On-board device, program, program update method, and on-board update system

Abstract

To provide an in-vehicle device and the like capable of efficiently performing update processing of a program when an in-vehicle device performing processing to update programs of onboard ECUs performs processing for updating the program applied to the in-vehicle device itself.SOLUTION: An in-vehicle device comprises a controller that acquires an update program transmitted from an external server outside a vehicle and performs processing for updating programs of onboard ECUs installed in the vehicle. The controller acquires an update program to be applied to the in-vehicle device from the external server, selects, as a proxy ECU, any onboard ECU that is not subject to a program update from among a plurality of onboard ECUs installed in the vehicle, and performs activation processing that applies the acquired update program to the in-vehicle device according to an activation instruction from the selected proxy ECU.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an in-vehicle device, a program, a program update method, and an in-vehicle update system. [Background technology]

[0002] A vehicle is equipped with an ECU (Electronic Control Unit) for controlling in-vehicle devices such as a drive control system such as an engine control system, and a body system such as an air conditioner control system. The ECU includes a calculation processing unit such as an MPU, a rewritable non-volatile storage unit such as an EEPROM, and a communication unit for communicating with other ECUs, and controls the in-vehicle devices by reading and executing a control program stored in the storage unit. Furthermore, the vehicle is equipped with a communication device having a wireless communication function, and can communicate with a program providing device connected to a network outside the vehicle via the communication device, download (receive) a control program for the ECU from the program providing device, and update the control program for the ECU (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-97851 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the communication device (repeater) of Patent Document 1 has a problem in that no consideration is given to the process for updating the control program itself applied to the device itself.

[0005] The object of the present disclosure is to provide an in-vehicle device etc. that can efficiently perform program update processing when the in-vehicle device performs processing to update a program applied to the in-vehicle device itself, when the in-vehicle device performs processing to update the program of the in-vehicle ECU. [Means for solving the problem]

[0006] An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device that includes a control unit that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of an in-vehicle ECU installed in the vehicle, wherein the control unit acquires an update program to be applied to the in-vehicle device from the external server, selects one of a plurality of in-vehicle ECUs installed in the vehicle that is not subject to program update as a substitute ECU, and performs an activation process to apply the acquired update program to the in-vehicle device in response to an activation instruction from the selected substitute ECU. Effect of the Invention

[0007] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device that efficiently performs a process of updating a program applied to an in-vehicle ECU when the in-vehicle device performs a process of updating the program. [Brief description of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating a configuration of an in-vehicle updating system including an in-vehicle device according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle device. [Diagram 3] FIG. 2 is an explanatory diagram illustrating vehicle configuration information; [Figure 4] 1 is an explanatory diagram illustrating state transitions of an in-vehicle device, a substitute ECU, an in-vehicle ECU to be updated, and the like in a program update process. [Diagram 5] 1 is an explanatory diagram illustrating a process flow (sequence) of an in-vehicle device, a substitute ECU, an in-vehicle ECU to be updated, and the like. [Figure 6] 4 is a flowchart illustrating a process of a control unit of an in-vehicle device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0010] (1) An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device including a control unit that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of an in-vehicle ECU mounted on the vehicle, wherein the control unit acquires an update program to be applied to the in-vehicle device from the external server, selects one of a plurality of in-vehicle ECUs mounted on the vehicle that is not subject to program update as a substitute ECU, and performs an activation process to apply the acquired update program to the in-vehicle device in response to an activation instruction from the selected substitute ECU.

[0011] In this embodiment, when applying an update program to the in-vehicle device itself (own device), the control unit of the in-vehicle device selects an in-vehicle ECU that is not a target for program update as a substitute ECU that issues (sends) an activation instruction to the own device, and therefore can perform processing related to program update for the own device based on an instruction from the substitute ECU. In other words, the in-vehicle device can smoothly perform program update processing in the in-vehicle device by having the selected substitute ECU take charge of control related to program update (application of update programs, etc.) in the own device.

[0012] (2) In an in-vehicle device according to one embodiment of the present disclosure, when the control unit receives a rollback instruction from the representative ECU after performing an activation process, the control unit performs a rollback process to revert to the original program before the update program was applied.

[0013] In this embodiment, after the control unit of the in-vehicle device performs activation processing in response to an activation instruction from the substitute ECU, the substitute ECU performs processing such as operation check (abnormality detection sequence) on the in-vehicle device after the activation processing (after application of the update program). If the substitute ECU detects an abnormality in the in-vehicle device after the activation processing, it transmits (outputs) a rollback instruction to the in-vehicle device. The in-vehicle device (control unit) that receives the rollback instruction from the substitute ECU performs rollback processing to return to the original program before application of the update program, so that even if the activation processing fails, the in-vehicle device (control unit) can execute the original program and continue control over the vehicle.

[0014] (3) In one embodiment of the in-vehicle device according to the present disclosure, the control unit obtains from the external server an update program to be applied to an in-vehicle ECU that is a target for program update, and before performing an activation process for the in-vehicle device, outputs the obtained update program for the in-vehicle ECU to the in-vehicle ECU that is the target for update, and outputs an activation instruction to the in-vehicle ECU that is the target for update to apply the update program for the in-vehicle ECU.

[0015] In this embodiment, it is assumed that the application target of the update program is not only the in-vehicle device, but also the in-vehicle device and one or more in-vehicle ECUs, and the in-vehicle device acquires each of the update programs to be applied to the device itself and the in-vehicle ECU from an external server. Before performing activation processing of the in-vehicle device itself, the control unit of the in-vehicle device outputs (transmits) the update program and an activation instruction to the in-vehicle ECU that is the program update target, thereby applying the update program to the in-vehicle ECU before the in-vehicle device itself. In other words, since the operating state of the in-vehicle device before application of the update program is relatively stable, the update program can be smoothly applied to these in-vehicle ECUs.

[0016] (4) In an in-vehicle device according to one embodiment of the present disclosure, the control unit performs a rollback process in response to a rollback instruction from the representative ECU, and then outputs a rollback instruction to the in-vehicle ECU to be updated to restore the original program before the update program was applied.

[0017] In this embodiment, when the application target of the update program is an in-vehicle device and multiple in-vehicle ECUs, it is necessary to apply the update program to all of the in-vehicle devices and in-vehicle ECUs that are the update target. In response to the rollback instruction from the substitute ECU, the control unit of the in-vehicle device performs rollback processing in the in-vehicle device itself, and after the rollback processing, outputs a rollback instruction to all the in-vehicle ECUs that are the update target, and makes these in-vehicle ECUs perform rollback processing. In this way, when the application of the update program in the in-vehicle device itself fails, the in-vehicle device (control unit) performs rollback processing in the in-vehicle device itself based on the instruction from the substitute ECU, and makes other in-vehicle ECUs that are also the update target like the in-vehicle device itself perform rollback processing, thereby restoring the operating environment to the state before the update program was applied.

[0018] (5) In an in-vehicle device according to an aspect of the present disclosure, the control unit performs processing related to an update program during a period in which the vehicle is prohibited from being started.

[0019] In this embodiment, the control unit of the in-vehicle device performs processing related to the update program, including activation processing and rollback processing, including selection of a substitute ECU, during a period when the vehicle is prohibited from being in an activated state, such as a period when engine start or traction motor drive is prohibited. In the overall processing content of the program update, the in-vehicle device (control unit) performs a two-stage process of applying the update program to the in-vehicle ECU to be updated and a process of applying the update program to the in-vehicle device itself based on an instruction from the substitute ECU, so there is a concern that temporary inconsistency (version difference) may occur between the applied programs. In contrast, since the program update process (processing related to the update program) is performed during a period when the vehicle is prohibited from being in an activated state, even if the update program application process is performed in two stages, it is possible to reliably prevent the vehicle from starting up in a state where inconsistency occurs between the applied programs.

[0020] (6) In one embodiment of the in-vehicle device of the present disclosure, the control unit identifies a number of candidate ECUs having the function of the proxy ECU from among a number of in-vehicle ECUs mounted on the vehicle, and selects one of the multiple candidate ECUs as the proxy ECU depending on a result of a proxy request sent to the identified candidate ECU.

[0021] In this embodiment, since the vehicle is equipped with a plurality of candidate ECUs having the function of a proxy ECU, even if one of the candidate ECUs (the in-vehicle ECU having the function of a proxy ECU) is a program update target, another candidate ECU can be selected, and redundancy in the proxy ECU selection process can be improved. When selecting a proxy ECU, the control unit of the in-vehicle device takes into consideration the transmission results of the proxy request sent to these plurality of candidate ECUs, and for example, transmits the proxy request to these plurality of candidate ECUs in sequence based on a predetermined priority order, and selects the candidate ECU that responds first as the proxy ECU. By selecting the candidate ECU that responds to the transmission of such a proxy request as the proxy ECU, the reliability of the proxy ECU can be efficiently guaranteed.

[0022] (7) An in-vehicle device according to one embodiment of the present disclosure includes a memory unit in which vehicle configuration information including information regarding in-vehicle ECUs installed in the vehicle is stored, and the candidate ECU is identified by referring to the vehicle configuration information.

[0023] In this embodiment, the in-vehicle device (controller) aggregates information related to all in-vehicle ECUs mounted on the vehicle and stores the aggregated information as vehicle configuration information in an accessible storage area such as a storage unit provided in the device itself. The vehicle configuration information includes information (candidate ECU flag) indicating whether each in-vehicle ECU has a function as a substitute ECU (suitability as a candidate ECU), so the control unit of the in-vehicle device can efficiently identify multiple candidate ECUs by referring to the vehicle configuration information.

[0024] (8) In one embodiment of the in-vehicle device of the present disclosure, an in-vehicle network equipped in the vehicle is composed of a plurality of segments to which in-vehicle ECUs are connected, and the control unit selects an in-vehicle ECU connected to the same segment as the in-vehicle ECU whose program is to be updated as the substitute ECU.

[0025] In this embodiment, the in-vehicle network mounted on the vehicle is composed of a plurality of segments, and a single or a plurality of in-vehicle ECUs are connected to each of the plurality of segments. The in-vehicle device includes a plurality of in-vehicle communication units, such as a CAN transceiver, corresponding to each of the plurality of segments. The control unit of the in-vehicle device selects an in-vehicle ECU connected to the same segment as the in-vehicle ECU to be updated as a substitute ECU, and thereby can deactivate the in-vehicle communication unit, for example, by stopping the supply of electricity to the in-vehicle communication unit corresponding to (connected to) the segment to which the in-vehicle ECU to be updated is not connected, during the period in which the program update process is performed. The program update process must be performed during the period in which the engine is stopped, and therefore consumes power from a storage device, such as a lead battery. In contrast, by selecting a substitute ECU connected to the same segment as the in-vehicle ECU to be updated, it is possible to stop the supply of electricity to the in-vehicle communication unit of the segment to which the in-vehicle ECU to be updated is not connected, thereby reducing the amount of power consumption.

[0026] (9) A program according to one embodiment of the present disclosure causes a computer that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of an onboard ECU mounted on the vehicle to acquire an update program to be applied to the computer from the external server, selects one of a plurality of onboard ECUs mounted on the vehicle that is not subject to the program update as a substitute ECU, and performs an activation process to apply the acquired update program to the computer in response to an activation instruction from the selected substitute ECU.

[0027] In this aspect, it is possible to provide a program that causes a computer to function as an in-vehicle device that efficiently performs a program update process when updating a program applied to the computer.

[0028] (10) A program update method according to one embodiment of the present disclosure includes causing a computer that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of an on-board ECU mounted on the vehicle to acquire an update program to be applied to the computer from the external server, selects one of a plurality of on-board ECUs mounted on the vehicle that is not subject to the program update as a substitute ECU, and performs an activation process to apply the acquired update program to the computer in response to an activation instruction from the selected substitute ECU.

[0029] In this aspect, it is possible to provide an update method that causes a computer to function as an in-vehicle device that efficiently performs update processing of a program applied to the computer when the computer performs processing to update the program.

[0030] (11) An in-vehicle update system according to one embodiment of the present disclosure includes a plurality of in-vehicle ECUs mounted on a vehicle, and an in-vehicle device that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of the in-vehicle ECU mounted on the vehicle, wherein the in-vehicle device acquires the update program to be applied to the in-vehicle device from the external server, selects one of the plurality of in-vehicle ECUs that is not a target for program update as a substitute ECU, the selected substitute ECU outputs an activation instruction to the in-vehicle device, and the in-vehicle device performs activation processing to apply the acquired update program to the in-vehicle device in response to the activation instruction from the substitute ECU.

[0031] According to this aspect, it is possible to provide an in-vehicle update system including an in-vehicle device that efficiently performs a program update process when performing a process of updating a program applied to the in-vehicle device.

[0032] [Details of the embodiment of the present invention] The present invention will be specifically described based on the drawings showing the embodiments. An in-vehicle device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is indicated by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0033] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram showing the configuration of an in-vehicle update system S according to the first embodiment. Fig. 2 is a block diagram showing the configuration of an in-vehicle device 2. The in-vehicle update system S includes an external communication device 1 and an in-vehicle device 2 mounted on a vehicle C, and transmits an update program acquired from an external server S1 (program providing device, OTA server) connected via an external network N to an in-vehicle ECU3 (Electronic Control Unit) mounted on the vehicle C.

[0034] The external server S1 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a storage unit S11 such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk, and corresponds to a program providing device outside the vehicle. The external server S1 stores in the storage unit S11 programs or data for controlling the in-vehicle ECU 3, which are created by a manufacturer of the in-vehicle ECU 3, for example. The programs or data are transmitted to the vehicle C as an update program, as described below, and are used to update the programs or data of the in-vehicle ECU 3 installed in the vehicle C. The external server S1 (program providing device) configured in this manner is also called an OTA (Over The Air) server.

[0035] The in-vehicle device 2 functions as an OTA master that transmits an update program acquired from the external server S1 to the in-vehicle ECU 3 to be updated, and transmits an activation instruction for applying the transmitted update program to the in-vehicle ECU 3. When applying an update program to the in-vehicle device 2 (activation processing), the in-vehicle device 2 functioning as the OTA master selects a substitute ECU 31, which will be described later, and performs activation processing or rollback processing according to an instruction from the selected substitute ECU 31. The in-vehicle ECU 3 mounted in the vehicle C acquires the update program transmitted from the external server S1 by wireless communication via the in-vehicle device 2, and applies the update program (activation processing) according to an activation instruction, thereby updating (reprogramming) a program executed by the in-vehicle ECU.

[0036] Hereinafter, the program will be described as including a program code including a control syntax and the like for the in-vehicle ECU 3 to perform processing, and an external file in which data referenced when the program code is executed is described. When transmitting an update program, the external file in which the program code and data are described is transmitted from the external server S1, for example, as an encrypted archive file. When transmitting the update program, the external server S1 generates a package including the update program, and transmits the generated package to the vehicle C. The package includes, for example, package information (campaign information) that is information related to the program update, information related to the in-vehicle ECU 3 to be updated (target information), and the update program to be applied to the in-vehicle ECU 3 to be updated.

[0037] The vehicle C is equipped with an external communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The external communication device 1 and the in-vehicle device 2 are communicatively connected by a harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by an in-vehicle network 4 that supports a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark).

[0038] The exterior-vehicle communication device 1 includes an exterior-vehicle communication unit (not shown) and an input / output I / F (not shown) (interface) for communicating with the in-vehicle device 2. The exterior-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as LTE (registered trademark), 4G, 5G, or WiFi (registered trademark), and transmits and receives data to and from an external server S1 via an antenna 11 connected to the exterior-vehicle communication unit. The communication between the exterior-vehicle communication device 1 and the external server S1 is performed via an external network N such as a public line network or the Internet.

[0039] The input / output I / F of the extra-vehicle communication device 1 is a communication interface for, for example, serial communication with the in-vehicle device 2. The extra-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via a harness such as a serial cable connected between the input / output I / Fs. In this embodiment, the extra-vehicle communication device 1 is a device separate from the in-vehicle device 2, and these devices are communicatively connected by the input / output I / F or the like, but this is not limited thereto. The extra-vehicle communication device 1 may be built into the in-vehicle device 2 as one component of the in-vehicle device 2. Alternatively, the extra-vehicle communication device 1 and the in-vehicle device 2 may be connected by an in-vehicle network 4 such as a CAN.

[0040] The in-vehicle device 2 includes a control unit 20, a storage unit (a first storage unit 231, a second storage unit 232), an input / output I / F 21, and an in-vehicle communication unit 22. The in-vehicle device 2 is configured to acquire, from the outside-vehicle communication device 1, an update program (package) that the outside-vehicle communication device 1 has received from an external server S1 by wireless communication, and transmit the update program to a predetermined in-vehicle ECU 3 (an in-vehicle ECU 3 to be updated) via the in-vehicle network 4. That is, the in-vehicle device 2 functions as an OTA master (repro master) that controls program updates in the in-vehicle ECU 3 to be updated.

[0041] The in-vehicle device 2 is a gateway (in-vehicle relay device) that manages a plurality of buses (segments) such as an in-vehicle ECU 3 of a control system, an in-vehicle ECU 3 of a safety system, and an in-vehicle ECU 3 of a body system, and relays communication between the in-vehicle ECUs 3 between these buses (segments). That is, the in-vehicle device 2 is connected to each of the communication lines 41 that constitute the plurality of buses (segments), and the in-vehicle network 4 is configured by the plurality of communication lines 41 (segments) aggregated by the in-vehicle device 2. The in-vehicle device 2 functions as a CAN gateway in relaying the CAN protocol, and functions as a layer 2 switch or layer 3 switch in relaying the TCP / IP protocol. The in-vehicle device 2 may be a PLB (Power Lan Box) that functions as a power distribution device that distributes and relays power output from a power supply device such as a secondary battery and supplies power to an in-vehicle device such as an actuator connected to the device itself, in addition to relaying communication. Alternatively, the in-vehicle device 2 may be configured as one functional part of a body ECU that controls the entire vehicle C. Alternatively, the in-vehicle device 2 may be an integrated ECU that is configured with a central control device such as a vehicle computer and performs overall control of the vehicle C.

[0042] The control unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and is configured to perform various control processing and calculation processing, etc. by reading and executing a control program P (program product) and data pre-stored in the memory unit.

[0043] The storage unit is composed of two storage areas, a first storage unit 231 and a second storage unit 232, and each of the first storage unit 231 and the second storage unit 232 is composed of a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory. The first storage unit 231 and the second storage unit 232 store a control program P and data to be referenced during processing in advance. The control program P is a target to be updated by an update program acquired from an external server S1. The control program P (program product) stored in the storage unit (first storage unit 231, second storage unit 232) may be a control program P (program product) read from a recording medium 24 readable by the in-vehicle device 2. The control program P may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit.

[0044] The storage units (first storage unit 231, second storage unit 232) store information on each version of two programs (control program P), namely, the current version and the old version, and information on the area (operating surface) in which the currently executed (applied) program is stored. That is, when a program stored in the first storage unit 231 (first surface) is currently executed, the first storage unit 231 stores that the operating surface is the first storage unit 231 (first surface). In this case, the non-operating surface is stored that the second storage unit 232 (second surface). The first storage unit 231, which is the operating surface, stores the current version of the control program P. The second storage unit 232, which is the non-operating surface, stores the old version of the control program P. Alternatively, the second storage unit 232, which is the non-operating surface, may be a storage area in which the old version of the control program P, etc. is not stored and which becomes an available capacity. In this way, since the non-operational side is in a state where free memory space or an old version of the control program P, etc. are stored, when updating, a new version of the control program P can be written to the non-operational side, ensuring that the system can be restored to the old version.

[0045] The input / output I / F 21 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. The in-vehicle device 2 is communicatively connected to the exterior communication device 1, the display device 5, and the IG switch 6 via the input / output I / F.

[0046] The in-vehicle communication unit 22 is an input / output interface using a communication protocol such as CAN or Ethernet (registered trademark), and the control unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 22. A plurality of in-vehicle communication units 22 (three in this embodiment) are provided, and a communication line 41 (segment) constituting the in-vehicle network 4 is connected to each of the in-vehicle communication units 22. By providing a plurality of in-vehicle communication units 22 in this manner, the in-vehicle network 4 is divided into a plurality of segments, and each in-vehicle ECU 3 is connected to each segment according to, for example, the function of the in-vehicle ECU 3 (control system function, safety system function, body system function).

[0047] The in-vehicle ECU 3 includes a control unit, a storage unit, and an in-vehicle communication unit (not shown) similarly to the in-vehicle device 2. The storage unit is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read only memory (ROM), an electrically erasable programmable ROM (EEPROM) or a flash memory, and stores programs or data of the in-vehicle ECU 3. The programs or data are to be updated by an update program transmitted from a program providing device and relayed by the in-vehicle device 2. The in-vehicle communication unit of the in-vehicle ECU 3 is configured with, for example, a CAN transceiver or an Ethernet PHY unit similarly to the in-vehicle device 2, and communicates with the in-vehicle device 2 via the in-vehicle communication unit.

[0048] Among the in-vehicle ECUs 3 mounted on the vehicle C, some of the in-vehicle ECUs 3 have a function (function as a proxy ECU 31) of acting as a proxy for processing related to application of update programs in the in-vehicle device 2. As will be described in detail later, in response to a proxy request transmitted from the in-vehicle device 2, the proxy ECU 31 issues an activation instruction to the in-vehicle device 2, checks the operation of the in-vehicle device 2 after the activation process, and issues a rollback instruction when an operational defect is detected.

[0049] 3 is an explanatory diagram illustrating an example of vehicle configuration information. The in-vehicle device 2 periodically, cyclically, or steadily communicates with all in-vehicle ECUs 3 mounted on the vehicle C (own vehicle) and acquires information on these in-vehicle ECUs 3. For example, when the IG switch 6 is turned on or off, or at a predetermined timing, the in-vehicle device 2 requests all in-vehicle ECUs 3 steadily mounted on the vehicle C or a specific in-vehicle ECU 3 to transmit configuration information of its own ECU and an update history of the configuration information. The in-vehicle device 2 acquires the configuration information and update history transmitted from each of the in-vehicle ECUs 3, aggregates the configuration information, etc., and stores the aggregated configuration information and update history as vehicle configuration information.

[0050] The in-vehicle device 2 may acquire and consolidate each of the configuration information and update histories spontaneously transmitted by each of the in-vehicle ECUs 3 without requesting the in-vehicle ECUs 3 to transmit the configuration information and update history, and store the information in the storage unit. Alternatively, the in-vehicle device 2 may transmit an update program to the in-vehicle ECUs 3, and change the configuration information (vehicle configuration information) based on the transmitted update program each time the transmission is completed. The in-vehicle device 2 generates vehicle configuration information, for example, in a table format, by consolidating information on each of the in-vehicle ECUs 3 acquired from the plurality of in-vehicle ECUs 3, and stores the vehicle configuration information in the storage unit of the in-vehicle device 2. The storage unit that stores the vehicle configuration information may be the first storage unit 231, the second storage unit 232, or the first storage unit 231 and the second storage unit 232, which store the vehicle configuration information in a redundant manner.

[0051] As an example, the vehicle configuration information stored in a table format includes, as management items (fields), for example, the manufacturing number (serial number) of the in-vehicle ECU 3, the ECU part number (model number), the software part number, the current version of the program, the old version, the operation aspect, the state (reproduction status), the segment number, the update target (campaign number), the substitute ECU, and the priority, and is managed in association with an ECU-ID, which is a sequential number or the like set so as not to overlap with each in-vehicle ECU 3. The management item of the ECU-ID stores an identification number, which is a sequential number or the like for uniquely identifying each in-vehicle ECU 3 mounted on the vehicle C. Furthermore, the vehicle configuration information may include, as management items (fields), a MAC (Media Access Control) address and an IP address of the in-vehicle ECU 3.

[0052] The manufacturing number (serial number) is a number assigned when the in-vehicle ECU 3 is manufactured, and is a unique number that can uniquely identify the ECU, and is composed of a lot number indicating the production base, etc., and a serial number at the time of manufacture, etc. The ECU part number (model number) is a number that identifies the type of in-vehicle ECU 3, such as a parts number. The software part number is a number for identifying the type of software of the update program (the control program P to be updated). The in-vehicle device 2 may identify the in-vehicle ECU 3 to be updated among the in-vehicle ECUs 3 mounted in the vehicle by comparing the manufacturing number or ECU part number included in the target information acquired from the external server S1 with the manufacturing number or ECU part number included in the vehicle configuration information.

[0053] The current version is the version number of the program currently being executed (applied) by the in-vehicle ECU 3, and is the version number of the program stored in the operational side. The old version is the version number of the program previously executed (applied) by the in-vehicle ECU 3, and is the version number of the program stored in the non-operational side (a storage area that is not the operational side). The operational side is information that identifies one of the storage areas (first side: the first storage unit 231 or second side: the second storage unit 232) in which the program currently being executed (applied) by the in-vehicle ECU 3 is stored. These operational side and version information are stored so as to be used when rolling back from the new version of the program written during an update to the old version of the program.

[0054] The status management item stores status information (reproduction status) regarding application of an update program in a corresponding in-vehicle ECU 3 (ECU-ID of the same record). The in-vehicle device 2 may communicate with the in-vehicle ECU 3 to which an activation instruction is sent and obtain status information (reproduction status) of the in-vehicle ECU 3, thereby updating the status (status management item) of each in-vehicle ECU 3. This allows the in-vehicle device 2 to aggregate, store, and manage status information (reproduction status) of each in-vehicle ECU 3 after activation processing. The in-vehicle device 2 may refer to or update these data when installing a new version of a program during an update, when activating, and when performing rollback processing.

[0055] The management item of the segment number stores the number of the communication line 41 (segment) to which the corresponding in-vehicle ECU 3 is connected. The number of the communication line 41 (segment) corresponds to the number (communication port number) of each of the multiple in-vehicle communication units 22 included in the in-vehicle device 2. This allows the in-vehicle device 2 to identify each in-vehicle ECU 3 directly connected to each of the in-vehicle communication units 22 in the in-vehicle device 2 via the communication line 41 (segment).

[0056] In the management item of the update target (campaign number), for example, a campaign number is stored for the in-vehicle ECU 3 that is the target of the current update (campaign). For example, when performing a group update in which multiple in-vehicle ECUs 3 are updated simultaneously, it is necessary to determine the consistency of the set of versions of the multiple in-vehicle ECUs 3 that are the update target (campaign target). In response to this, in all the in-vehicle ECUs 3 mounted on the vehicle C, the in-vehicle ECUs 3 that are the target of the current update (campaign) can be efficiently identified by storing the number of the campaign in the field of the in-vehicle ECU 3. As illustrated in the present embodiment, the field of the in-vehicle ECU 3 that is not the update target may be blank (storing a null value), for example. Furthermore, information (ECU part number, software version, etc.) related to the multiple in-vehicle ECUs 3 that have the campaign number stored in the update target field may be extracted and list-managed in a separate table.

[0057] The management item of the proxy ECU 31 stores information (yes or no) indicating whether the corresponding in-vehicle ECU 3 has the function as the proxy ECU 31. In this embodiment, an in-vehicle ECU 3 for which the management item of the proxy ECU 31 is "yes" is an in-vehicle ECU 3 that can function as the proxy ECU 31, and corresponds to a candidate ECU for selection as the proxy ECU 31.

[0058] When the corresponding in-vehicle ECUs 3 are identified as candidate ECUs, the priority management item stores the priority order for selecting the candidate ECUs as the substitute ECU 31. The in-vehicle device 2 may transmit the substitute request to the identified candidate ECUs in sequence based on the priority order set for each of the candidate ECUs.

[0059] 4 is an explanatory diagram illustrating state transitions of the in-vehicle device 2, the substitute ECU 31, the in-vehicle ECU 3 to be updated, etc. in a program update process. In the in-vehicle device 2 and the in-vehicle ECU 3 to be updated, the states before and after the update program is stored are shown in inverted display form.

[0060] Before the update program is stored (before rewriting), the in-vehicle device 2 and the in-vehicle ECU 3 execute the control program P stored in the operational plane. The in-vehicle device 2 stores the update program for its own device, acquired from the external server S1, in the non-operational plane of its own device, and transmits the update program for the in-vehicle ECU 3 to the in-vehicle ECU 3, whereby the update program is stored in the non-operational plane of the in-vehicle device 2 and the in-vehicle ECU 3.

[0061] The in-vehicle device 2 is not an update target, and has the function of the substitute ECU 31. CU The in-vehicle ECU 3 that responded to the proxy request sends a proxy request to the in-vehicle ECU 3 (candidate ECU) and sends an activation command to the in-vehicle ECU 3 that is the target of the update. CU The (candidate ECU) starts a processing sequence as the substitute ECU 31, and transmits an activation instruction to the in-vehicle device 2. After transmitting the activation instruction, the substitute ECU 31 detects whether or not there is an operational defect in the in-vehicle device 2 that has performed the activation process.

[0062] When the substitute ECU 31 detects an operational defect in the in-vehicle device 2 after the activation process (operation defect: present), it transmits a rollback instruction to the in-vehicle device 2. The in-vehicle device 2 that has received the rollback instruction from the substitute ECU 31 performs rollback processing by executing the original program before the update program was applied. The in-vehicle device 2 that performs rollback processing and executes the original program before the update program was applied transmits a rollback instruction to the in-vehicle ECU 3 to be updated.

[0063] A rollback command was received from the in-vehicle device 2. In-vehicle ECU3 to be updatedThe rollback process is performed by executing the original program before the update program is applied. As a result, the in-vehicle device 2 and the in-vehicle ECU 3 execute the original program before the update program is applied. and become.

[0064] In this way, the activation process and the rollback process in the in-vehicle device 2 are performed by the substitute ECU 31, so that the activation process and the rollback process are performed in two stages on the in-vehicle device 2 and the in-vehicle ECU 3 that are the update targets. In contrast, a series of processes related to the program update for the in-vehicle device 2 and the in-vehicle ECU 3 is performed during a period in which the vehicle C is prohibited from being in a started state, such as a period in which the engine start or the traction motor drive is prohibited. By performing the processes during the prohibited period, it is possible to prevent the engine from being started in a state in which a temporary inconsistency (version difference) occurs between the applied programs. When performing a series of processes related to the update program during a period in which the vehicle C is prohibited from being in a started state, the in-vehicle device 2 may temporarily disable the on signal output from the IG switch 6 via the input / output I / F 21 or the like by, for example, performing a mask process.

[0065] 5 is an explanatory diagram illustrating a process flow (sequence) of the in-vehicle device 2, the proxy ECU 31, the in-vehicle ECU 3 to be updated, etc. When performing a process related to a program update in the in-vehicle device 2 (OTA master) and the in-vehicle ECU 3 to be updated using an update program, the process sequences of the external server S1 (OTA server), the in-vehicle device 2 (OTA master), the in-vehicle ECU 3 to be updated (target ECU), and the proxy ECU 31 will be described.

[0066] The in-vehicle device 2 acquires an update program from an external server S1 (S01). The in-vehicle device 2 accesses the external server S1 using, for example, the identification number (VIN: Vehicle Identification Number) of the vehicle C (own vehicle) in which the in-vehicle device 2 is mounted, and acquires a package including an update program to be applied to the own vehicle from the external server S1. The package includes, for example, package information (campaign information) that is information about the program update, information (target information) about the in-vehicle device 2 and the in-vehicle ECU 3 that are the targets of the update, and the update program to be applied to the in-vehicle device 2 and the in-vehicle ECU 3 that are the targets of the program update.

[0067] The in-vehicle device 2 stores an update program for its own device (S02). The in-vehicle device 2 stores the update program for its own device in a storage area (storage unit) that is a non-operational surface. The in-vehicle device 2 includes a first storage unit 231 and a second storage unit 232 as storage areas for storing programs. For example, the program currently being executed is stored in the first storage unit 231. is stored in In this case, the first storage unit 231 corresponds to the operating surface. In this case, the second storage unit 232, which is the non-operating surface, stores a program of an earlier version (old version) than the program currently being executed as a backup. The in-vehicle device 2 stores an update program for the device itself acquired from the external server S1 in the second storage unit 232, which is the non-operating surface. This allows the currently executed program to maintain the state stored in the first storage unit 231 without being overwritten.

[0068] The in-vehicle device 2 outputs (transmits) to the in-vehicle ECU 3 to be updated an update program for the in-vehicle ECU 3 (S03). The in-vehicle device 2 identifies the in-vehicle ECU 3 to be updated based on the target information acquired from the external server S1, and transmits the update program for the in-vehicle ECU 3 to the identified in-vehicle ECU 3.

[0069] The in-vehicle ECU 3 to be updated stores the update program acquired (received) from the in-vehicle device 2 (S04). Like the in-vehicle device 2, the in-vehicle ECU 3 to be updated stores the acquired update program in a non-operational plane, thereby making it possible to prevent the currently executed program (stored in the operational plane) from being overwritten.

[0070] The in-vehicle device 2 selects the proxy ECU 31 by transmitting a proxy request (S05). The in-vehicle device 2, for example, refers to vehicle configuration information stored in a storage unit (the first storage unit 231 or the second storage unit 232) of the in-vehicle device 2 to identify a plurality of candidate ECUs to function as the proxy ECU 31. The in-vehicle device 2 selects, as the proxy ECU 31, any of the identified plurality of candidate ECUs that is not a target of the current program update. When there are a plurality of candidate ECUs that are not a target of the update, the in-vehicle device 2 may, for example, transmit a proxy request (proxy request message) to the plurality of candidate ECUs in sequence in a predetermined priority order, and select the candidate ECU that responds to the proxy request first as the proxy ECU 31.

[0071] The candidate ECU that responded to the proxy request from the in-vehicle device 2 is triggered by the proxy request, for example, to start a processing routine as the proxy ECU 31. As a result, the proxy ECU 31 fulfills its functions as an activation instruction unit that issues an activation instruction to the in-vehicle device 2, an abnormality detection unit for the in-vehicle device 2 that has performed the activation process, and a recovery control unit.

[0072] If none of the candidate ECUs responds to the sequentially sent proxy requests (proxy request messages), the in-vehicle device 2 may transmit a notification to the external server S1 indicating that the current update program was not applied because the proxy ECU 31 could not be identified.

[0073] The in-vehicle device 2 outputs (transmits) an activation instruction to the in-vehicle ECUs 3 to be updated (S06). The in-vehicle device 2 outputs the activation instruction to each of the in-vehicle ECUs 3 to be updated, and causes these in-vehicle ECUs 3 to execute the activation process.

[0074] The in-vehicle ECU 3 to be updated performs activation processing (S07) in response to the activation instruction output from the in-vehicle device 2. The in-vehicle ECU 3 that has acquired (received) the activation instruction output from the in-vehicle device 2 performs activation processing to apply the update program by restarting the in-vehicle ECU 3 with the storage area in which the update program is stored as the operating surface.

[0075] The substitute ECU 31 outputs (transmits) an activation instruction to the in-vehicle device 2 (S08). The in-vehicle device 2 performs activation processing in response to the activation instruction output from the substitute ECU 31 (S09). The in-vehicle device 2 that has acquired (received) the activation instruction output from the substitute ECU 31 restarts with the storage area in which the update program is stored as the operating surface, thereby performing activation processing to apply the update program.

[0076] The substitute ECU 31 performs a process of checking the operation (detecting operational imperfections) of the in-vehicle device 2 that has been activated (S10). The substitute ECU 31 (abnormality detection unit) monitors, for example, whether or not a spontaneously transmitted frame is periodically transmitted from the in-vehicle device 2 after the activation process, and determines that the in-vehicle device 2 after the activation process is normal when the spontaneously transmitted frame is received, and determines that the in-vehicle device 2 after the activation process is abnormal (detecting operational imperfections) when the in-vehicle device 2 cannot receive the frame. Alternatively, the substitute ECU 31 may transmit a test signal for detecting operational imperfections to the in-vehicle device 2 after the activation process, and perform the operation check (detecting operational imperfections) of the in-vehicle device 2 based on whether or not a response signal to the test signal is received. That is, the substitute ECU 31 may determine that the in-vehicle device 2 after the activation process is normal when a response signal to the test signal is received from the in-vehicle device 2 after the activation process, and determine that the in-vehicle device 2 after the activation process is abnormal (detecting operational imperfections) when the in-vehicle device 2 cannot receive the frame.

[0077] The substitute ECU 31 outputs (transmits) a normal notification or a rollback instruction to the in-vehicle device 2 according to the operation check result (S11). If the operation check result is normal, the substitute ECU 31 outputs (transmits) a normal notification to the in-vehicle device 2. If the operation check result is abnormal (an operational defect is detected), the substitute ECU 31 (recovery control unit) outputs (transmits) a rollback instruction to the in-vehicle device 2. The rollback instruction corresponds to an abnormality notification indicating that the activation process (application of the update program) in the in-vehicle device 2 has failed.

[0078] The in-vehicle device 2 performs rollback processing based on the rollback instruction output from the substitute ECU 31 (S12). The in-vehicle device 2 that has received the rollback instruction output from the substitute ECU 31 performs rollback processing by restarting to execute the program (original program) that was being executed before the update program was applied (activation processing). The original program is stored (saved) as a backup in a storage area (non-operational surface) different from the storage area (operational surface) in which the update program is stored. By restarting with the storage area in which the original program is stored as the operational surface, the in-vehicle device 2 can perform rollback processing with the storage area in which the update program is stored as the non-operational surface.

[0079] The in-vehicle device 2 outputs (transmits) a rollback instruction to the in-vehicle ECU 3 to be updated (S13). When the in-vehicle device 2 performs rollback processing on its own device, the in-vehicle device 2 also outputs a rollback instruction to the in-vehicle ECU 3 to be updated, thereby eliminating inconsistencies that may occur between the in-vehicle device 2 and the in-vehicle ECU 3 due to differences in program versions, etc.

[0080] If the in-vehicle device 2 does not perform the rollback process of its own device, that is, even if the activation process of its own device has been normally completed, if the activation process of any of the in-vehicle ECUs 3 to be updated fails, the in-vehicle device 2 outputs (transmits) a rollback instruction to all of the in-vehicle ECUs 3 to be updated. In this case, the in-vehicle device 2 further performs the rollback process of its own device. This makes it possible to eliminate inconsistencies caused by differences in program versions between the in-vehicle device 2 and the in-vehicle ECUs 3.

[0081] The in-vehicle ECU 3 to be updated performs rollback processing in response to the rollback instruction output from the in-vehicle device 2 (S14). The in-vehicle ECU 3 to be updated, like the in-vehicle device 2, switches the correspondence between the operating and non-operating aspects in the storage area in which the update program is stored and the storage area in which the original program is stored, and restarts, thereby performing rollback processing to return to the execution environment of the original program.

[0082] The in-vehicle device 2 outputs (transmits) the processing result related to the update program to the external server S1 (S15). As a result of the processing related to the update program, the in-vehicle device 2 outputs (transmits) to the external server S1 an update success notification indicating that the application of the update program to the in-vehicle device 2 and the in-vehicle ECU 3 that are the update targets has been successful, or an update failure notification indicating that the application of the update program has failed and been rolled back. The in-vehicle device 2 may output the processing result related to the update program to the display device 5 and cause the display device 5 to display the processing result. The in-vehicle device 2 may modify vehicle configuration information related to the in-vehicle device 2 and the in-vehicle ECU 3 that are the update targets, based on the processing result of the update program.

[0083] In this embodiment, the proxy ECU 31 is said to act as a proxy for the program update processing in the in-vehicle device 2, but this is not limited to this, and the proxy ECU 31 may act as a proxy for all program update processing in the in-vehicle device 2 and the in-vehicle ECU 3 that are the update targets.

[0084] 6 is a flowchart illustrating the processing of the control unit 20 of the in-vehicle device 2. The control unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a stopped state (the IG switch 6 is off).

[0085] The control unit 20 of the in-vehicle device 2 acquires an update program from the external server S1 (S101). The control unit 20 of the in-vehicle device 2 stores the update program for the in-vehicle device 2 (S102). The control unit 20 of the in-vehicle device 2 acquires a package including an update program to be applied to the in-vehicle device 2 and the in-vehicle ECU 3 from the external server S1, and stores the update program for the in-vehicle device 2 in a storage area of ​​the non-operational side. For example, when the first storage unit 231 is the operational side and stores a program currently being executed, the control unit 20 of the in-vehicle device 2 stores the update program for the in-vehicle device 2 in the second storage unit 232, which is the non-operational side.

[0086] The control unit 20 of the in-vehicle device 2 outputs (transmits) to the in-vehicle ECU 3 to be updated an update program for the in-vehicle ECU 3 (S103). The control unit 20 of the in-vehicle device 2 identifies the in-vehicle ECU 3 to be updated based on the target information included in the package acquired from the external server S1, and transmits the update program for the in-vehicle ECU 3 to the identified in-vehicle ECU 3.

[0087] The control unit 20 of the in-vehicle device 2 selects the substitute ECU 31 by transmitting a substitute request (S104). The control unit 20 of the in-vehicle device 2 refers to the vehicle configuration information and identifies a plurality of candidate ECUs that are in-vehicle ECUs 3 that are not the target of the current program update and that can function as the substitute ECU 31. The control unit 20 of the in-vehicle device 2 transmits a substitute request to the plurality of candidate ECUs in sequence based on the priority order set in the vehicle configuration information, and selects the candidate ECU that responds to the substitute request first as the substitute ECU 31.

[0088] When selecting the substitute ECU 31, the control unit 20 of the in-vehicle device 2 may select, as the substitute ECU 31, an in-vehicle ECU 3 that is not a target for updating and is connected to the same communication line 41 (segment) as the in-vehicle ECU 3 to be updated. The control unit 20 of the in-vehicle device 2 may, for example, refer to vehicle configuration information to identify one or more candidate ECUs to function as the substitute ECU 31 from among the in-vehicle ECUs 3 that are not a target for updating and are connected to the same communication line 41 (segment) as the in-vehicle ECU 3 to be updated. The control unit 20 of the in-vehicle device 2 may transmit a substitute request to the identified candidate ECUs, and select the candidate ECU that responds first as the substitute ECU 31.

[0089] Then, the control unit 20 of the in-vehicle device 2 may stop supplying power to the in-vehicle communication unit 22 connected to the communication line 41 (segment) to which the in-vehicle ECU 3 to be updated is not connected, thereby reducing power consumption by the in-vehicle communication unit 22. A relay is provided for each of the in-vehicle communication units 22 included in the in-vehicle device 2, controlling supply and cut-off of power to the in-vehicle communication unit 22, and the control unit 20 of the in-vehicle device 2 turns off the relay. This may stop supplying power to the in-vehicle communication unit 22 connected to the communication line 41 (segment) to which the in-vehicle ECU 3 to be updated is not connected. Since the program update process needs to be performed while the engine is stopped, it consumes power from a power storage device such as a lead battery. However, by stopping the supply of power to the in-vehicle communication unit 22, the amount of power consumption can be reduced.

[0090] The control unit 20 of the in-vehicle device 2 outputs (transmits) an activation instruction to the in-vehicle ECUs 3 to be updated (S105). The control unit 20 of the in-vehicle device 2 outputs the activation instruction to each of the in-vehicle ECUs 3 to be updated, and causes these in-vehicle ECUs 3 to execute the activation process.

[0091] The control unit 20 of the in-vehicle device 2 acquires (receives) an activation instruction from the proxy ECU 31 (S106). The control unit 20 of the in-vehicle device 2 performs an activation process in response to the activation instruction (S107). The control unit 20 of the in-vehicle device 2 executes (applies) an update program by performing the activation process, and upgrades the control program P executed in the in-vehicle device 2. By executing the update program, the control unit 20 of the in-vehicle device 2 outputs, for example, predetermined data (frames or messages) by broadcast or multicast periodically or periodically.

[0092] The substitute ECU 31 judges whether or not it has received predetermined data periodically transmitted from the in-vehicle device 2 that has been activated (to which the update program has been applied), and judges whether or not an operational defect has occurred in the in-vehicle device 2 after the activation process based on the judgment result. Alternatively, the substitute ECU 31 may transmit a test signal to the in-vehicle device 2 that has been activated (to which the update program has been applied), and judges whether or not an operational defect has occurred in the in-vehicle device 2 after the activation process based on the presence or absence of a response from the in-vehicle device 2. If the substitute ECU 31 judges that an operational defect has occurred in the in-vehicle device 2 after the activation process, it outputs (transmits) a rollback instruction to the in-vehicle device 2. If the substitute ECU 31 judges that no operational defect has occurred in the in-vehicle device 2 after the activation process, it outputs (transmits) a normal notification to the in-vehicle device 2.

[0093] The control unit 20 of the in-vehicle device 2 determines whether or not a rollback instruction has been acquired (received) from the substitute ECU 31 (S108). If a rollback instruction has been acquired from the substitute ECU 31 (S108: YES), the control unit 20 of the in-vehicle device 2 performs rollback processing (S109). When the control unit 20 of the in-vehicle device 2 acquires a rollback instruction from the substitute ECU 31, the control unit 20 performs rollback processing by restarting the in-vehicle device 2 to execute a program (original program) that was executed before the update program was applied (activation processing).

[0094] When the control unit 20 of the in-vehicle device 2 does not receive a rollback instruction from the substitute ECU 31 (S108: NO), the control unit 20 of the in-vehicle device 2 judges whether the activation process of all the in-vehicle ECUs 3 to be updated has been normally performed (S1081). When the control unit 20 of the in-vehicle device 2 does not receive a rollback instruction from the substitute ECU 31, the control unit 20 of the in-vehicle device 2 judges that the application of the update program (activation process) in the in-vehicle device 2 has been normally completed. Alternatively, when the control unit 20 of the in-vehicle device 2 receives a normal notification from the substitute ECU 31, the control unit 20 of the in-vehicle device 2 may judge that the application of the update program (activation process) in the in-vehicle device 2 has been normally completed. Then, the control unit 20 of the in-vehicle device 2 judges whether the application of the update program (activation process) in all the in-vehicle ECUs 3 to be updated has been normally completed. The control unit 20 of the in-vehicle device 2 may transmit, for example, test communication data to each of all the in-vehicle ECUs 3 to be updated, and judge whether the activation process of each of these in-vehicle ECUs 3 has been normally completed based on whether response data to the communication data has been received.

[0095] When it is determined that the activation process of all the in-vehicle ECUs 3 to be updated has not been performed normally, i.e., when it is determined that the activation process of any one of the in-vehicle ECUs 3 to be updated has not been performed normally (S1081: NO), or after performing rollback process of its own device (S109), a rollback instruction is output (transmitted) to the in-vehicle ECU 3 to be updated (S110). The in-vehicle ECU 3 to be updated performs rollback process in response to the rollback instruction output from the in-vehicle device 2.

[0096] When it is determined that the activation process of all the in-vehicle ECUs 3 to be updated has been normally performed (S1081: YES), or after outputting a rollback instruction to the in-vehicle ECUs 3 to be updated (S110), the control unit 20 of the in-vehicle device 2 outputs (transmits) the processing result related to the update program to the external server S1 (S111). The control unit 20 of the in-vehicle device 2 outputs the processing result related to the update program to the external server S1 and the display device 5, and may further modify the vehicle configuration information related to the in-vehicle devices 2 and in-vehicle ECUs 3 to be updated based on the processing result.

[0097] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present disclosure is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims. [Explanation of symbols]

[0098] C Vehicle S In-vehicle update system S1 External server (OTA server) S11 storage section N External network 1. External communication device 11 Antenna 2. In-vehicle device (OTA master) 20 Control section 21 Input / Output Interface 22 In-vehicle communication unit 231 1st memory section (memory section) 232 2nd memory section (memory section) 24 Recording media P Control program (program product) 3 In-vehicle ECU (candidate ECU) 31 Surrogate ECU 4. In-vehicle network 41 Communication line (segment) 5 Display device 6. IG Switch

Claims

1. An in-vehicle device including a control unit that acquires an update program transmitted from an external server outside the vehicle and performs processing for updating a program of an in-vehicle ECU mounted in the vehicle, The control unit is obtaining an update program to be applied to the in-vehicle device from the external server; selecting, as a substitute ECU, one of a plurality of on-board ECUs mounted on the vehicle that is not a target for program update; In response to an activation instruction from the selected representative ECU, an activation process is performed to apply the acquired update program to the in-vehicle device. In-vehicle device.

2. When the control unit receives a rollback instruction from the representative ECU after performing the activation process, the control unit performs a rollback process to return the program to the original program before the update program was applied. The in-vehicle device according to claim 1 .

3. The control unit is obtaining an update program to be applied to the in-vehicle ECU that is the target of the program update from the external server; outputting the acquired update program for the in-vehicle ECU to the in-vehicle ECU to be updated before performing an activation process for the in-vehicle device; An activation instruction is output to the in-vehicle ECU to be updated, for applying the update program for the in-vehicle ECU. The in-vehicle device according to claim 1 or 2.

4. The control unit performs a rollback process in response to a rollback instruction from the substitute ECU, and then outputs a rollback instruction to the in-vehicle ECU to be updated, for returning the in-vehicle ECU to an original program before the update program was applied. The vehicle-mounted device according to claim 3.

5. The control unit performs processing related to an update program during a period in which the vehicle is prohibited from being activated. The vehicle-mounted device according to any one of claims 1 to 4.

6. The control unit is Identifying a plurality of candidate ECUs having the function of the substitute ECU from among a plurality of on-board ECUs mounted on the vehicle; According to a result of a proxy request transmitted to the identified candidate ECU, one of the candidate ECUs is selected as the proxy ECU. The in-vehicle device according to any one of claims 1 to 5.

7. a storage unit in which vehicle configuration information including information regarding an on-board ECU mounted on the vehicle is stored; The candidate ECU is identified by referring to the vehicle configuration information. The vehicle-mounted device according to claim 6.

8. The in-vehicle network of the vehicle is configured with a plurality of segments to which an in-vehicle ECU is connected, The control unit selects, as the substitute ECU, an in-vehicle ECU that is connected to the same segment as an in-vehicle ECU that is a program update target. The in-vehicle device according to any one of claims 1 to 7.

9. A computer that receives an update program transmitted from an external server outside the vehicle and performs processing to update a program of an on-board ECU installed in the vehicle. obtaining an update program to be applied to the computer from the external server; selecting, as a substitute ECU, one of a plurality of on-board ECUs mounted on the vehicle that is not a target for program update; In response to an activation instruction from the selected representative ECU, an activation process is performed to apply the acquired update program to the computer. A program that executes a process.

10. A computer that receives an update program transmitted from an external server outside the vehicle and performs processing to update a program of an on-board ECU installed in the vehicle. obtaining an update program to be applied to the computer from the external server; selecting, as a substitute ECU, one of a plurality of on-board ECUs mounted on the vehicle that is not a target for program update; In response to an activation instruction from the selected representative ECU, an activation process is performed to apply the acquired update program to the computer. A method for updating a program that executes a process.

11. A plurality of on-board ECUs mounted on a vehicle; and an in-vehicle device that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of an in-vehicle ECU mounted on the vehicle, The in-vehicle device includes: obtaining an update program to be applied to the in-vehicle device from the external server; selecting, as a substitute ECU, one of the plurality of in-vehicle ECUs that is not a target for program update; The selected substitute ECU outputs an activation instruction to the in-vehicle device, The in-vehicle device performs an activation process to apply the acquired update program to the in-vehicle device in response to an activation instruction from the substitute ECU. In-vehicle update system.

Images