Vehicle-mounted program update system and vehicle-mounted program update method

Abstract

This vehicle-mounted program update system comprises a plurality of control devices for controlling a vehicle by executing a program. A first control device, which is one of the plurality of control devices, has a repro order determination unit that: has an authority to communicate with other devices; receives a repro request for a program of at least one of the control devices; determines an order for updating the program on the basis of information about an update target program included in the received repro request; and calculates, on the basis of the amount of data of the program that is updated and the determined update order, a function stop time of the control device to be updated. The first control device transmits the determined update order and the calculated function stop time to the other control devices. The plurality of control devices stop functions during the program update of the other control devices according to the update order and the function stop time which are received from the first control device, and take over the authority to communicate with the other devices before starting a program update of the host control device.

Description

In-vehicle program update system and in-vehicle program update method

[0001] The present invention relates to an in-vehicle program update system for updating a program of a vehicle control device.

[0002] With the increase in functions such as autonomous driving (AD) and advanced driver assistance systems (ADAS), the number of control devices mounted on a single vehicle control device has increased, and the power consumption of the control devices has also increased. In addition, when reprogramming each control device, the reprogramming time and power consumption during reprogramming have increased.

[0003] In addition, the electrification of vehicles is progressing, and a reduction in the power consumption of vehicle control devices is required.

[0004] As background art in this technical field, there is the following prior art. For example, in Patent Document 1 (Japanese Patent Application Laid-Open No. 2023-170941), an update control device connected to a first electronic control device equipped with first software and a second electronic control device equipped with second software via a communication network, a file acquisition unit that acquires a first update file for updating the first software and a second update file for updating the second software, and when the first update file is an update file for updating the first software that is application software, and the second update file is an update file for updating the second software that is basic software on which the application software operates, an update order determination unit that determines an update order of executing the update of the second software after the update of the first software is executed, and an update instruction unit that instructs to execute the update of the first software using the first update file and the update of the second software using the second update file in the update order are provided.

[0005] Japanese Patent Application Laid-Open No. 2023-170941

[0006] The power saving during reprogramming described in Patent Document 1 mainly concerns power saving at the electronic control unit level. However, in electronic control units having multiple control units that are subject to reprogramming, effective power saving for each vehicle control unit is desired.

[0007] A representative example of the invention disclosed in this application is as follows: In other words, an in-vehicle program update system for updating the program of a vehicle control device, wherein the in-vehicle program update system comprises a plurality of control devices that execute the program and control the vehicle, each of the plurality of control devices having a communication unit for communicating with other control devices, a storage device for storing the program, a repro control unit for controlling the update of the program, an execution unit for executing the program, and a function deactivation control unit for stopping and releasing the function deactivation of the control device, wherein a first control device, which is one of the plurality of control devices, has the authority to communicate with other devices, receives a repro request targeting the program of at least one of the control devices, determines the order in which to update the program based on the information of the program to be updated included in the received repro request, has a repro order determination unit that calculates the function deactivation time of the control device to be updated based on the amount of data of the program to be updated and the determined update order, transmits the determined update order and the calculated function deactivation time to the other control devices, and the plurality of control devices stop functioning during the program update of the other control devices in accordance with the update order and function deactivation time received from the first control device, and take over the authority to communicate with other devices before starting the program update of its own control device.

[0008] According to one aspect of the present invention, power consumption during reprogramming can be reduced. Problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.

[0009] This figure shows the configuration of an in-vehicle program update system in which the control device of Embodiment 1 of the present invention does not constitute a hierarchical structure. This figure shows the configuration of an in-vehicle program update system in which the control device of Embodiment 1 of the present invention constitutes a hierarchical structure. This figure shows the configuration of a vehicle control device in which the control device of Embodiment 1 of the present invention does not constitute a hierarchical structure. This figure shows the configuration of a vehicle control device in which the control device of Embodiment 1 of the present invention constitutes a hierarchical structure. This figure shows the configuration of control device A of Embodiment 1 of the present invention. This figure shows the configuration of control device B of Embodiment 1 of the present invention. This figure shows the configuration of control device C of Embodiment 1 of the present invention. This figure shows the configuration of control device D of Embodiment 1 of the present invention. This figure shows the configuration of control device E of Embodiment 1 of the present invention. This figure shows the configuration of control device F of Embodiment 1 of the present invention. This figure shows the configuration of a repeater of Embodiment 1 of the present invention. This is a sequence diagram of processing executed by an in-vehicle program update system in which the control device of Embodiment 1 of the present invention does not constitute a hierarchical structure. This figure shows an example of the hardware configuration of a vehicle control device of Embodiment 1 of the present invention.

[0010] <Example 1> Figure 1 shows the configuration of the in-vehicle program update system according to Example 1 of the present invention.

[0011] The in-vehicle program update system of Embodiment 1 is mounted on a vehicle and includes a vehicle control device 1 and an update control device 2. The vehicle control device 1 and the update control device 2 are connected to each other via a network so as to be able to communicate.

[0012] The vehicle control device 1 includes control device A10, control device B11, control device C12, and switch 4. The vehicle control device 1 also includes an electronic device 3.

[0013] For example, control devices A10, B11, and C12 can be implemented as a System on a Chip (SoC) in which control devices that perform one or more vehicle controls are mounted on a single semiconductor chip, and each has an arithmetic unit and a memory device (for example, memory devices 106, 116, and 126 in Figure 3).

[0014] Control devices A10, B11, and C12 are control devices capable of direct communication with the outside of the vehicle control device 1. One of the control devices A10 to C12 of the vehicle control device 1 is assigned representative authority to communicate with the update control device 2. For example, in the initial state when the ignition is turned on, control device A10 has representative authority to communicate with the update control device 2. Representative authority may be transferred from control device A10 to the other control devices as the reprogramming process progresses.

[0015] Electronic device 3 is an electronic device that does not need to operate when reprogramming is performed to rewrite the programs of control devices 10 to 12. Electronic device 3 is a peripheral device included in the vehicle control device 1 and connected to the control device, and is, for example, a power supply and heater control device for a camera that takes images inside and outside the vehicle, a display device that transmits the output of control devices 10 to 12 to the occupants, and an interface for connecting to other devices.

[0016] Switch 4 is a switch that toggles whether or not power is supplied from the vehicle battery 5 to the electronic device 3.

[0017] The on-board battery 5 is an auxiliary battery that supplies power to devices installed in the vehicle.

[0018] The update control device 2 is a control device that connects to an external network and controls communication with the outside. For example, the update control device 2 controls the reprogramming of control devices 10 to 12 in accordance with a reprogramming request received from an external program update server.

[0019] <Example 1> Figure 2 shows the configuration of the in-vehicle program update system according to Example 1 of the present invention.

[0020] The in-vehicle program update system of Embodiment 1 is mounted on a vehicle and includes a vehicle control device 1 and an update control device 2. The vehicle control device 1 and the update control device 2 are connected to each other via a network so as to be able to communicate.

[0021] The vehicle control device 1 includes a repeater 9, control device A10, control device B11, control device C12, control device D13, control device E14, control device F15, and a switch 4. The vehicle control device 1 also includes an electronic device 3.

[0022] For example, control devices A10, B11, C12, D13, E14, and F15 can be implemented as a System on a Chip (SoC) in which control devices that perform one or more vehicle controls are mounted on a single semiconductor chip, each having an arithmetic unit and a memory device (for example, memory devices 106, 116, and 126 in Figure 3). The higher-level control device A10 may control the reprogramming of the lower-level control devices D13 and E14, and similarly, control device C12 may control the reprogramming of the lower-level control device F15.

[0023] Control devices A10, B11, and C12 are control devices that can communicate directly with the outside of the vehicle control device 1, while control devices D13, E14, and F15 are control devices that cannot communicate directly with the outside of the vehicle control device 1. For this reason, control devices D13, E14, and F15 are connected to either a control device that can communicate directly or indirectly with the outside. For example, control devices D13 and E14 are connected to control device A10 via repeater 9, and control device F15 is directly connected to control device C12. In other words, control devices A10, B11, and C12, which can communicate directly with the outside, are defined as 1-layer devices, repeater 9, which is directly connected to control device A10, which can communicate directly with the outside, is defined as a 2-layer control device, and control devices D13, E14, and F15, which cannot communicate directly with the outside, are defined as 3-layer control devices. It should be noted that a hierarchical structure of the control devices is not essential in this embodiment. As shown in Figure 4, a hierarchical structure may be established between the control devices, or as shown in Figures 1 and 3, a hierarchical structure may not be established between the control devices.

[0024] Furthermore, one of the control devices A10 to C12 of the vehicle control device 1 is assigned representative authority to communicate with the update control device 2. For example, in the initial state when the ignition is turned on, control device A10 has representative authority to communicate with the update control device 2. Representative authority may be transferred from control device A10 to another control device as the reprogramming process progresses.

[0025] The repeater 9 is a communication device that controls communication between control devices, and may be, for example, a PCI express switch.

[0026] Electronic device 3 is an electronic device that does not need to operate when reprogramming is performed to rewrite the programs of control devices 10 to 15. Electronic device 3 is a peripheral device included in the vehicle control device 1 and connected to the control device, and is, for example, a power supply and heater control device for a camera that takes images inside and outside the vehicle, a display device that transmits the output of control devices 13 to 15 to the occupants, and an interface for connecting to other devices.

[0027] Switch 4 is a switch that toggles whether or not power is supplied from the vehicle battery 5 to the electronic device 3.

[0028] The on-board battery 5 is an auxiliary battery that supplies power to devices installed in the vehicle.

[0029] The update control device 2 is a control device that connects to an external network and controls communication with the outside. For example, the update control device 2 controls the reprogramming of control devices 10 to 15 in accordance with a reprogramming request received from an external program update server.

[0030] Figure 6 shows an example of the hardware configuration of the vehicle control device 1 according to Embodiment 1 of the present invention.

[0031] The vehicle control device 1 is an electronic control unit (ECU) having a communication device 1003, an input / output device 1004, a CPU (Central Processing Unit) 1005, a memory 1006, and a storage device 1007. The communication device 1003, input / output device 1004, CPU 1005, memory 1006, and storage device 1007 are connected to each other via an internal signal line 1008 such as a bus.

[0032] The communication device 1003 is connected to other vehicle control devices via an in-vehicle network for communication. The input / output device 1004 is an interface for inputting and outputting data to the vehicle control device 1. The CPU 1005 is an arithmetic unit that executes programs stored in the memory 1006. The CPU 1005 operates as a functional block that provides various functions of the vehicle control device 1 by executing predetermined arithmetic processes. The memory 1006 has a volatile storage area that temporarily stores data used by the CPU 1005 when executing programs. The storage device 1007 has a non-volatile storage area that is accessible to the CPU 1005 and includes a program area that stores programs executed by the CPU 1005 and a data area that stores data used by the CPU 1005 when executing programs.

[0033] Figure 3 shows the configuration of a vehicle control device 1 in which the control device of Embodiment 1 of the present invention does not constitute a hierarchical structure.

[0034] As mentioned above, the vehicle control device 1 includes a repeater 9, control device A10, control device B11, control device C12, control device D13, control device E14, control device F15, electronic device 3, and switch 4. In Figure 3, the repeater 9, control device D13, control device E14, and control device F15 are not shown.

[0035] The control device A10 includes a communication unit 101, a reprogramming sequence determination unit 102, a function stop control unit 103, a start / stop unit 104, a vehicle monitoring unit 105, and a storage device 106.

[0036] The communication unit 101 controls communication with other control devices B11 and C12 and the update control device 2.

[0037] The reprogramming sequence determination unit 102 determines the time and order of reprogramming for each control device 10 to 12 to stop during reprogramming, based on the information and data volume of the program to be reprogrammed included in the reprogramming notification received from the update control device 2. For example, the order of reprogramming may be predetermined or determined randomly. The stop time for reprogramming may be determined from the time and order of reprogramming required for each control device, which are determined by the communication speed between the update control device 2 and the vehicle control device 1 and the processing capacity of each control device. The reprogramming sequence determination unit 102 is present in one of the multiple control devices (preferably the control device with representative authority), and the other control devices do not have a reprogramming sequence determination unit.

[0038] The function deactivation control unit 103 controls the deactivation of the control device A10. The function deactivation control unit 103 may also control the operating mode of the control device A10 to control the power consumption during operation.

[0039] The start / stop unit 104 controls the switch 4 to control the power supply to the electronic device 3.

[0040] The vehicle monitoring unit 105 monitors the vehicle status and determines that vehicle control is unnecessary. The vehicle monitoring unit 105 acquires the vehicle status from the update control device 2 via the communication unit 101. The vehicle monitoring unit 105 may also acquire the vehicle status from another vehicle control device (not shown) mounted on the vehicle via the communication unit, rather than from the update control device 2. For example, the vehicle monitoring unit 105 can determine that vehicle control is unnecessary if the vehicle is not in motion and there are no plans for it to be driven, based on detection results such as the driver monitoring system not detecting a driver, the driver's seat occupancy sensor not detecting a driver, or the ignition being off. If the vehicle monitoring unit 105 determines that vehicle control is unnecessary before starting reprogramming based on monitoring the vehicle status, it stops the functions of control devices 11 and 12 via the communication units 111 and 121 of the other control device via the communication unit 101, stops control devices 11 and 12, and also controls the switch 4 via the start / stop unit 104 to stop the functions of the electronic device 3. If the vehicle monitoring unit 105 determines, based on monitoring the vehicle status, that vehicle control is necessary after the start of reprogramming, it will release the deactivation of the control devices 11 and 12 via the communication units 111 and 121 of the other control devices 11 and 12 from the communication unit 101, and will also release the deactivation of the electronic device 3 by controlling the switch 4 from the start / stop unit 104.

[0041] The storage device 106 stores the program for the reprogramming control unit 107, which controls the reprogramming of the control device A10, and the program for the program execution unit 108, which executes the program to be reprogrammed. The storage device 106 also has a program storage unit 109, which is a storage area for storing the program to be reprogrammed.

[0042] The control device B11 includes a communication unit 111, a function stop control unit 113, a start / stop unit 114, a vehicle monitoring unit 115, and a storage device 116.

[0043] The communication unit 111 controls communication with other control devices A10, C12 and the update control device 2.

[0044] The function deactivation control unit 113 controls the deactivation of the control device B11. The function deactivation control unit 113 may also control the operating mode of the control device B11 to control the power consumption during operation.

[0045] The start / stop unit 114 controls the switch 4 to control the power supply to the electronic device 3.

[0046] The vehicle monitoring unit 115 monitors the vehicle state and determines that vehicle control is not required. The vehicle monitoring unit 115 acquires the vehicle state from the update control device 2 via the communication unit. The vehicle monitoring unit 115 may also acquire the vehicle state from another vehicle control device (not shown) mounted on the vehicle via the communication unit instead of from the update control device 2. When the vehicle monitoring unit 115 determines that vehicle control is necessary based on the monitoring of the vehicle state, it releases the function stop of the control devices 10 and 12 via the communication units 101 and 121 of the other control devices 10 and 12 from the communication unit 111, and also releases the function stop of the electronic device 3 by controlling the switch 4 from the start / stop unit 114.

[0047] The storage device 116 stores the program of the reprogramming control unit 117 that controls the reprogramming of the control device B11 and the program of the program execution unit 118 that executes the program to be reprogrammed. The storage device 116 also has a program storage unit 119 that is a storage area for storing the program to be reprogrammed.

[0048] The control device C12 includes a communication unit 121, a function stop control unit 123, a start / stop unit 124, a vehicle monitoring unit 125, and a storage device 126.

[0049] The communication unit 121 controls communication with the other control devices A10, B11 and the update control device 2.

[0050] The function stop control unit 123 controls the function stop of the control device C12. The start / stop unit 123 may control the operation mode of the control device C12 to the power saving mode to control the power consumption during operation.

[0051] The start / stop unit 124 controls the switch 4 to control the power supply to the electronic device 3.

[0052] The vehicle monitoring unit 125 monitors the vehicle status and determines that vehicle control is not required. The vehicle monitoring unit 125 obtains the vehicle status from the update control device 2 via the communication unit. The vehicle monitoring unit 125 may also obtain the vehicle status from another vehicle control device (not shown) mounted on the vehicle via the communication unit instead of from the update control device 2. If the vehicle monitoring unit 125 determines, through monitoring the vehicle status, that vehicle control is required, it releases the deactivation of the control devices 10 and 11 via the communication units 101 and 111 of the other control devices 10 and 11 via the communication unit 121, and also controls the switch 4 via the start / stop unit 124 to release the deactivation of the electronic device 3.

[0053] The storage device 126 stores the program for the reprogramming control unit 127, which controls the reprogramming of the control device C12, and the program for the program execution unit 128, which executes the program to be reprogrammed. The storage device 126 also has a program storage unit 129, which is a storage area for storing the program to be reprogrammed.

[0054] Figures 4A to 4H show the configuration of the vehicle control device 1 in which the control device of Embodiment 1 of the present invention constitutes a hierarchical structure. Figure 4A shows the overall configuration of the vehicle control device in which the control devices constitute a hierarchical structure, Figures 4B to 4G show the configuration of control devices A to F, respectively, and Figure 4H shows the configuration of the repeater.

[0055] As described above, the vehicle control device 1 includes a repeater 9, control device A10, control device B11, control device C12, control device D13, control device E14, control device F15, and a switch 4.

[0056] As shown in Figure 4A, the control device A10 is positioned on the first layer, which can communicate directly with the update control device 2. As shown in Figure 4B, the control device A10 includes a communication unit 101, a reprogramming sequence determination unit 102, a function stop control unit 103, a start / stop unit 104, a vehicle monitoring unit 105, and a storage device 106.

[0057] The communication unit 101 controls communication with other control devices 13, 14 and the update control device 2 via the repeater 9. The communication unit 101 may also control communication with other control devices 11, 12.

[0058] The reprogramming sequence determination unit 102 determines the time and order of reprogramming for each control device 10-15 and the repeater 9 to stop during reprogramming, based on the information and data volume of the program to be reprogrammed received from the update control device 2. For example, the reprogramming order may be determined randomly or in a predetermined order. The stop time for reprogramming may be determined from the time and order of reprogramming required for each control device, which is determined by the communication speed between the update control device 2 and the vehicle control device 1 and the processing capacity of each control device. The reprogramming sequence determination unit 102 is present in one of the multiple control devices (preferably the control device with representative authority), and the other control devices do not have a reprogramming sequence determination unit.

[0059] The function deactivation control unit 103 controls the deactivation of the control device A10.

[0060] The start / stop unit 104 controls the switch 4 to control the power supply to the electronic device 3.

[0061] The vehicle monitoring unit 105 monitors the vehicle status and determines that vehicle control is not required. The vehicle monitoring unit 105 obtains the vehicle status from the update control device 2 via the communication unit. The vehicle monitoring unit 105 may also obtain the vehicle status from another vehicle control device (not shown) mounted on the vehicle via the communication unit, rather than from the update control device 2. For example, the vehicle monitoring unit 105 can determine that vehicle control is not required if the vehicle is not in motion and there are no plans for it to be driven, based on detection results such as the driver monitoring system not detecting a driver, the driver's seat occupancy sensor not detecting a driver, or the ignition being off.

[0062] If the vehicle monitoring unit 105 determines, based on monitoring the vehicle status, that vehicle control is unnecessary before the start of reprogramming, it stops the functions of control devices 11-14 and repeater 9 via the communication units 91, 111-141 of the other control devices and repeaters from the communication unit 101, and also stops the functions of electronic device 3 by controlling switch 4 from the start / stop unit 104. At this time, control device 15 stops its functions via the communication unit 151 from the communication unit 121 of control device 12.

[0063] If the vehicle monitoring unit 105 determines, based on monitoring the vehicle status, that vehicle control is necessary after the start of reprogramming, it releases the deactivation of the control devices 11-14 and the repeater 9 via the communication units 91, 111-141 of the other control devices and the repeater from the communication unit 101, and also controls the switch 4 from the start / stop unit 104 to stop the function of the electronic device 3. At this time, the control device 15 is released from deactivation via the communication unit 151 from the communication unit 121 of the control device 12.

[0064] The storage device 106 stores the program for the reprogramming control unit 107, which controls the reprogramming of the control device A10, and the program for the program execution unit 108, which executes the program to be reprogrammed. The storage device 106 also has a program storage unit 109, which is a storage area for storing the program to be reprogrammed.

[0065] As shown in Figure 4H, the repeater 9 is located in the second layer, which is unable to communicate directly with the update control device 2 but can communicate directly with the first-layer control device A10, and has a communication unit 91, a function deactivation control unit 93, and a storage device 96.

[0066] The communication unit 91 controls communication with the higher-level control device A11 and the lower-level control devices 13 and 14.

[0067] The function deactivation control unit 93 controls the deactivation of the repeater 9.

[0068] The storage device 96 stores the program for the reprogramming control unit 97, which controls the reprogramming of the repeater 9, and the program for the program execution unit 98, which executes the program to be reprogrammed. The storage device 96 also has a program storage unit 99, which is a storage area for storing the program to be reprogrammed.

[0069] Control devices D13 and E14 are located in layer 3 and cannot communicate directly with the update control device 2, but can communicate indirectly via the layer 1 control device A10 and the layer 2 repeater 9.

[0070] As shown in Figure 4E, the control device D13 includes a communication unit 131, a function deactivation control unit 133, and a storage device 136.

[0071] The communication unit 131 controls communication with the repeater 9.

[0072] The function deactivation control unit 133 controls the deactivation of the control device D13.

[0073] The storage device 136 stores the program for the reprogramming control unit 137, which controls the reprogramming of the control device D13, and the program for the program execution unit 138, which executes the program to be reprogrammed. The storage device 136 also has a program storage unit 139, which is a storage area for storing the program to be reprogrammed.

[0074] As shown in Figure 4F, the control device D14 includes a communication unit 141, a function deactivation control unit 143, and a storage device 146.

[0075] The communication unit 141 controls communication with the repeater 9.

[0076] The function deactivation control unit 143 controls the deactivation of the control device E14.

[0077] The storage device 146 stores the program for the reprogramming control unit 147, which controls the reprogramming of the control device E14, and the program for the program execution unit 148, which executes the program to be reprogrammed. The storage device 146 also has a program storage unit 149, which is a storage area for storing the program to be reprogrammed.

[0078] As shown in Figure 4C, the control device B11 includes a communication unit 111, a function stop control unit 113, a start / stop unit 114, a vehicle monitoring unit 115, and a storage device 116.

[0079] The communication unit 111 controls communication with other control devices A10, C12 to F15 and the update control device 2.

[0080] The function deactivation control unit 113 controls the deactivation of the control device B11. The function deactivation control unit 113 may also control the operating mode of the control device B11 to control the power consumption during operation.

[0081] The start / stop unit 114 controls the power supply to the electronic device 3 by controlling the switch 4.

[0082] The vehicle monitoring unit 115 monitors the vehicle status and determines that vehicle control is not required. The vehicle monitoring unit 115 obtains the vehicle status from the update control device 2 via the communication unit. The vehicle monitoring unit 115 may also obtain the vehicle status from another vehicle control device (not shown) mounted on the vehicle via the communication unit, instead of from the update control device 2. If the vehicle monitoring unit 115 determines, through monitoring the vehicle status, that vehicle control is required, it releases the deactivation of the control devices 10 and 12 via the communication units 101 and 121 of the other control devices 10 and 12 via the communication unit 111, and also controls the switch 4 via the start / stop unit 114 to release the deactivation of the electronic device 3. At this time, the repeater 9 is released from the communication unit 91 of the control device 11 via the communication unit 111. At this time, the control devices 13 and 14 are released from the communication unit 131 and 141 of the control device 11 and the communication unit 91 of the repeater 9 via the communication unit 131 and 141. At this time, the control device 15 is deactivated via the communication unit 151 from the communication unit 121 of the control device 12.

[0083] The storage device 116 stores the program for the reprogramming control unit 117, which controls the reprogramming of the control device B11, and the program for the program execution unit 118, which executes the program to be reprogrammed. The storage device 116 also has a program storage unit 119, which is a storage area for storing the program to be reprogrammed.

[0084] As shown in Figure 4D, the control device C12 includes a communication unit 121, a function stop control unit 123, a start / stop unit 124, a vehicle monitoring unit 125, and a storage device 126.

[0085] The communication unit 121 controls communication with other control devices A10, B11 to F15 and the update control device 2.

[0086] The function stop control unit 123 controls the function stop of the control device C12. The start / stop unit 123 may control the power consumption during operation by controlling the operating mode of the control device C12 to a power saving mode.

[0087] The start / stop unit 124 controls the power supply to the electronic device 3 by controlling the switch 4.

[0088] The vehicle monitoring unit 125 monitors the vehicle status and determines that vehicle control is not required. The vehicle monitoring unit 125 obtains the vehicle status from the update control device 2 via the communication unit 121. The vehicle monitoring unit 125 may also obtain the vehicle status from another vehicle control device (not shown) mounted on the vehicle via the communication unit, instead of from the update control device 2. If the vehicle monitoring unit 115 determines, through monitoring the vehicle status, that vehicle control is required, it releases the deactivation of control devices 11, 12, and 15 via the communication units 101 and 111 of the other control devices 10 and 11 via the communication unit 121, and also controls the switch 4 via the start / stop unit 114 to release the deactivation of the electronic device 3. At this time, the repeater 9 is released from the communication unit 91 of the control device 11 via the communication unit 111. At this time, the control devices 13 and 14 are released from the communication unit 131 and 141 of the control device 11 and the communication unit 91 of the repeater 9 via the communication unit 131 and 141.

[0089] The storage device 126 stores the program for the reprogramming control unit 127, which controls the reprogramming of the control device C12, and the program for the program execution unit 128, which executes the program to be reprogrammed. The storage device 126 also has a program storage unit 129, which is a storage area for storing the program to be reprogrammed.

[0090] As shown in Figure 4E, the control device D15 includes a communication unit 151, a function deactivation control unit 153, and a storage device 156.

[0091] The function deactivation control unit 153 controls the deactivation of the control device F15.

[0092] The storage device 156 stores the program for the reprogramming control unit 157, which controls the reprogramming of the control device E15, and the program for the program execution unit 158, which executes the program to be reprogrammed. The storage device 156 also has a program storage unit 159, which is a storage area for storing the program to be reprogrammed.

[0093] Figure 5 is a sequence diagram of the processing performed by an in-vehicle program update system in which the control device of Embodiment 1 of the present invention does not constitute a hierarchical structure.

[0094] When the update control device 2 receives a reprogramming request from an external program update server (not shown), it obtains information about the program to be reprogrammed and the amount of data for the program to be reprogrammed from the received reprogramming request and transmits it to the vehicle control device 1 as a reprogramming notification (501). The update control device 2 also transmits to the vehicle control device 1 a vehicle status that allows it to detect that the vehicle is not in motion and is not scheduled to be driven.

[0095] In the vehicle control device 1, control device A10, which communicates directly with the update control device 2, has representative authority. Therefore, control device A10 receives the reprogramming notification (501) and the vehicle status (531) for determining whether vehicle control is unnecessary, which are transmitted from the update control device 2.

[0096] When the vehicle monitoring unit 105 of the control device A10 receives the vehicle status from the vehicle update control device 2, it determines that the vehicle is not currently in motion and is not scheduled to be driven (532).

[0097] When the reprogramming order determination unit 102 of the control device A10 receives a reprogramming notification from the update control device 2, it extracts information and data volume of the program to be reprogrammed from the received reprogramming notification and determines the reprogramming order of each control device and the time to stop during reprogramming based on the information and data volume of the program to be reprogrammed (502). The stop time during reprogramming should be determined from the time required for reprogramming of each control device, which is determined by the communication speed between the update control device 2 and the vehicle control device 1 and the processing capacity of each control device, as well as the reprogramming order. For example, since the order in which control device B11 is to be reprogrammed after control device A10 has been determined, the stop time for control device B11 is the reprogramming start time of control device A10 plus the time required for reprogramming of control device A10. Similarly, since the order in which control device C12 is to be reprogrammed after control device B11 has been determined, the stop time for control device C12 is the reprogramming start time of control device A10 plus the time required for reprogramming of both control device A10 and control device B11.

[0098] Then, the communication unit 101 of control device A10 notifies the other control devices B11 and C12 of the determined stop time and reprogramming order (503). This notification transmitted from control device A10 may be transmitted separately from control device A10 to each device as shown in Figure 5, or it may be forwarded from control device A10 to control device B11 and then to control device C12 in a predetermined order.

[0099] Control device B11 activates the timer for the stop time received from control device A10 and stops its function (504). Control device C12 also activates the timer for the stop time received from control device A10 and stops its function (505).

[0100] For example, control devices B11 and C12 may disable all functions except the timer, or they may operate in sleep mode with low power consumption, running only the circuits necessary for the minimum functions (e.g., waiting for startup requests from other devices).

[0101] The start / stop unit 104 of the control device A10 controls the switch 4 to stop the function of the electronic device 3 (506). The electronic device 3 may resume operation after the function stop is released by the control of the switch 4 from the control devices 10 to 12.

[0102] Then, the reprogramming control unit 107 of the control device A10 starts reprogramming (507). For example, the control device A10 receives reprogramming data of a predetermined size and repeatedly writes the received data to memory. While the control device A10 is reprogramming, the other control devices B11 and C12 are stopped, so the control device A10 monitors the vehicle status and determines that vehicle control is not required. If the control device A10 determines, through monitoring the vehicle status, that vehicle control is required, it starts the other control devices B11 and C12 and the electronic device 3.

[0103] Then, when the activated timer times out, the control device B11 estimates that the reprogramming of the control device A10 has finished, releases the deactivation, and resumes operation (508). Alternatively, the control device B11 may release the deactivation based on the reprogramming completion notification 509 sent from the control device A10, rather than the timer.

[0104] Control device A10 sends a reprogramming completion notification to control device B11 at the reprogramming completion timing (510). At the reprogramming completion timing of control device A10, control device B11 releases the function deactivation due to the timer timeout.

[0105] When control device B11 receives a reprogramming completion notification from control device A10, it takes over representative authority from control device A10 (511) and sends a representative authority transfer completion response to control device A10 (512). This transfer of representative authority enables control device B11 to receive notifications transmitted from update control device 2. Furthermore, control device B can release the deactivated functions of electronic device 3 and control devices A10 and C12.

[0106] When control device A10 receives a response from control device B11 indicating that the transfer of representative authority is complete, it stops functioning (513).

[0107] Then, the reprogramming control unit 117 of the control device B11 starts reprogramming (514). For example, the control device B11 receives reprogramming data of a predetermined size and repeatedly writes the received data to memory. While the control device B11 is reprogramming, the other control devices A10 and C12 are stopped, so the control device B11 monitors the vehicle status.

[0108] Then, when the activated timer times out, the control device C12 estimates that the reprogramming of the control device B11 has finished, releases the deactivation, and resumes operation (515). Alternatively, the control device C12 may release the deactivation based on the reprogramming completion notification 516 sent from the control device B11, rather than the timer.

[0109] When the reprogramming is complete, control device B11 sends a reprogramming completion notification to control device C12 (516). At the time when control device B11 finishes reprogramming, control device C12 releases the function deactivation due to the timer timeout.

[0110] When control device C12 receives a reprogramming completion notification from control device B11, it takes over the representative authority from control device B11 (518) and sends a representative authority transfer completion response to control device B11 (519). By taking over the representative authority, control device C12 becomes able to receive notifications sent from update control device 2.

[0111] When control device B11 receives a response from control device C12 indicating that the transfer of representative authority is complete, it stops functioning (520).

[0112] As explained above, one control unit A10 determines the stop time and reprogramming order for each control unit A10 to C12 based on the reprogramming notification (information and data amount of the program to be reprogrammed) from the external update control unit 2, and notifies the other control units B11 to C12. Then, by transferring representative authority to the control unit that will perform the reprogramming, the control units that will not perform the reprogramming can be stopped. This reduces the power consumption of the vehicle control unit 1 during reprogramming.

[0113] Furthermore, when reprogramming a control device that cannot communicate directly with the outside world, a control device that can communicate directly with the outside world has representative authority, allowing for monitoring of the vehicle status. This reduces the power consumption of devices that cannot communicate directly with the outside world. For example, control devices D13 and E14 can be stopped while repeater 9 is being reprogrammed.

[0114] Furthermore, after the first control device (control device A10, which initially has representative authority) receives a reprogramming notification from the external update control device 2, the start / stop unit 104 uses the switch 4 to stop the power supply to the electronic device 3 that does not need to operate during reprogramming, thereby reducing the power consumption of the electronic device 3 that does not need to operate during reprogramming.

[0115] Furthermore, when control devices B11 and C12 have released their deactivation status, they receive a reprogramming completion notification from the previous control device, determine that the control device ahead in the reprogramming sequence has completed its reprogramming, and take over the representative authority to execute the update. Therefore, the control device that has completed the update can be stopped.

[0116] Furthermore, once a control unit has completed reprogramming, it will shut down upon receiving a representative authority handover response from the next control unit to be reprogrammed. This reduces the power consumption of the reprogrammed control unit.

[0117] Furthermore, the control unit with representative authority monitors the vehicle's status and, if vehicle control is required, determines that it is impossible to continue power saving. In such cases, it can release the deactivated functions of the stopped control units 10-15, the repeater 9, and the electronic device 3, return to normal operation, and cancel power saving.

[0118] It should be noted that the present invention is not limited to the embodiments described above, but includes various modifications and equivalent configurations within the spirit of the attached claims. For example, the embodiments described above are described in detail to make the present invention easier to understand, and the present invention is not necessarily limited to having all of the described configurations. Furthermore, some of the configurations of one embodiment may be replaced with those of another embodiment. Furthermore, some of the configurations of one embodiment may be added to those of another embodiment. Furthermore, some of the configurations of each embodiment may be added, deleted, or replaced with those of other embodiments.

[0119] Furthermore, each of the aforementioned configurations, functions, processing units, and processing means may be implemented in hardware, for example, by designing them as integrated circuits, or they may be implemented in software by having a processor interpret and execute programs that realize each function.

[0120] Information such as programs, tables, and files that implement each function can be stored in memory, hard disks, SSDs (Solid State Drives), or recording media such as IC cards, SD cards, and DVDs.

[0121] Furthermore, the control lines and information lines shown are those deemed necessary for explanation purposes and do not necessarily represent all control lines and information lines required for implementation. In reality, it can be assumed that almost all components are interconnected.

Claims

1. An in-vehicle program update system for updating the program of a vehicle control device, comprising a plurality of control devices that execute the program and control the vehicle, each of the plurality of control devices having: a communication unit that communicates with other control devices; a storage device that stores the program; a repro control unit that controls the update of the program; an execution unit that executes the program; and a function deactivation control unit that stops the function of the control device and releases the function deactivation, wherein a first control device, which is one of the plurality of control devices, has the authority to communicate with other devices, receives a repro request targeting the program of at least one of the control devices, determines the order in which to update the program based on the information of the program to be updated included in the received repro request, and calculates the function deactivation time of the control device to be updated based on the amount of data of the program to be updated and the determined update order, transmits the determined update order and the calculated function deactivation time to the other control devices, and the plurality of control devices stop functioning during program updates of other control devices in accordance with the update order and function deactivation time received from the first control device, and take over the authority to communicate with other devices before starting the program update of its own control device.

2. An in-vehicle program update system according to claim 1, wherein the plurality of control devices are configured in a hierarchical structure, comprising a first control device capable of direct communication with other devices and a second control device capable of communicating with the first control device but not capable of direct communication with the other devices.

3. An in-vehicle program update system according to claim 1, wherein each of the plurality of control devices has a start / stop unit that controls the supply of power to one or more electronic devices of the vehicle, and the start / stop unit controls electronic devices that are not necessary for the program update to stop during the program update.

4. An in-vehicle program update system according to claim 1, characterized in that, after the control device to which the authority is transferred receives a program update completion notification from the control device that transferred the authority, the reprogramming control unit of the control device to which the authority is transferred starts updating the program.

5. An in-vehicle program update system according to claim 4, characterized in that the control device to which the authority is transferred stops functioning after receiving the update completion notification.

6. An in-vehicle program update system according to claim 3, wherein each of the plurality of control devices has a vehicle monitoring unit that monitors the status of the vehicle, and the start / stop unit releases the function stop when it is determined that the status of the vehicle monitored by the vehicle monitoring unit requires vehicle control by the control device.

7. A program update method for an in-vehicle program update system to update the program of a vehicle control device, wherein the in-vehicle program update system has a plurality of control devices that execute the program to control the vehicle, each of the plurality of control devices has a communication unit that communicates with other control devices, a storage device that stores the program, a repro control unit that controls the update of the program, an execution unit that executes the program, and a function deactivation control unit that deactivates and releases the function deactivation of the control device, one of the plurality of control devices is designated as a first control device that has the authority to communicate with other devices, the program update method comprises: the first control device receiving a repro request targeting the program of at least one of the control devices; the first control device determining the order in which to update the program based on the information of the program to be updated included in the received repro request; the first control device calculating the function deactivation time of the control device to be updated based on the amount of data of the program to be updated and the determined update order; and the first control device transmitting the determined update order and the calculated function deactivation time to the other control devices. An in-vehicle program update method characterized in that the control device suspends its function during a program update of another control device in accordance with the update order and function suspension time received from the first control device, and the control device takes over the authority to communicate with the other device before the program update begins.

Images