JP2010195111A - Onboard computer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To update a program for each device included in an onboard machine, as safely as possible to minimize the effect of a failure even when an unexpected failure occurs. <P>SOLUTION: A master unit includes: a slave update control means which controls an update order to, in a hierarchical structure of slave control means, preferentially update a computer program executed by a slave control means on a lower layer and subsequently update a computer program for a slave control means one hierarchical level higher than the lower layer; and a master update control means which controls an update order to, in a hierarchical structure of the master control means, preferentially update a computer program executed by a master control means on a lower layer and subsequently update a computer program for a master control means one hierarchical level higher than the lower layer after a slave update means updates the computer programs for slave units to be updated. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technique for updating a computer program included in an in-vehicle computer system.

The in-vehicle device includes a plurality of control devices, and each control device is connected to each other via an in-vehicle network. Among these control devices, for example, called a master unit or master ECU (Electronic Control Unit), a device that manages the entire vehicle-mounted device, called a slave unit or slave ECU, and connected to the master unit There is a device for executing the processing in charge.

  Further, both the master unit and the slave unit may have a control unit such as a microcomputer (hereinafter simply referred to as a microcomputer) including a processor and a memory over a plurality of layers. For example, the multiple hierarchy refers to a parent-child relationship structure in which lower-level control units share and execute processing according to instructions from the higher-level control unit. Therefore, in the in-vehicle device, a plurality of control units construct a parent-child relationship, and the in-vehicle device constructs a tree structure of the control unit. And each control part provides each function by running the computer program expand | deployed on memory.

  A technology that reads various control programs to be incorporated into multiple devices on the vehicle from the outside, saves them in EEPROM, and designates various devices on the vehicle through the transmission path to transfer the corresponding control programs from the EEPROM. Has also been proposed (for example, Patent Document 1 below).

JP 2004-140996 A JP 2006-172093 A JP 2006-189973 A

  However, in the conventional technology, when each device included in the in-vehicle device has a parent-child relationship and has a complicated tree structure, when updating the control program of each device, the update fails. Consideration is not enough. For example, while updating the device program, the power supply may be interrupted due to an erroneous operation or a battery shortage, and the program being updated may be destroyed.

  An object of the present invention is to provide a technique for updating the program of each device included in an in-vehicle device as safely as possible and reducing the influence of the failure as much as possible even when an unexpected failure occurs.

  The present invention employs the following means in order to solve the above problems. That is, one aspect of the present invention is exemplified as an in-vehicle system including a master unit and one or more slave units connected via an in-vehicle network.

Here, the master unit has connection means to a network outside the vehicle, connection means to the in-vehicle network, and a plurality of master control means forming a hierarchical structure. The plurality of master control means includes at least a part of the first master control means that instructs other master control means to execute at least a part of the processes, and the process instructed by the first master control means. A second master control means for instructing the third master control means to execute another part when there is a third master control means for executing and executing at least another part of the process. A hierarchical structure including at least two layers is formed. Each of the plurality of master control means includes storage means for storing the computer program in an executable form, and processing means for executing the computer program stored in the storage means.

  On the other hand, the slave unit has the same configuration as that of the master unit except that the slave unit includes a connection unit to the in-vehicle network and a plurality of slave control units that form a hierarchical structure.

  Then, the master unit obtains an update program for updating each computer program through a connection means to a network outside the vehicle, stores the update program in a nonvolatile storage means, and a slave control means for the slave unit In the hierarchical structure, the computer program executed by the slave control means in the lower layer is preferentially updated, and the computer program executed by the slave control means in the lower layer is updated and then executed by the slave control means in the upper hierarchy of the lower layer. Slave update control means for controlling the update order so as to update the computer program to be updated, and after the computer program of the slave unit to be updated is updated by the slave update means, the master control of the lower layer in the hierarchical structure of the master control means Control executed by means The master update that controls the update order so that the computer program executed by the lower-level master control means is updated and then the computer program executed by the lower-level master control means is updated. Control means.

  In this configuration, in updating the computer program of the in-vehicle system, the slave unit is updated before the master unit. Since the update program is held in the master unit, even if the update in the slave unit fails, the update program can be immediately updated again with the update program held in the master unit. On the other hand, when the update in the master unit is performed first and fails, the update program for the entire in-vehicle system cannot be used, and there is a high possibility that the entire update program must be acquired again. There is a high possibility that the above-described exemplary embodiment can avoid such a situation.

  In addition, in each update of the slave unit and the master unit, the lower layer of each hierarchical structure of the slave control unit and the master control unit is updated first. In general, problems in updating a program often occur at the initial stage of the update. Therefore, by updating the computer program executed in the lower layer of the hierarchical structure first, it is possible to limit the occurrence of the problem or the influence of the update failure to the lower side of the hierarchical structure, that is, a narrow range in the system. Is expensive.

  According to the present invention, the program of each device included in the in-vehicle device is updated as safely as possible, and even when an unexpected failure occurs, the influence of the failure can be minimized.

It is an example of a block diagram of an in-vehicle system. It is a figure which shows the specific example of a master unit. It is an example of the management table of a slave unit. It is an example of the management table of the microcomputer in one slave unit. It is a figure which illustrates the processing flow of the program update process of a vehicle-mounted system. It is a figure which illustrates the detail of the program update process with respect to a slave unit. It is a figure which illustrates the update process by the parent microcomputer by the side of a slave unit. It is a figure which illustrates the recovery process by the parent microcomputer by the side of a slave unit. FIG. 10 is a diagram illustrating a program update process of a slave unit according to the second embodiment. FIG. 10 is a diagram illustrating a program update process after an accessory power supply is stopped according to a third embodiment. FIG. 10 is a diagram illustrating a program update process according to a fourth embodiment.

  Hereinafter, an in-vehicle system according to the best mode for carrying out the present invention (hereinafter referred to as an embodiment) will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

<System overview>
FIG. 1 illustrates a configuration diagram of the in-vehicle system. This in-vehicle system includes a master unit 10 and one or more slave units 20 and 30 connected via an in-vehicle LAN (Local Area Network) 2 (corresponding to the in-vehicle network of the present invention). In the present embodiment, two slave units 20 and 30 will be described. However, the number of slave units is not limited to two, and may be one, or may be three or more. . Various standards have been proposed for the in-vehicle LAN, and examples thereof include AVC-LAN and MOST (Media Oriented Systems Trans-port).

Each of the master unit 10 and the slave units 20 and 30 is an ECU (Electronic
Control Unit) and includes a plurality of microcomputers (hereinafter referred to as microcomputers). These microcomputers constitute a hierarchical parent-child relationship. That is, in the example of FIG. 1, the master unit 10 includes a parent microcomputer 11 and child microcomputers 11 </ b> A and 11 </ b> B managed by the parent microcomputer 11. Here, “managed” means that, for example, a part of the function provided by the parent microcomputer is shared and processed in accordance with an instruction from the parent microcomputer 11. Further, the child microcomputer 11B further manages the grandchild microcomputer 11C. These microcomputers are connected by a bus (indicated by “internal connection” in FIG. 1). A plurality of parent microcomputers 11, child microcomputers 11A and 11B, grandchild microcomputers 11C, and the like correspond to master control means.

  Similarly, the slave unit 20 includes a parent microcomputer 21, child microcomputers 21A and 21B, and a grandchild microcomputer 21C. The slave unit 30 includes a parent microcomputer 31, child microcomputers 31A and 31B, and a grandchild microcomputer 31C. A plurality of parent microcomputers 21, 31, child microcomputers 21A, 21B, 31A, 31B, grandchild microcomputers 21C, 31C, and the like correspond to slave control means. In the example of FIG. 1, each of the master unit 10 and the slave units 20 and 30 has two child microcomputers and one grandchild microcomputer, but the hierarchical relationship of the microcomputers is limited to such a structure. Do not mean.

  This in-vehicle system is a center server on a backbone network (also referred to as a core network) by a wireless communication medium, for example, an in-vehicle data communication module (DCM), a mobile phone, a PHS (Personal Handyphone System), a wireless LAN, or the like. Communicate with 3. The master unit 10 of the in-vehicle system acquires the latest version of the program from the center server 3 and updates the computer program executed in the master unit 10 and the slave units 20 and 30 to the latest version.

FIG. 2 shows a specific example of the master unit 10. In this example, the parent microcomputer 11 of the master unit 10 includes a CPU 12 (corresponding to the processing means of the present invention), a ROM (Read Only Memory) 13, a RAM (Random Access Memory) 14, and an I / O interface 15. The ROM 13 is, for example, a flash memory, and can be written once and rewritten after erasing data. In this sense, the ROM 13 of this embodiment is also called a non-volatile memory (corresponding to the storage means of the present invention) and is not a non-writable memory. In the ROM 13, the computer program executed by the CPU 12 is expanded into a format that can be executed and stored at a predetermined address. The executable format is a computer program described in the machine instruction sequence of the CPU 12, and each part (module) of the computer program is directly or indirectly assigned to each address. For example, by a control instruction such as a JUMP instruction This means that the modules are connected and arranged so that the CPU 12 can process the machine instruction in accordance with the instruction of the counter indicating the machine instruction to be executed next.

  The ROM 13 temporarily stores programs to be installed in the slave units 20 and 30. On the other hand, the RAM 14 is a dynamic RAM, for example, and holds data processed by the CPU 12.

  In FIG. 2, a tuner unit is illustrated as an example of the child microcomputer 11B. The tuner unit includes a CPU 11B, a ROM 13B, an I / O interface 15B, and a tuner 16B. The I / O interface 15B connects the CPU 12B of the child microcomputer 11B and the CPU 12 of the parent microcomputer 11 through the bus and the I / O interface 15 of the parent microcomputer. The CPU 12B executes a computer program developed on the ROM 13B and controls the tuner 16B. The ROM 13B is, for example, a flash memory, and can be written once and rewritten after erasing data. In the ROM 13B, a computer program executed by the CPU 12B is expanded into a format that can be executed and stored at a predetermined address. For example, the tuner 16B receives information transmitted from the server 3 as a wireless communication signal. A grandchild microcomputer may be further provided inside the tuner 16B.

  The CPU 12B of the child microcomputer 11B delivers the information received by the tuner 16B to the CPU 12 of the parent microcomputer via the I / O interface 15B, the bus, and the I / O interface 15.

  In FIG. 2, a video unit including a video interface 15C and a video decoder 16C is illustrated as an example of another child microcomputer. For example, the configuration of the child microcomputer is included in the video decoder 16C. In this case, a grandchild microcomputer is further provided under the child microcomputer according to the complexity of the function. Further, a display operation panel 17C is connected to the video decoder 16C. The display operation panel 17C displays the video data and the graphics object on the screen, and detects a user operation on the graphics object. That is, the display operation panel 17C is a so-called touch panel.

  In FIG. 2, a configuration including an audio interface 15D and a power amplifier 16D is illustrated as an example of another child microcomputer. For example, the configuration of the child microcomputer is included in the power amplifier 16D. In this case, a grandchild microcomputer is further provided under the child microcomputer according to the complexity of the function.

  Further, in FIG. 2, an input operation unit 16E is connected to the I / O interface 15 through the I / O interface 15E. The input operation unit 16E is, for example, an operation button row. Alternatively, the input operation unit 16E may be a remote controller interface including a light receiving unit that receives infrared rays from a remote controller and a signal processing unit. The input operation unit 15E is also provided with at least one child microcomputer.

In addition, a removable storage medium input / output device 16F is connected to the I / O interface 15 through the I / O interface 15F. The removable storage medium input / output device 16F is, for example, a CD-ROM (Compact Disk Read Only Memory) reader, a DVD (Digital Versatile Disk) drive, a Blu-ray disc drive, a flash memory card input / output device, or the like. The detachable storage medium input / output device 16F is also provided with at least one child microcomputer.

  Further, the in-vehicle LAN 2 is connected to the I / O interface 15 through an interface to the in-vehicle LAN 2 (corresponding to the connection means to the in-vehicle network of the present invention). The slave units 20 and 30 have the same configuration as the master unit 10. However, although the slave units 20 and 30 include an interface to the in-vehicle LAN 2 (corresponding to the connection means to the in-vehicle network of the present invention), the connection means to the outside such as the tuner 16B and the removable storage medium input / output device 16F are Not included.

  Therefore, in the master unit 10, according to the configuration of the equipment to be equipped, the microcomputers are hierarchically connected under the parent microcomputer 11 such as the child microcomputers 11B and 11C and the grandchild microcomputer 11D (see FIG. 1). Is done.

  The hierarchical structures of the parent microcomputer, the child microcomputer, and the grandchild microcomputer as described above exist in the slave units 20 and 30 as well. The slave unit 20 is, for example, an air conditioner control device. The slave unit 30 is, for example, a digital television control device.

  In this in-vehicle system, when upgrading the computer program of each microcomputer, the parent microcomputer 11 of the master unit 10 accesses the center server 3 through the tuner unit 11B and acquires the update program. However, the parent microcomputer of the master unit 10 may acquire the update program from a portable medium (DVD, CD, memory card, etc.) through the removable storage medium input / output device 16F.

  Then, the parent microcomputer 11 of the master unit 10 updates the computer program executed by each of the master unit 10 and the slave units 20 and 30. In this case, the in-vehicle system updates the computer program of each microcomputer so as to suppress as much as possible the possibility that a failure accompanying the update of the computer program affects the entire in-vehicle system.

  Hereinafter, each slave unit is referred to as a slave unit 20 with a reference number attached. On the other hand, when a plurality of slave units are collectively referred to, the reference number is omitted and the slave unit is simply referred to as a slave unit.

<Data structure>
3 and 4 show examples of data that the master unit 10 refers to in order to update the program of each part of the in-vehicle system. FIG. 3 is an example of a management table of slave units connected to the master unit 10 by the in-vehicle LAN 2. The slave unit management table is held in the ROM 13 of the master unit 10.

As shown in FIG. 3, each record of the slave unit management table includes a device ID of the slave unit, a model number, and an address of the in-vehicle LAN 2. The device ID of the slave unit is information for identifying the slave unit. For example, the device ID is a node name on the in-vehicle LAN 2 of each device (ECU such as a master unit and a slave unit). The model number is a management code in the manufacturer of those devices. For example, the center server 3 can be accessed using the model number as a key, and detailed information regarding the device, for example, the component configuration in the device, the number of microcomputers, the hierarchical structure of a plurality of microcomputers, and the like can be acquired. The address of the in-vehicle LAN 2 is an address when the master unit 10 accesses the slave unit.

  The slave unit management table is maintained as follows. For example, when the slave unit 20 is incorporated and communication is first performed between the master unit 10 and the slave unit 20, information on the slave unit 20 may be stored in the management table of the slave unit. By referring to the management table of the slave unit, the CPU 12 of the master unit 10 determines whether or not each slave unit 20 or the like connected to the in-vehicle LAN 2 exists, the model number, and the on-vehicle LAN 2 for accessing the slave unit 20 or the like. Can be recognized. The model number may be input from the operation display panel 17C and recorded in association with the device ID when the slave unit 20 or the like is installed. Further, the slave unit management table as shown in FIG. 3 may be stored in the nonvolatile memory when the vehicle-mounted system is shipped from the factory.

  FIG. 4 is an example of a management table of a microcomputer that is one of the slave units and is included in the slave unit specified by the device ID (ECU1). A microcomputer management table is provided for each master unit 10 or each slave unit, and manages the microcomputers included in each. Each record of the microcomputer management table includes a microcomputer ID, a child ID, a parent ID, and a communication microcomputer flag.

  For example, when the device ID is a slave unit of the ECU 1, ID1-ID5 is exemplified as the microcomputer. There are still ID2 and ID3 as child IDs of the microcomputer of ID1. In this example, ID2 and ID3 microcomputers are child microcomputers of the ID1 microcomputer. The ID1 microcomputer is the parent microcomputer of the ID2 and ID3 microcomputers. The designation of the parent microcomputer of the ID1 microcomputer is blank ("-"), indicating that the ID1 microcomputer is positioned at the top of the hierarchical structure.

  Furthermore, the microcomputer flag for communication indicates that the microcomputer whose ID is ID5 is a communication microcomputer. Such a microcomputer management table may be acquired from the center server 3 and stored in the ROM 13.

  That is, when the master unit 10 first establishes communication with the slave unit (for example, ECU 1) and recognizes the ECU 1, the master unit 10 registers the device ID of the slave unit in the management table of the slave unit, and from the center server 3 The slave unit microcomputer management table may be acquired and stored in the nonvolatile memory.

<Processing flow>
FIG. 5 illustrates a processing flow of the program update process of the in-vehicle system. The processing in FIG. 5 is realized by the CPU 12 of the master unit 10 executing a computer program loaded in a nonvolatile memory. The CPU 12 detects a user operation on the input / output operation unit 16E of the master unit 10 and activates the processing shown in FIG. Note that the processing of FIG. 5 may be activated by an operation on the display operation panel 17C instead of an operation on the input / output operation unit 16E.

In this process, the master unit 10 first downloads encrypted data obtained by encrypting the system update program from the center server 3, and stores it in the RAM 14 of the master unit 10 (S5). Then, the master unit 10 decrypts the downloaded program on the RAM 14 of the master unit 10 and stores it in the nonvolatile memory (S7). The CPU 12 of the master unit 10 that executes the process of S7 corresponds to means for acquiring the update program of the present invention and storing it in the nonvolatile storage means.

  Next, the master unit 10 determines an update target device whose program is to be updated by the update program (S8). The list of devices to be updated may be downloaded from the center server 3 together with the update program. Then, the master unit 10 collates the update target device list (model number list) with the model numbers of the slave unit management table (FIG. 3), and determines the update target device mounted in the in-vehicle system. Good.

  Next, the master unit 10 updates the program of the slave unit using the decrypted update program (S9). Then, the master unit 10 determines whether or not the programs of all the slave units to be updated have been updated (S10). If there is an unupdated slave unit to be updated, the master unit 10 returns the control to S9 and repeats the program update process for the remaining slave units to be updated.

  On the other hand, when the update processing of all the update target slave units is completed, the master unit 10 next determines whether or not the master unit 10 itself is an update target (S12). Then, when the program of the master unit 10 is included in the update target by the update program, the master unit 10 updates the update target program of the master unit 10 itself (S13). The CPU 12 of the master unit 10 that executes the process of S13 corresponds to the master update control means of the present invention.

  FIG. 6 illustrates details of the slave unit program update process (S9 in FIG. 6). In this process, the master unit 10 searches the next microcomputer by following the hierarchical structure of the microcomputer in the slave unit to be updated based on the microcomputer management table (see FIG. 4) of each slave unit (S91). Here, the next microcomputer is a microcomputer located at the lowest position in the hierarchical structure. For example, when there are three layers of a parent microcomputer, a child microcomputer, and a grandchild microcomputer, the grandchild microcomputer is first updated. The microcomputer located at the lowest level in the hierarchical structure can be searched by following the management table of the microcomputer shown in FIG. If there are a plurality of microcomputers in the same hierarchy, the microcomputer found first in the microcomputer management table of FIG. 4 is processed first.

  Then, it is determined whether or not the retrieved microcomputer is a program update target (S93). What is necessary is just to make it download the identification information of the microcomputer of the update object of a program from the center server 3 with an update program, for example. If the next microcomputer searched in S91 is a program update target, the slave unit is instructed to update the microcomputer program (S95). The program is updated, for example, by writing the program corresponding to the address on the nonvolatile memory of the slave unit executed by the microcomputer. The program writing process to the nonvolatile memory of the slave unit is performed, for example, by transferring the ID of the microcomputer to be updated and the update program of the microcomputer from the master unit 10 (parent microcomputer 11) to the slave unit and writing to the slave unit. Can be requested. The CPU 12 of the master unit 10 that executes the processes of S91 to S95 corresponds to the slave update control means of the present invention.

Next, the master unit 10 determines whether or not the confirmation of program update of all the microcomputers has been completed for the slave unit (S97). If the program update processing of all the microcomputers has not been completed, the master unit 10 returns the control to S91 and searches for the next microcomputer in the hierarchical structure of the microcomputers in the slave unit. This process is repeated from the lowest layer microcomputer to the parent microcomputer in the hierarchical structure. On the other hand, when the confirmation of program update for all the microcomputers is completed, the master unit 10 ends the process.

  Here, the processing of FIG. 6 is executed by the master unit 10, but the processing of S91 to S97 may be executed by the parent microcomputer of the slave unit.

  FIG. 7 illustrates an update process by the parent microcomputer on the slave unit side. In this process, the slave unit receives the ID of the microcomputer to be updated and the update program from the master unit 10 (S31). Next, the master microcomputer on the slave unit side stores the update program for the communication microcomputer among the received update programs in the nonvolatile memory (S32). The communication microcomputer is a microcomputer that controls an interface with the in-vehicle LAN 2.

  In S32, the communication microcomputer update program is stored in the nonvolatile memory, but the communication microcomputer update program may be stored in the nonvolatile memory. When the update program is saved, the update can be executed again when the update fails. In addition, when the pre-update program is saved, it can be restored to the pre-update state when the update fails. Therefore, it is only necessary to store at least one of the communication microcomputer update program or the pre-update program. The parent microcomputer of the slave unit that executes this processing corresponds to means for storing at least one of the computer program update program for controlling the connection means to the in-vehicle network of the present invention and the computer program before update.

  Next, the start of the update process is stored in the nonvolatile memory (S33). This corresponds to means for recording in the nonvolatile storage device that the parent microcomputer of the slave unit executing the processing of S33 has started the update of the computer program of the present invention.

  Then, the parent microcomputer updates the program of the microcomputer to be updated. That is, the update program is written in the storage location (nonvolatile memory address) of the program corresponding to the microcomputer ID designated by the master unit 10 (S35).

  When the update is completed, the parent microcomputer on the slave unit side stores the update completion in the nonvolatile memory (S39). The parent microcomputer of the slave unit that executes the process of S39 corresponds to means for recording in the nonvolatile storage device that the update of the computer program of the present invention has been completed.

  FIG. 8 illustrates recovery processing by the parent microcomputer on the slave unit side. This is because, for example, when the parent microcomputer on the slave unit side shuts off the power while executing the program update process of any microcomputer belonging to the slave unit, the next time the power is turned on again It is processing. This process is executed whenever the power is turned on.

  In this process, the parent microcomputer on the slave unit side searches the nonvolatile memory for whether or not there is a record in which the update is started and the update is not completed. When such a recording is detected, the parent microcomputer on the slave unit side determines that the update is not completed (S53). The master microcomputer of the slave unit that executes the process of S53 corresponds to means for determining that the update of the present invention has been interrupted.

In that case, the parent microcomputer on the slave unit side determines whether or not the update program stored in the nonvolatile memory is normal (S55). That is, if the power is shut off during program update, the update program may not be stored in the nonvolatile memory in a complete state. Whether or not the update program stored in the non-volatile memory is normal (whether or not the program is destroyed) can be determined by giving a checksum value to the update program downloaded from the center server 3, for example. That's fine. Then, the checksum of the update program stored in the nonvolatile memory may be calculated to determine whether or not it matches the checksum downloaded from the center server 3. The parent microcomputer of the slave unit that executes the process of S55 corresponds to means for determining whether or not the update program of the present invention has been destroyed.

  If the program is not normal, the parent microcomputer on the slave unit side determines whether the destroyed program is a program for the communication microcomputer (S56). If the communication microcomputer program is not destroyed, the parent microcomputer on the slave unit side designates the ID of the microcomputer to be updated to the master unit 10 and requests retransmission of the update program (S57). The parent microcomputer of the slave unit that executes the process of S57 corresponds to a means for requesting another transmission of the present invention. Then, the parent microcomputer on the slave unit side receives the update program again (corresponding to means for acquiring again by the parent microcomputer of the slave unit that executes this processing), and updates the program of the microcomputer to be updated (S58). ).

  On the other hand, when the communication microcomputer program is destroyed, the parent microcomputer on the slave unit side reads the communication microcomputer program from the nonvolatile memory and re-executes the update process (S59). The parent microcomputer of the slave unit that executes the process of S59 corresponds to means for restoring control of the means for connecting to the network of the present invention. Then, after the program update of the communication microcomputer is completed, the slave microcomputer on the slave unit side stores the update completion in the nonvolatile memory (S60).

  As described above, according to the in-vehicle system according to the present embodiment, the program of the slave unit is updated before the master unit 10. When the update of the program of the master unit 10 fails, for example, the recovery program can be recovered through the input / output device of the removable storage medium, and the update program can be downloaded from the center server 3 again. However, in that case, all programs must be downloaded. In other words, the entire in-vehicle system is updated again. On the other hand, if the program on the slave unit side is updated first and the update fails as in this embodiment, the update program remains in the non-volatile memory of the master unit 10, so it can be re-executed with a small load. The slave unit program can be updated again.

  However, in the case of a slave unit, the input / output device 16F of a detachable storage medium is not usually connected like the master unit 10 is. Therefore, communication between the master unit 10 and the slave unit through the in-vehicle LAN 2 becomes an important recovery means. Therefore, in this embodiment, as shown in FIG. 8, on the slave unit side, the update program of the communication microcomputer for communicating with the master unit 10 through at least the in-vehicle LAN 2 or the communication program before the update is stored in the nonvolatile memory of the parent microcomputer. Save in memory. As a result, even if an unexpected situation such as power interruption occurs when the communication program is updated, at least the communication function with the master unit 10 can be restored on the slave unit side.

  In updating the program for the slave unit, the program of the microcomputer located at the lower position in the hierarchical microcomputer configuration of the parent microcomputer, the child microcomputer, or the grandchild microcomputer was first updated. Since the lower-level microcomputer has a smaller influence range when the program update fails, the program can be updated more safely by the above procedure. For example, even if a situation occurs in which there is a problem with the update program itself and the update fails, the problem can be identified as early as possible in a range with little influence.

  In this embodiment, on the slave unit side, the parent microcomputer records the update start and update completion of each microcomputer program in the nonvolatile memory. Then, when the power of the in-vehicle system is turned on, the update of the program is started, and it is determined whether or not there is a record that has not been updated. This makes it possible to detect an update process that has been interrupted during the update. Further, when such an interruption is detected, the parent microcomputer next checks whether or not the update program has been destroyed. If the communication program is destroyed, the communication function is restored based on the program saved by the parent microcomputer. If a program other than the communication program is destroyed, an update program is acquired again from the master unit. As described above, according to the in-vehicle system, it is possible to detect the interruption of the update and the destruction of the program, and it is possible to reduce the occurrence of problems associated with the update of the program as much as possible.

  In the first embodiment, on the slave unit side, the communication microcomputer update program is temporarily stored in the nonvolatile memory, and then the program is updated. By such a procedure, at least the recovery means through the in-vehicle LAN 2 between the master unit 10 and the slave unit was maintained. Instead of such a configuration, that is, instead of temporarily storing the communication microcomputer update program in the nonvolatile memory, the slave unit cannot be recovered by devising the microcomputer program update procedure in the slave unit. Can be reduced to some extent.

  FIG. 9 shows another example of the program update process of the slave unit. This processing differs from the case of FIG. 6 in that the program is updated last for the communication microcomputer.

  That is, the master unit 10 searches the microcomputer management table of FIG. 5 with priority given to the lowest layer of the hierarchical structure among the microcomputers included in the slave unit, except for the communication microcomputer (S91A). Since the subsequent processing of S93-S97 is the same as that in the case of FIG. 6, the description thereof is omitted. When the program update confirmation is completed for the microcomputers other than the communication microcomputer, the master unit 10 determines whether or not the communication microcomputer is a program update target (S98). When the communication microcomputer is a program update target, the master unit 10 instructs to update the communication microcomputer program in the microcomputer included in the slave unit (S99).

  By taking such a procedure, even if there is a problem in the update program and the update fails, the possibility that the problem will occur before the program update of the communication microcomputer can be increased. For example, although omitted in FIG. 9, each microcomputer may perform an operation check every time the program update of the microcomputer ends. The operation check may be executed when the program update of the microcomputer to be updated other than the communication microcomputer is completed.

  Then, when the problem occurs, the update process is stopped and the slave unit may notify the master unit 10 that the problem has occurred. Such a procedure can reduce the possibility of program update failure in the communication microcomputer. When a failure occurs in the communication microcomputer, communication with the master unit 10 becomes impossible and the slave unit may not be used. Such a possibility can be reduced as much as possible.

In the second embodiment, instead of temporarily storing the update program for the communication microcomputer in the nonvolatile memory, the program update procedure for the communication microcomputer in the slave unit is made last to reduce the occurrence of problems to some extent. However, instead of such a procedure, the communication microcomputer update program may be temporarily stored in the nonvolatile memory, and the communication microcomputer program update in the slave unit may be last. By such a combination, it is possible to reliably maintain the means for restoring the communication between the master unit 10 and the slave unit, and further reduce the occurrence of program update failures in the communication microcomputer.

(Program update after turning off accessory power)
In the first embodiment, the program in a state where sufficient power can be supplied to the in-vehicle system, that is, the power source (for example, the engine) of the vehicle is starting and power is supplied from the accessory power source. The update process has been described. However, if the in-vehicle system program is updated while the vehicle is operating, the in-vehicle system itself cannot be used. For this reason, after the power source of the vehicle is stopped (after the accessory power supply is stopped), the user is provided with a function of driving the in-vehicle system with a secondary battery such as a battery and updating the program.

  FIG. 10 illustrates a program update process after the accessory power supply is stopped. This process is executed when the master unit 10 receives a user instruction through the input operation unit 16E or the display operation panel 17C. The CPU 12 of the master unit 10 that detects the instruction corresponds to a means for receiving an instruction to execute the update in the secondary battery mode of the present invention.

  Upon receiving such an instruction, the master unit 10 executes the following process when the in-vehicle system is driven by the secondary battery after the accessory power supply is shut off. In this process, the master unit 10 confirms the state of charge of the secondary battery (S1). The state of charge of the secondary battery can be determined from the terminal voltage of the secondary battery, for example.

  Then, the master unit 10 determines whether or not the charge amount is sufficient (S3). What is necessary is just to determine the reference value of whether charge amount is enough from the time required for a program update process. For example, it is assumed that the time required for the program update of the in-vehicle system is T2 minutes by a preliminary test or the like. On the other hand, the open terminal voltage V of the secondary battery and the operating time T of the in-vehicle system are related and mapped, and stored in the nonvolatile memory. Then, the open terminal voltage V2 corresponding to the amount of charge required for the operation of T2 may be obtained from the map and used as a reference value. Then, when the open terminal voltage V exceeds the reference value V2, it may be determined that the charge amount is sufficient. The CPU 12 of the master unit 10 that executes the process of S3 corresponds to means for detecting the state of charge of the present invention.

  When the charge amount is insufficient, the master unit 10 displays a message indicating that the charge amount of the secondary battery is insufficient, for example, on the display / operation panel 17C of the in-vehicle system (S21), and ends the process. Instead of such a message, a predetermined warning may be displayed with a light emitting diode or the like. The CPU 12 of the master unit 10 that executes the process of S21 corresponds to the notification means of the present invention. On the other hand, when the amount of charge is sufficient, the master unit 10 performs the process of S5-S13. This process is the same as in the first and second embodiments.

  Then, after updating the program of the slave unit and the master unit 10 itself, the master unit 10 checks whether or not each slave unit has shut off the power (S15). The CPU 12 of the master unit 10 that executes the process of S15 corresponds to means for determining whether or not the power supply is shut off after the completion of the update of the present invention.

When the power of the slave unit is not shut off, for example, a warning message may be displayed on the display / operation panel 17C or a warning by a light emitting diode or the like may be displayed. Further, a warning may be issued by a sound such as a buzzer. And the master unit 10 returns control to S15, and confirms again whether the slave unit interrupted | blocked the power supply. Instead of checking whether each slave unit shuts off the power, when the program update is completed in each slave unit, the master unit 10 forces the power of the slave unit that has been updated. You may make it interrupt.

  On the other hand, when the power of all the slave units is cut off, the master unit 10 cuts off the power of the master unit 10 itself (S19). The CPU 12 of the master unit 10 that executes the process of S19 corresponds to means for shutting off the power supply of the master unit 10 of the present invention.

  As described above, according to the present embodiment, the program update process can be executed safely even after the accessory power supply is shut off. In addition, after the program update is completed, the power to the slave unit and the master unit 10 can be surely cut off, and the secondary battery can be prevented from being consumed.

  Further, according to this embodiment, when the charging state of the secondary battery is not sufficient, the master unit displays a message indicating that the charging amount of the secondary battery is insufficient, and ends the process. Therefore, it is possible to suppress activation of the program update process in an insufficient battery state where the update process is interrupted in the middle.

  FIG. 11 illustrates a program update process according to the fourth embodiment. This process is a process when the in-vehicle LAN 2 is a ring network. In the case of a ring network, when any one of the master unit 10 and the slave unit connected to the network stops, the communication of the entire in-vehicle system is cut off. Therefore, in the case of a ring network, the time is set after the program update is completed, and the master unit 10 and the slave unit simultaneously shut off the power. Other configurations and operations are the same as those in the third embodiment. Therefore, the same processing steps are denoted by the same reference numerals and description thereof is omitted.

  That is, in FIG. 11, the processing from S1 to S13 and the processing of S21 are the same as those in FIG. In the fourth embodiment, after the program update is completed (YES in S11), the master unit 10 transmits an instruction to each slave unit to shut off the power after a predetermined time (for example, T1 seconds) (S15A). ). The CPU 12 of the master unit 10 that executes the process of S11 corresponds to means for determining whether or not the update of the present invention has been completed. Further, the CPU 12 of the master unit 10 that executes the process of S15 corresponds to means for transmitting an instruction to shut down the power supply of the slave unit of the present invention to the slave unit.

  Then, the master unit 10 measures a predetermined time (T1 second) (S17A). The CPU 12 of the master unit 10 that executes the process of S17 corresponds to the measuring means of the present invention. The time measurement may be realized, for example, by calling the clock function of the master microcomputer of the master unit 10 and the clock function of the OS from an API (application interface). At this time, the same measurement is performed in each slave unit.

  Then, after a predetermined time (T1 second) has elapsed, the master unit 10 shuts off the power (S19). Similarly, each slave unit also cuts off the power. The CPU 12 of the master unit 10 that executes the process of S19 corresponds to means for shutting off the power supply of the master unit 10 after a predetermined time of the present invention has elapsed.

  According to the procedure as described above, even in the in-vehicle LAN 2 of the ring network, the power supply to the master unit 10 and the slave unit can be shut off after executing the program update by the secondary battery, and the consumption of the secondary battery can be suppressed.

<Others>
The functions of the in-vehicle system described above can be realized as a computer executed by each parent microcomputer and child microcomputer included in the master unit 10, the slave unit, and the like. In addition, these computer programs can be stored in a medium that can be input / output by the removable storage medium input / output device 16F, and can be installed in the in-vehicle system. The in-vehicle system can also download these computer programs from a network outside the vehicle through the tuner 16B and install them in the in-vehicle system.

1 In-vehicle system 2 In-vehicle LAN
3 Center server 10 Master unit 11, 21, 31 Parent microcomputer 12 CPU
13 ROM
14 RAM
15, 15B I / O interface 11A, 11B, 11C Child microcomputer 20, 30 Slave unit 21A, 21B, 21C, 31A, 31B, 31C Child microcomputer

Claims (5)

It has a master unit and one or more slave units connected via the in-vehicle network,
The master unit is
Means for connecting to a network outside the vehicle;
Means for connecting to the in-vehicle network;
A plurality of master control means forming a hierarchical structure,
The plurality of master control means includes a first master control means for instructing another master control means to execute at least a part of the processes, and at least a part of the processes instructed by the first master control means. And a second master for instructing the third master control means to execute the other part when there is a third master control means for executing at least another part of the process. Forming a hierarchical structure of at least two layers including control means;
Each of the plurality of master control means includes storage means for storing a computer program in an executable form, and processing means for executing the computer program stored in the storage means,
The slave unit is
Means for connecting to the in-vehicle network;
A plurality of slave control means forming a hierarchical structure,
The plurality of slave control means include a first slave control means for instructing other slave control means to execute at least a part of the processes, and at least a part of the processes instructed by the first slave control means. And a second slave that instructs the third slave control means to execute the other part when there is a third slave control means that executes at least another part of the process. Forming a hierarchical structure of at least two layers including control means;
Each of the plurality of slave control means includes storage means for storing a computer program in an executable form, and processing means for executing the computer program stored in the storage means,
The master unit is
Means for acquiring an update program for updating the respective computer program through the connection means to the network outside the vehicle, and storing the update program in a nonvolatile storage means;
For the slave unit, in the hierarchical structure of the slave control means, the computer program executed by the lower slave control means is preferentially updated, and after updating the computer program executed by the lower slave control means, Slave update control means for controlling the update order so as to update the computer program executed by the slave control means of the upper hierarchy of the lower layer;
After the computer program of the slave unit to be updated is updated by the slave update control unit, in the hierarchical structure of the master control unit, the computer program executed by the lower master control unit is preferentially updated, and the lower layer An in-vehicle computer having master update control means for controlling an update order so as to update the computer program executed by the master control means in the upper layer after the update of the computer program executed by the master control means system. The uppermost slave control means of the hierarchical structure of the slave units is:
Means for storing at least one of an update program of the communication program for controlling the connection means to the in-vehicle network and a communication program before the update;
Means for recording in the non-volatile storage device that the update of the computer program has started;
Means for recording in the nonvolatile storage device that the update of the computer program has been completed;
Means for determining that the update is interrupted before the end after the start of the update of the computer program when the power is turned off and then turned on again;
Means for determining whether the update program is destroyed when it is determined that the update is interrupted before the end;
Means for restoring control of the connection means to the in-vehicle network by the update program stored in the non-volatile memory or the communication program before update when it is determined that the update program of the communication program is destroyed;
Means for requesting retransmission to the master unit when determining that an update program other than the communication program has been destroyed, and obtaining the update program again,
The in-vehicle computer system according to claim 1, wherein the master unit includes a unit that reads the update program requested to be retransmitted from the nonvolatile storage unit and transmits the program to the slave unit. The master unit is configured to receive an update execution instruction in a secondary battery mode in which the computer program is updated by driving a secondary battery after the vehicle engine is stopped;
Means for determining whether or not the slave unit shuts off the power after completion of the update of the computer program when executing the update in the secondary battery mode;
The vehicle-mounted computer system according to claim 1, further comprising means for shutting off the power of the master unit after the slave unit shuts off the power. The in-vehicle network is a ring-connected network,
The master unit is configured to receive an update execution instruction in a secondary battery mode in which the computer program is updated by driving a secondary battery after the vehicle engine is stopped;
Means for determining whether or not the update of the computer program is completed in each of the slave units when performing the update in the secondary battery mode;
Means for transmitting to the slave unit an instruction to shut off the power of each slave unit after a lapse of a predetermined time when the update in all the slave units is completed;
Means for measuring the predetermined time;
The vehicle-mounted computer system according to claim 1, further comprising a unit that shuts off a power supply of the master unit after the predetermined time has elapsed. A master unit that is connected to one or more slave units via an in-vehicle network.
The slave unit is
Means for connecting to the in-vehicle network;
A plurality of slave control means forming a hierarchical structure,
The plurality of slave control means include a first slave control means for instructing other slave control means to execute at least a part of the processes, and at least a part of the processes instructed by the first slave control means. And a second slave that instructs the third slave control means to execute the other part when there is a third slave control means that executes at least another part of the process. Forming a hierarchical structure of at least two layers including control means;
Each of the plurality of slave control means includes storage means for storing a computer program in an executable form, and processing means for executing the computer program stored in the storage means,
The master unit is
Means for connecting to a network outside the vehicle;
Means for connecting to the in-vehicle network;
A plurality of master control means forming a hierarchical structure,
The plurality of master control means includes a first master control means for instructing another master control means to execute at least a part of the processes, and at least a part of the processes instructed by the first master control means. And at least another part of the process is executed.
And a second master control means for instructing the third master control means to execute the other part when the master control means is present, forming a hierarchical structure of at least two layers,
Each of the plurality of master control means includes storage means for storing a computer program in an executable form, and processing means for executing the computer program stored in the storage means,
Furthermore, the master unit is
Means for acquiring an update program for updating the respective computer program through the connection means to the network outside the vehicle, and storing the update program in a nonvolatile storage means;
For the slave unit, in the hierarchical structure of the slave control means, the computer program executed by the lower slave control means is preferentially updated, and after updating the computer program executed by the lower slave control means, Slave update control means for controlling the update order so as to update the computer program executed by the slave control means of the upper hierarchy of the lower layer;
After the computer program of the slave unit to be updated is updated by the slave update control unit, in the hierarchical structure of the master control unit, the computer program executed by the lower master control unit is preferentially updated, and the lower layer A master update control means for controlling an update order so as to update the computer program executed by the master control means of the upper layer after the update of the computer program executed by the master control means. .

Images