be updated are "completed", the switching control unit 315 notifies the ECUs 111, 112 to be updated of a start request to start a predetermined control by the updated program.

[0052] On the other hand, when the "update result" of the ECUs 111, 112 to be updated includes "updating", the switching control unit 315 notifies the ECUs 111, 112 to be updated of a switching request requesting switching to the program before the update, to the ECUs 111, 112 to be updated. Furthermore, when switching to the program before the update in the ECUs 111, 112 to be updated is completed, the switching control unit 315 notifies the ECUs 111, 112 to be updated of a control start request requesting the start of predetermined control by the program before the update, to the ECUs 111, 112 to be updated.

[0053] (ECU functional configuration) 2, the ECU 111 realizes a communication unit 321, an update unit 322, a switching unit 323, a start control unit 324, a function control unit 325, a storage unit 326, and the like. Note that at least a part of the above-mentioned functional configurations may be realized by hardware. Here, the functional configuration of the ECU 111 will be described, but the ECU 112 has the same functional configuration as the ECU 111 as described above.

[0054] The communication unit 321 connects the ECU 111 to the in-vehicle network 140 using, for example, the communication I / F 205 in FIG. 2, and communicates with the update management device 100 and the like.

[0055] When the update unit 322 receives an update request notified from the update management device 100 , the update unit 322 stores the updated program included in the update request in the storage unit 326 .

[0056] As shown in FIG. 3, the storage unit 326 includes a first storage area 332 for storing the pre-update program, a second storage area 333 for storing the post-update program, boot information 531, and the like.

[0057] For example, if there is no program update, the ECU 111 starts up using the program (the program before the update) stored in the first storage area 332, and realizes the functional configuration of the ECU 111 as shown in Fig. 3. If there is a program update, the update unit 322 of the ECU 111 stores the updated program in the second storage area 333, and updates the boot information 331 so that, for example, the updated program is used for startup at the next startup.

[0058] Furthermore, when the update unit 322 is started up with the updated program upon IG-ON (an example of a predetermined timing), for example, it notifies the update management device of a completion notification indicating that the program update has been completed.

[0059] Fig. 5 is a diagram for explaining boot information according to the first embodiment. Fig. 5(a) shows an example of boot information 331a before the ECU 111 accepts an update request from the update management device 100. For example, as shown in Fig. 5(a), the boot information includes information such as a "start address" and a "version" before the update, a "start address" and a "version" after the update, and "functional limitations."

[0060] The "start address" before the update is information indicating the start address of the first memory area 332 which stores the program before the update. The "version" before the update is information indicating the version number, etc. of the program before the update. The "start address" after the update is information indicating the start address of the second memory area 333 which stores the program after the update. The "version" after the update is information indicating the version number, etc. of the program after the update. "Function restriction" is information indicating whether to prohibit or permit a specified control by ECU 111, and is set to "on" if the specified control is prohibited, and to "off" if the specified control is permitted.

[0061] For example, when the update unit 322 of the ECU 111 receives an update request from the update management device 100, it sets "Function restriction" to "ON" as shown in boot information 331b in Fig. 5(b) and starts storing the updated program in the second storage area 333. Furthermore, when the storage of the updated program is completed, the update unit 322 stores the updated "start address" and "version" as shown in boot information 331b in Fig. 5(b).

[0062] Returning now to FIG. 3, the description of the functional configuration of the ECU 111 will be continued.

[0063] When starting or restarting the ECU 111, the start-up control unit 324 refers to the boot information 331 and starts up the ECU 111 (its own device) using the pre-update program stored in the first memory area 332 or the updated program stored in the second memory area 333.

[0064] For example, when the updated "start address" is not stored as in the boot information 331a shown in FIG. 5(a), the start control unit 324 starts the ECU 111 using the program stored in the first memory area 332 using the "start address" before the update.

[0065] 5B, when the updated "start address" is stored, the start control unit 324 uses the updated "start address" to start the ECU 111 using the updated program stored in the second storage area 333. In this case, the ECU 111 executes the updated program stored in the second storage area 333 to realize each functional configuration of the ECU 111 as shown in FIG.

[0066] Preferably, the start-up control unit 324 is realized by, for example, an IPL (Initial Program Loader) stored in the ROM 203 in FIG.

[0067] After the ECU 111 starts up using the updated program, the switching unit 323 switches the operation of the ECU 111 depending on the update results of the multiple ECUs 111, 112 to be updated, which are stored in the update result storage unit 314 of the update management device 100.

[0068] For example, when the ECU 111 starts up using the updated program, the "function restriction" is set to "on" as shown in the boot information 331b in Fig. 5(b). In this case, the switching unit 323 prohibits the ECU 111 from performing a predetermined control (for example, engine control, brake control, etc.).

[0069] Also, for example, when the update result stored in the update result storage unit 314 indicates that the update of the multiple ECUs to be updated has been completed, as in the update result 404 shown in Fig. 4(d), the update management device 100 transmits the above-mentioned start request to the multiple ECUs to be updated. In this case, in response to this start request, the switching unit 323 of the ECU 111 sets "Function Restriction" to "OFF" as in the boot information 331c shown in Fig. 5(c), and permits the ECU 111 to perform a predetermined control.

[0070] On the other hand, for example, as in the update result 403 shown in FIG. 4(c), when the update result stored in the update result storage unit 314 indicates that there is an ECU for which the update has not been completed, the update management device 100 transmits the above-mentioned switching request to the multiple ECUs to be updated. In this case, the switching unit 323 of the ECU 111 restarts the ECU 111 using the pre-update program according to the pre-update "start address" while keeping the "functional restriction" "on" as in the boot information 331b shown in FIG. 5(b). Furthermore, the switching unit 323 notifies the update management device 100 that the ECU 111 has been restarted using the pre-update program, and when it receives a control start request transmitted from the update management device 100, it permits a predetermined control using the pre-update program.

[0071] The function control unit 325 executes a predetermined control (for example, engine control, brake control, etc.) that differs for each ECU 111. In addition, the function control unit 325 stores and manages data such as setting values ​​and learning values ​​required for the predetermined control in control information 334 of the storage unit 326.

[0072] <Processing flow> Next, a process flow of the update management method according to the first embodiment will be described.

[0073] (Processing of update management device) FIG. 6 is a flowchart illustrating an example of processing of the update management device according to the first embodiment.

[0074] 6A shows an example of update processing by the update management device 100. This processing is executed in response to, for example, a user operation, a predetermined time interval, or an update notification from the management server 20.

[0075] In step S611, the update information acquisition unit 311 acquires update information of the programs in the multiple ECUs 111 and 112 mounted on the vehicle 10 from the management server 20 via the communication device 150.

[0076] In step S612, the update management device 100 branches the process depending on the presence or absence of update information acquired by the update information acquisition section 311 (presence or absence of an update).

[0077] For example, if the update information acquisition unit 311 cannot acquire the update information, i.e., if there is no program update, the update management device 100 ends the update information confirmation process. On the other hand, if the update information acquisition unit 311 can acquire the update information, i.e., if there is a program update, the update management device 100 shifts the process to step S613.

[0078] In step S613, the update request unit 313 transmits (notifies) an update request including the post-update program to the plurality of ECUs 111 and 112 to be updated.

[0079] In step S614, the update result storage unit 314 stores the update results notified from the multiple ECUs 111 and 112 to be updated.

[0080] The process in step S614 is optional and not essential. For example, if all the ECUs 111 and 112 to be updated are configured to notify the update result in response to IG-ON as shown in FIG. 6B, the process in step S614 can be omitted.

[0081] The process shown in FIG. 6(b) shows an example of a process that the update management device 100 executes when the ignition of the vehicle 10 is turned on (IG-ON).

[0082] In step S621, when the IG-ON of the vehicle 10 is turned on by, for example, a user operation, the update management device 100 executes the processes in and after step S622.

[0083] In step S622, the update result storage unit 314 receives and stores the update results notified from the multiple ECUs 111 and 112 to be updated, for example, for a predetermined period after the IG-ON.

[0084] In step S623 , the switching control unit 315 checks the update results of the plurality of ECUs 111 and 1123 to be updated that are stored in the update result storage unit 314 .

[0085] In step S624, the switching control unit 315 branches the process depending on whether the update of the multiple ECUs 111, 112 to be updated has been completed. For example, as in the update result 404 shown in Fig. 4(d), when the update results of all ECUs whose update status is "yes" are "completed", the switching control unit 315 determines that the update has been completed. On the other hand, as in the update result 403 shown in Fig. 4(c), when the ECUs whose update status is "yes" include an ECU whose update status is "updating", the switching control unit 315 determines that the update has not been completed.

[0086] If the updating of the ECUs 111, 112 to be updated has been completed, the switching control unit 315 shifts the process to step S625. On the other hand, if the updating has not been completed, the switching control unit 315 shifts the process to step S626.

[0087] When the process proceeds from step S624 to step S625, the switching control unit 315 notifies the plurality of ECUs 111 and 112 to be updated of a start request for requesting the start of control by the updated program.

[0088] When the process proceeds from step S624 to step S626, the switching control unit 315 transmits a switching request to the plurality of ECUs 111 and 112 to be updated, requesting switching to the program before the update.

[0089] In step S627, the switching control unit 315 receives switching completion notifications transmitted from the multiple ECUs 111, 112 that transmitted the switching requests, and if it determines that the switching is completed, it shifts the process to step S628.

[0090] In step S628, the switching control unit 315 transmits a control start request to the plurality of ECUs 111 and 112 to be updated, requesting the start of control using the pre-update program.

[0091] (ECU processing) 7 is a flowchart showing an example of processing by the ECU according to the first embodiment. This processing shows an example of processing on the ECUs 111 and 112 side, which corresponds to the processing of the update management device 100 shown in FIG.

[0092] FIG. 7A shows an example of an update process on the ECUs 111 and 112 side, which corresponds to the update process of the update management device 100 shown in FIG. 6A.

[0093] In step S711, when the ECUs 111 and 112 receive the update request notified from the update management device 100, the ECUs 111 and 112 execute the processes in and after step S712.

[0094] In step S712, the update unit 322 of the ECU 111, 112 sets the "functional restriction" in the boot information 331 to "on."

[0095] In step S713, the update unit 322 of the ECU 111, 112 stores the updated program included in the update request received from the update management device 100 in the second storage area 333.

[0096] In step S714, when the updating unit 322 of the ECUs 111 and 112 has completed storing the updated program, the updating unit 322 updates the information in the boot information 331, such as the updated "start address" and "version".

[0097] As a result of the above processing, for example, in boot information 331a in which the updated "start address" and "version" are not stored as shown in FIG. 5(a), the updated "start address" and "version" are stored as in boot information 331b shown in FIG. 5(b).

[0098] On the other hand, for example, as shown in Fig. 5(c), boot information 331c in which the updated "start address" and "version" are already stored is updated to the information shown in boot information 331d in Fig. 5(d). For example, the updated "start address" and "version" stored in boot information 331c are stored in the "start address" and "version" before the update of boot information 331d. Moreover, the updated "start address" and "version" of boot information 331d are stored with the updated start address and version of the program stored in the second memory area 333.

[0099] FIG. 7B shows an example of a process that the ECUs 111 and 112 execute when the ignition of the vehicle 10 is turned on.

[0100] In step S721, when the IG of the vehicle 10 is turned on by, for example, a user operation, the ECUs 111 and 112 execute the processes in and after step S722.

[0101] In step S722, the ECUs 111 and 112 start or restart in accordance with the boot information 331. For example, as shown in Fig. 1, the ECU 111 connected to the IG power supply to which power is supplied when the IG-ON is turned on starts in response to the IG-ON. On the other hand, the start-up control unit 324 of the ECU 112 connected to the continuous power supply (+B power supply) restarts the ECU 112 in response to the IG-ON.

[0102] At this time, the ECUs 111 and 112 select a program to be used for startup (or restart) in accordance with the "start address" before the update stored in the boot information 331 and the "start address" after the update.

[0103] 5(a), when only the "start address" before the update is stored, the ECUs 111 and 112 select a program to be used for startup or restart according to the "start address" before the update. That is, in this case, the ECUs 111 and 112 start up or restart using the program before the update stored in the first storage area 332.

[0104] 5(b), (c), and (d), when the updated "start address" is stored, the ECUs 111 and 112 select a program to be used for startup or restart according to the updated "start address." That is, in this case, the ECUs 111 and 112 start up or restart using the updated program stored in the second storage area 333.

[0105] In step S723, the switching unit 323 branches the process depending on whether or not the "functional restriction" in the boot information 331 is "on."

[0106] If the "Function Restriction" in the boot information 331 is not "ON", that is, if the "Function Restriction" is "OFF", the ECUs 111 and 112 end the processing at IG-ON and perform predetermined control by the function control unit 325. On the other hand, if the "Function Restriction" in the boot information 331 is "ON", the ECUs 111 and 112 execute the processing from step S724 onwards. Note that the fact that the "Function Restriction" in the boot information 331 is "ON" indicates that the update processing shown in Fig. 7(a) has been executed.

[0107] In step S724, the switching unit 323 of the ECUs 111 and 112 prohibits the predetermined control by the function control unit 325. If the programs of the ECUs 111 and 112 are created in advance so as not to start the predetermined control until a start request or a control start request is received from the update management device 100, the process of step S724 can be omitted.

[0108] In step S725, the update unit 322 of the ECUs 111 and 112 notifies the update management device 100 of the update result of the update process shown in FIG.

[0109] For example, when the update process shown in Fig. 7(a) is completed normally, the "Function restriction" is set to "ON" and the "start address" and "version" after the update are correctly stored in the boot information 331, as in the boot information 331b shown in Fig. 5(b). In this case, the update unit 322 notifies the update management device 100 of the update result (OK) indicating that the update process has been completed normally.

[0110] In step S726, the switching unit 323 of the ECU 111, 112 branches the process depending on whether the program update is successful or not by the update process shown in Fig. 7(a). For example, if the program update is not successful, the switching unit 323 shifts the process to step S732. On the other hand, if the program update is successful, the switching unit 323 shifts the process to step S727.

[0111] In step S727, the switching unit 323 of the ECU 111, 112 determines whether or not a start request for requesting the start of a predetermined control by the updated program has been received from the update management device 100. If a start request has been received, the switching unit 323 shifts the process to step S728. On the other hand, if a start request has not been received, the switching unit 323 shifts the process to step S730.

[0112] When the process proceeds from step S727 to step S728, the switching unit 323 of the ECU 111, 112 sets the "functional restriction" in the boot information 331 to "off."

[0113] In step S729, the switching unit 323 of the ECU 111, 112 starts control by the updated program. As a result, the ECU 111, 112 that has been started up or restarted with the updated program starts predetermined control by the function control unit 325.

[0114] When the process proceeds from step S727 to step S730, the switching unit 323 of the ECU 111, 112 determines whether or not a switching request for switching to the program before the update has been received from the update management device 100. If a switching request has not been received, the switching unit 323 returns the process to step S727 and re-executes the same process. On the other hand, if a switching request has been received, the switching unit 323 transitions the process to step S731.

[0115] When the process proceeds to step S731, the switching unit 323 of the ECUs 111 and 112 uses the start control unit 324 to restart the ECUs 111 and 112 with the pre-update programs stored in the first storage area 332. The switching unit 323 also notifies the update management device 100 of a switching completion notification indicating that switching to the pre-update program has been completed.

[0116] In step S732, the switching units 323 of the ECUs 111 and 112 wait for a control start request sent from the update management device 100, and upon receiving the control start request, start control using the pre-update program in step S733. As a result, the ECUs 111 and 112 that have been started up or restarted using the pre-update program start predetermined control using the function control unit 325.

[0117] Next, the overall process flow in the update system 1 will be described with reference to FIGS.

[0118] (Update system process 1) Fig. 8 is a sequence diagram (1) showing an example of the process of the update system according to the first embodiment. This process shows an example of the process when there is update information for the ECUs 111 and 112 and the program update of the ECUs 111 and 112 is normally completed. It is assumed that, at the start of the process shown in Fig. 8, the ECUs 111 and 112 are executing a predetermined control 820 according to the program before the update. Also, each process shown in Fig. 8 corresponds to each process shown in Figs. 6 and 7, and therefore a detailed description thereof will be omitted here.

[0119] In steps S801 and S802, the update information acquisition section 311 of the update management device 100 acquires update information from the management server 20. This process corresponds to the process of step 611 in FIG.

[0120] In the following description, it is assumed that the update information acquisition unit 311 has acquired the update information of the ECU 111 and the ECU 112.

[0121] In steps S803a and S803b, the update request unit 313 of the update management device 100 notifies the ECUs 111 and 112 to be updated of an update request for requesting program update. This process corresponds to the process of step S613 in FIG.

[0122] In steps S804a and S804b, the update units 322 of the ECUs 111 and 112 store the updated programs included in the update request notified from the update management device 100 in the second storage area. In steps S805a and S805b, the update units 322 of the ECUs 111 and 112 update the boot information. This process corresponds to the processes in steps S712 to S714 in FIG. 7(a).

[0123] In step S806, for example, the vehicle 10 transitions to the IG-OFF state 830 due to an off operation by the user.

[0124] At this time, the ECU 111 connected to the ignition power supply (IG power supply) stops the predetermined control 820 based on the pre-update program, and starts up with the post-update program at the next startup. That is, in the ECU 111 connected to the ignition power supply, switching is performed from the pre-update program to the post-update program.

[0125] On the other hand, the ECU 112 connected to the continuous power supply (+B power supply) continues the predetermined control 820 according to the program before the update.

[0126] In step S807, for example, the vehicle 10 transitions to the IG-ON state 840 due to an on-operation by the user.

[0127] In step S808, the update management device 100 starts up in response to, for example, IG-ON, and starts the process shown in FIG. 6(b).

[0128] In step S809, the ECU 111 connected to the ignition power supply starts the process shown in FIG. 7B in response to IG-ON, and starts up with the updated program.

[0129] In step S810, the ECU 112 connected to the continuous power supply starts the process shown in Fig. 7(b) in response to IG-ON, and restarts with the updated program. As a result, the ECU 112 connected to the continuous power supply stops the predetermined control 820 based on the pre-update program, and the program is switched from the pre-update program to the updated program.

[0130] At this point, the ECU 111 and the ECU 112 do not start the predetermined control 850 by the updated program. For example, the ECU 111 and the ECU 112 are prohibited from performing the predetermined control by the process of step S724 in Fig. 7(b). Alternatively, the updated programs of the ECU 111 and the ECU 112 may be configured in advance to start the predetermined control in response to a start request from the update management device 100.

[0131] In steps S811a and S811b, the update units 322 of the ECUs 111 and 112 notify the update management device 100 of the update result (completion) indicating that the update to the updated program has been completed. This process corresponds to the process of step S725 in FIG. 7B.

[0132] In step S812, the switching control unit 315 of the update management device 100 confirms that the update to the post-update program has been completed in the ECU 111 and the ECU 112 to be updated. This process corresponds to the processes in steps S623 and S624 in FIG. 6B.

[0133] In steps S813a and S813b, the switching control unit 315 of the update management device 100 notifies the ECU 111 and the ECU 112 to be updated of a start request for requesting the start of a predetermined control by the updated program. This process corresponds to the process of step S625 in FIG. 6B.

[0134] In steps S814a and S814b, the switching unit 323 of the ECU 111 and the ECU 112 starts a predetermined control by the function control unit 325. As a result, the ECU 111 and the ECU 112 execute a predetermined control 850 based on the updated program. This process corresponds to the processes of steps S727 to S729 in FIG. 7B.

[0135] 8, the update system 1 is managed so that a predetermined control 820 by the ECU 111 according to the pre-update program and a predetermined control 850 by the ECU 112 according to the post-update program are not executed simultaneously. Also, the update system 1 is managed so that a predetermined control 850 by the ECU 111 according to the post-update program and a predetermined control 820 by the ECU 112 according to the pre-update program are not executed simultaneously.

[0136] (Update system process 2) 9 is a sequence diagram (2) showing an example of processing of the update system according to the first embodiment. This processing shows an example of processing when there is update information for the ECUs 111 and 112 and the program update in the ECU 111 has failed.

[0137] At the start of the process in Fig. 9, the update management device 100, the ECU 111, and the ECU 112 execute the processes in steps S801 to S805a and S805b in Fig. 8, and the update of the program in the ECU 111 fails due to the OFF operation in step S806. For example, it is assumed that the vehicle 10 transitions to an IG-OFF state when the ECU 111 stores the updated program in the second storage area 333 in step S804a in Fig. 8, or before updating the boot information in step S805a.

[0138] 9 are similar to the processes shown in FIG. 8, the following description will focus on the differences from the processes shown in FIG.

[0139] In step S901, the ECU 111 connected to the ignition power supply starts the processing shown in FIG. 7(b) in response to IG-ON. However, since the program update is not yet completed in this case, the ECU 111 starts with the program before the update.

[0140] In step S902, the update unit 322 of the ECU 111 that has failed in updating the program notifies the update management device 100 of the update result (incomplete or failed) indicating that the program update has failed. This process corresponds to the process of step S725 in FIG. 7B.

[0141] In step S903, the switching control unit 315 of the update management device 100 confirms that the program update in the ECU 111 of the ECUs 111 and 112 to be updated is not completed. This process corresponds to the processes in steps S623 and S624 in FIG. 6B.

[0142] In steps S904a and S904b, the switching control unit 315 of the update management device 100 notifies the ECU 111 and the ECU 112 to be updated of a switching request for switching to the program before the update. This process corresponds to the process of step S626 in FIG. 6B.

[0143] In step S905, the ECU 112 that is executing the updated program restarts with the pre-update program, and in step S907, sends a switching completion notification indicating that the program switching has been completed to the update management device 100. This process corresponds to the process of step S731 in FIG. 7B.

[0144] On the other hand, the ECU 111 that is executing the pre-update program, for example, ignores the switching request transmitted from the update management device 100. As another example, the ECU 111 may notify the update management device 100 of a switching completion notification indicating that the pre-update program is being executed.

[0145] In step S907, the switching control unit 315 of the update management device 100 confirms that the ECU 112 that has been executing the post-update program has completed switching to the pre-update program. This process corresponds to, for example, the process of step S627 in FIG. 6B.

[0146] In steps S908a and S908b, the switching control unit 315 of the update management device 100 notifies the ECU 111 and the ECU 112 of a control start request for starting a predetermined control by the pre-update program. This process corresponds to the process of step S628 in FIG. 6B.

[0147] In steps S909a and S909b, the switching units 323 of the ECUs 111 and 112 start predetermined control 820 according to the pre-update program. This process corresponds to the processes of steps S732 and S733 in FIG.

[0148] By the above process, in the update system 1, if there is an ECU for which the update has not been completed among the ECUs to be updated, the update system 1 switches back to the program before the update and executes control of the vehicle 10.

[0149] As described above, according to this embodiment, in the update system 1 that updates the programs executed by the ECUs 111, 112 that are started or restarted at different times, it is possible to prevent inconsistencies in program versions.

[0150] [Second embodiment] In the first embodiment, an example has been described in which the ECUs 111 and 112 are started or restarted at the timing of IG-OFF and IG-ON of the vehicle 10, and the program before the update is switched to the program after the update. However, this is a preferred example, and the program of the ECUs 111 and 112 may be updated at a timing other than IG-ON.

[0151] In the second embodiment, an example of performing a program update at a predetermined timing after IG-ON (for example, when the update of all ECUs to be updated is completed, etc.) will be described.

[0152] <Configuration of ECU> FIG. 10 is a diagram showing an image of the configuration of the ECU according to the second embodiment. The ECUs 111 and 112 according to the second embodiment have, for example, a first CPU 1001 and a second CPU 1002 as shown in FIG. 10.

[0153] By executing a first predetermined program, the first CPU 1001 realizes, for example, the communication unit 321, the update unit 322, and the switching unit 323 in FIG. 3. Also, by executing a second predetermined program, the second CPU 1002 realizes, for example, the startup control unit 324 and the function control unit 325 in FIG. 3.

[0154] With the above configuration, in response to a notification from the update management device 100, the first CPU 1001 stores the updated program in the second storage area 333 and updates the boot information in the same manner as in the first embodiment. Also, when the second CPU 1002 receives a switching instruction instructing the program update timing from the update management device 100, the second CPU 1002 performs a software reset and restarts using the updated program stored in the second storage area 333.

[0155] The second CPU 1002 starts (or restarts) using the program before update stored in the first storage area, and restarts using the updated program stored in the second storage area 333 in response to a restart request from the first CPU 1001.

[0156] Note that the functional configurations of the ECUs 111 and 112 according to the second embodiment may be the same as the functional configurations of the ECUs 111 and 112 according to the first embodiment shown in FIG. 3.

[0157] <Flow of processing> Next, a process flow of the update management method of the update system 1 according to the second embodiment will be described.

[0158] Fig. 11 is a sequence diagram showing an example of the process of the update system according to the second embodiment. At the start of the process shown in Fig. 11, it is assumed that the ECU 111 and the ECU 112 have normally completed the storage of the updated program in the second storage area 333 and the update of the boot information 331 by the processes of steps S801 to S805a and S805b in Fig. 8.

[0159] In step S1101, for example, the vehicle 10 transitions to the IG-OFF state due to an off operation by the user. As a result, the ECU 11 connected to the ignition power supply stops operating. Meanwhile, the second CPU 1002 of the ECU 112 connected to the continuous power supply continues the predetermined control 820 according to the program before the update.

[0160] In step S1102, for example, the vehicle 10 transitions to an IG-ON state by a user's on operation. As a result, in step S1103, the update management device 100 is started, and in step S1104, the ECU 111 is started. At this time, the second CPU 1002 of the ECU 111 according to this embodiment is started using the program before the start, and resumes the predetermined control 820 by the program before the update.

[0161] In steps S1105a and S1005b, the update management device 100 notifies the ECU 111 and the ECU 112 of a switching instruction to instruct them to switch from the pre-update program to the post-update program at a predetermined timing.

[0162] As an example, when the update management device 100 is started in response to the IG-ON, it notifies the ECU 111 and the ECU 112 of a switching instruction. As a result, similar to the first embodiment, in response to the IG-ON of the vehicle 10, a predetermined control 850 by the updated program can be started.

[0163] As another example, the update management device 100 may notify the ECU 111 and the ECU 112 of a switching instruction when it is confirmed that the updates of the ECUs 111 and 112 to be updated have been completed by the process of step S614 in Fig. 6(a). Furthermore, the update management device 100 may transmit the switching instruction to the ECU 111 and the ECU 112 at a timing other than the above.

[0164] In steps S1106a and S1106b, the switching unit 323 realized by the first CPU 1001 of the ECU 111 and the ECU 112 performs a software reset on the second CPU 1002. As a result, the start-up control unit 324 realized by the second CPU 1002 of the ECU 111 and the ECU 112 restarts the second CPU 1002 by using the updated program stored in the second storage area 333. As a result, in the ECU 111 and the ECU 112, switching is performed from the pre-update program to the updated program.

[0165] In steps S1107a and S1007b, the update unit 322 implemented by the first CPU 1001 of the ECU 111 and the ECU 112 notifies the update management device 100 of the update result (completion) indicating that the program update has been completed.

[0166] In step S1108, the switching control unit 315 of the update management device 100 confirms that the update to the post-update programs in the ECUs 111 and 112 to be updated has been completed.

[0167] In steps S1109a and S1109b, the switching control unit 315 of the update management device 100 notifies the ECU 111 and the ECU 112 of a start request for requesting the start of a predetermined control by the updated program.

[0168] In steps S1110a and S1110b, the switching unit 323 implemented by the first CPU 1001 of the ECU 111 and the ECU 112 causes the second CPU 1002 to start a predetermined control 850 according to the updated program.

[0169] Through the above processing, the update system 1 of the second embodiment becomes able to switch from the pre-update program to the updated program in the ECU 111 and ECU 112 to be updated at a predetermined timing different from when the IG-ON is turned on.

[0170] Although an embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0171] 1 Update System 10 Vehicles 100 Update management device 111 ECU (first electronic control unit, electronic control unit) 112 ECU (second electronic control unit, electronic control unit) 313 Update request section (request section) 314 Update result storage unit (storage unit) 315 Switching control section 322 Update Department 323 Switching section 324 Start control section 332 First Memory Area 333 Second Memory Area

Claims

1. A plurality of electronic control devices; a request unit that requests the plurality of electronic control units to update their programs; an update result storage unit that stores the update results of the programs notified from the plurality of electronic control units; When the update result stored in the update result storage unit indicates that the update of the program in the plurality of electronic control devices has been completed, a first start request is sent to the plurality of electronic control devices to request the start of a predetermined control by the updated program; an update management device that notifies the plurality of electronic control devices of a switch request to a program before the update when the update result indicates that at least a part of the update of the program in the plurality of electronic control devices has failed, and upon receiving a completion notification from the plurality of electronic control devices indicating that the switch in response to the switch request has been completed, notifies the plurality of electronic control devices of a second start request to start a predetermined control by the program before the update; A vehicle comprising: Each of the plurality of electronic control devices a storage unit that stores the updated program in response to a request from the update management device; a startup unit that starts up the program using the updated program; a notification unit that, when the storage of at least a part of the updated program has failed, issues a notification indicating failure to store the updated program; In response to the first start request notified from the update management device, starting the predetermined control by the updated program; and an execution unit that executes the pre-update program based on the second start request when any one of the plurality of electronic control devices has made the notification, even if the post-update program has been successfully stored in the electronic control device itself; A vehicle equipped with.

2. The vehicle according to claim 1 , wherein the execution unit prohibits the predetermined control by the updated program until the execution unit receives the start request notified from the update management device.

3. The plurality of electronic control devices include a first electronic control device mounted on the vehicle and supplied with an ignition power supply of the vehicle; a second electronic control unit mounted on the vehicle and supplied with a constant power supply of the vehicle; 3. A vehicle as claimed in claim 1 or 2, comprising:

4. 4. The vehicle according to claim 3, wherein the second electronic control unit has a startup control unit that restarts the second electronic control unit using the updated program in response to an ignition being turned on of the vehicle after the updated program is stored in the memory unit.

5. The vehicle described in claim 3, wherein the first electronic control unit and the second electronic control unit have a startup control unit that restarts the device using the updated program in response to a switching instruction notified by the update management device after storing the updated program in the memory unit.

Images