Relay device, program, and program update method

Abstract

To provide a relay device, a program, and a program update method capable of efficiently performing processing for updating a program of an on-vehicle ECU.SOLUTION: A relay device, which acquires an update program transmitted from an out-vehicle device S1 and performs processing for updating a program of an on-vehicle ECU installed on a vehicle, includes a control unit that performs relay processing between on-vehicle ECUs and a storage unit that stores a relay processing program used when performing the relay processing and a switching program for switching between the relay processing and the update processing. The control unit that is executing the switching program acquires the update processing program for performing the update processing from the out-vehicle device, stores the acquired update processing program in the storage unit storing the relay processing program, and executes the update processing program stored in the storage unit. The control unit that is executing the update processing program outputs the update program acquired from the out-vehicle device to the on-vehicle ECU 3 to be updated.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a relay device, a program, and a program update method. [Background technology]

[0002] A vehicle is equipped with an ECU (Electronic Control Unit) for controlling in-vehicle devices such as drive control systems (e.g., engine control) and body systems (e.g., air conditioning control). The ECU includes a processing unit such as an MPU, a rewritable nonvolatile storage unit such as RAM, and a communication unit for communicating with other ECUs, and controls the in-vehicle devices by reading and executing control programs stored in the storage unit. The vehicle is also equipped with a communication device with wireless communication capabilities, and can communicate with a program provider connected to a network outside the vehicle via the communication device, download (receive) a control program for the ECU from the program provider, and update the control program for the ECU (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2017-97851 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the communication device (repeater) of Patent Document 1 has problems such as, for example, when the control program to be downloaded becomes large, the storage capacity of the storage unit in the communication device (repeater) must be increased, or when downloading the required control program, the control program must be downloaded in multiple parts and updated, which increases the time required for the entire update process.

[0005] An object of the present disclosure is to provide a relay device or the like that can efficiently perform a program update process when the program update process is performed for an in-vehicle ECU. [Means for solving the problem]

[0006] A relay device according to one aspect of the present disclosure is a relay device that acquires update programs transmitted from an external device and performs processing to update programs of on-board ECUs installed in a vehicle, and is equipped with a control unit that performs relay processing between the on-board ECUs, and a memory unit that stores a relay processing program used when performing the relay processing and a switching program for switching between the relay processing and the update processing. The control unit, while executing the switching program, acquires the update processing program for performing the update processing from the external device, stores the acquired update processing program in the memory unit using the memory area in which the relay processing program is stored, and executes the update processing program stored in the memory unit. The control unit, while executing the update processing program, outputs the update program acquired from the external device to the on-board ECU to be updated. [Effects of the Invention]

[0007] According to one aspect of the present disclosure, when a process for updating a program of an in-vehicle ECU is performed, a relay device or the like that efficiently performs the process for updating the program can be provided. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating the configuration of an in-vehicle update system including a relay device according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating a physical configuration of a relay device. [Figure 3] FIG. 10 is an explanatory diagram illustrating the state of a storage unit of a relay device. [Figure 4] 10 is a flowchart illustrating a process of a control unit of a relay device. [Figure 5]10 is a flowchart according to the second embodiment (compressing a non-general program portion). [Figure 6] FIG. 10 is a block diagram illustrating a physical configuration of a relay device according to a third embodiment (two-sided). [Figure 7] FIG. 10 is an explanatory diagram illustrating the state of a storage unit of a relay device. [Figure 8] 10 is a flowchart illustrating a process of a control unit of a relay device. DETAILED DESCRIPTION OF THE INVENTION

[0009] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. At least some of the embodiments described below may be combined in any desired manner.

[0010] (1) A relay device according to one aspect of the present disclosure is a relay device that receives update programs transmitted from an external device and performs processing to update programs of onboard ECUs installed in a vehicle, and includes a control unit that performs relay processing between the onboard ECUs, and a memory unit that stores a relay processing program used when performing relay processing and a switching program for switching between relay processing and update processing. The control unit, while executing the switching program, obtains the update processing program for performing the update processing from the external device, stores the obtained update processing program in the memory unit using the memory area in which the relay processing program is stored, and executes the update processing program stored in the memory unit. The control unit, while executing the update processing program, outputs the update program obtained from the external device to the onboard ECU to be updated.

[0011] In this aspect, the storage unit of the external device stores a control program executed by the control unit, and the control program includes a switching program (self-reproduction program) and a relay program. The relay processing program corresponds to a normal control program for executing functions during normal control in the vehicle, such as when the vehicle is running. When the control unit executes the relay processing program, the relay device enters a normal processing mode (relay processing mode). The control unit executes the switching program (self-reproduction program) in response to campaign information transmitted from, for example, an external server such as an OTA server or a program provider device (diagnosis device) used by an authorized dealer. These external servers (OTA servers) and program provider devices (diagnosis devices) correspond to external devices. When the control unit executes the switching program, the relay device transitions from the normal processing mode to the switching mode (self-reproduction mode). When the control unit executes the switching program (self-reproduction program), the control unit that transitions to the switching mode (the control unit executing the switching program) obtains an update processing program for performing an update process on the on-board ECU from the external device. The control unit executing the switching program transitions to the update processing mode by executing the acquired update processing program. The control unit executing the switching program stores the update processing program acquired from the external device in the storage unit using the storage area where the relay program is stored. That is, the control unit executing the switching program rewrites the relay program stored in the storage unit with the update processing program. This allows the storage area where the relay program that does not need to be executed during the update processing to be utilized, thereby securing the freed-up storage area (free space) as a buffer, and the update program acquired from the external device can be efficiently stored (buffered) in the buffer. By utilizing the storage area where the relay program that does not need to be executed during the update processing is stored as a buffer area in this way, even if the update program acquired from the external device becomes large, the increase in the capacity of the update program can be accommodated.This prevents the storage capacity of the storage unit from increasing, and also eliminates the need to download and process update programs multiple times, thereby reducing processing time.The control unit can also perform self-programming, which rewrites its own program while the program is running.

[0012] (2) In a relay device according to one embodiment of the present disclosure, a control unit executing the update processing program executes the switching program after completing the output of the update program to the vehicle ECU to be updated, and the control unit executing the switching program restores the relay processing program.

[0013] In this embodiment, the control unit executing the update processing program executes the switching program after completing the output of the update program to the new target in-vehicle ECU, thereby transitioning to the switching mode (self-replication mode). The control unit executing the switching program restores the update relay processing program and executes the restored relay processing program, thereby starting relay processing between the in-vehicle ECUs (transitioning to the normal processing mode).

[0014] (3) In a relay device according to one embodiment of the present disclosure, the control unit, while executing the switching program, stores the acquired update processing program in the memory unit by overwriting the memory area in which the relay processing program is stored, and restores the relay processing program by acquiring the overwritten relay processing program from the external vehicle device.

[0015] In this aspect, the control unit executing the switching program uses the storage area in which the relay processing program is stored to store the update processing program obtained from the external device in the storage unit, and even if the relay processing program is overwritten, the control unit can efficiently restore the relay processing program by obtaining the relay processing program from the external device. The overwriting process includes deleting the relay processing program from the storage area in which the relay processing program is stored to free up space, and then storing (writing) the update processing program in the freed up space.

[0016] (4) In a relay device according to one embodiment of the present disclosure, the control unit, while executing the switching program, compresses the relay processing program to free up the memory area in which the relay processing program was stored, and stores the acquired update processing program in the memory unit using the free space, and then decompresses the compressed relay processing program to restore the relay processing program.

[0017] In this aspect, when the control unit executing the switching program uses the storage area in which the relay processing program is stored to store the update processing program acquired from the external device in the storage unit, the control unit may, for example, compress the relay processing program to free up space in the storage area and store the program in this free space. Even in this case, the compressed relay processing program is stored in the storage unit, and the relay processing program can be efficiently restored by decompressing the compressed relay processing program.

[0018] (5) In one embodiment of the relay device of the present disclosure, the relay processing program includes a non-general program portion that is dependent on the vehicle and a general program portion that is not dependent on the vehicle, and the control unit executing the switching program compresses the non-general program portion to free up the memory area in which the non-general program portion was stored, stores the update processing program in the memory unit using the free area and the memory area in which the general program portion is stored, decompresses the compressed non-general program portion, and restores the relay processing program by obtaining the general program portion from the off-vehicle device.

[0019] In this aspect, a relay processing program including a vehicle-dependent non-general program portion and a vehicle-independent general program portion can be reduced in size by compressing the non-general program portion, thereby freeing up the storage area where the non-general program portion was stored. Furthermore, because the compressed non-general program portion is stored in the storage unit of the relay device, the non-general program portion can be restored by decompressing the compressed non-general program portion, eliminating the need to obtain the non-general program portion from an external device. Since the external device does not need to separately store and manage the vehicle-dependent non-general program portion, the complexity and cumbersomeness of storing and managing the relay processing program of the relay device in the external device can be alleviated. Furthermore, the vehicle-independent general program portion is stored in the external device as a common or standardized program, for example, for the same vehicle model or vehicle manufacturer. Therefore, the relay device (the control unit executing the switching program) can efficiently restore the general program portion by obtaining the general program portion from the external device.

[0020] (6) In a relay device according to one embodiment of the present disclosure, the memory unit includes a first memory unit in which a currently applied relay processing program is stored and a second memory unit in which a previously applied relay processing program is stored, and the control unit executing the switching program stores the acquired update processing program in the second memory unit.

[0021] In this aspect, the storage unit is configured as a two-sided storage unit including a first storage unit and a second storage unit. The first storage unit, which stores the currently applied switching program and relay processing program, functions as an active unit. The second storage unit, which stores the previously applied switching program and relay processing program, functions as an inactive unit. The control unit, while executing the switching program, stores the update processing program acquired from the external device in the inactive second storage unit, thereby maintaining the currently applied update processing program and relay processing program stored in the active first storage unit. This eliminates the need for the relay device to restore the relay processing program, such as by acquiring the relay processing program from an external server, when transitioning from the update processing mode to the normal processing mode.

[0022] (7) In a relay device according to one embodiment of the present disclosure, the control unit executing the switching program stores a portion of the update processing program in free space in the first memory unit, and stores the remainder of the update processing program in the second memory unit using the memory area in which the previously applied relay processing program is stored.

[0023] In this embodiment, the storage unit includes an area used as the operating surface and an area used as the non-operating surface, and the operating surface and the non-operating surface are configured to be switchable. That is, when the operating surface is the first storage unit, the non-operating surface becomes the second storage unit, and the operating surface becomes the first storage unit. 2In the case of a storage unit, the non-operating surface is the first storage unit. The control unit executing the switching program stores the update processing program using the free space in the operating surface and the storage area in the non-operating surface where the relay processing program is stored, thereby ensuring sufficient buffer space. When the operating surface and the non-operating surface are configured to be switchable in this manner, the first storage unit and the second storage unit may be divided into separate areas. Meanwhile, the control unit of the relay device may cancel or disable the division of the areas when storing the update processing program, and set the first storage unit and the second storage unit as logically continuous storage areas. This allows the update processing program to be stored using the free space in the first storage unit and the storage area (second storage unit) where the previous relay processing program is stored, ensuring sufficient buffer space for the update program to be applied to the in-vehicle ECU.

[0024] (8) In a relay device according to an aspect of the present disclosure, the switching program has a smaller program size than the relay processing program.

[0025] In this embodiment, the switching program has a smaller program size (data volume of the executable file) than the relay processing program, thereby preventing the free space in the storage unit from becoming too full. Furthermore, the switching program may have a smaller program size than the update processing program. In this way, the switching program may be configured with a minimum-configuration module specialized for switching between relay processing and update processing, thereby making the program size smaller than the relay processing program and the update processing program. This reduces the program size of the switching program stored in the storage unit, regardless of whether the control unit is executing relay processing (normal mode) or update processing (reproduction mode), thereby efficiently securing free space in the storage unit.

[0026] (9) A program according to one embodiment of the present disclosure acquires an update program transmitted from an external device, performs processing to update a program of an onboard ECU installed in a vehicle, and causes a computer having a memory unit storing a relay processing program used for performing relay processing and a switching program for switching between relay processing and update processing to execute the switching program, thereby acquiring an update processing program for performing update processing from the external device, storing the acquired update processing program in the memory unit using the memory area in which the relay processing program is stored, and executing the update processing program stored in the memory unit, thereby causing a control unit executing the update processing program to execute a process to output the update program acquired from the external device to the onboard ECU to be updated.

[0027] In this aspect, a program can be provided that causes a computer to function as a relay device that can efficiently perform a program update process when updating a program in an on-board ECU. This program corresponds to a control program stored in a storage unit of the computer, and the control program includes a switching program, a relay program, and an update program. These switching program, relay program, and update program may be executed in a chain by the computer to operate as a program (control program) that performs the series of processes in this aspect. Alternatively, the control program may include, in addition to the switching program, relay program, and update program, a program startup module that controls the start and stop of each of these programs, and the program startup module may control the series of processes in this aspect.

[0028] (10) A program update method according to one aspect of the present disclosure acquires an update program transmitted from an external device, performs processing to update a program of an onboard ECU installed in a vehicle, and causes a computer having a memory unit storing a relay processing program used for performing relay processing and a switching program for switching between relay processing and update processing to execute the switching program, thereby acquiring an update processing program for performing update processing from the external device, storing the acquired update processing program in the memory unit using the memory area in which the relay processing program is stored, and executing the update processing program stored in the memory unit, thereby causing a control unit executing the update processing program to execute processing to output the update program acquired from the external device to the onboard ECU to be updated.

[0029] In this aspect, an update method can be provided that causes a computer to function as a relay device that can efficiently perform the program update process when updating a program in an in-vehicle ECU.

[0030] [Details of the embodiments of the present disclosure] The present disclosure will be specifically described with reference to drawings showing embodiments thereof. A relay device 2 according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0031] (Embodiment 1) Hereinafter, embodiments will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating the configuration of an in-vehicle update system including a relay device 2 according to the first embodiment. Fig. 2 is a block diagram illustrating the physical configuration of the relay device 2. The in-vehicle update system S includes an exterior communication device 1 and a relay device 2 mounted on a vehicle C, and transmits update programs acquired from an external server S1 (program providing device, OTA server) connected via an exterior network N to an in-vehicle ECU3 (Electronic Control Unit) mounted on the vehicle C.

[0032] The external server S1 is a computer such as a server connected to an external network N, such as the Internet or a public line network. The external server S1 includes a storage unit S11 such as a random access memory (RAM), a read-only memory (ROM), or a hard disk. The external server S1 stores programs or data for controlling the in-vehicle ECU 3, which are created by the manufacturer of the in-vehicle ECU 3, in the storage unit S11. The programs or data are transmitted to the vehicle C as update programs, as described below, and are used to update the programs or data of the in-vehicle ECU 3 installed in the vehicle C. The external server S1 (program providing device) configured in this manner is also referred to as an OTA (Over-The-Air) server. The external server S1 corresponds to an external device that provides update programs, etc. The external device may be a program providing device (diagnosis device) used by an authorized dealer, etc. In other words, the external device that provides update programs, etc. to the relay device 2 may include the external server S1, such as an OTA server, and a program providing device, such as a diagnosis device.

[0033] The relay device 2 functions as an OTA master that transmits update programs acquired from the external server S1 to the in-vehicle ECU 3 to be updated, and transmits an activation instruction to apply the transmitted update programs to the in-vehicle ECU 3. The in-vehicle ECU 3 installed in the vehicle C acquires the update programs transmitted by wireless communication from the external server S1 via the relay device 2, and applies the update programs (activation processing) in response to the activation instruction, thereby updating (repro) the programs executed by the in-vehicle ECU 3 itself.

[0034] Hereinafter, the program will be described as including program code including control syntax and the like for the in-vehicle ECU 3 to perform processing, and an external file describing data referenced when the program code is executed. When transmitting an update program, the external file describing the program code and data is transmitted from the external server S1, for example, as an encrypted archive file. When transmitting an update program, the external server S1 may generate a package including the update program and transmit the generated package to the vehicle C. When there are multiple in-vehicle ECUs 3 to be updated, the external server S1 may generate a single package of update programs to be applied to each of the multiple in-vehicle ECUs 3.

[0035] When transmitting the update program, the external server S1 may transmit campaign information, which is information related to the program update, to the relay device 2. The relay device 2 can confirm the presence or absence of campaign information by communicating with the external server S1, and determine whether or not an update process is required in the vehicle in which the relay device 2 (its own device) is installed, based on the confirmation result. The campaign information includes information (target information) related to one or more in-vehicle ECUs 3 to be updated.

[0036] The vehicle C is equipped with an exterior communication device 1, a relay device 2, a display device 5, and a plurality of on-board ECUs 3 for controlling various on-board devices. The exterior communication device 1 and the relay device 2 are communicatively connected by a harness such as a serial cable. The relay device 2 and the on-board ECUs 3 are communicatively connected by an on-board network 4 that supports a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark).

[0037] The exterior-vehicle communication device 1 includes an exterior-vehicle communication unit (not shown) and an input / output I / F (not shown) (interface) for communicating with the relay device 2. The exterior-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as LTE (registered trademark), 4G, 5G, or WiFi (registered trademark), and transmits and receives data to and from an external server S1 via an antenna 11 connected to the exterior-vehicle communication unit. The communication between the exterior-vehicle communication device 1 and the external server S1 is performed via an external network N, such as a public line network or the Internet.

[0038] The input / output I / F of the exterior-vehicle communication device 1 is a communication interface for, for example, serial communication with the relay device 2. The exterior-vehicle communication device 1 and the relay device 2 communicate with each other via a harness such as a serial cable connected between the input / output I / Fs. In this embodiment, the exterior-vehicle communication device 1 is a separate device from the relay device 2, and these devices are communicatively connected by the input / output I / F or the like, but this is not limiting. The exterior-vehicle communication device 1 may be built into the relay device 2 as one component of the relay device 2. Alternatively, the exterior-vehicle communication device 1 and the relay device 2 may be connected by an in-vehicle network 4 such as a CAN.

[0039] The relay device 2 includes a control unit 20, a storage unit 23, an input / output I / F 21, and an in-vehicle communication unit 22. The relay device 2 is configured to acquire, from the outside-vehicle communication device 1, an update program (package) that the outside-vehicle communication device 1 has received from the external server S1 via wireless communication, and to transmit the update program to a predetermined in-vehicle ECU 3 (an in-vehicle ECU 3 to be updated) via the in-vehicle network 4. In other words, the relay device 2 functions as an OTA master (repro master) that controls program updates in the in-vehicle ECU 3 to be updated.

[0040] The relay device 2 is a gateway that manages multiple buses (segments), such as an on-board ECU 3 for a control system, an on-board ECU 3 for a safety system, and an on-board ECU 3 for a body system, and relays communications between the on-board ECUs 3 between these buses (segments). That is, the relay device 2 is connected to each of the communication lines 41 constituting the multiple buses (segments), and the multiple communication lines 41 (segments) aggregated by the relay device 2 form an on-board network 4. The relay device 2 functions as a CAN gateway when relaying the CAN or CAN-FD protocol, and as a Layer 2 switch or Layer 3 switch when relaying the TCP / IP protocol. The relay device 2 may be a power LAN box (PLB) that, in addition to relaying communications, also functions as a power distribution device that distributes and relays power output from a power supply device such as a secondary battery and supplies power to on-board devices such as actuators connected to the relay device. Alternatively, the relay device 2 may be configured as a functional part of a body ECU that controls the entire vehicle C. Alternatively, the relay device 2 may be an integrated ECU that is configured by a central control device such as a vehicle computer and performs overall control of the vehicle C.

[0041] The control unit 20 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and performs various control processes and calculation processes by reading and executing a control program P (program product) and data pre-stored in the storage unit 23. As will be described in detail below, the control program P includes a switching program P1 (self-reproduction program), a relay processing program P2 (control gateway program), and an update processing program P3 (reproduction gateway program). By executing the switching program P1, the control unit 20 transitions to switching mode (self-reproduction mode). By executing the relay processing program P2, the control unit 20 transitions to normal processing mode (relay processing mode). By executing the update processing program P3, the control unit 20 transitions to update processing mode (reproduction mode).

[0042] The storage unit 23 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory. The control program P (program product) stored in the storage unit 23 may be a control program P (program product) read from a recording medium 24 readable by the relay device 2. Alternatively, the control program P may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 23.

[0043] 3 is an explanatory diagram illustrating the states of the storage unit 23 of the relay device 2. When the control unit 20 is in the normal processing mode (relay processing mode), the storage unit 23 stores a switching program P1 and a relay processing program P2. When the control unit 20 is in the update processing mode (reproduction mode), the storage unit 23 stores a switching program P1 and an update processing program P3.

[0044] When the control unit 20 is in the switching mode (self-reproduction mode), the control unit 20, which is executing the switching program P1 (switching mode), switches (overwrites) between the relay processing program P2 and the update processing program P3. In this way, the memory area in which the relay processing program P2 is stored is overwritten by the update processing program P3, thereby ensuring sufficient free space in the memory unit 23.

[0045] When the update processing program P3 is stored in the storage unit 23, it is not limited to the case where the relay processing program P2 is overwritten, but the update processing program P3 may be stored using a storage area (free area) made free by compressing the relay processing program P2. In this case, the free area (free area) in the storage unit 23 becomes a buffer area and is used as an area for buffering the update program for the in-vehicle ECU 3.

[0046] When outputting (transmitting) an update program acquired (received) from an external server to the in-vehicle ECU 3, the relay device 2 needs to buffer the update program due to differences in input / output bandwidth of the relay device 2, etc. Even in such a case, as described above, when the control unit 20 is in the update processing mode (reproduction mode), the relay processing program P2 is overwritten by the update processing program P3, ensuring sufficient free space for buffering. As a result, even if the update program acquired from the external device becomes large in size, an increase in the storage capacity of the storage unit 23 can be suppressed in order to accommodate the increase in size, or the update program does not need to be downloaded multiple times for update processing, thereby reducing the processing time.

[0047] The input / output I / F 21 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. The relay device 2 is communicably connected to the exterior communication device 1, a display device 5 such as an HMI (Human Machine Interface) device, and an IG switch 6 via the input / output I / F. The control unit 20 may output information about the current operation mode (normal processing mode, switching mode, or update processing mode) to the display device 5, thereby causing the display device 5 to display the current operation mode of the control unit 20 (relay device 2).

[0048] The in-vehicle communication unit 22 is an input / output interface that uses a communication protocol such as CAN, CAN-FD, or Ethernet (registered trademark), and the control unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices 2 that are connected to the in-vehicle network 4 via the in-vehicle communication unit 22. A plurality of in-vehicle communication units 22 (three in this embodiment) are provided, and communication lines 41 (segments) that constitute the in-vehicle network 4 are connected to each of the in-vehicle communication units 22. By providing a plurality of in-vehicle communication units 22 in this way, the in-vehicle network 4 is divided into a plurality of segments, and each in-vehicle ECU 3 is connected to each segment according to, for example, the function of the in-vehicle ECU 3 (control system function, safety system function, body system function).

[0049] The in-vehicle ECU 3 includes a control unit 20, a storage unit, and an in-vehicle communication unit (not shown), similar to the relay device 2. The storage unit 23 is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory, and stores programs or data for the in-vehicle ECU 3. These programs or data are to be updated by an update program transmitted from a program providing device and relayed by the relay device 2. The in-vehicle communication unit of the in-vehicle ECU 3, similar to the relay device 2, is configured with, for example, a CAN transceiver or an Ethernet PHY unit, and communicates with the relay device 2 via the in-vehicle communication unit.

[0050] 4 is a flowchart illustrating the processing of the control unit 20 of the in-vehicle device. The control unit 20 of the relay device 2 steadily performs the following processing, for example, when the vehicle C is stopped (IG switch 6 is off).

[0051] The control unit 20 of the relay device 2 communicates with the external server S1 and determines whether or not it is necessary to perform the update process for the in-vehicle ECU 3 (S101). When the relay device 2 is in a normal processing mode (relay processing mode) in which the relay processing program P2 is being executed, or when the control unit 20 of the relay device 2 receives an OFF signal indicating that the IG switch 6 has been turned OFF, the control unit 20 communicates with the external server S1 using a VIN (Vehicle Identification Number) or the like to check whether or not there is campaign information related to the update process for the in-vehicle ECU 3. The campaign information includes, for example, information related to the in-vehicle ECU 3 to be updated (target information). When the control unit 20 of the relay device 2 receives the campaign information from the external server S1, it determines that it is necessary to perform the update process for the in-vehicle ECU 3. When the control unit 20 of the relay device 2 does not receive the campaign information from the external server S1 and does not receive the campaign information, it determines that it is not necessary to perform the update process for the in-vehicle ECU 3.

[0052] The control unit 20 of the relay device 2 steadily or periodically acquires program information and model information applied to all in-vehicle ECUs 3 mounted on the vehicle C (host vehicle), and stores the acquired and aggregated information as vehicle C configuration information in the storage unit 23. The control unit 20 of the relay device 2 can identify one or more in-vehicle ECUs 3 to be updated by referring to the acquired campaign information and vehicle C configuration information. If it is determined that there is no need to perform the update process for the in-vehicle ECUs 3 (S101: NO), the control unit 20 of the relay device 2 performs loop processing to execute the process of S101 again.

[0053] When it is determined that the update process of the in-vehicle ECU 3 needs to be performed (S101: YES), the control unit 20 of the relay device 2 executes the switching program P1 to transition to the switching mode (S102). When it is determined that the update process of the in-vehicle ECU 3 needs to be performed (there is campaign information), the control unit 20 of the relay device 2 executes the switching program P1. As a result, the control unit 20 of the relay device 2 becomes the control unit 20 currently executing the switching program P1 and transitions to the switching mode (self-reproduction mode). The control unit 20 currently executing the switching program P1 (switching mode) may stop the execution of the relay processing program P2 (terminate the process).

[0054] The control unit 20 of the relay device 2 rewrites the relay processing program P2 with the update processing program P3 acquired from the external server S1 (S103). The control unit 20, while executing the switching program P1, acquires the update processing program P3 from the external server S1 and stores the update processing program P3 in the storage unit 23, using the storage area in which the relay processing program P2 is stored. As a result, the control unit 20, while executing the switching program P1, rewrites the relay processing program P2 with the update processing program P3. In other words, the storage area for the relay processing program P2 is overwritten with the update processing program P3. This overwriting process includes a process of deleting the relay processing program P2 from the storage area in which the relay processing program P2 is stored to free up space, and then storing (writing) the update processing program P3 in the freed-up storage area.

[0055] The control unit 20 of the relay device 2 executes the update processing program P3, thereby transitioning to update processing mode (S104). The control unit 20, which is executing the switching program P1, executes the update processing program P3. As a result, the control unit 20 of the relay device 2 becomes the control unit 20 executing the update processing program P3, and transitions to update processing mode (reproduction mode). When transitioning to the update processing mode, the control unit 20, which is executing the update processing program P3, may terminate the switching program P1, or may set the process of the switching program P1 to a standby processing state, for example, as background processing.

[0056] The control unit 20 of the relay device 2 acquires an update program for the in-vehicle ECU 3 from the external server S1 (S105). The control unit 20, while executing the update processing program P3, acquires (receives) an update program for one or more in-vehicle ECUs 3 from the external server S1 in response to the campaign information and stores (buffers) the acquired update program in a buffer area of the storage unit 23. If there are multiple in-vehicle ECUs 3 to be updated this time, the control unit 20 of the relay device 2 may acquire update programs for all of the multiple in-vehicle ECUs 3 at once. In the storage unit 23 of the relay device 2, the relay processing program P2 used in the normal processing mode is overwritten by the update processing program P3, thereby securing free space in the storage unit 23. By using the free space as a buffer, even if the total program size of the update programs for all of the multiple in-vehicle ECUs 3 becomes large, it is not necessary to download the update program multiple times for update processing, thereby reducing processing time.

[0057] The control unit 20 of the relay device 2 outputs the acquired update program to the in-vehicle ECU 3 (S106). The control unit 20, which is executing the update processing program P3, refers to, for example, campaign information and vehicle C configuration information to identify one or more in-vehicle ECUs 3 to be updated, and outputs (transmits) the update program buffered in the storage unit 23 to the in-vehicle ECUs 3.

[0058] The control unit 20 of the relay device 2 determines whether the update process for all the in-vehicle ECUs 3 has been completed (S107). The control unit 20, while executing the update process program P3, determines whether the output of the update program and the operation check for all the in-vehicle ECUs 3 to be updated have been completed. The control unit 20, while executing the update process program P3, may determine that the update process for all the in-vehicle ECUs 3 has been completed if it receives a signal indicating that the operation check has been completed successfully (a normal completion signal) from all the in-vehicle ECUs 3 to be updated. The control unit 20, while executing the update process program P3, may determine that the update process for all the in-vehicle ECUs 3 has not been completed if it does not receive a normal completion signal from any of the in-vehicle ECUs 3 to be updated.

[0059] If it is determined that the update process for all the in-vehicle ECUs 3 has not been completed (S107: NO), the control unit 20 of the relay device 2 performs a loop process to execute the process from S105 again. If the update programs for all the in-vehicle ECUs 3 to be updated this time have been acquired from the external server S1, the control unit 20 of the relay device 2 may perform a loop process to execute the process from S106 or S107. Note that, if the control unit 20 executing the switching program P1 acquires a signal indicating that the operation check has abnormally ended (an abnormal end signal) from any of the in-vehicle ECUs 3 to be updated, the control unit 20 may perform a rollback process to restore the programs of the previous versions to all the in-vehicle ECUs to be updated. In this case, the control unit 20 executing the switching program P1 may perform the process from S209 after the rollback process.

[0060] When it is determined that the update process for all the in-vehicle ECUs 3 has been completed (S107: YES), the control unit 20 of the relay device 2 executes the switching program P1, thereby transitioning to the switching mode (S108). The control unit 20, which is executing the update process program P3, executes the switching program P1. As a result, the control unit 20 of the relay device 2 becomes the control unit 20 executing the switching program P1, and transitions to the switching mode (self-replication mode). When transitioning from the update process mode to the switching mode, the control unit 20 of the relay device 2 is not limited to re-executing the switching program P1. For example, the control unit 20 of the relay device 2 may activate the process of the switching program P1, which has been in a standby processing state by background processing or the like, by foreground processing or the like, and resume processing of the switching program P1.

[0061] The control unit 20 of the relay device 2 rewrites the update processing program P3 with the relay processing program P2 obtained from the external server S1 (S109). The control unit 20, which is executing the switching program P1, obtains the relay processing program P2 from the external server S1 and restores the relay processing program P2 by storing the relay processing program P2 in the memory unit 23 using the memory area in which the update processing program P3 is stored. As a result, the control unit 20, which is executing the switching program P1, rewrites the update processing program P3 with the relay processing program P2. In other words, the memory area for the update processing program P3 is overwritten by the relay processing program P2.

[0062] When the control unit 20 of the relay device 2 acquires the relay processing program P2 from the external server S1, the control unit 20 is not limited to acquiring the relay processing program P2 that is the same as (the same version of) the overwritten relay processing program P2, but may acquire a new version of the relay processing program P2. That is, in the current update process, if the relay device 2 is also to be updated in addition to the in-vehicle ECU 3 to be updated, the control unit 20 executing the switching program P1 can also perform the update process of the relay device 2, which is its own device, by acquiring the new version of the relay processing program P2.

[0063] The control unit 20 of the relay device 2 executes the relay processing program P2 to transition to the normal processing mode (S110). The control unit 20 executing the switching program P1 executes the relay processing program P2. As a result, the control unit 20 of the relay device 2 becomes the control unit 20 executing the relay processing program P2, and transitions to the normal processing mode (relay processing mode). The control unit 20 executing the relay processing program P2 may resume relay processing and the like, which are functions during normal control in the vehicle C.

[0064] (Embodiment 2) 5 is a flowchart according to the second embodiment (compressing the non-general program portion). The control unit 20 of the relay device 2 communicates with the external server S1 and determines whether or not it is necessary to perform an update process for the in-vehicle ECU 3 (S201). The control unit 20 of the relay device 2 executes the switching program P1 to transition to the switching mode (S202). The control unit 20 of the relay device 2 performs the processes from S201 to S202, similar to the processes from S101 to S102 of the first embodiment.

[0065] The control unit 20 of the relay device 2 compresses the non-general program portion in the relay processing program P2 (S203). The relay processing program P2 stored in the storage unit 23 includes a non-general program portion that depends on the vehicle C (host vehicle) on which the relay device 2 is installed, and a general program portion that does not depend on the vehicle C. The general program portion is, for example, a program portion configured from a group of modules that are common or standardized for the same vehicle model or vehicle manufacturer. The non-general program portion includes, for example, a group of modules that differ for each vehicle C on which the relay device 2 is installed, or configuration data that includes setting information such as parameters that depend on the vehicle C. The relay processing program P2 is configured by a combination of these general program portion and non-general program portion.

[0066] The control unit 20, while executing the switching program P1, compresses the non-general program portion that is part of the relay processing program P2, thereby reducing the program size of the non-general program portion. If the compressed non-general program portion is generated separately from the original non-general program portion, the control unit 20 of the relay device 2 may delete the original non-general program portion. Depending on the compression rate used to compress the non-general program portion, free space is generated in the storage area where the non-general program portion was stored.

[0067] The control unit 20 of the relay device 2 rewrites the relay processing program P2 with the update processing program P3 obtained from the external server S1 (S204). As in the first embodiment, the control unit 20, while executing the switching program P1, obtains the update processing program P3 from the external server S1. While executing the switching program P1, the control unit 20 stores a portion of the update processing program P3 in a storage area freed up by compressing the non-general program portion, and stores the remaining portion of the update processing program P3 in the storage unit 23 using the storage area in which the general-purpose program portion is stored. As a result, while executing the switching program P1, the control unit 20 rewrites the general-purpose program portion that constitutes a portion of the relay processing program P2 with the update processing program P3, while compressing and retaining the non-general program portion (storing the compressed non-general program portion).

[0068] The control unit 20 of the relay device 2 executes the update processing program P3 to transition to the update processing mode (S205). The control unit 20 of the relay device 2 acquires an update program for the in-vehicle ECU 3 from the external server S1 (S206). The control unit 20 of the relay device 2 outputs the acquired update program to the in-vehicle ECU 3 (S207). The control unit 20 of the relay device 2 determines whether the update processing for all the in-vehicle ECUs 3 has been completed (S208). The control unit 20 of the relay device 2 executes the switching program P1 to transition to the switching mode (S209). The control unit 20 of the relay device 2 performs the processes of S205 to S209, similar to the processes of S104 to S108 in the first embodiment.

[0069] The control unit 20 of the relay device 2 decompresses the non-generic program portion (S210). The control unit 20, which is executing the switching program P1, decompresses the compressed non-generic program portion stored in memory. This restores the non-generic program portion. The control unit 20, which is executing the switching program P1, may delete the update processing program P3 stored in the memory unit 23 when decompressing the compressed non-generic program portion.

[0070] The control unit 20 of the relay device 2 restores the relay processing program P2 (S211). The control unit 20, which is executing the switching program P1, obtains a general-purpose program portion that forms part of the relay processing program P2 from the external server S1, and stores the general-purpose program portion in the memory unit 23, using the memory area in which the update processing program P3 was stored. The control unit 20, which is executing the switching program P1, restores the relay processing program P2 using the decompressed non-general-purpose program portion and the general-purpose program portion obtained from the external server S1.

[0071] The control unit 20 of the relay device 2 executes the relay processing program P2 to transition to the normal processing mode (S212). The control unit 20 of the relay device 2 performs the process of S212 in the same manner as the process S110 in the first embodiment.

[0072] (Embodiment 3) FIG. 6 is a block diagram illustrating a physical configuration of a relay device 2 according to a third embodiment (two-face configuration). The storage unit 23 of the relay device 2 of the third embodiment includes two storage areas: a first storage unit 231 and a second storage unit 232. Each of the first storage unit 231 and the second storage unit 232 is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. A switching program P1 and a relay processing program P2 are stored in the first storage unit 231 and the second storage unit 232 in advance. The first storage unit 231 and the second storage unit 232 may be configured with separate storage devices, or may be configured with areas divided by physical address ranges in the same storage device.

[0073] The storage unit 23 (first storage unit 231, second storage unit 232) stores information about the respective versions of two control programs P (switching program P1 and relay processing program P2), the current version and the old version, and information about the area (operating surface) in which the currently executed (applied) control program P is stored. That is, when the control program P stored in the first storage unit 231 (first surface) is currently being executed, the first storage unit 231 stores that the operating surface is the first storage unit 231 (first surface). In this case, the non-operating surface is stored that is the second storage unit 232 (second surface).

[0074] The first storage unit 231, which is the operating side, stores the current version of the control program P (the switching program P1 and the relay processing program P2). The second storage unit 232, which is the non-operating side, stores the old version of the control program P (the switching program P1 and the relay processing program P2). Alternatively, the second storage unit 232, which is the non-operating side, may not store the old version of the control program P, etc., and may be a storage area with free capacity. In this way, by making the non-operating side a storage area with free capacity or a storage area with the old version of the control program P, etc., stored, it is possible to ensure that the old version can be restored by writing the new version of the control program P to the non-operating side during an update.

[0075] 7 is an explanatory diagram illustrating an example of the state of the storage unit 23 of the relay device 2. When the control unit 20 is in the normal processing mode (relay processing mode), the first storage unit 231 (first side), which is the active side, stores the current versions of the switching program P1 and relay processing program P2, and the second storage unit 232 (second side), which is the inactive side, stores the old versions of the switching program P1 and relay processing program P2.

[0076] When the control unit 20 is in the update processing mode (reproduction mode), the first storage unit 231 (first side), which is the active side, stores the current versions of the switching program P1 and relay processing program P2, and the second storage unit 232 (second side), which is the inactive side, stores the update processing program P3. That is, the old versions of the switching program P1 and relay processing program P2 stored in the second storage unit 232 (second side), which is the inactive side, are overwritten by the update processing program P3. This makes it possible to maintain the switching program P1 and relay processing program P2 stored in the first storage unit 231, which is the active side.

[0077] Storing the update processing program P3 in the storage unit 23 is not limited to storing it only in the second storage unit 232, which is the inactive area. Alternatively, a portion of the update processing program P3 may be stored using free space in the first storage unit 231, which is the active area, and the remaining portion of the update processing program P3 may be stored in the second storage unit 232, which is the inactive area, thereby overwriting the old version of the switching program P1 and the relay processing program P2. When storing the update processing program P3 across the first storage unit 231 and the second storage unit 232, the control unit 20 may cancel or invalidate the area division between the first storage unit 231 and the second storage unit 232. The area division may be canceled or invalidated by setting the first storage unit 231 and the second storage unit 232 as logically continuous storage areas, i.e., by making the first storage unit 231 and the second storage unit 232 continuous areas using logical addresses.

[0078] By overwriting the old version of the relay processing program P2 and the like stored in the second storage unit 232, it is possible to ensure sufficient free space in the second storage unit 232 (storage unit 23). At this time, the free space in the second storage unit 232 (storage unit 23) (free space) becomes a buffer area, and is used as an area for buffering update programs for the in-vehicle ECU 3. This makes it possible to accommodate an increase in the capacity of update programs even when the number of in-vehicle ECUs 3 to be updated increases.

[0079] 8 is a flowchart illustrating the processing of the control unit 20 of the in-vehicle device. The control unit 20 of the relay device 2 communicates with the external server S1 and determines whether or not it is necessary to perform an update process for the in-vehicle ECU 3 (S301). The control unit 20 of the relay device 2 executes the switching program P1 to transition to the switching mode (S302). The control unit 20 of the relay device 2 performs the processing from S301 to S302, similar to the processing from S101 to S102 in the first embodiment.

[0080] The control unit 20 of the relay device 2 stores the update processing program P3 on the inactive side (S303). The control unit 20, which is executing the switching program P1, acquires the update processing program P3 from the external server S1 and stores the update processing program P3 in the storage unit 23 (second storage unit 232) using the storage area on the inactive side (second storage unit 232) where the relay processing program P2 and the like are stored. As a result, the control unit 20, which is executing the switching program P1, rewrites the relay processing program P2 stored in the inactive side (second storage unit 232) with the update processing program P3. In other words, the storage area on the inactive side (second storage unit 232) for the relay processing program P2 and the like is overwritten by the update processing program P3.

[0081] The control unit 20 of the relay device 2 executes the update processing program P3 to transition to the update processing mode (S304). The control unit 20 of the relay device 2 acquires an update program for the in-vehicle ECU 3 from the external server S1 (S305). The control unit 20 of the relay device 2 outputs the acquired update program to the in-vehicle ECU 3 (S306). The control unit 20 of the relay device 2 determines whether the update processing for all the in-vehicle ECUs 3 has been completed (S307). The control unit 20 of the relay device 2 executes the switching program P1 to transition to the switching mode (S308). The control unit 20 of the relay device 2 performs the processes from S304 to S308 in the same manner as the processes from S104 to S108 in the first embodiment.

[0082] The control unit 20 of the relay device 2 executes the relay processing program P2, thereby transitioning to normal processing mode (S309). The control unit 20, which is executing the switching program P1, executes the relay processing program P2 stored in the active side (first storage unit 231). As a result, the control unit 20 of the relay device 2 becomes the control unit 20 which is executing the relay processing program P2, and transitions to normal processing mode (relay processing mode). By storing the update processing program P3 in the inactive side (second storage unit 232) in this way without overwriting the relay processing program P2 stored in the active side (first storage unit 231), it is possible to eliminate the need for processing such as obtaining the relay processing program P2 from the external server S1.

[0083] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0084] C vehicle S In-vehicle update system S1 External server (outside vehicle device, OTA server) S11 storage section N External network 1. External communication device 11 Antenna 2. Relay device (OTA master) 20 Control Unit 21 Input / Output Interface 22 In-vehicle communication unit 23 Memory section 231 1st memory section 232 2nd memory section 24 Recording media P Control Program (Program Product) P1 Switching Program (Self-Reproduction Program) P2 relay processing program P3 Update processing program 3 In-vehicle ECU 4. In-vehicle network 41 Communication line 5 Display device 6 IG Switch

Claims

1. A relay device that receives an update program transmitted from an external device and performs processing to update a program of an on-board ECU installed in a vehicle, a control unit that performs relay processing between the in-vehicle ECUs; a storage unit that stores a relay processing program used when performing relay processing and a switching program for switching between relay processing and update processing; The control unit executing the switching program obtaining an update processing program for performing the update processing from the external device; storing the acquired update processing program in the storage unit using a storage area in which the relay processing program is stored; Execute the update processing program stored in the storage unit, The control unit, which is executing the update processing program, outputs the update program acquired from the external device to the in-vehicle ECU to be updated. Relay device.

2. the control unit executing the update processing program executes the switching program after completing output of the update program to the in-vehicle ECU to be updated; The control unit executing the switching program restores the relay processing program. The relay device according to claim 1 .

3. The control unit executing the switching program storing the acquired update processing program in the storage unit by overwriting the storage area in which the relay processing program is stored; The relay processing program is restored by acquiring the overwritten relay processing program from the external device. The relay device according to claim 2 .

4. The control unit executing the switching program By compressing the relay processing program, the storage area in which the relay processing program was stored is made free space; storing the acquired update processing program in the storage unit by using the free space; The compressed relay processing program is decompressed to restore the relay processing program. The relay device according to claim 2 .

5. the relay processing program includes a non-general program portion that is dependent on the vehicle and a general program portion that is not dependent on the vehicle, The control unit executing the switching program By compressing the non-generic program portion, the storage area in which the non-generic program portion was stored is made free space; storing the update processing program in the storage unit using the free area and the storage area in which the general-purpose program unit is stored; The compressed non-general program portion is decompressed, and the general program portion is acquired from the external device, thereby restoring the relay processing program. The relay device according to claim 2 .

6. The storage unit a first storage unit for storing a currently applied relay processing program; a second storage unit in which a previously applied relay processing program is stored; The control unit that is executing the switching program stores the acquired update processing program in the second storage unit. The relay device according to claim 1 .

7. The control unit executing the switching program storing a part of the update processing program in a free area of the first storage unit; The remaining part of the update processing program is stored in the second storage unit using the storage area in which the previously applied relay processing program is stored. The relay device according to claim 6.

8. The switching program has a smaller program size than the relay processing program. The relay device according to any one of claims 1 to 7.

9. a computer that acquires an update program transmitted from an external device, performs processing for updating a program of an on-board ECU mounted on a vehicle, and has a storage unit that stores a relay processing program used for performing the relay processing and a switching program for switching between the relay processing and the update processing; By executing the switching program, obtaining an update processing program for performing the update processing from the external device; storing the acquired update processing program in the storage unit using a storage area in which the relay processing program is stored; By executing the update processing program stored in the storage unit, The control unit, which is executing the update processing program, outputs the update program acquired from the external device to the in-vehicle ECU to be updated. A program that executes a process.

10. a computer that acquires an update program transmitted from an external device, performs processing for updating a program of an on-board ECU mounted on a vehicle, and has a storage unit that stores a relay processing program used for performing the relay processing and a switching program for switching between the relay processing and the update processing; By executing the switching program, obtaining an update processing program for performing the update processing from the external device; storing the acquired update processing program in the storage unit using a storage area in which the relay processing program is stored; By executing the update processing program stored in the storage unit, The control unit, which is executing the update processing program, outputs the update program acquired from the external device to the in-vehicle ECU to be updated. A method for updating a program that executes a process.

Images