JP2017215889A - Control device, program update method, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device which allows an administrator to appropriately manage updating of a control program for controlling a target device being run by an in-vehicle control device configured to control the target device mounted on a vehicle.SOLUTION: When updating a control program for controlling a target device being run by an ECU 30, an in-vehicle control device configured to control the target device mounted on a vehicle, the ECU that functions as a control device for controlling the update acquires (S6, S7) a result of determination on whether a user of the vehicle is an administrator or not, which is obtained by comparing first user information, representing information of the user of the vehicle, and second user information representing information of a user preregistered as the administrator for updating the control program. Processing associated with the control program update is controlled based on the determination result (S8).SELECTED DRAWING: Figure 5

Description

  The present invention relates to a control device, a program update method, and a computer program, and more particularly to a control device, a program update method, and a computer program that control update of a control program of an in-vehicle control device.

In recent years, in the technical field of automobiles, functions of vehicles have been advanced, and a wide variety of in-vehicle devices are mounted on vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are vehicle-mounted control devices for controlling each vehicle-mounted device, are mounted on the vehicle.
The ECU includes, for example, an engine, a brake, an EPS (Electric Power Steering) control for the operation of an accelerator, a brake, and a steering wheel, and a headlight is turned on / off according to a switch operation by an occupant. Some of them operate the meters arranged near the driver's seat, such as wiper ON / OFF and door lock / unlock.

In general, the ECU is configured by an arithmetic processing device such as a microcomputer, and the control of the in-vehicle device is realized by reading and executing a control program stored in a ROM (Read Only Memory).
The control program of the ECU may differ depending on the destination and grade of the vehicle, and it is necessary to rewrite the old version control program to the new version control program in response to the upgrade of the control program.

  For example, in Patent Document 1, a gateway such as an in-vehicle communication device receives an update program from a management server, and an ECU rewrites a control program from an old version to a new version by using the received update program. A technique for performing program update remotely by wireless communication is disclosed.

JP 2007-65856 A

  One of the ways in which vehicles are used is to share them among multiple users. For example, it may be used as a rental car that is shared by an unspecified number of user groups or shared by a specific user group such as a family.

  For example, there is a need for an administrator of the vehicle, such as the owner of the vehicle, to manage the update of the control program of the ECU of the vehicle. However, when the vehicle is shared and used by a plurality of users and the ECU control program is updated when a user other than the administrator is using the vehicle, the administrator appropriately updates the ECU control program. There are cases where it cannot be managed.

  An object of one aspect of the present invention is to provide a control device, a program update method, and a computer program that enable an administrator to appropriately manage program updates.

  According to an embodiment, the control device is a control device that controls updating of a control program for controlling the target device of the in-vehicle control device that controls the target device mounted on the vehicle, The first user information that is information and the second user information that is user information registered in advance as an administrator for updating the control program is a manager of the vehicle user. A user authentication unit that acquires a result of the determination as to whether or not, and an update control unit that controls processing related to the update of the control program based on the result of the determination.

  According to another embodiment, the program update method is an update method of a control program for controlling a target device of an in-vehicle control device that controls the target device mounted on a vehicle, and includes information on a user of the vehicle. Whether or not the user of the vehicle is an administrator obtained by collating certain first user information with second user information that is user information registered in advance as an administrator of control program update A step of obtaining a result of the determination, and a step of controlling processing related to the update of the control program based on the result of the determination.

  According to another embodiment, the computer program causes the computer to function as a control device that controls the update of the control program for controlling the target device of the in-vehicle control device that controls the target device mounted on the vehicle. It is a computer program, and the computer collates first user information, which is information on a vehicle user, and second user information, which is user information registered in advance as a control program update manager. And a user authentication unit that obtains a result of determination as to whether or not the user of the vehicle is an administrator, and an update control unit that controls processing related to control program update based on the result of the determination. Let

  According to the present invention, the administrator can appropriately manage the update of the control program for controlling the target device of the in-vehicle control device that controls the target device mounted on the vehicle.

1 is an overall configuration diagram of a program update system according to an embodiment of the present invention. It is a block diagram which shows the internal structure of a gateway. It is a block diagram which shows the internal structure of ECU. It is a block diagram which shows the internal structure of a management server. It is a sequence diagram which shows an example of the update of the control program of ECU. It is the block diagram which showed the specific example of the function structure of ECU which can communicate with a device. 7 is a flowchart showing an example of a user authentication process flow in steps S6 and S7 of FIG.

[Description of Embodiment]
This embodiment includes at least the following.
That is, the control device included in the present embodiment is a control device that controls the update of a control program for controlling the target device of the in-vehicle control device that controls the target device mounted on the vehicle. The user of the vehicle, which is obtained by collating the first user information that is user information and the second user information that is user information registered in advance as an administrator for updating the control program, manages the management A user authentication unit that obtains a result of the determination as to whether or not the user is an authorized person, and an update control unit that controls processing related to the update of the control program based on the result of the determination.
According to this configuration, when the user of the vehicle is an administrator for updating the control program, the process related to the update of the control program of the in-vehicle control device is performed, and when the user of the vehicle is not the administrator, the process is not performed. Can be controlled. Therefore, the administrator can appropriately manage the update of the control program.

Preferably, a user authentication part acquires the result of the determination performed using the 1st user information of the user of the vehicle in the case of an update.
As a result, it is possible to improve the accuracy of control program update management.

Preferably, the first user information is user information of a user who is within a predetermined range from the vehicle either when the vehicle door is unlocked, when the engine is turned on, or when the power is turned on.
With such a configuration, it is possible to increase the possibility that the user information used for the determination is the user information of the user of the vehicle at the time of updating the control program. Can be improved.

Preferably, the user authentication unit includes an acquisition unit that acquires first user information and a determination unit that performs determination using the first user information.
With this configuration, the control device itself can perform processing for managing control program updates.

Preferably, the acquisition unit communicates with the mobile terminal device of the user of the vehicle by a communication function within a predetermined communication range, and acquires first user information read from the mobile terminal device.
With this configuration, it is possible to increase the possibility that the user information used for the determination is the user information of the user of the vehicle when the control program is updated, and the user information is acquired without requiring a user operation. Therefore, it is possible to improve the accuracy of management of control program updates without requiring user operation.

Preferably, an acquisition part communicates with the apparatus in which the user of a vehicle can input 2nd user information, and acquires the 2nd user information input by the user at the apparatus.
With this configuration, it is possible to increase the possibility that the user information used for the determination is the user information of the user of the vehicle when the control program is updated, and the user information is acquired with an easy configuration. Therefore, it is possible to further improve the accuracy of control program update management with an easy configuration.

Preferably, the control device further includes a storage unit that stores the second user information, the user authentication unit further includes a reading unit that reads the second user information from the storage unit, and the determination unit is acquired by the acquisition unit. The determination is performed using the first user information and the second user information read by the reading unit.
With this configuration, it is possible to easily manage the update of the control program by registering the user information (second user information) of the user who is an administrator in the storage unit.

Preferably, the user authentication unit further includes a reading unit that reads the second user information from a storage unit that stores the second user information included in another device, and the determination unit is the first acquired by the acquisition unit. The user information and the second user information read by the reading unit are used for determination.
With this configuration, it is possible to easily manage control program updates without performing an operation of registering user information (second user information) of a user who is an administrator in the control device.

The program update method included in the present embodiment is a method for updating a control program for controlling a target device of an in-vehicle control device that controls the target device mounted on the vehicle, and is information on the user of the vehicle. Whether or not the user of the vehicle is an administrator, obtained by collating the first user information with the second user information, which is user information registered in advance as an administrator for updating the control program And a step of acquiring a result of the determination, and a step of controlling processing related to the update of the control program based on the result of the determination.
According to this configuration, when the user of the vehicle is an administrator for updating the control program, the process related to the update of the control program of the in-vehicle control device is performed, and when the user of the vehicle is not the administrator, the process is not performed. Can be controlled. Therefore, the administrator can appropriately manage the update of the control program.

A computer program included in the present embodiment is a computer for causing a computer to function as a control device that controls update of a control program for controlling the target device of an in-vehicle control device that controls the target device mounted on the vehicle. The program is a computer for collating first user information that is vehicle user information and second user information that is user information registered in advance as an administrator of control program updates. And a user authentication unit that obtains a result of determination as to whether or not the user of the vehicle is an administrator, and an update control unit that controls processing related to the update of the control program based on the result of the determination. .
According to this configuration, when the user of the vehicle is an administrator for updating the control program, the process related to the update of the control program of the in-vehicle control device is performed, and when the user of the vehicle is not the administrator, the process is not performed. Can be controlled. Therefore, the administrator can appropriately manage the update of the control program.

[Details of the embodiment]
Hereinafter, preferred embodiments will be described with reference to the drawings. In the following description, the same parts and components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, these descriptions will not be repeated.

<First Embodiment>
[Overall system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to an embodiment of the present invention.
As shown in FIG. 1, the program update system of this embodiment includes a vehicle 1, a management server 5, and a DL (download) server 6 that can communicate via a wide area communication network 2.
The management server 5 and the DL server 6 are operated by, for example, a car manufacturer of the vehicle 1 and can communicate with a large number of vehicles 1 owned by users who are registered as members in advance.

The vehicle 1 is equipped with a gateway 10, a wireless communication unit 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the ECUs 30.
In the vehicle 1, there is a communication group including a plurality of ECUs 30 that are bus-connected to a common in-vehicle communication line, and the gateway 10 relays communication between the communication groups. Therefore, a plurality of in-vehicle communication lines are connected to the gateway 10.

  At least one ECU 30 </ b> A among the plurality of ECUs 30 can wirelessly communicate with the device 7. The device 7 is a user's portable terminal device as an example. In this case, the device 7 is a device that stores user information and has a communication function with respect to the ECU 30A. The device 7 is, for example, a user phone such as a mobile phone, a smartphone, a tablet terminal, or a license owned by the user. As another example, the device 7 is an input device capable of inputting user information. In this case, the device 7 is a device having a function for inputting user information (for example, a reading device such as a button, a touch panel, a microphone, a camera, and a fingerprint) and a communication function for the ECU 30A. The device 7 is, for example, a car navigation device or a smartphone owned by the user.

The wireless communication unit 15 is communicably connected to a wide area communication network 2 such as a mobile phone network, and is connected to the gateway 10 via an in-vehicle communication line. The gateway 10 transmits information received by the wireless communication unit 15 from the external devices such as the management server 5 and the DL server 6 to the ECU 30 through the wide area communication network 2.
The gateway 10 transmits information acquired from the ECU 30 to the wireless communication unit 15, and the wireless communication unit 15 transmits the information to an external device such as the management server 5.

Examples of the wireless communication unit 15 mounted on the vehicle 1 include devices such as mobile phones, smartphones, tablet terminals, and notebook PCs (Personal Computers) owned by users.
In FIG. 1, the case where the gateway 10 communicates with an external device via the wireless communication unit 15 is illustrated, but when the gateway 10 has a wireless communication function, the gateway 10 itself is a management server 5 or the like. It is good also as a structure which performs radio | wireless communication with an external device.

  In the program update system of FIG. 1, the management server 5 and the DL server 6 are configured as separate servers, but the servers 5 and 6 may be configured as a single server device.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing the internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected via the wireless communication unit 15 and the in-vehicle communication line, but these may be configured by a single device.

The CPU 11 causes the gateway 10 to function as a relay device for various types of information by reading one or more programs stored in the storage unit 13 into the RAM 12 and executing them.
The CPU 11 can execute a plurality of programs in parallel, for example, by switching and executing a plurality of programs in a time division manner. The RAM 12 is composed of a memory element such as SRAM (Static RAM) or DRAM (Dynamic RAM), and temporarily stores a program executed by the CPU 11, data necessary for execution, and the like.

The storage unit 13 includes a nonvolatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory).
The storage unit 13 has a storage area for storing programs executed by the CPU 11 and data necessary for execution. The storage unit 13 also stores an update program for each ECU 30 received from the DL server 6.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1. The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark). Communication with the ECU 30 is performed according to the standard.
The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11. The in-vehicle communication unit 14 may communicate according to other communication standards used for the in-vehicle network as well as the above communication standards.

The wireless communication unit 15 includes a wireless communication device including an antenna and a communication circuit that performs transmission / reception of a wireless signal from the antenna. The wireless communication unit 15 can communicate with an external device by being connected to a wide area communication network 2 such as a mobile phone network.
The wireless communication unit 15 transmits information given from the CPU 11 to an external device such as the management server 5 via the wide area communication network 2 formed by a base station (not shown), and receives information received from the external device to the CPU 11. give.

Instead of the wireless communication unit 15 illustrated in FIG. 2, a wired communication unit that functions as a relay device in the vehicle 1 may be employed. The wired communication unit has a connector to which a communication cable conforming to a standard such as USB (Universal Serial Bus) or RS232C is connected, and performs wired communication with another communication device connected via the communication cable.
When another communication device and an outside device such as the management server 5 are capable of wireless communication through the wide area communication network 2, the outside of the vehicle depends on the communication path of the outside device → another communication device → the wired communication unit → the gateway 10. The apparatus and the gateway 10 can communicate with each other.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing an internal configuration of the ECU 30A that can communicate with the device 7 in the ECU 30. As shown in FIG.
As shown in FIG. 3, the ECU 30A includes a CPU 31, a RAM 32, a storage unit 33, a first communication unit 34, a second communication unit 36, and the like. The ECU 30 is an in-vehicle control device that individually controls target devices mounted on the vehicle 1. Examples of the ECU 30 include an engine control ECU, a steering control ECU, and a door lock control ECU.

The CPU 31 controls the operation of the target device that it is in charge of by reading one or more programs stored in advance in the storage unit 33 into the RAM 32 and executing them.
The RAM 32 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 31, data necessary for execution, and the like.

The storage unit 33 is configured by a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The information stored in the storage unit 33 includes, for example, a computer program (hereinafter referred to as “control program”) for causing the CPU 31 to perform information processing for controlling a target device that is a control target in the vehicle.

The gateway 10 is connected to the first communication unit 34 via an in-vehicle communication line disposed in the vehicle 1. The first communication unit 34 communicates with the gateway 10 according to a standard such as CAN, Ethernet, or MOST.
The first communication unit 34 transmits the information given from the CPU 31 to the gateway 10 and gives the information received from the gateway 10 to the CPU 31. The first communication unit 34 may communicate according to other communication standards used for the in-vehicle network, as well as the above communication standards.

  The CPU 31 to the first communication unit 34 described above are similarly included in the ECU 30 that does not have a communication function with the device 7.

The second communication unit 36 performs short-range wireless communication with the device 7 in accordance with a standard such as NFC (Near Field Communication) or Bluetooth (registered trademark).
The second communication unit 36 gives information received from the device 7 to the CPU 31 by short-range wireless communication.

The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode by the CPU 31 to either “normal mode” or “reprogramming mode” (hereinafter also referred to as “repro mode”).
Here, the normal mode is a control mode in which the CPU 31 of the ECU 30 executes an original control for the target device (for example, engine control for the fuel engine, door lock control for the door lock motor, etc.).

The reprogramming mode is a control mode in which a control program used for controlling the target device is updated.
That is, the reprogramming mode is a control mode in which the CPU 31 erases or rewrites the control program in the ROM area of the storage unit 33. Only in this control mode, the CPU 31 can update the control program stored in the ROM area of the storage unit 33 to a new version.

When the CPU 31 writes the new version of the control program in the storage unit 33 in the repro mode, the activation unit 35 once restarts (resets) the ECU 30 and executes the verify process on the storage area in which the new version of the control program is written. .
The activation unit 35 causes the CPU 31 to operate according to the updated control program after the above-described verification processing is completed.

[Management Server internal configuration]
FIG. 4 is a block diagram showing the internal configuration of the management server 5.
As shown in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads out one or more programs stored in advance in the ROM 52 to the RAM 53 and executes them, thereby controlling the operation of each hardware and causing the management server 5 to function as an external device that can communicate with the gateway 10.
The RAM 53 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 51 and data necessary for execution.

The storage unit 54 includes a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 includes a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to the wide area communication network 2 such as a mobile phone network to execute the communication processing. The communication unit 55 transmits the information given from the CPU 51 to the external device via the wide area communication network 2 and gives the information received via the wide area communication network 2 to the CPU 51.

[Control program update sequence]
FIG. 5 is a sequence diagram illustrating an example of control program update for the ECU, which is executed in the program update system of the present embodiment. As an example, the management server 5 determines the timing for updating the control program of the ECU of the vehicle 1 for the vehicle 1 owned by a user who is registered as a member in advance. The update timing may be set by, for example, the car manufacturer of the vehicle 1.

When the timing for updating the ECU control program is reached, the management server 5 transmits the update program storage URL of the ECU 30 and the download request to the gateway 10 of the vehicle 1 (step S1).
Thereby, the gateway 10 downloads the update program for the ECU 30 from the DL server 6 (step S2). The gateway 10 temporarily stores and stores the received update program in the storage unit 13 of its own device.

When the saving of the update program is completed, the gateway 10 transmits to the management server 5 that the DL has been normally completed (step S3). When the update is continuously performed automatically, the management server 5 that has received the DL completion notification transmits a control program update request to the gateway 10. After the DL is completed, the management server 5 may temporarily suspend and receive an update request from the outside, and then send a control program update request to the gateway 10 (step S4).
The gateway 10 that has received the update request transmits a control program update request to the corresponding ECU 30 in order to update the control program using the update program stored in the storage unit 13 (step S5).

  When the control program update request is received, the corresponding ECU 30 executes user authentication (steps S6 and S7). In the user authentication, it is determined whether or not the user of the vehicle 1 at the time of executing the update process of the control program is a user registered as an update manager who is an administrator who has the authority to update the control program of the ECU 30. It is processing. Specifically, when the corresponding ECU 30 is an ECU 30A that can communicate with the device 7, the ECU 30A reads the user information from the device 7 (step S6), and the user's user registered in advance as the control program update manager By comparing with the information, it is determined whether or not the user information of the device 7, that is, the current user of the vehicle 1 is an update manager (step S7). Note that the user of the vehicle 1 refers to a user in the vehicle 1. The user of the vehicle 1 may include a user who is within a predetermined range from the vehicle 1. The predetermined range is, for example, a range in which the second communication unit 36 of the ECU 30A can perform near field communication with the device 7.

  If the corresponding ECU 30 is not an ECU 30A that can communicate with the device 7, the ECU 30 may read user information from the device 7 via the ECU 30A that can communicate with the device 7 in step S6. Alternatively, the ECU 30 may instruct user authentication to the ECU 30A that can communicate with the device 7, cause the ECU 30A to execute steps S6 to S7, and obtain an authentication result from the ECU 30A. That is, in the user authentication in the ECU 30 in steps S6 to S7, the corresponding ECU 30A itself acquires user information from the device 7 or the ECU 30 acquires user information from the device 7 through another ECU 30A to perform user authentication. And what includes the result of user authentication which ECU30 performed with other ECU30A is included.

  If it is determined by user authentication that the user of the vehicle 1 is an update manager, the user's own control mode is switched from the normal mode to the repro mode. Thus, the ECU is in a state where the control program can be updated.

  The ECU 30 rewrites the received update program and applies it to the old version control program, thereby rewriting the control program from the old version to the new version (step S8). When the rewriting is completed, the ECU 30 transmits a rewriting completion notification to the gateway 10 (step S9). When the gateway 10 receives the rewriting completion notification from the corresponding ECU 30, the gateway 10 transmits the update completion notification to the management server 5 (step S10).

[Functional structure of ECU]
FIG. 6 is a block diagram illustrating a specific example of a functional configuration for performing control program update processing of the ECU 30 </ b> A capable of communicating with the device 7. Each function of FIG. 6 is mainly realized by the CPU 31 when the CPU 31 of the ECU 30A reads out and executes the program stored in the storage unit 33 on the RAM 32.

  Specifically, referring to FIG. 6, the CPU 31 of the ECU 30 </ b> A acquires an acquisition unit 311 that acquires user information Y <b> 1 (first user information) from the device 7 by short-range wireless communication in the second communication unit 36, and a storage unit By comparing the reading unit 312 that reads the user information Y2 (second user information) of the update manager from the database DB that stores the user information prepared in 33, the user information Y1 and the user information Y2 are collated, The determination part 313 which determines whether the user of the vehicle 1 is an update manager, and the update process part (update control part) 314 which controls the update of a control program according to the determination result are included. The acquisition unit 311, the reading unit 312, and the determination unit 313 are user authentication units for performing user authentication represented in steps S <b> 6 and S <b> 7, and the update processing unit is an update that controls processing related to control program update. It is an example of a control part.

  For example, when the device 7 is a mobile terminal device such as a mobile phone, a smartphone, or a tablet terminal, the user information Y1 includes a user name, a telephone number, a mail address, or a combination thereof stored in the device. . When the device 7 is a license, a portable terminal device, or the like, a user name, an identifier (number or the like) given to the user, a combination thereof, or the like stored in the device can be used. When the device 7 is an input device such as a car navigation device or a smartphone, an ID, a password, a face image, voice information, fingerprint or iris information, a combination thereof, or the like given to the user can be used.

  The database DB may be prepared in the storage unit 33 of its own device (ECU 30A), or may be prepared in any of the storage units 33 of the plurality of ECUs 30. For example, the other ECU 30 may be, for example, an ECU 30 that performs door locking / unlocking. In this case, the ECU 30 may also be used as user information for user authentication at the time of door locking / unlocking. By doing in this way, the memory capacity for memorizing user information can be suppressed. The update manager user information stored in the ECU 30A or the database DB of the ECU 30 may be registered in the database DB according to the operation of the user of the vehicle 1. By doing in this way, the user can register an update manager arbitrarily and can improve a user's convenience. Alternatively, the user information of the update manager may be automatically registered in the database DB in response to a registration request from the management server 5. In this way, registration of the update manager can be facilitated.

  Further, a database DB may be prepared for each ECU 30, and user information Y2 registered in the database DB of the own apparatus may be used for user authentication when updating the control program of the ECU 30. By doing in this way, a different update manager can be set for every ECU 30, and finer management is enabled.

  The database DB may be prepared in the storage unit 54 or the DL server 6 of the management server 5. The user information of the update manager stored in the management server 5 or the DL server 6 is registered together when the user registers as a member, for example. In this way, registration of the update manager can be facilitated.

  The database DB may store user information Y2 of a plurality of users as update managers. When user information of a plurality of update managers is registered in the database DB, the determination unit 313 determines that the user information Y1 acquired from the device 7 matches at least one of the plurality of user information Y2, so that the vehicle 1 It may be determined that the user is an update manager. Alternatively, the determination unit 313 receives a plurality of pieces of user information Y1 from the acquisition unit 311 and determines that the user of the vehicle 1 is an update manager when all the pieces of user information Y2 are included therein. Good. By doing in this way, management of update of the control program can be made more strict or flexible.

  In a configuration in which user information of a plurality of users can be stored as an update manager in the database DB, a level at which updating can be permitted is set for each update manager, and user authentication depends on the level of control program update User information may also be used. For example, even if it is the control program of the same ECU, all the updates are permitted for the manager 1, and some updates are permitted for the manager 2. In this way, more detailed management is possible.

  Even in the case of the ECU 30 that does not have a communication function with the device 7, the CPU 31 may have the functions shown in FIG. In this case, the acquisition unit 311 communicates with the ECU 30A that can communicate with the device 7, and receives the user information Y1 acquired from the device 7 by the ECU 30A.

[User Authentication]
FIG. 7 is a flowchart showing an example of the flow of the user authentication process in steps S6 and S7. The process shown in the flowchart of FIG. 7 is realized, for example, by the CPU 31 of the ECU 30A reading out and executing the program stored in the storage unit 33 on the RAM 32 and exhibiting the functions of FIG.

  User authentication is performed in the ECU 30A at a predetermined timing. The predefined timing is, for example, the timing when the ECU 30A receives a control program update request (step S5) from the gateway 10 as shown in FIG. Further, for example, the user authentication may be performed at a timing when the ECU 30 </ b> A receives the update program together with the update request from the gateway 10 and is stored in the storage unit 33. Further, for example, when an update program that has been received from the gateway 10 and has not been updated yet is stored in the storage unit 33, user authentication may be performed at a predetermined time interval. . That is, as an example, user authentication is performed immediately before the control program is updated. In this case, the user information Y1 is that of the user of the vehicle 1 when the control program is updated, and the management accuracy can be improved.

Further, for example, regardless of whether there is an update request or an update program, a user who has been defined in advance, such as a door unlock timing of the vehicle 1, a timing of accepting a power ON operation, a timing of accepting an engine ON operation, User authentication may be performed at the timing when the driving of the vehicle 1 is started or inside. That is, as an example, the user authentication is performed before the control program is updated, and the result of the user authentication is used when the control program is updated. Similarly, acquisition of user information Y1 from the device 7 may be performed at the above-specified timing, and user authentication may be performed using the user information Y1 stored immediately before the control program is updated. In this case, it is possible to perform authentication faster than starting user authentication immediately before updating the control program while ensuring management accuracy, and to shorten the time required for updating the control program.
Note that the result of user authentication in this case is discarded from the memory when the user finishes driving the vehicle 1 or goes outside. The timing of discarding is, for example, a door lock timing, a timing when a power-off operation is accepted, a timing when an engine-off operation is accepted, or the like. Alternatively, user authentication may be performed at every timing when the user starts driving the vehicle 1 or is inside, and the user authentication stored in the memory may be overwritten. By doing in this way, the result of the user authentication of the user of the vehicle 1 at the time of the update of the control program can be used for the determination of the update of the control program, and the management accuracy can be improved.

  The CPU 31 starts the process of FIG. 7 when the above timing is reached. Referring to FIG. 7, when user authentication is started, CPU 31 acquires user information Y1 by communicating with device 7 (step S101). The device 7 is a device having a function for inputting user information, such as a car navigation device and a smartphone, and a communication function for the ECU 30A, and the user information Y1 is an ID, a password assigned to the user as described above, or a combination thereof. In step S101, the CPU 31 transmits information for displaying a screen for accepting input of the user information Y1 to the device 7, a message for prompting input, and the like, so that the user inputs the user information Y1 to the device 7 in step S101. You may be prompted.

  Further, the CPU 31 reads the update manager user information Y2 from the database DB of the storage unit 33 or the database DB of another device such as the management server 5 (step S103). And CPU31 collates these user information Y1, Y2 (step S105).

  When the collation result is OK, that is, when it is determined that the user of the vehicle 1 is an update manager (“OK” in step S105), the CPU 31 updates the control program using the received update program. (Step S107).

  If the result of the collation is NG, that is, if it is not determined that the user of the vehicle 1 is an update manager (“NG” in step S105), step S107 is skipped. That is, in this case, the control program is not updated. In this case, the screen display as described above is not performed.

  Note that the user authentication result may be used to determine whether or not to execute any process related to control program update, including control program update processing. For example, prior to the update of the control program, a screen display or message output for inquiring whether the update is possible is performed on an output device (not shown) such as a navigation device or the display of the device 7, a speaker, etc. When updating of the program is started, whether to perform output may be determined according to the result of user authentication.

[Effect of the first embodiment]
According to the program update system according to the first embodiment, the user authentication of the vehicle user is performed prior to the update of the control program of the ECU, and the control program is updated when the user is an update manager. When the user who is not the update manager is a vehicle user, the control program is not updated. That is, it is possible to avoid a situation in which the control program is updated without the update manager grasping it. Therefore, the update manager can manage the update of the control program.

  Further, when the control program is updated after obtaining the user's approval, the control program is not updated by a user other than the update manager, so that a user other than the update manager uses the vehicle. In such a case, the notification for obtaining the control program update approval is not performed. For this reason, the update manager can appropriately manage the update of the control program.

<Second Embodiment>
In the program update system according to the first embodiment, user authentication is performed in the ECU 30 that updates the control program. However, the user authentication may be performed by any device (control device) that can control the update of the control program in the ECU 30. For example, the control device may be, for example, a second ECU different from the first ECU that updates the control program.

  As described above, the second ECU also has the functions shown in FIG. The second ECU executes the user authentication in FIG. 7 after the user gets on the vehicle 1 until the first ECU updates the control program (for example, at the above timing), and the authentication result is the first authentication result. Or the authentication result is stored in the storage unit 33 and passed in response to a request from the first ECU.

  The second ECU 30 may be, for example, an ECU 30 that performs door locking / unlocking, an ECU 30 that performs engine ON / OFF, and the like. In this case, the authentication result of user authentication at the time of door lock / unlock and user authentication at the time of engine ON / OFF may be passed to the first ECU 30.

<Third Embodiment>
The control device that performs user authentication may be a device other than the ECU 30. As an example, user authentication may be performed in the gateway 10 that is a control device that controls processing related to the update of the control program in the ECU 30.

  When the gateway 10 performs user authentication, the CPU 11 of the gateway 10 reads out the program stored in the storage unit 13 onto the RAM 12 and executes it, whereby each function of FIG. In this case, the acquisition unit 311 acquires user information Y1 acquired from the device 7 by the ECU 30 by communicating with the ECU 30 or other ECU 30A that updates the control program. A database DB for storing user information of the update manager may be prepared in the storage unit 13, and the reading unit 312 may read the user information Y <b> 2 from the storage unit 13. Or the reading part 312 may read the user information Y2 memorize | stored in these apparatuses by communicating with ECU30 which updates the control program, other ECU30A, or the management server 5. FIG.

  The gateway 10 passes the update program to the ECU 30 and requests the control program to be updated (step S5), and performs user authentication. For example, the gateway 10 may perform user authentication when a download of an update program is requested from the management server 5 (step S1), or receives a door lock / unlock timing of the vehicle 1 or a power ON operation. User authentication may be performed at a timing when the user starts driving the vehicle 1 such as timing or is inside. The gateway 10 may pass the update program to the ECU 30 before the user authentication, and may request the ECU 30 to update the control program when the user authentication is successful.

<Fourth embodiment>
The control device that performs user authentication may be a control device outside the vehicle. As shown in FIG. 5, since the management server 5 requests the gateway 10 to update the control program in the ECU 30 (step S <b> 4), the management server 5 also controls processing related to the control program update in the ECU 30. It can be said that. Therefore, user authentication may be performed in the management server 5.

  When the management server 5 performs user authentication, the CPU 51 of the management server 5 reads out the program stored in the ROM 52 onto the RAM 53 and executes it, whereby the functions shown in FIG. In this case, the acquisition unit 311 acquires user information Y1 acquired from the device 7 by the ECU 30 by communicating with the ECU 30 or other ECU 30A that updates the control program. The database DB for storing the user information of the update manager may be prepared in the storage unit 54, and the reading unit 312 may read the user information Y2 from the storage unit 54. Or the reading part 312 may read the user information Y2 memorize | stored in these apparatuses by communicating with ECU30 and the gateway 10 which update a control program.

  The management server 5 performs user authentication before requesting the gateway 10 to update the control program (step S4). For example, the management server 5 may perform user authentication before requesting the gateway 10 to download an update program (step S1), or before requesting the gateway 10 to update the control program of the ECU 30 (step S4). User authentication may be performed. When the management server 5 and the DL server 6 are configured by the same server device, these servers may perform user authentication before transmitting the update program to the gateway 10 (step S2).

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 Vehicle 2 Wide Area Communication Network 5 Management Server (Control Device)
6 DL server (control device)
7 Device 10 Gateway (control device)
11 CPU
12 RAM
DESCRIPTION OF SYMBOLS 13 Memory | storage part 14 In-vehicle communication part 15 Wireless communication part 30 ECU (vehicle-mounted control apparatus)
31 CPU
32 RAM
33 Storage Unit 34 First Communication Unit 35 Start-up Unit 36 Second Communication Unit 51 CPU
52 ROM
53 RAM
54 storage unit 55 communication unit 311 acquisition unit (user authentication unit)
312 Reading unit (user authentication unit)
313 determination unit (user authentication unit)
314 Update processing unit (update control unit)
Y1, Y2 User information

Claims (10)

A control device for controlling an update of a control program for controlling the target device of an in-vehicle control device for controlling the target device mounted on a vehicle,
The vehicle obtained by collating first user information that is user information of the vehicle and second user information that is user information registered in advance as an administrator of the update of the control program A user authenticating unit for obtaining a result of the determination as to whether or not the user is the administrator;
And an update control unit that controls processing related to the update of the control program based on the result of the determination.   The control device according to claim 1, wherein the user authentication unit acquires a result of the determination performed using the first user information of the user of the vehicle at the time of the update.   The first user information is user information of a user who is within a predetermined range from the vehicle at any time when the door of the vehicle is unlocked, when the engine is turned on, and when the power is turned on. The control device described. The user authentication unit includes:
An acquisition unit for acquiring the first user information;
The control apparatus as described in any one of Claims 1-3 including the determination part which performs the said determination using said 1st user information.   The said acquisition part communicates with the portable terminal device of the user of the said vehicle by the communication function of the communication range prescribed | regulated previously, The said 1st user information read from the said portable terminal device is acquired. Control device.   The said acquisition part communicates with the apparatus in which the user of the said vehicle can input the said 2nd user information, and acquires the said 2nd user information input by the said user into the said apparatus. Control device. A storage unit for storing the second user information;
The user authentication unit further includes a reading unit that reads the second user information from the storage unit,
7. The determination unit according to claim 4, wherein the determination unit performs the determination using the first user information acquired by the acquisition unit and the second user information read by the reading unit. A control device according to claim 1. The user authentication unit further includes a reading unit that reads the second user information from a storage unit that stores the second user information included in another device,
7. The determination unit according to claim 4, wherein the determination unit performs the determination using the first user information acquired by the acquisition unit and the second user information read by the reading unit. A control device according to claim 1. An in-vehicle control device for controlling a target device mounted on a vehicle, a method for updating a control program for controlling the target device,
The vehicle obtained by collating first user information that is user information of the vehicle and second user information that is user information registered in advance as an administrator of the update of the control program Obtaining a result of the determination as to whether or not the user is the administrator;
And a step of controlling processing related to the update of the control program based on the result of the determination. A computer program for causing a computer to function as a control device for controlling an update of a control program for controlling the target device of an in-vehicle control device for controlling the target device mounted on a vehicle, the computer comprising:
The vehicle obtained by collating first user information that is user information of the vehicle and second user information that is user information registered in advance as an administrator of the update of the control program A user authenticating unit for obtaining a result of the determination as to whether or not the user is the administrator;
A computer program that functions as an update control unit that controls processing related to update of the control program based on a result of the determination.

Images