In-vehicle device, program, and program update method

Abstract

To provide an on-vehicle device and the like which efficiently perform operation confirmation to an on-vehicle ECU applied with a program when performing processing of updating the program of the on-vehicle ECU.SOLUTION: An on-vehicle device is an on-vehicle update device for acquiring an update program transmitted from an external server outside the vehicle and performing processing of updating a program of an on-vehicle ECU mounted on a vehicle, and comprises a control unit which performs processing about the update program. The control unit acquires from the external server an operation confirmation scenario for performing operation confirmation to the on-vehicle ECU being an update target when acquiring the update program, outputs the acquired update program and the operation confirmation scenario to the on-vehicle ECU being the update target, and performs processing about the operation confirmation to the on-vehicle ECU being the update target on the basis of the operation confirmation scenario.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an in-vehicle device, a program, and a program update method. [Background technology]

[0002] A vehicle is equipped with an ECU (Electronic Control Unit) for controlling in-vehicle devices such as a drive control system such as an engine control system, and a body system such as an air conditioner control system. The ECU includes a calculation processing unit such as an MPU, a rewritable non-volatile storage unit such as a RAM, and a communication unit for communicating with other ECUs, and controls the in-vehicle devices by reading and executing a control program stored in the storage unit. Furthermore, the vehicle is equipped with a communication device having a wireless communication function, and can communicate with a program providing device connected to a network outside the vehicle via the communication device, download (receive) a control program for the ECU from the program providing device, and update the control program for the ECU (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-97851 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the communication device (repeater) of Patent Document 1 has a problem in that when applying the downloaded control program to the ECU to be updated, it does not take into consideration the need to check the operation of the control program when applied to the ECU to be updated.

[0005] An object of the present disclosure is to provide an in-vehicle device or the like that, when performing processing to update a program for an in-vehicle ECU, can efficiently check the operation of the in-vehicle ECU to which the program is applied. [Means for solving the problem]

[0006] According to an embodiment of the present disclosure, an in-vehicle device receives an update program transmitted from an external server outside the vehicle and performs a process for updating a program of an in-vehicle ECU mounted in the vehicle. In-vehicle device The system further includes a control unit that performs processing related to the update program, and when acquiring the update program, the control unit acquires from the external server an operation check scenario for performing operation check on the in-vehicle ECU to be updated, outputs the acquired update program and the operation check scenario to the in-vehicle ECU to be updated, and performs processing related to operation check on the in-vehicle ECU to be updated based on the operation check scenario. Effect of the Invention

[0007] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that, when performing processing to update a program of an in-vehicle ECU, efficiently performs operation check of the in-vehicle ECU to which the program is applied. [Brief description of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating a configuration of an in-vehicle updating system including an in-vehicle device according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating a physical configuration of the in-vehicle device. [Diagram 3] 2 is an explanatory diagram illustrating a process flow (sequence) of an in-vehicle device and an in-vehicle ECU to be updated. FIG. [Figure 4] 4 is a flowchart illustrating a process of a control unit of an in-vehicle device. [Diagram 5] 10 is a flowchart illustrating a process of a control unit of an in-vehicle device according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0010] (1) An in-vehicle device according to an embodiment of the present disclosure receives an update program transmitted from an external server outside the vehicle and performs processing for updating a program of an in-vehicle ECU mounted in the vehicle. In-vehicle device The system further includes a control unit that performs processing related to the update program, and when acquiring the update program, the control unit acquires from the external server an operation check scenario for performing operation check on the in-vehicle ECU to be updated, outputs the acquired update program and the operation check scenario to the in-vehicle ECU to be updated, and performs processing related to operation check on the in-vehicle ECU to be updated based on the operation check scenario.

[0011] In this embodiment, the in-vehicle device (controller) outputs an update program and an operation check scenario to the in-vehicle ECU to be updated, and performs a process related to the operation check of the in-vehicle ECU to be updated based on the operation check scenario. The operation check scenario lists the execution procedures of a process sequence, script, command, or the like for the operation check performed by the in-vehicle device for the in-vehicle ECU to be updated. The in-vehicle ECU (in-vehicle ECU to be updated) that has acquired the update program and the operation check scenario from the in-vehicle device applies the acquired update program, and then performs a process related to the operation check of its own ECU based on the operation check scenario acquired together with the update program. As a result, the in-vehicle ECU to be updated and the in-vehicle device perform an operation check of the in-vehicle ECU to which the update program has been applied (in-vehicle ECU to be updated) based on the same operation check scenario, and it is possible to efficiently perform an operation check in the actual environment of the vehicle in which the in-vehicle ECU and the in-vehicle device are installed.

[0012] (2) In an in-vehicle device according to one embodiment of the present disclosure, the control unit performs processing related to operation confirmation for the in-vehicle ECU to be updated by substituting an in-vehicle ECU other than the in-vehicle ECU to be updated based on the operation confirmation scenario.

[0013] In this embodiment, the in-vehicle device performs processing related to operation check of the in-vehicle ECU to be updated by substituting an in-vehicle ECU other than the in-vehicle ECU to be updated, thereby enabling efficient operation check that is in line with the actual environment of the vehicle.

[0014] (3) In an in-vehicle device according to one embodiment of the present disclosure, the operation confirmation scenario includes a processing sequence in which the control unit replacing the other in-vehicle ECU transmits data to the in-vehicle ECU to be updated, and a processing sequence in which the in-vehicle ECU to be updated to which the update program has been applied transmits data to the other in-vehicle ECU replaced by the control unit.

[0015] In this embodiment, the operation check scenario includes a processing sequence that specifies data transmission and reception between an in-vehicle device that replaces another in-vehicle ECU and an in-vehicle ECU to which an update program has been applied (an in-vehicle ECU to be updated), so that an operation check that conforms to the actual environment of the vehicle can be efficiently performed. That is, the in-vehicle ECU to which the update program has been applied attempts to transmit and receive data with the other in-vehicle ECU based on the operation check scenario, but the data transmission and reception is performed by the in-vehicle device that replaces the other in-vehicle ECU. As a result, while the in-vehicle ECU to which the update program has been applied performs an operation check that conforms to the actual operation (actual vehicle environment) of the vehicle, in reality, the in-vehicle device that replaces the other in-vehicle ECU responds based on the operation check scenario. Therefore, by performing the operation check, an operation check of the in-vehicle ECU to which the update program has been applied can be efficiently performed without affecting the control of the vehicle itself.

[0016] (4) In an in-vehicle device according to one embodiment of the present disclosure, the operation check scenario includes judgment information for determining the result of the operation check for the in-vehicle ECU to be updated, and the control unit obtains the result of the operation check by performing processing related to the operation check for the in-vehicle ECU to be updated, and determines whether the program update in the in-vehicle ECU to be updated was successful based on the obtained result of the operation check and the judgment information included in the operation check scenario.

[0017] In this embodiment, the operation check scenario includes judgment information for judging the result of the operation check for the vehicle ECU to be updated. The judgment information includes, for example, the type of data expected to be transmitted from the vehicle ECU to be updated, the transmission period, the expected usage rate of the CPU or memory of the vehicle ECU, and the expected value of the reply response when the data for the operation check is transmitted from the vehicle device. The vehicle device (controller) can efficiently judge whether the program update in the vehicle ECU to be updated has been successful (success or failure) by comparing the judgment information included in the operation check scenario with various values ​​included in the result of the operation check.

[0018] (5) In an in-vehicle device according to one embodiment of the present disclosure, the control unit acquires from the in-vehicle ECU to be updated the results of a standalone diagnosis performed by the in-vehicle ECU to be updated based on the operation confirmation scenario, and determines whether the program update in the in-vehicle ECU to be updated was successful based on the acquired results of the standalone diagnosis.

[0019] In this embodiment, the in-vehicle ECU performs a self-diagnosis process within the ECU itself based on the confirmation scenario acquired from the in-vehicle device. The self-diagnosis process is a diagnostic process that does not communicate with other in-vehicle ECUs such as the in-vehicle device, and corresponds to a standalone diagnosis. The in-vehicle device acquires the result of the standalone diagnosis from the in-vehicle ECU to be updated, and determines whether the program update in the in-vehicle ECU to be updated has been successful based on the result of the standalone diagnosis, so that it is possible to efficiently determine whether the program update in the in-vehicle ECU to be updated has been successful (success or failure).

[0020] (6) In one embodiment of the in-vehicle device of the present disclosure, the control unit complements the operation confirmation scenario obtained from the external server using a relay log collected when performing communication relay processing between multiple in-vehicle ECUs installed in the vehicle, outputs the acquired update program and the complemented operation confirmation scenario to the in-vehicle ECU to be updated, and performs processing related to operation confirmation for the in-vehicle ECU to be updated based on the complemented operation confirmation scenario.

[0021] In this embodiment, the in-vehicle device functions as an in-vehicle relay device such as a gateway or an Ethernet SW that relays communication between a plurality of in-vehicle ECUs mounted on the vehicle. The in-vehicle device that functions as an in-vehicle relay device stores in a storage unit a relay log collected when performing relay processing, and the relay log includes header information (source address, destination address, message ID, etc.) of the Ethernet frame or CAN message that is the relay target, payload information, transmission / reception frequency or period, etc. The in-vehicle device (control unit) can further adapt the operation check scenario acquired from the external server to the actual environment of the vehicle by adding, etc., to the operation check scenario using the relay log stored in the storage unit. By using the operation check scenario (complemented operation check scenario) with improved compatibility with the actual environment of the vehicle in this way, the accuracy of the operation check for the in-vehicle ECU to be updated can be improved.

[0022] (7) In an in-vehicle device according to one embodiment of the present disclosure, when an IG switch of the vehicle is turned off, the control unit performs processing related to operation check of the in-vehicle ECU to be updated based on the operation check scenario.

[0023] In this embodiment, the in-vehicle device performs processing related to operation confirmation based on the operation confirmation scenario after the vehicle's IG switch is turned off, so that the in-vehicle device can perform processing related to operation confirmation without being influenced by other in-vehicle ECUs that only operate when the IG switch is on, and without affecting those other in-vehicle ECUs.

[0024] (8) In an in-vehicle device according to one embodiment of the present disclosure, the control unit outputs a sleep signal to other in-vehicle ECUs other than the in-vehicle ECU to be updated, in order to transition the other in-vehicle ECUs to a sleep mode, and after outputting the sleep signal, performs processing related to operation confirmation of the in-vehicle ECU to be updated based on the operation confirmation scenario.

[0025] In this aspect, after outputting a sleep signal to the in-vehicle ECU other than the in-vehicle ECU to be updated, the in-vehicle device performs processing related to operation check based on the operation check scenario. As a result, the other in-vehicle ECU transitions to a sleep mode in which processing related to data transmission / reception is not performed, so that the in-vehicle device can perform processing related to operation check without being influenced by the other in-vehicle ECU and without affecting the other in-vehicle ECU.

[0026] (9) A program according to one embodiment of the present disclosure causes a computer that acquires an update program transmitted from an external server outside the vehicle and performs processing to update a program of an on-board ECU installed in the vehicle to acquire, when acquiring the update program, an operation check scenario for performing operation check on the on-board ECU to be updated from the external server, output the acquired update program and operation check scenario to the on-board ECU to be updated, and perform processing related to operation check on the on-board ECU to be updated based on the operation check scenario.

[0027] In this aspect, the computer can function as an in-vehicle device that, when performing processing to update a control program for an in-vehicle ECU, efficiently checks the operation of the in-vehicle ECU to which the control program is applied.

[0028] (10) A program updating method according to one embodiment of the present disclosure includes causing a computer to acquire an update program transmitted from an external server outside the vehicle and perform processing to update a program of an on-board ECU installed in the vehicle, when acquiring the update program, to acquire from the external server an operation check scenario for performing an operation check on the on-board ECU to be updated, output the acquired update program and operation check scenario to the on-board ECU to be updated, and perform processing related to the operation check on the on-board ECU to be updated based on the operation check scenario.

[0029] According to this aspect, it is possible to provide a program updating method that, when updating a control program for an in-vehicle ECU, efficiently checks the operation of the in-vehicle ECU to which the control program is applied.

[0030] [Details of the embodiment of the present invention] The present invention will be specifically described based on the drawings showing the embodiments. An in-vehicle device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is indicated by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0031] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram showing the configuration of an in-vehicle update system S according to the first embodiment. Fig. 2 is a block diagram showing the configuration of an in-vehicle device 2 and the like. The in-vehicle update system S includes an external communication device 1 and an in-vehicle device 2 mounted on a vehicle C, and transmits packages (update programs, operation check scenarios) acquired from a program providing device S1 connected via an external network N to an in-vehicle ECU3 (Electronic Control Unit / in-vehicle control device) mounted on the vehicle C.

[0032] The program providing device S1 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a storage unit S11 such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk, and corresponds to an external server outside the vehicle. In the program providing device S1, a program or data for controlling the vehicle-mounted ECU 3, which is created by a manufacturer of the vehicle-mounted ECU 3, is stored in the storage unit S11. The program or data is transmitted to the vehicle C as an update program, as described later, and is used to update the program or data of the vehicle-mounted ECU 3 mounted on the vehicle C. The program providing device S1 (external server) configured in this manner is also called an OTA (Over The Air) server. The vehicle-mounted ECU 3 mounted on the vehicle can update (reprogram) a program executed by its own ECU by acquiring the update program transmitted from the program providing device S1 by wireless communication and applying the update program as a program to be executed.

[0033] Hereinafter, the program will be described as including a program code including a control syntax and the like for the in-vehicle ECU 3 to perform processing, and an external file in which data to be referenced when the program code is executed is described. When transmitting an update program, the external file in which the program code and data are described is transmitted from the program providing device S1 as, for example, an encrypted archive file. When transmitting the update program, the program providing device S1 generates a package including the update program, and transmits the generated package to the vehicle C. The package includes, for example, package information (campaign information) that is information about the program update, information about the in-vehicle ECU to be updated (target information), an update program to be applied to the in-vehicle ECU to be updated, and an operation check scenario for performing an operation check when the update program is applied to the in-vehicle ECU.

[0034] The vehicle C is equipped with an external communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The external communication device 1 and the in-vehicle device 2 are communicatively connected by a harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by an in-vehicle LAN 4 that supports a communication protocol such as CAN (Control Area Network / registered trademark) or Ethernet (registered trademark).

[0035] The exterior-vehicle communication device 1 includes an exterior-vehicle communication unit (not shown) and an input / output I / F (not shown) (interface) for communicating with the in-vehicle device 2. The exterior-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, 5G, or WiFi, and transmits and receives data to and from the program providing device S1 via an antenna 11 connected to the exterior-vehicle communication unit. The communication between the exterior-vehicle communication device 1 and the program providing device S1 is performed via an external network such as a public line network or the Internet.

[0036] The input / output I / F of the extra-vehicle communication device 1 is a communication interface for, for example, serial communication with the in-vehicle device 2. The extra-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via a harness such as a serial cable connected between the input / output I / Fs. In this embodiment, the extra-vehicle communication device 1 is a device separate from the in-vehicle device 2, and these devices are communicatively connected by the input / output I / F or the like, but this is not limiting. The extra-vehicle communication device 1 may be built into the in-vehicle device 2 as one component of the in-vehicle device 2.

[0037] The in-vehicle device 2 includes a control unit 20, a storage unit 21, and an in-vehicle communication unit 23. The in-vehicle device 2 is configured to acquire, from the outside-vehicle communication device 1, an update program (package) that the outside-vehicle communication device 1 has received from the program providing device S1 via wireless communication, and transmit the update program to a predetermined in-vehicle ECU 3 (an in-vehicle ECU 3 to be updated) via the in-vehicle LAN 4. That is, the in-vehicle device 2 functions as an OTA master (repro master) that controls program updates in the in-vehicle ECU 3 to be updated.

[0038] The in-vehicle device 2 is a gateway (in-vehicle relay device) that manages a plurality of buses (segments) such as an in-vehicle ECU 3 of a control system, an in-vehicle ECU 3 of a safety system, and an in-vehicle ECU 3 of a body system, and relays communication between the in-vehicle ECUs 3 between these buses (segments). That is, the in-vehicle device 2 functions as a CAN gateway in relaying the CAN protocol, and functions as a layer 2 switch or a layer 3 switch in relaying the TCP / IP protocol. The in-vehicle device 2 may be a PLB (Power Lan Box) that functions as a power distribution device that distributes and relays power output from a power supply device such as a secondary battery and supplies power to an in-vehicle device such as an actuator connected to the in-vehicle device itself, in addition to relaying communication. Alternatively, the in-vehicle device 2 may be configured as one functional part of a body ECU that controls the entire vehicle C. Alternatively, the in-vehicle device 2 may be an integrated ECU that is configured as a central control device such as a vehicle computer and performs overall control of the vehicle.

[0039] The control unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and is configured to perform various control processing, calculation processing, etc. by reading and executing a control program P (program product) and data pre-stored in the memory unit 21.

[0040] The storage unit 21 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, and stores a control program and data to be referenced during processing in advance. The control program P (program product) stored in the storage unit 21 may be a control program P (program product) read from a recording medium 211 readable by the in-vehicle device 2. Alternatively, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0041] Furthermore, vehicle configuration information that aggregates configuration information of each vehicle-mounted ECU mounted on the vehicle is stored in the storage unit 21. The vehicle configuration information includes, for example, the manufacturing number (serial number) of each vehicle-mounted ECU, ECU part number (model number), Software part number, current version of the program, old version, number of operating aspects, operating aspects, MAC (Media Access Control) address, IP address, previous update completion date and time, repro status, and VIN (Vehicle Identification Number).

[0042] The storage unit 21 stores relay path information (routing table) used in relay processing for communication between the in-vehicle ECUs 3 or communication between the in-vehicle ECUs 3 and the external server 100. The format of the relay path information is determined based on the communication protocol. When the communication protocol is CAN, the CAN relay path information includes a message identifier (CAN-ID) included in the CAN message and a relay destination (I / O port number of the CAN communication unit 232) associated with the CAN-ID. When the communication protocol is TCP / IP, the TCP / IP relay path information includes a destination address (MAC address or IP address) included in the IP packet and a relay destination (physical port number of the Ethernet communication unit 231) associated with the destination address. The relay path information (routing table) may be included in the vehicle configuration information.

[0043] The storage unit 21 further stores a relay log collected when relaying communication between a plurality of vehicle-mounted ECUs. The relay log includes, for example, header information (source address, destination address, message ID, etc.) of the Ethernet frame or CAN message to be relayed, payload information, transmission / reception frequency or period, and other data, and a timestamp indicating the communication history may be associated with the data. As a result, the relay log can be used as data indicating the communication state and communication history in the actual operating environment (actual vehicle environment) of the vehicle in which the vehicle-mounted device is mounted.

[0044] The input / output I / F 22 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. Through the input / output I / F 22, the in-vehicle device 2 is communicatively connected to the exterior communication device 1, a display device 5 (HMI device), and an IG switch 6 that starts and stops the vehicle C.

[0045] The in-vehicle communication unit 23 is an input / output interface (CAN transceiver, Ethernet PHY unit) using a communication protocol such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate), or Ethernet (registered trademark), and functions as a communication unit for communication between the in-vehicle device 2 and the in-vehicle ECU 3. A plurality of in-vehicle communication units 23 are provided, and each of the in-vehicle communication units 23 is connected to a communication line 41 (Ethernet cable, CAN bus) constituting the in-vehicle network 4, that is, each bus. By providing a plurality of in-vehicle communication units 23 in this way, the in-vehicle network 4 may be divided into a plurality of buses (segments), and the in-vehicle ECU 3 may be connected to each segment according to the function of the in-vehicle ECU 3. The control unit 20 of the in-vehicle device 2 communicates with the in-vehicle ECU 3 connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0046] The in-vehicle ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown) similar to the in-vehicle device 2. The storage unit is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read only memory (ROM), an electrically erasable programmable ROM (EEPROM) or a flash memory, and stores a program or data of the in-vehicle ECU 3. This program or data is to be updated by an update program transmitted from a program providing device and relayed by the in-vehicle device 2. The in-vehicle communication unit of the in-vehicle ECU 3 is configured with, for example, a CAN transceiver or an Ethernet PHY unit similar to the in-vehicle device 2, and communicates with the in-vehicle device 2 via the in-vehicle communication unit.

[0047] The display device 5 is, for example, an HMI (Human Machine Interface) device such as a display of a car navigation system. The display device 5 is communicatively connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the control unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0048] FIG. 3 shows the in-vehicle device 2 and the update subject 1 is an explanatory diagram illustrating a process flow (sequence) by the in-vehicle ECU 3, etc. When performing a process related to a program update in the in-vehicle ECU 3 to be updated using an update program, the process sequences of the program providing device S1 (OTA server), the in-vehicle device 2 (OTA master), and the in-vehicle ECU 3 to be updated (target ECU) will be described.

[0049] The in-vehicle device 2 outputs (transmits) vehicle configuration information of the vehicle C (own vehicle) to the program providing device S1 (S01). The in-vehicle device 2 constantly acquires program information and model information applied to each in-vehicle ECU 3 from each in-vehicle ECU 3, and generates and stores the vehicle configuration information by aggregating this information. The in-vehicle device 2 may include a VIN (Vehicle Identification Number) in the vehicle configuration information.

[0050] The program providing device S1 generates a package including the update program and the operation check scenario (S02). The program providing device S1 generates the package based on the vehicle configuration information acquired from the in-vehicle device 2. The package includes package information (campaign information) that is information related to the program update, information related to the in-vehicle ECU 3 to be updated (target information), subjectThe program providing device S1 generates an operation check scenario conforming to the actual environment of the vehicle C in which the in-vehicle device 2 is mounted, based on the vehicle configuration information transmitted from the in-vehicle device 2. The program providing device S1 outputs (transmits) the generated package to the in-vehicle device 2 (S03).

[0051] The in-vehicle device 2 stores the package acquired (received) from the program providing device S1 in the storage unit S11 (S04). The in-vehicle device 2 may shift (transition) from a normal mode (a state during normal operation of the vehicle C) to an update mode by acquiring the package from the program providing device S1. The in-vehicle device 2 outputs (transmits) the update program and the operation check scenario included in the package to the in-vehicle ECU 3 to be updated (S05).

[0052] The in-vehicle ECU 3 to be updated stores the update program and the operation check scenario acquired (received) from the in-vehicle device 2 in the storage unit (S06). Upon receiving the update program and the operation check scenario from the in-vehicle ECU 3 to be updated, the in-vehicle ECU 3 to be updated transitions (transitions) to the update mode.

[0053] The storage unit of the in-vehicle ECU 3 to be updated includes a first storage area in which a program currently being applied (a current version of the program) is stored, and a second storage area in which a program previously applied (an old version of the program) is stored. The in-vehicle ECU 3 to be updated may store the update program and the operation check scenario acquired from the in-vehicle device 2 in the second storage area, thereby saving (storing) the update program and the like without overwriting the current version of the program stored in the first storage area. The in-vehicle ECU 3 to be updated can reliably perform rollback processing to revert to the old version of the program by providing a dual storage unit having the first storage area and the second storage area.

[0054] After the IG switch 6 of the vehicle C is turned off, the in-vehicle device 2 issues an activation request (an instruction to apply the update program) to the in-vehicle ECU 3 to be updated (S07). After the IG switch 6 of the vehicle C is turned off, the in-vehicle device 2 issues an activation request (an instruction to apply the update program) by, for example, transmitting a control signal (activation request signal) to the in-vehicle ECU 3 to be updated. Although the activation request is triggered by the IG switch 6 being turned off in the above description, this is not limited thereto, and the in-vehicle device 2 may issue an activation request triggered by preset scheduling information, multicast of a sleep signal, or the like.

[0055] In response to the activation request from the in-vehicle device 2, the in-vehicle ECU 3 to be updated switches from the currently applied program to the update program (S08). The in-vehicle ECU 3 to be updated outputs (transmits) information indicating the switch to the update program (activation result) to the in-vehicle device 2 (S09). As described above, the in-vehicle ECU 3 to be updated has a two-sided storage unit having a first storage area and a second storage area, and switches to the update program by enabling (activating) the second storage area in which the update program is stored.

[0056] The in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to transition to the operation check mode (S10) in accordance with the operation check scenario stored in the storage unit 21. The in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to transition to the operation check mode, for example, by transmitting a control signal (operation check mode transition signal) to the in-vehicle ECU 3 to be updated.

[0057] The in-vehicle ECU 3 to be updated transitions (transitions) to the operation check mode in response to a transition request from the in-vehicle device 2 to the operation check mode (S11). The in-vehicle ECU 3 to be updated that has transitioned to the operation check mode executes the update program based on the operation check scenario. The operation check scenario includes a sequence related to a self-diagnosis process (single unit diagnosis) performed within its own ECU (in the in-vehicle ECU 3 to be updated). The in-vehicle ECU 3 to be updated that has transitioned to the operation check mode performs a self-diagnosis process (single unit diagnosis) within its own ECU based on the operation check scenario.

[0058] The in-vehicle device 2 outputs (transmits) operation check data to the in-vehicle ECU 3 to be updated based on the operation check scenario (S12). When outputting the operation check data to the in-vehicle ECU 3 to be updated, the in-vehicle device 2 substitutes for another in-vehicle ECU 3 with which the in-vehicle ECU 3 to be updated normally communicates. When substituting for another in-vehicle ECU 3, the in-vehicle device 2 may transmit an Ethernet frame with the IP address of the other in-vehicle ECU 3 as a source address. Alternatively, when substituting for another in-vehicle ECU 3, the in-vehicle device 2 may transmit a CAN message including a CAN-ID used by the other in-vehicle ECU 3.

[0059] The in-vehicle ECU 3 to be updated outputs (transmits) response data to the in-vehicle device 2 in response to the operation check data transmitted from the in-vehicle device 2 that has replaced the other in-vehicle ECU 3 (S13). A processing sequence involving data transmission and reception between the in-vehicle device 2 that has replaced the other in-vehicle ECU 3 and the in-vehicle ECU 3 to be updated is performed based on an operation check scenario. In this processing sequence, control of sensors or actuators connected to the in-vehicle ECU 3 to be updated may be omitted or disabled. The in-vehicle device 2 and the in-vehicle ECU 3 to be updated may store response values ​​or measured values ​​(actual values) such as communication traffic volume in the processing sequence involving data transmission and reception, and save them as operation check results.

[0060] The in-vehicle ECU 3 to be updated outputs (transmits) to the in-vehicle device 2 the result of the standalone diagnosis and the result of the operation check performed by transmitting and receiving data to and from the in-vehicle device 2 (S14). The operation check scenario includes standalone diagnosis determination information for determining the result of the standalone diagnosis. The standalone diagnosis determination information is expected values ​​for a process list, CPU usage, memory usage, and the like that are generated in the in-vehicle ECU 3 to be updated when the update program is executed (activated).

[0061] The in-vehicle ECU 3 to be updated judges the result of the unit diagnosis by comparing various actual measured values ​​in the result of the unit diagnosis with various expected values ​​in the judgment information for the unit diagnosis. If the actual measured values ​​in the result of the unit diagnosis match the expected values ​​in the judgment information for the unit diagnosis, the in-vehicle ECU 3 to be updated judges that the result of the unit diagnosis performed based on the operation check scenario is positive (the program update is successful). If the actual measured values ​​in the result of the unit diagnosis do not match the expected values ​​in the judgment information for the unit diagnosis, the in-vehicle ECU 3 to be updated judges that the result of the unit diagnosis performed based on the operation check scenario is negative (the program update is unsuccessful).

[0062] The in-vehicle device 2 stores the results of the operation check performed by transmitting and receiving data to and from the in-vehicle ECU 3 to be updated in the storage unit 21 (S15). The in-vehicle device 2 stores the results of the operation check output from the in-vehicle ECU 3 to be updated in the storage unit 21. Furthermore, the in-vehicle device 2 also stores in the storage unit 21 the results of the operation check verified by the in-vehicle device 2 itself.

[0063] Based on the judgment information included in the operation check scenario, the in-vehicle device 2 compares the judgment information included in the operation check scenario with various values ​​(measured values, actual values) included in the operation check result to judge whether the program update in the in-vehicle ECU 3 to be updated has been successful (S16). The judgment information includes, for example, an expected value for response data from the in-vehicle ECU 3 to be updated in response to operation check data transmitted from the in-vehicle device 2 substituting for another in-vehicle ECU 3 to the in-vehicle ECU 3 to be updated. The expected value for the response data is, for example, the presence or absence of response data, its type (header information), data length, payload information, and a reply response value of the response data.

[0064] In transmitting and receiving data to and from the in-vehicle ECU 3 to be updated, the in-vehicle device 2 verifies the result of the operation check by comparing actual values ​​such as the presence or absence of response data from the in-vehicle ECU 3 to be updated, the data length, or the return response value with the determination information (expected value for the response data) included in the operation check scenario. If the response data from the in-vehicle ECU 3 to be updated matches the determination information, i.e., the expected value (expected value for the response data) defined in the operation check scenario, the in-vehicle device 2 determines that the result of the operation check performed based on the operation check scenario is positive (the program update is successful). If the response data from the in-vehicle ECU 3 to be updated does not match the determination information, i.e., the expected value (expected value for the response data) defined in the operation check scenario, the in-vehicle device 2 determines that the result of the operation check performed based on the operation check scenario is negative (the program update is unsuccessful).

[0065] Furthermore, the in-vehicle device 2 judges whether or not the program update in the in-vehicle ECU 3 to be updated has been successful (success or failure) based on the result of the unit diagnosis acquired from the in-vehicle ECU 3 to be updated and the result of the operation check by data transmission and reception with the in-vehicle device 2. That is, the in-vehicle device 2 judges whether or not the program update in the in-vehicle ECU 3 to be updated has been successful based on three check results, namely, the result of the operation check regarding the transmission and reception of the operation check data from the in-vehicle device 2, the result of the operation check regarding the transmission and reception of the operation check data from the in-vehicle ECU 3, and the result of the unit diagnosis in the in-vehicle ECU 3. If all the three check results are positive, the in-vehicle device 2 judges that the program update in the in-vehicle ECU 3 to be updated has been successful. By acquiring such three check results in the actual vehicle environment, it is possible to improve the accuracy of the judgment of the success or failure of the program update.

[0066] When it is determined that the program update has been successful, the in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to transition to the normal mode (S17). The in-vehicle ECU 3 to be updated transitions (transitions) to the normal mode in response to the transition request to the normal mode from the in-vehicle device 2 (S18). When the in-vehicle ECU 3 to be updated receives the transition request to the normal mode from the in-vehicle device 2, the program update in the in-vehicle ECU 3 to be updated is completed, and the in-vehicle ECU 3 transitions (transitions) to a state (normal mode) in which control is performed in a normal mode when the vehicle C is traveling, etc.

[0067] If at least one of the three check results is negative, the in-vehicle device 2 determines that the program update in the in-vehicle ECU 3 to be updated has failed. If it is determined that the program update has failed, the in-vehicle device 2 may request a rollback process from the in-vehicle ECU 3 to be updated. The in-vehicle device 2 may determine whether to perform a rollback process or transition to a degenerate mode based on these three check results. The in-vehicle device 2 may output a message to the display device 5, for example, to the effect that the program update has failed, to notify an operator of the vehicle C, etc.

[0068] The in-vehicle device 2 outputs (transmits) the results of the operation check based on the operation check scenario to the program providing device S1 (S19). The program providing device S1, which has acquired the results of the operation check output from the in-vehicle device 2, stores the results in its own storage unit S11. This makes it possible to achieve consistency (synchronization) of information relating to package-based program updates between the in-vehicle device 2 and the program providing device S1.

[0069] 4 is a flowchart illustrating the processing of the control unit 20 of the in-vehicle device 2. The control unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a start-up state (IG switch 6 is on).

[0070] The control unit 20 of the in-vehicle device 2 outputs (transmits) vehicle configuration information of the vehicle C (own vehicle) to the program providing device S1 (S101). The output of the vehicle configuration information by the control unit 20 of the in-vehicle device 2 to the program providing device S1 is not limited to when performing a program update process for the in-vehicle ECU 3, and the output of the vehicle configuration information may be performed constantly. In other words, the control unit 20 of the in-vehicle device 2 constantly or periodically acquires program information and model information applied to the in-vehicle ECU 3 from all in-vehicle ECUs 3 mounted on the vehicle C (own vehicle), and stores the acquired and aggregated information as vehicle configuration information. The control unit 20 of the in-vehicle device 2 constantly or periodically transmits the vehicle configuration information including the VIN to the program providing device S1. Send to In this way, the program providing device S1 identifies a target vehicle C based on vehicle configuration information including a VIN, and creates a package according to the identified vehicle C. The package created by the program providing device S1 includes package information (campaign information) that is information related to a program update, information related to the in-vehicle ECU 3 to be updated (target information), an update program (update data), and an operation check scenario.

[0071] The control unit 20 of the in-vehicle device 2 acquires a package including an update program and an operation check scenario from the program providing device S1 (S102). The control unit 20 of the in-vehicle device 2 communicates with the program providing device S1 via the external communication device 1 and acquires the package from the program providing device S1. The control unit 20 of the in-vehicle device 2 stores the acquired package in the storage unit 21.

[0072] The control unit 20 of the in-vehicle device 2 outputs the update program and the operation check scenario to the in-vehicle ECU 3 to be updated (S103). By outputting the operation check scenario to the in-vehicle ECU 3 to be updated, the operation check scenario is shared by the in-vehicle device 2 and the in-vehicle ECU 3 to be updated. In other words, the in-vehicle device 2 and the in-vehicle ECU 3 to be updated can perform processing related to operation check based on the same operation check scenario. The control unit 20 of the in-vehicle device 2 may output an activation request indicating that the update program is to be applied to the in-vehicle ECU 3 in addition to outputting the update program and the operation check scenario to the in-vehicle ECU 3 to be updated.

[0073] The control unit 20 of the in-vehicle device 2 outputs a request to transition to the operation check mode to the in-vehicle ECU 3 to be updated (S104). The in-vehicle ECU 3 to be updated that has acquired (received) the request to transition to the operation check mode from the in-vehicle device 2 starts executing an operation check based on the operation check scenario when applying the update program.

[0074] The control unit 20 of the in-vehicle device 2 outputs operation check data to the in-vehicle ECU 3 to be updated based on the operation check scenario (S105). In a normal state (normal mode) such as when the vehicle C is running, the target of data communication for the in-vehicle ECU 3 to be updated is not the in-vehicle device 2 but the other in-vehicle ECU 3. In contrast, in the operation check scenario, the in-vehicle device 2 substitutes the other in-vehicle ECU 3 to simulate the operation mode of the other in-vehicle ECU 3. As a result, the in-vehicle ECU 3 to be updated in the operation check mode executes a series of processing sequences including data transmission and reception with the in-vehicle device 2 that has substituted the other in-vehicle ECU 3. Based on the operation check scenario, the control unit 20 of the in-vehicle device 2 outputs operation check data to the in-vehicle ECU 3 to be updated, and the in-vehicle ECU 3 to be updated also outputs response data based on the operation check scenario. That is, the control unit 20 of the in-vehicle device 2 and the in-vehicle ECU 3 to be updated start transmitting and receiving data conforming to the actual vehicle environment based on the same operation check scenario.

[0075] The control unit 20 of the in-vehicle device 2 acquires the result of the operation check based on the operation check scenario (S106). The in-vehicle ECU 3 to be updated outputs the result of the standalone diagnosis and the result of the operation check related to the transmission and reception of the data for operation check from its own ECU side to the in-vehicle device 2. The control unit 20 of the in-vehicle device 2 acquires these results from the in-vehicle ECU 3 to be updated. Furthermore, the control unit 20 of the in-vehicle device 2 acquires the result of the operation check related to the transmission and reception of the data for operation check from its own device side. As described above, in the operation check performed based on the operation check scenario, various actual measurement values ​​are stored in the storage unit 21 of the in-vehicle device 2. The control unit 20 of the in-vehicle device 2 acquires the result of the operation check related to the transmission and reception of the data for operation check from its own device side by referring to the storage unit 21 of its own device. That is, the control unit 20 of the in-vehicle device 2 acquires these three operation check results.

[0076] The control unit 20 of the in-vehicle device 2 determines whether the program update in the in-vehicle ECU 3 to be updated has been successful (S107). The operation check scenario includes determination information for determining the result of the operation check. The control unit 20 of the in-vehicle device 2 determines whether the program update has been successful by comparing various actual measurement values, which are the acquired results of the operation check, with the expected values ​​included in the determination information. For example, if all the actual measurement values ​​are within the range of the expected values, the control unit 20 of the in-vehicle device 2 determines that the program update has been successful. For example, if all the actual measurement values ​​are not within the range of the expected values, the control unit 20 of the in-vehicle device 2 determines that the program update has failed.

[0077] If the program update is successful (S107: YES), the control unit 20 of the in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to transition to the normal mode (S108). If it is determined that the program update is successful, the control unit 20 of the in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to transition to the normal mode, for example, by outputting a control signal (normal mode transition signal) to the in-vehicle ECU 3 to be updated. The in-vehicle ECU 3 to be updated that has received the request to transition to the normal mode transitions to the normal mode.

[0078] If the program update is not successful (S107: NO), that is, if the program update fails, the control unit 20 of the in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to perform rollback processing (S1071). If it is determined that the program update has failed, the control unit 20 of the in-vehicle device 2 requests rollback processing by, for example, outputting a control signal (rollback signal) to the in-vehicle ECU 3 to be updated. Alternatively, the control unit 20 of the in-vehicle device 2 may determine whether to request rollback processing or to transition to degenerate mode, depending on the state of the result of the operation check.

[0079] The control unit 20 of the in-vehicle device 2 outputs (transmits) the result of the operation check based on the operation check scenario to the program providing device S1 (S109). The control unit 20 of the in-vehicle device 2 outputs (transmits) the result of the operation check based on the operation check scenario to the program providing device S1 via the external vehicle communication device 1. Alternatively, the control unit 20 of the in-vehicle device 2 may output the result of the operation check based on the operation check scenario to the display device 5 and notify the operator of the vehicle C, etc. of the result.

[0080] According to this embodiment, the in-vehicle ECU 3 to be updated and the in-vehicle device 2 perform operation check of the in-vehicle ECU 3 to which the update program has been applied (the in-vehicle ECU 3 to be updated) based on the same operation check scenario, and operation check can be efficiently performed in the actual environment of the vehicle C in which the in-vehicle ECU 3 and the in-vehicle device 2 are installed. In the processing sequence of operation check based on the operation check scenario, the in-vehicle device 2 substitutes for another in-vehicle ECU 3 other than the in-vehicle ECU 3 to be updated, so that the in-vehicle ECU 3 to be updated can perform pseudo data transmission with the other in-vehicle ECU 3, and operation check in line with the actual environment of the vehicle C can be efficiently performed.

[0081] (Embodiment 2) 5 is a flowchart illustrating the processing of the control unit 20 of the in-vehicle device 2 according to the second embodiment. The control unit 20 of the in-vehicle device 2 outputs (transmits) vehicle configuration information of the vehicle C (host vehicle) to the program providing device S1 (S201). The control unit 20 of the in-vehicle device 2 acquires a package including an update program and an operation check scenario from the program providing device S1 (S202). The control unit 20 of the in-vehicle device 2 performs the processing of S201 and S202 similarly to the processing of S101 and S102 of the first embodiment.

[0082] The control unit 20 of the in-vehicle device 2 complements the operation check scenario by using a relay log collected when relaying communication between the multiple in-vehicle ECUs 3 (S203). The in-vehicle device 2 includes multiple in-vehicle communication units 23, and functions as an in-vehicle relay device that relays communication between the in-vehicle ECUs 3 connected to these in-vehicle communication units 23. When relaying communication between the in-vehicle ECUs 3, the control unit 20 of the in-vehicle device 2 stores a relay log in the storage unit 21 based on the data (Ether Frame, CAN message) that was the subject of the relay. The relay log includes, for example, header information (source address, destination address, message ID, etc.) of the Ethernet frame or CAN message that was the subject of the relay, payload information, transmission and reception frequency or period, etc., and is data indicating the communication state in the actual operating environment (actual vehicle environment) of the vehicle C in which the in-vehicle device 2 is installed.

[0083] The control unit 20 of the in-vehicle device 2 uses the relay log to add or modify sequences related to data transmission and reception included in the operation check scenario, thereby complementing the operation check scenario generated by the program providing device S1 to make it more suited to the actual vehicle environment. The control unit 20 of the in-vehicle device 2 performs subsequent processing using the complemented operation check scenario. That is, in the subsequent processing, the operation check scenario used by the control unit 20 of the in-vehicle device 2 and the in-vehicle ECU 3 to be updated is the operation check scenario complemented using the relay log.

[0084] The control unit 20 of the in-vehicle device 2 outputs the update program and the operation check scenario to the in-vehicle ECU 3 to be updated (S204). The control unit 20 of the in-vehicle device 2 performs the process of S204 similarly to the process of S103 in the first embodiment.

[0085] The control unit 20 of the in-vehicle device 2 outputs a sleep signal to the other in-vehicle ECUs 3 other than the in-vehicle ECU 3 to be updated (S205). The control unit 20 of the in-vehicle device 2 can grasp all in-vehicle ECUs 3 mounted on the vehicle C (own vehicle) by, for example, referring to vehicle configuration information or a routing table used for relay processing. The control unit 20 of the in-vehicle device 2 identifies the other in-vehicle ECUs 3 other than the in-vehicle ECU 3 to be updated among all in-vehicle ECUs 3 mounted on the vehicle C (own vehicle). The control unit 20 of the in-vehicle device 2 outputs (transmits) a sleep signal to the identified other in-vehicle ECUs 3 to transition to a sleep mode. The other in-vehicle ECUs 3 that receive the sleep signal transition to the sleep mode to stop processing such as data transmission and reception. This makes it possible to perform the program update processing on the in-vehicle ECU 3 to be updated while preventing the occurrence of an influence on the other in-vehicle ECUs other than the in-vehicle ECU 3 to be updated. Although the control unit 20 of the in-vehicle device 2 is described as outputting a sleep signal, this is not limited to the above, and the control unit 20 of the in-vehicle device 2 may restrict communication between the in-vehicle ECU 3 to be updated and other in-vehicle ECUs 3 by stopping relay processing in the in-vehicle device 2 itself.

[0086] The control unit 20 of the in-vehicle device 2 outputs a request to the in-vehicle ECU 3 to be updated to transition to the operation check mode (S206). The control unit 20 of the in-vehicle device 2 outputs operation check data to the in-vehicle ECU 3 to be updated based on the operation check scenario (S207). The control unit 20 of the in-vehicle device 2 acquires the result of the operation check based on the operation check scenario (S208). The control unit 20 of the in-vehicle device 2 determines whether the program update in the in-vehicle ECU 3 to be updated is successful (S209). If the program update is successful (S209: YES), the control unit 20 of the in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to transition to the normal mode (S210). If the program update is not successful (S209: NO), that is, if the program update has failed, the control unit 20 of the in-vehicle device 2 requests the in-vehicle ECU 3 to be updated to perform rollback processing (S2091). The control unit 20 of the in-vehicle device 2 outputs (transmits) the result of the operation check based on the operation check scenario to the program providing device S1 (S211). The control unit 20 of the in-vehicle device 2 performs the processes from S206 to S211, similar to the processes from S104 to S109 in the first embodiment.

[0087] According to this embodiment, the in-vehicle device 2 can improve the compatibility of the operation check scenario with the actual environment of the vehicle by supplementing the operation check scenario acquired from the external server by using the relay log obtained when the relay process was performed. By using the operation check scenario with improved compatibility with the actual environment of the vehicle in this way (complemented operation check scenario), the accuracy of the operation check when the update program is applied to the in-vehicle ECU 3 to be updated can be improved.

[0088] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present disclosure is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims. [Explanation of symbols]

[0089] C Vehicle S In-vehicle update system S1 Program provision device S11 storage section 1. External communication device 11 Antenna 2 Onboard equipment 20 Control section 21 Memory section 211 Recording media P Control program (program product) 22 Input / Output Interface 23 In-vehicle communication unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication Line 5 Display device 6. IG Switch

Claims

1. An in-vehicle device that acquires an update program transmitted from an external server outside the vehicle and performs a process for updating a program of an in-vehicle ECU mounted in the vehicle, a control unit that processes the update program, The control unit is When acquiring the update program, an operation check scenario for performing an operation check on the in-vehicle ECU to be updated is acquired from the external server; outputting the acquired update program and the operation check scenario to the in-vehicle ECU to be updated; Based on the operation check scenario, a process for checking the operation of the in-vehicle ECU to be updated is performed; complementing the operation check scenario acquired from the external server using a relay log collected when relaying communication between a plurality of on-board ECUs mounted in the vehicle; outputting the acquired update program and the complemented operation check scenario to the in-vehicle ECU to be updated; Based on the supplemented operation check scenario, a process for checking the operation of the in-vehicle ECU to be updated is performed. In-vehicle device.

2. The control unit performs a process for checking the operation of the in-vehicle ECU to be updated by substituting another in-vehicle ECU other than the in-vehicle ECU to be updated based on the operation check scenario. The in-vehicle device according to claim 1 .

3. The operation check scenario is as follows: a processing sequence in which the control unit substituting for the other in-vehicle ECU transmits data to the in-vehicle ECU to be updated; a processing sequence in which the in-vehicle ECU to be updated, to which the update program has been applied, transmits data to the other in-vehicle ECU replaced by the control unit. The vehicle-mounted device according to claim 2 .

4. The operation check scenario includes determination information for determining a result of an operation check on the in-vehicle ECU to be updated, The control unit is performing a process for checking the operation of the in-vehicle ECU to be updated, and acquiring a result of the check; Based on the acquired operation check result and the determination information included in the operation check scenario, it is determined whether the program update in the vehicle-mounted ECU to be updated has been successful. The in-vehicle device according to any one of claims 1 to 3.

5. The control unit is obtaining, from the in-vehicle ECU to be updated, a result of a standalone diagnosis performed by the in-vehicle ECU to be updated based on the operation check scenario; Based on the acquired result of the unit diagnosis, it is determined whether the program update in the vehicle-mounted ECU to be updated has been successful. The vehicle-mounted device according to claim 4.

6. The control unit performs a process for checking the operation of the in-vehicle ECU to be updated based on the operation check scenario when an IG switch of the vehicle is turned off. The in-vehicle device according to any one of claims 1 to 5.

7. The control unit is outputting a sleep signal to other in-vehicle ECUs other than the in-vehicle ECU to be updated, for transitioning the other in-vehicle ECUs to a sleep mode; After outputting the sleep signal, a process for checking the operation of the in-vehicle ECU to be updated is performed based on the operation check scenario. The in-vehicle device according to any one of claims 1 to 6.

8. A computer that receives an update program transmitted from an external server outside the vehicle and performs processing to update a program of an on-board ECU installed in the vehicle. When acquiring the update program, an operation check scenario for performing an operation check on the in-vehicle ECU to be updated is acquired from the external server; outputting the acquired update program and the operation check scenario to the in-vehicle ECU to be updated; Based on the operation check scenario, a process for checking the operation of the in-vehicle ECU to be updated is performed; complementing the operation check scenario acquired from the external server using a relay log collected when relaying communication between a plurality of on-board ECUs mounted in the vehicle; outputting the acquired update program and the complemented operation check scenario to the in-vehicle ECU to be updated; Based on the supplemented operation check scenario, a process for checking the operation of the in-vehicle ECU to be updated is performed. A program that executes a process.

9. A computer that receives an update program transmitted from an external server outside the vehicle and performs processing to update a program of an on-board ECU installed in the vehicle. When acquiring the update program, an operation check scenario for performing an operation check on the in-vehicle ECU to be updated is acquired from the external server; outputting the acquired update program and the operation check scenario to the in-vehicle ECU to be updated; Based on the operation check scenario, a process for checking the operation of the in-vehicle ECU to be updated is performed; complementing the operation check scenario acquired from the external server using a relay log collected when relaying communication between a plurality of on-board ECUs mounted in the vehicle; outputting the acquired update program and the complemented operation check scenario to the in-vehicle ECU to be updated; Based on the supplemented operation check scenario, a process for checking the operation of the in-vehicle ECU to be updated is performed. A method for updating a program that executes a process.

Images