JP2009053920A - Program management system for on-vehicle electronic control unit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system which, while upgrading a program of an ECU, prevents the occurrence of an operation failure of the ECU by version mismatching with a program of another ECU connected by a bus. <P>SOLUTION: The system comprises a server connected to a plurality of electronic control units through a bus, and holding an upgrade program updated from a current program loaded in the electronic units. Any one of the electronic control units or the server includes a dependency information management part which holds dependency information between the current program and the upgrade program, and an update determination processing part which determines the propriety of update to the upgrade program from the dependency information. The update determination processing part makes, when it determines that the update is possible, the server transmit the held upgrade program to the electronic control unit. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a program management system for an on-vehicle electronic control unit, and more specifically, when performing a version upgrade of a program incorporated in an electronic control unit, electronic control due to a mismatch with a program version of another electronic control unit This prevents the unit from malfunctioning.

Conventionally, a vehicle has a plurality of electronic control units (ECUs) that control in-vehicle devices, and the plurality of ECUs are connected via a multiplex communication bus to communicate with each other. Is adopted.
Each ECU incorporates a program for operating data on the vehicle by performing data communication with other ECUs. Since the program is often upgraded by a manufacturer of the in-vehicle device, the ECU program is updated to a version upgrade program by a dealer or the like.

  The programs incorporated in these ECUs differ in activation timing and communication timing depending on the version of the program. Therefore, when a specific ECU program is updated to a version upgrade program after the vehicle is shipped, the ECU may cause an abnormality in communication with another ECU due to a version mismatch with another ECU program. There is a risk of malfunction such as inability to operate the in-vehicle device.

  For this reason, for example, in Japanese Patent Application Laid-Open No. 2000-207681 (Patent Document 1), each ECU has a program backup area, and before updating to the upgrade program, the current program is used as an old program as a backup area. A method of saving is proposed. When an operation failure occurs in the ECU after the update to the version upgrade program, the old program stored in the backup area is used to return the ECU to the state before the update that was operating normally.

JP 2000-207681 A

However, in Patent Document 1, although it is possible to return the ECU program to the state before the update to the version upgrade program, it is not possible to prevent malfunction of the ECU due to version mismatch with other ECU programs. There is a problem.
In addition, another ECU having a program that does not match the upgraded program cannot be specified, and the cause of the malfunction of the ECU cannot be specified.

  The present invention has been made in view of the above-described problem, and prevents an ECU from malfunctioning due to inconsistency with other ECU program versions when an ECU program is updated to a version upgrade program. It is an issue.

In order to solve the above-mentioned problem, there is a program management system for an in-vehicle electronic control unit that manages version upgrade of a program for an electronic control unit mounted on a vehicle,
A server that is connected to a plurality of the electronic control units via a bus and has a version upgrade program updated from a current program installed in the electronic control unit,
Any one of the electronic control units or the server determines a dependency information management unit that holds dependency relationship information between the current program and the upgrade program, and whether or not the dependency information can be updated to the upgrade program. An update determination processing unit,
The update determination processing unit provides a program management system for an in-vehicle electronic control unit that causes the electronic control unit to transmit the upgrade program held in the server when it is determined that the update is possible.

  Any one of the electronic control units (hereinafter referred to as a management ECU) or the update determination processing unit of the server reads dependency information between the current program and the upgrade program from the dependency information management unit, and holds it in the server From the version upgrade program version and the dependency relationship information, it is determined whether or not the upgrade to the upgrade program for a predetermined ECU is possible.

When the management ECU includes an update determination processing unit, the update determination processing unit transmits the determination result from the management ECU to the server when the update determination processing unit determines that the update is possible, and the server transmits a version upgrade program to the predetermined ECU. Update the program to the upgrade program. When the server includes an update determination processing unit, when the update determination processing unit determines that update is possible, the update determination processing unit transmits an upgrade program provided in the server to a predetermined ECU.
When the update determination processing unit determines that the update to the upgrade program is impossible, the server does not transmit the upgrade program to a predetermined ECU and does not perform the update.

  In this way, the update determination processing unit determines whether or not the upgrade to the upgrade program for the predetermined ECU is possible, and if the update is impossible, the server does not transmit the upgrade program, so the program of the other ECU It is possible to prevent malfunction of the ECU due to inconsistency with this version.

Specifically, the dependency relationship information includes the version of the upgrade program when the upgrade program is incorporated into a predetermined ECU and the version of the program of another ECU that does not become inconsistent with the version of the upgrade program. Has been.
When updating a program of a predetermined ECU to a version upgrade program held by the server, the update determination processing unit sets the version of the current program of another ECU prepared in advance as the version of the version upgrade program of the dependency relationship information. Compared to the version of the other ECU program that does not match, the current program of the other ECU satisfies the version of the other ECU program described in the dependency relationship information, that is, the version upgrade program and the other ECU If the current program is consistent, it is determined that the upgrade to the upgrade program for a predetermined ECU is possible. On the other hand, if the upgrade program and the current program of another ECU are inconsistent, it is determined that the update is impossible.
Therefore, the update determination processing unit can specify another ECU having a program that does not match the upgrade program.

  The electronic control unit or the server having the dependency information management unit or the update determination processing unit stores a version of the current program of the plurality of electronic control units connected by the bus in advance, or the electronic A version inquiry unit for inquiring the version of the current program to the control unit is provided.

  When the management ECU or the server includes a version management unit, the version of the current program of the plurality of ECUs is stored in advance, so that the update determination processing unit upgrades using the stored version of the current program. Whether to update the program can be determined at high speed.

In addition, since the management ECU or the server includes a version management unit, if at least only the ECU that should update the upgrade program is made to correspond to the program management system of the present invention, the operation of other ECUs will not occur. The upgrade program can be updated using the program management system of the invention. That is, even if the ECU having the current program that may be inconsistent with the upgrade program is not compatible with the program management system of the present invention, the update determination processing unit is stored in the version management unit. It is possible to determine whether or not the upgrade to the upgrade program is possible using the version of the current program. If the update is possible, the upgrade program can be updated to the corresponding ECU.

When the management ECU or server includes a version inquiry unit, each ECU includes a version response unit. The management ECU or server does not store the upper version of the current program in advance, but each time the version upgrade program is updated, the management ECU or server inquires each ECU about the version of the program and determines the version of each ECU. Have acquired.
For this reason, the update determination processing unit can reliably determine whether the update to the upgrade program is possible using the latest version information. Even when the program is updated to the upgrade program by means other than this system, the latest version information can be used reliably.
Further, since the update determination processing unit obtains the version of the current program of each ECU every time the version upgrade program is updated, the management ECU or server has a version management unit for storing in advance the version of the current program of each ECU. There is no need to provide it.

  When an ECU having a version response unit and an ECU not having a version response unit are mixed, the management ECU or the server may include both a version management unit and a version inquiry unit. In this case, each time the version upgrade program is updated, the update determination processing unit inquires of the ECU having the version response unit about the version of the program and obtains the version. On the other hand, the update determination processing unit The version can be acquired from the version management unit.

The server may receive the version upgrade program or / and dependency relationship information between programs from an external server via wireless.
The program management system includes an external server wirelessly connected to the management ECU or server, and stores version upgrade programs and / or dependency information between programs. The management ECU or server receives dependency relationship information between programs from an external server and stores it in the dependency information management unit, and the server receives and stores an upgrade program from the external server.
An update determination processing unit provided in the management ECU or the server determines whether or not an update to the upgrade program for a predetermined ECU can be performed using the dependency relationship information and the upgrade program received from the external server.

  In this way, each time an update to the upgrade program is performed, the upgrade program or / and dependency information is received from the external server and used, so that the upgrade program or / and dependency information is previously managed by the management ECU or server. There is no need to provide a storage unit for storing the data.

The external server is specifically arranged in a manufacturer of an in-vehicle device driven by the ECU, and the manufacturer provides a program to be incorporated in the ECU. When the manufacturer provides a version upgrade program for the program incorporated in the ECU, new dependency relationship information regarding the version upgrade program is also provided and stored in the external server.
The vehicle management ECU or server receives an upgrade program or / and dependency relationship information provided from a manufacturer by connecting to an external server via wireless communication.
For this reason, the server can always receive the latest upgrade program and send it to a predetermined ECU, and the management ECU or the update determination processing unit of the server always uses the latest dependency information to determine whether or not to update. It can be performed.

The server is a server housed in a diagnosis connected to the electronic control unit via the bus.
The server may be an electronic device such as a car navigation system, a mobile phone, or a personal computer.

Each of the electronic control units may include a program backup area for storing the current program before upgrading as an old program.
When updating the upgrade program to a predetermined ECU, the ECU stores the old program in the program backup area. If the ECU malfunctions after the upgrade to the upgrade program, the diagnosis instructs the ECU to restore the old program stored in the program backup area. Before updating to the upgrade program, the ECU was operating normally using the old program, so returning the old program normalizes the operation of the ECU that malfunctioned due to the upgrade to the upgrade program. be able to.

In addition, when the ECU malfunctions after the update to the upgrade program, the update determination processing unit determines that the update of the upgrade program has failed and includes the dependency information in the dependency information management unit. An update failure of the version upgrade program may be added.
Further, when the dependency information is stored in the external server, the update failure information of the upgrade program may be provided to the external server.

  Specifically, the on-vehicle electronic control unit program management system of the present invention can be classified into the following first to seventh embodiments.

In the first mode, the plurality of electronic control units are connected via a bus, and any one of the plurality of electronic control units is a program of another electronic control unit including its own electronic control unit. A program management unit including a version management unit that stores a version in advance and a dependency information management unit that stores dependency information between programs, and determines whether or not the dependency information can be updated to the upgrade program. An update determination processing unit for
The electronic control unit including the program management unit is connected to a diagnosis (hereinafter referred to as a diagnosis) having a program holding unit for holding a program including a version upgrade program by the bus,
The update determination processing unit of the electronic control unit having the program management unit uses the version information of the current program of the electronic control unit managed by the version management unit, and the dependency relationship between the current program and the upgrade program The information is read from the dependency information management unit to determine whether or not the upgrade to the upgrade program is possible. When the update is possible, the diagnostic transmits the upgrade program to the electronic control unit.

In the second mode, the plurality of electronic control units are connected via a bus, and any one of the plurality of electronic control units is a program of another electronic control unit including its own electronic control unit. An electronic control unit having a version management unit that stores a version in advance, the electronic control unit having the version management unit stores dependency relationship information between a program holding unit that holds a program including a version upgrade program and the held program Connected via the bus to a diagnosis having a dependency information management unit and an update determination processing unit that determines whether or not an update to the upgrade program is possible from the dependency relationship information,
The update determination processing unit of the diagnosis uses the version information of the current program of the electronic control unit managed by the version management unit to determine the dependency relationship between the current program and the upgrade program from the dependency information management unit. Reading is performed to determine whether or not the upgrade to the upgrade program is possible. If the update is possible, the upgrade program is transmitted to the electronic control unit.

In a third mode, the plurality of electronic control units include a diagnosis connected via a bus,
The diagnosis includes a program holding unit that holds a program including an upgrade program, a dependency information management unit that stores dependency relationship information between the held programs, and an update program that updates the dependency information to the upgrade program. While comprising an update determination processing unit that determines whether it is possible and a version inquiry unit that inquires the electronic control unit about the version of the current program,
Each electronic control unit includes a version response unit that responds to the current version number of the current program in response to an inquiry from the inquiry unit of the diagnosis,
The inquiry unit of the diagnosis is a response from the version response unit of the electronic control unit, and acquires version information of the current program of the electronic control unit managed by the version management unit, and the update determination processing unit is the current program Is read from the dependency information management unit to determine whether or not the upgrade to the upgrade program is possible. If the update is possible, the upgrade program is transmitted to the electronic control unit. ing.

In a fourth mode, the plurality of electronic control units include a diagnosis connected via a bus and an external server connected wirelessly,
The external server includes a dependency information management unit that stores dependency information between programs,
The diagnosis includes a program holding unit that holds a program including an upgrade program and an update determination processing unit that determines whether or not an update to the upgrade program is possible from the dependency relationship information.
Any one of the plurality of electronic control units includes a version management unit that stores in advance a version of a program of another electronic control unit including the own electronic control unit,
The diagnostic update determination processing unit uses the version information of the current program of the electronic control unit managed by the version management unit to obtain dependency information between the current program and the upgrade program as the dependency information management unit. From the above, it is determined whether or not the upgrade to the upgrade program is possible. If the update is possible, the diagnostic program transmits the upgrade program to the electronic control unit.

In a fifth aspect, the plurality of electronic control units include a diagnosis connected via a bus and an external server connected wirelessly.
The external server includes a dependency information management unit that stores dependency relationship information between programs, and a program holding unit that holds a program including an upgrade program,
The diagnosis includes a download unit that downloads the upgrade program from the external server and an update determination processing unit that determines whether or not an update to the upgrade program is possible from the dependency information.
Any one of the plurality of electronic control units includes a version management unit that stores in advance a version of a program of another electronic control unit including the own electronic control unit,
The diagnostic update determination processing unit uses the version information of the current program of the electronic control unit managed by the version management unit to obtain dependency information between the current program and the upgrade program as the dependency information management unit. Is read out from the external server to determine whether or not the upgrade to the upgrade program is possible. If the update is possible, the diagnostic program downloads the upgrade program from the external server and sends it to the electronic control unit. .

In a sixth aspect, the plurality of electronic control units include a diagnosis connected via a bus, and an external server connected wirelessly,
The external server includes a dependency information management unit that stores dependency information between programs,
The diagnosis includes a program holding unit that holds a program including an upgrade program and an update determination processing unit that determines whether or not an update to the upgrade program is possible from the dependency relationship information.
Any one of the plurality of electronic control units includes a version management unit that stores in advance a version of a program of another electronic control unit including the own electronic control unit,
Each electronic control unit includes a program backup area for storing the current program before the upgrade as an old program,
The diagnostic update determination processing unit uses the version information of the current program of the electronic control unit managed by the version management unit to obtain dependency information between the current program and the upgrade program as the dependency information management unit. From this, it is determined whether or not the upgrade to the upgrade program is possible. If the update is possible, the diagnostic program transmits the upgrade program to the electronic control unit, while the electronic control unit stores the current program in the program backup area. As an old program.

In a seventh aspect, the plurality of electronic control units include a diagnosis connected via a bus, and an external server connected wirelessly,
The external server includes a dependency information management unit that stores dependency relationship information between programs, and a program holding unit that holds a program including an upgrade program,
The diagnosis includes a download unit that downloads the upgrade program from the external server and an update determination processing unit that determines whether or not an update to the upgrade program is possible from the dependency information.
Any one of the plurality of electronic control units includes a version management unit that stores in advance a version of a program of another electronic control unit including the own electronic control unit,
Each electronic control unit includes a program backup area for storing the current program before the upgrade as an old program,
The diagnostic update determination processing unit uses the version information of the current program of the electronic control unit managed by the version management unit to obtain dependency information between the current program and the upgrade program as the dependency information management unit. From the above, it is determined whether or not the upgrade to the upgrade program is possible, and if the update is possible, the diagnostic downloads the upgrade program from the external server and transmits it to the electronic control unit. The electronic control unit stores the current program as an old program in the program backup area.

As described above, according to the in-vehicle electronic control unit program management system of the present invention, the update determination processing unit determines whether or not the upgrade to the upgrade program for the predetermined ECU is possible, and when the update is not possible, Since the server does not transmit the upgrade program, it is possible to prevent malfunction of the ECU due to inconsistencies with the versions of the programs of other ECUs.
In addition, using the dependency relationship information of the dependency information management unit, updating the upgrade program from the dependency relationship information between the version of the upgrade program and the version of the current program of the management ECU and other ECUs stored in the version management unit Therefore, it is possible to identify another ECU having a program that does not match the upgraded program.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
1 to 4 show a first embodiment of the present invention.
The program management system 10 according to the present invention manages version upgrade of an electronic control unit (ECU) 20 mounted on a vehicle, and includes the plurality of ECUs 20 and a diagnosis 30. The plurality of ECUs 20 are connected to each other via a bus 11 for multiplex communication, and any one of the plurality of ECUs 20 is used as a management ECU. In the present embodiment, four ECUs 20 are provided, and the ECU 20D is a management ECU 20D.
The management ECU 20D and the other ECU 20 are connected to a diagnosis (hereinafter abbreviated as a diagnosis) 30 via a bus 11, and the diagnosis 30 serves as a server having a version upgrade program.

  Each ECU 20 includes a storage unit 22 and an ECU processing unit 21. The storage unit 22 stores a program for driving an in-vehicle device (not shown) connected to the ECU 20 to communicate with other ECUs 20. In addition, when the ECU processing unit 21 updates the program stored in the storage unit 22 to the upgrade program transmitted from the diagnosis 30, the ECU processing unit 21 transmits the upgrade result indicating whether the update is successful to the diagnosis 30. Yes.

The management ECU 20D includes a management processing unit 23 that functions as an update determination processing unit that determines whether an upgrade to the version upgrade program is possible, and a program management unit 24. The program management unit 24 includes a storage unit such as a memory, and includes a version management unit 50 and a dependency information management unit 51.
The version management unit 50 stores in advance version information of programs of other ECUs 20 including its own ECU 20, and the dependency information management unit 51 stores dependency relationship information between programs. These pieces of information are stored in advance when the vehicle is shipped from the factory.

2A shows an example of the version management unit 50, and FIG. 2B shows an example of the dependency information management unit 51.
The version management unit 50 in FIG. 2A stores all the program versions of each ECU 20, and indicates that the current version of the program of the ECU 20A is, for example, Ver1.41.42. 2B, for example, when upgrading the program version of the ECU 20B to Ver 1.74.00, the version of the ECU 20C is Ver2.23.62 or higher, and the version of the ECU 20A is This indicates that Ver 2.00.00 or higher is sufficient.
Therefore, when the version of the ECU 20A is upgraded to Ver 2.00.00, the ECU 20B and the ECU 20C may be Ver 1.73.20 and Ver 2.23.62 or more, respectively. Satisfies.
On the other hand, since the version of ECU 20A is Ver1.41.42 from FIG. 2A, the version of the program of ECU20B cannot be upgraded to Ver1.74.00.

The management processing unit 23 acquires the version information of the version management unit 50 and the dependency relationship information of the dependency information management unit 51 from the version management unit 50, reads the dependency relationship information with the version upgrade program, and updates the version upgrade program. Whether or not it is possible is determined, and the determination result is transmitted to the diagnosis 30. If the determination result is not updateable, the current version of the ECU 20 that caused the update failure and the version necessary for the update are transmitted to the diagnosis 30 simultaneously with the transmission of the determination result. For example, in the above example, when the version of the program of the ECU 20B is upgraded to Ver 1.74.00, the version of the ECU 20A is not consistent and cannot be upgraded. At this time, the fact that the current version of the ECU 20A causing the update failure is Ver1.41.42 and the version necessary for the update is Ver2.00.00 are transmitted.
Further, when the program of the ECU 20 to be upgraded is updated, an update notification is received from the diagnosis 30 and the version information of the version management unit 50 is rewritten.

The diagnosis 30 includes a diagnosis storage unit 32, a diagnosis processing unit 31, and a display unit 33. The diagnosis storage unit 32 includes a program storage unit 52 that stores a program including an upgrade program.
The diagnosis processing unit 31 receives the determination result of whether or not the upgrade to the upgrade program is possible from the management ECU 20D, and if the update is possible, transmits the upgrade program to the ECU 20 that is the upgrade target. In addition, when a notification indicating that the upgrade of the upgrade program has been successfully received is received from the ECU 20 that is the upgrade target, an update notification is transmitted to the management ECU 20D.
The display unit 33 displays that updating is not possible when the dependency determination result received from the management ECU 20D is not updatable. In addition, the current version of the ECU 20 that caused the update failure and the version necessary for the update are also displayed.

3 and 4 show operation flowcharts of the program management system configured as described above.
An example of updating the program of the ECU 20A to the version upgrade program stored in the diagnosis 30 will be described.
In step S10, the diagnosis 30 transmits version information of the upgrade program to the management ECU 20D. For example, when the version of the upgrade program is Ver2.00.00, the version information Ver2.00.00 of the upgrade program is transmitted to the management ECU 20D.

In step S11, the management ECU 20D receives version information of the upgrade program from the diagnosis 30.
In step S12, the management processing unit 23 of the management ECU 20D reads the version information of the version management unit 50 and the dependency relationship information of the dependency information management unit 51 from the program management unit 24.
In step S13, it is determined from the version information of the upgrade program received in step S11 and the version information and dependency relationship information of each ECU 20 read in step S12 whether the update of the program of ECU 20B to the upgrade program is possible.
For example, since the version of the upgrade program is Ver2.00.00, referring to the dependency relationship information of the dependency information management unit 51 shown in FIG. 2B, the program of the ECU 20A is upgraded to Ver2.00.00. It can be seen that the program version of the ECU 20B may be Ver 1.73.20 or higher and the version of the ECU 20C may be Ver 2.23.62 or higher. Therefore, referring to the version information of the version management unit 50 shown in FIG. 2A, the version of the current program of the ECU 20B is Ver1.73.20, and the version of the ECU20C is Ver2.23.62. Therefore, it is determined that the version can be upgraded.

In step S <b> 14, the management processing unit 23 transmits a determination result on whether or not update to the upgrade program is possible to the diagnosis 30. If the determination result is not updateable, the current version of the ECU 20 that caused the update failure and the version necessary for the update are also transmitted to the diagnosis 30 at the same time as the determination result is transmitted.
In step S15, the diagnosis processing unit 31 of the diagnosis 30 receives the determination result.
In step S16, the diagnosis processing unit 31 determines whether or not the received determination result can be updated to the upgrade program. If it can be updated, the process proceeds to step S17. If it cannot be updated, the process proceeds to step S30.
In step S17, the diagnosis processing unit 31 transmits an upgrade program to the ECU 20A.

In step S18, the ECU 20A receives the upgrade program.
In step S19, the ECU 20A stores the upgrade program in the storage unit 22, and updates the program to the upgrade program.
In step S30, when the update is not possible in step S16, the current version of ECU 20 that is the cause of the non-update and the version necessary for the update, which is transmitted simultaneously with the determination result, are displayed on display unit 33 of diagnosis 30. indicate.

Next, in step S20 shown in FIG. 4, the ECU 20A transmits upgrade result information indicating whether or not the upgrade is successful to the diagnosis 30.
In step S21, the diagnosis 30 receives the version upgrade result information.
In step S22, the diagnosis processing unit 31 determines whether or not the update of the upgrade program to the ECU 20A has succeeded from the received upgrade result information. If successful, the process proceeds to S23. If unsuccessful, the process proceeds to step S31.
In step S23, the diagnosis 30 transmits a notification that the version of the program of the ECU 20A has been updated to the management ECU 20D.
In step S24, the management ECU 20D receives the update notification in step S23.
In step S25, the management ECU 20D rewrites the version information of the ECU 20A of the version management unit 50 with the version received in step S11.
In step S31, when the update of the upgrade program has failed in the ECU 20A, the fact that the update has failed is displayed on the display unit 33 of the diagnosis 30.

According to the present invention, the management ECU 20D determines whether or not the upgrade to the upgrade program for the predetermined ECU 20 is possible. If the update is not possible, the diagnosis 30 does not transmit the upgrade program. It is possible to prevent malfunction of the ECU 20 due to inconsistency with the program version.
Further, the management ECU 20D uses the dependency relationship information of the dependency information management unit 51 to determine from the dependency relationship information between the version of the upgrade program and the version of the current program of the management ECU 20D and the other ECU 20 stored in the version management unit 50. Since it is determined whether or not the upgrade program can be updated, another ECU having a program that does not match the upgraded program can be identified.

Note that the management ECU 20D does not have to be a dedicated ECU 20, and the function of the management ECU 20D may be added to an existing ECU 20 that is used for other purposes such as a body ECU.
The diagnosis 30 may be a mobile phone, a personal computer or the like connected by wire or wireless, or may be an ECU.

  Further, the dependency relationship information stored in the dependency information management unit 51 is provided by a manufacturer of the in-vehicle device. When the dependency relationship information is updated after the vehicle is shipped from the factory or when the upgrade program for the predetermined ECU 20 is updated, new dependency relationship information is written in the diagnosis at the dealer or the like, and the diagnosis 30 depends on the management ECU 20D. The dependency information may be updated by transmitting the relationship information.

In addition, the management ECU 20D determines whether or not the upgrade to the upgrade program for the predetermined ECU 20 is possible, and even if it is not consistent with the program with the other ECU 20 and cannot be updated, the upgrade program is forcibly changed. A function of updating may be provided.
If the versions of the programs of the two ECUs are not consistent with each other and the upgrade program cannot be updated for either ECU, the other ECU can be forced to update to the upgrade program for the other ECU. Updates can also be made to the ECU.

5 and 6 show a second embodiment of the present invention.
As shown in FIG. 5, the first embodiment is different from the first embodiment in that the dependency information management unit 51 is provided in the diagnosis storage unit 32 of the diagnosis 30 and the update determination processing unit is the diagnosis processing unit 31.
FIG. 6 shows an operation flowchart of the program management system.
An example of updating the program of the ECU 20A to the version upgrade program stored in the diagnosis 30 will be described.
In step S40, the diagnosis 30 issues a transmission request to the management ECU 20D to transmit the version information of each ECU 20 stored in the version management unit 50 of the management ECU 20D.

In step S41, the management ECU 20D receives a transmission request from the diagnosis 30.
In step S <b> 42, the management ECU 20 </ b> D transmits the version information stored in the version management unit 50 of each ECU 20 to the diagnosis 30.
In step S43, the diagnosis 30 receives version information.
In step S <b> 44, the diagnosis processing unit 31 of the diagnosis 30 reads the dependency relationship information from the dependency information management unit 51 of the diagnosis storage unit 32 and also reads the version information of the upgrade program stored in the program holding unit 52.
In step S45, the diagnosis processing unit 31 of the diagnosis 30 converts the version information of each ECU 20 received in step S43, the dependency relationship information read in step S44, and the version information of the upgrade program to the upgrade program of the program of the ECU 20A. Judge whether or not to update.
Step S16 and subsequent steps are the same as those in the first embodiment. When the update to the upgrade program is possible, the upgrade program is transmitted to the ECU 20A, and when the update is impossible, the cause is displayed and the flowchart is terminated. Step S19 and subsequent steps are the same as those in FIG.

Even with the above configuration, the diagnosis 30 determines whether or not the upgrade to the upgrade program for the predetermined ECU is possible. If the update is not possible, the diagnosis does not transmit the upgrade program. Can be prevented from malfunctioning.
In addition, since another structure and an effect are the same as that of 1st Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

7 and 8 show a third embodiment of the present invention.
The diagnosis storage unit 32 of the diagnosis 30 includes a dependency information management unit 51. The diagnosis processing unit 31 includes a version inquiry unit 34. The version inquiry unit 34 inquires each ECU 20 about the version information of the program, and receives the version information transmitted from each ECU 20. Further, the update determination processing unit is a diagnosis processing unit 31. The ECU processing unit 21 of each ECU 20 includes a version response unit 26. When an inquiry about version information is transmitted from the diagnosis 30, the version information of the own ECU 20 is transmitted. .
That is, the program management system 10 does not include the version management unit 50 in advance, and the diagnosis 30 obtains version information by inquiring each ECU 20 about the version when determining the dependency.
Note that the management ECU 20D is not provided in the program management system of the present embodiment.

FIG. 8 shows an operation flowchart of the program management system having the above-described configuration.
An example of updating the program of the ECU 20A to the version upgrade program stored in the diagnosis 30 will be described.
In step S50, the version inquiry unit 34 of the diagnosis 30 inquires ECU 20B, 20C about program version information.
In step S51, the ECUs 20B and 20C receive the inquiry from the diagnosis 30.

In step S <b> 52, the version response unit 26 of the ECUs 20 </ b> B and 20 </ b> C transmits the version information of the program of the own ECU 20.
In step S53, the diagnosis 30 receives the program version information transmitted from the ECUs 20B and 20C.
In step S54, the diagnosis processing unit 31 of the diagnosis 30 reads the dependency relationship information from the dependency information management unit 51 of the diagnosis storage unit 32 and also reads the version information of the upgrade program.

In step S55, the diagnosis processing unit 31 of the diagnosis 30 converts the version information of each ECU 20 received in step S53, the dependency relationship information read in step S54, and the version information of the upgrade program into the upgrade program of the program of the ECU 20A. Judge whether or not to update.
Step S16 and subsequent steps are the same as those in the first embodiment. When the update to the upgrade program is possible, the upgrade program is transmitted to the ECU 20A, and when the update is impossible, the cause is displayed and the flowchart is terminated. Step S19 and subsequent steps are the same as those in FIG.
In the third embodiment, steps S23 to S25 of the first embodiment are not necessary. This is because the version management unit 50 is not provided in the third embodiment, and therefore it is not necessary to rewrite the version management unit 50.
In addition, since another structure and an effect are the same as that of 1st Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

9 and 10 show a fourth embodiment of the present invention.
The program management system 10 includes an external server 40 connected to a network 12 such as the Internet, and the external server 40 includes a dependency information management unit 51 and a server processing unit 41 stored in a server storage unit 42. The communication module 13 is connected to the bus 11 to which the diagnosis 30, the management ECU 20D, and the ECU 20 are connected. The communication module 13 and the network 12 perform wireless communication, and the external server 40, the diagnosis 30, the management ECU 20D, and the like. Communicate.
The update determination processing unit is the diagnosis processing unit 31 of the diagnosis 30.

A flow chart showing the operation of the program management system 10 is shown in FIG.
An example of updating the program of the ECU 20A to the version upgrade program stored in the diagnosis 30 will be described.
In step S60, the diagnosis 30 issues a transmission request to the management ECU 20D to transmit the version information of each ECU 20 stored in the version management unit 50 of the management ECU 20D.
In step S61, the management ECU 20D receives a transmission request from the diagnosis 30.
In step S <b> 62, the management ECU 20 </ b> D transmits the version information of each ECU 20 to the diagnosis 30.

In step S63, the diagnosis 30 receives version information.
In step S64, the diagnosis 30 issues a transmission request to the external server 40 to transmit the dependency information stored in the dependency information management unit 51 of the server storage unit 42 of the external server 40, and the version of the version upgrade program. Send information.
In step S65, the external server 40 receives the transmission request from the diagnosis 30 and the version information of the upgrade program.
In step S <b> 66, the external server 40 transmits dependency information related to the version information of the upgrade program to the diagnosis 30.
In step S <b> 67, the diagnosis 30 receives dependency relationship information from the external server 40.

In step S68, the diagnosis processing unit 31 of the diagnosis 30 converts the version information of each ECU 20 received in step S63, the dependency relationship information received in step S67, and the version information of the upgrade program to the upgrade program of the program of the ECU 20A. Judge whether or not to update.
Step S16 and subsequent steps are the same as those in the first embodiment. When the update to the upgrade program is possible, the upgrade program is transmitted to the ECU 20A, and when the update is impossible, the cause is displayed and the flowchart is terminated. Step S19 and subsequent steps are the same as those in FIG.
In addition, since another structure and an effect are the same as that of 1st Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

  Note that the version upgrade program operates a device connected to the ECU 20, and the external server 40 may be arranged in a manufacturer of the device. The diagnostic 30 transmits the upgrade program to the external server 40 before transmitting the upgrade program to the ECU 20. When the external server 40 authenticates the validity of the upgrade program and transmits the authenticated upgrade program to the diagnosis 30, the diagnosis 30 may upgrade the program of the ECU 20 using the authenticated upgrade program.

FIG. 11 shows a modification of the fourth embodiment of the present invention.
In the configuration of the program management system 10, the update determination processing unit is the server processing unit 41 of the external server 40.
Steps S60 to S63 are the same as in the fourth embodiment, and the diagnosis 30 receives the version information of each ECU 20 from the version management unit 50 of the management ECU 20D.
In step S <b> 70, the diagnosis 30 transmits the version information of each ECU 20 and the version information of the upgrade program stored in the diagnosis storage unit 32 to the external server 40.
In step S71, the external server 40 receives the version information of each ECU 20 and the version information of the upgrade program.

In step S <b> 72, the external server 40 reads dependency relationship information from the dependency information management unit 51 of the server storage unit 42.
In step S73, the server processing unit 41 of the external server 40 converts the version information of each ECU 20 received in step S70, the version information of the version upgrade program, and the dependency relationship information read out in step S71 to the version upgrade program of the ECU 20A. Judge whether or not to update.

In step S <b> 74, the server processing unit 41 of the external server 40 transmits a determination result on whether or not update to the upgrade program is possible to the diagnosis 30. If the determination result is not updateable, the current version of the ECU 20 that caused the update failure and the version necessary for the update are also transmitted to the diagnosis 30 at the same time as the determination result is transmitted.
In step S75, the diagnosis 30 receives the determination result.
Step S16 and subsequent steps are the same as those in the fourth embodiment. When the upgrade to the upgrade program is possible, the upgrade program is transmitted to the ECU 20A. When the update is not possible, the cause is displayed and the flowchart ends. Step S19 and subsequent steps are the same as those in FIG.
In addition, since another structure and an effect are the same as that of 4th Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

12 and 13 show a fifth embodiment of the present invention.
The fourth embodiment is that the server storage unit 42 of the external server 40 is provided with a program holding unit 52 for holding a program including an upgrade program, and the diagnosis processing unit 31 is provided with a download unit 53 instead of the diagnosis 30. Is different.

A flowchart showing the operation of the program management system 10 is shown in FIG.
An example in which the ECU 20A program is upgraded to a version upgrade program stored in the external server 40 will be described.
Steps S60 to S63 are the same as in the fourth embodiment, and the diagnosis 30 receives version information of each ECU 20 from the version management unit 50 of the management ECU 20D.

In step S80, the diagnosis 30 issues a transmission request to the external server 40 to transmit the dependency information stored in the dependency information management unit 51 of the server storage unit 42 of the external server 40, and the version of the version upgrade program. Send a request to send information.
In step S81, the external server 40 receives the transmission request from the diagnosis 30.
In step S <b> 82, the external server 40 reads the version information of the upgrade program from the server storage unit 42 and reads the dependency relationship information from the dependency information management unit 51.
In step S <b> 83, the external server 40 transmits the version information of the upgrade program and the dependency relationship information regarding the version information of the upgrade program to the diagnosis 30.
In step S84, the diagnosis 30 receives the dependency relationship information and the version information of the upgrade program from the external server 40.

Step S68 and step S16 are the same as in the fourth embodiment, and the diagnosis 30 updates the ECU 20A program to the upgrade program from the received version information of each ECU 20, the dependency relationship information, and the version information of the upgrade program. If the update is possible, the process proceeds to step S85.
In step S85, the diagnosis 30 issues a download request for the upgrade program to the external server 40.

In step S86, the external server 40 has received a download request.
In step S87, the external server 40 transmits the upgrade program to the diagnosis 30.
In step S88, the diagnosis 30 has received the upgrade program.
Step S17 and subsequent steps are the same as in the fourth embodiment, and the diagnosis 30 updates the program by transmitting an upgrade program to the ECU 20A. Step S19 and subsequent steps are the same as those in FIG.
In addition, since another structure and an effect are the same as that of 4th Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

  In the fifth embodiment, the diagnosis processing unit 31 of the diagnosis 30 is used as the update determination processing unit to determine whether the ECU 20A can be updated to the upgrade program. However, the server processing unit 41 of the external server 40 is updated. The diagnosis processing unit transmits the version information of each ECU 20 received from the management ECU 20D in step S63 to the external server 40, and the server processing unit 41 of the external server 40 can update the program of the ECU 20A to the upgrade program. May be judged. At this time, the determination result of whether or not update is possible is transmitted from the external server 40 to the diagnosis 30, and the operations after step S16 are performed.

14 to 16 show a sixth embodiment of the present invention.
Although it is the same structure as 4th Embodiment, the program backup area | region 25 is provided in the memory | storage part 22 which has memorize | stored the program of each ECU20A, 20B, 20C.

A flow chart showing the operation of the program management system 10 is shown in FIGS.
An example of updating the program of the ECU 20A to the version upgrade program stored in the diagnosis 30 will be described.
In FIG. 15, the step different from the fourth embodiment is step S90. When the ECU 20A receives the upgrade program from the diagnosis 30 in step S18, the ECU 20A programs the current program stored in the storage unit 22 as an old program. Save in the backup area 25. Thereafter, the upgrade program is stored in the storage unit 22 in step S19. Step S19 and subsequent steps are the same as those in FIG.

FIG. 16 shows a flowchart when the ECU 20A malfunctions after the update operation of the upgrade program to the ECU 20A shown in FIG.
In step S91, the diagnosis 30 instructs the ECU 20A to operate with the old program.
In step S92, the ECU 20A receives the command.
In step S93, the ECU 20A reads the old program stored in the program backup area 25, and stores the old program in the area where the version upgrade program is currently stored. That is, the ECU 20A switches the program so as to operate with the old version of the program.

In step S94, the ECU 20A notifies the diagnosis 30 that the operation switching in the old program has been completed.
In step S95, the diagnosis 30 receives a switch completion notification.
In step S96, the diagnosis 30 instructs the management ECU 20D to rewrite the version information of the version management unit 50 with the version of the old program.
In step S97, the management ECU 20D receives a rewrite command.
In step S98, the management ECU 20D rewrites the version information of the ECU 20A among the version information of the version management unit 50 to the version of the old program.
In step S99, the ECU 20A transmits a rewrite completion notification to the diagnosis 30.
In step S100, the diagnosis 30 receives a rewrite completion notification from the ECU 20A.

In step S101, the diagnosis 30 transmits a rewrite command to the dependency information management unit 51 of the server storage unit 42 of the external server 40, and uses the version of each ECU 20 program when the ECU 20A malfunctions as dependency relationship information. Sending.
In step S102, the external server 40 receives the rewrite command and dependency relationship information.
In step S103, the external server 40 rewrites the dependency relationship information.
In step S <b> 104, the external server 40 transmits a rewrite completion notification to the diagnosis 30.
In step S <b> 105, the diagnosis 30 receives a rewrite completion notification from the external server 40.
In addition, since another structure and an effect are the same as that of 4th Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

FIG. 17 shows a seventh embodiment of the present invention.
The program management system 10 has the same configuration as that of the fifth embodiment, but includes a program backup area 25 in the storage unit 22 that stores the programs of the ECUs 20A and 20B.
The operation of the program management system 10 of the present invention is the same as that of the flowchart of FIG. 13 of the fifth embodiment. Further, when the ECU 20A malfunctions after the update operation of the upgrade program to the ECU 20A is completed, the same operation as that of FIG. 15 of the sixth embodiment is performed.
In addition, since another structure and an effect are the same as that of 5th Embodiment, the same code | symbol is attached | subjected and description is abbreviate | omitted.

It is a block diagram which shows 1st Embodiment of the program management system of the vehicle-mounted electronic control unit which is this invention. (A) is an example of a version management unit, and (B) is an example of a dependency information management unit. It is a flowchart which shows operation | movement of a program management system. It is a flowchart which shows operation | movement of a program management system. It is a block diagram which shows 2nd Embodiment. It is a flowchart which shows operation | movement of a program management system. It is a block diagram which shows 3rd Embodiment. It is a flowchart which shows operation | movement of a program management system. It is a block diagram which shows 4th Embodiment. It is a flowchart which shows operation | movement of a program management system. It is a flowchart which shows operation | movement of the program management system which shows the modification of 4th Embodiment. It is a block diagram which shows 5th Embodiment. It is a flowchart which shows operation | movement of a program management system. It is a block diagram which shows 6th Embodiment. It is a flowchart which shows operation | movement of a program management system. It is a flowchart which shows operation | movement of the program management system at the time of malfunction of ECU after a program update. It is a block diagram which shows 7th Embodiment.

Explanation of symbols

10 Program Management System 20 (20A-20C) Electronic Control Unit (ECU)
20D management ECU
22 storage unit 23 management processing unit 24 program management unit 25 program backup area 26 version response unit 30 diagnosis 33 display unit 34 version inquiry unit 40 external server 50 version management unit 51 dependency information management unit 52 program holding unit 53 download unit

Claims (5)

A program management system for an in-vehicle electronic control unit that manages version upgrade of a program for an electronic control unit mounted on a vehicle,
A server that is connected to a plurality of the electronic control units via a bus and has a version upgrade program updated from a current program installed in the electronic control unit,
Any one of the electronic control units or the server determines a dependency information management unit that holds dependency relationship information between the current program and the upgrade program, and whether or not the dependency information can be updated to the upgrade program. An update determination processing unit,
The update determination processing unit is a program management system for an in-vehicle electronic control unit that causes the electronic control unit to transmit the upgrade program stored in the server when determining that the update is possible.   The electronic control unit or the server having the dependency information management unit or the update determination processing unit stores a version of the current program of the plurality of electronic control units connected by the bus in advance, or the electronic The in-vehicle electronic control unit program management system according to claim 1, further comprising a version inquiry unit that inquires the control unit about the version of the current program.   The program management of the vehicle-mounted electronic control unit according to claim 1 or 2, wherein the server receives the version upgrade program or / and dependency information between programs from an external server via wireless communication. system.   4. The on-vehicle electronic control unit program management according to claim 1, wherein the server is a server accommodated in a diagnosis connected to the electronic control unit via the bus. 5. system.   5. The on-vehicle electronic control unit program management system according to claim 1, wherein each electronic control unit includes a program backup area for storing a current program before upgrading as an old program. 6.

Images