JP2018005894A - Program distribution system, server, program distribution method, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a program distribution system capable of assuredly distributing an update program to a plurality of vehicles, while suppressing processing load of a server at the time of distributing the update program to the plurality of vehicles.SOLUTION: When an update program of an ECU which is an on-board control device for controlling object equipment mounted on a vehicle is distributed to gate ways 10A to 10C of each of a plurality of vehicles, a management server 5 for controlling download of an update program executes scheduling processing (step S2), and determines the priority of the download processing of the update program for a plurality of gate ways. The management server starts the download according to the determined priority (S3A to 3C).SELECTED DRAWING: Figure 5

Description

  The present invention relates to a program distribution system, a server, a program distribution method, and a computer program. In particular, the present invention relates to a program distribution system, a server, a program distribution method, and a computer program that distribute an update program for an in-vehicle control device to a plurality of vehicles. .

In recent years, in the technical field of automobiles, functions of vehicles have been advanced, and a wide variety of in-vehicle devices are mounted on vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are control devices for controlling each in-vehicle device, are mounted on the vehicle.
The types of ECUs include, for example, those related to the traveling system that controls the engine, brakes, EPS (Electric Power Steering), etc. for the operation of the accelerator, brake, and steering wheel. There are body-type ECUs that control the turning on / off of lights and the sounding of alarm devices, and meter-type ECUs that control the operation of meters arranged near the driver's seat.

In general, the ECU is configured by an arithmetic processing device such as a microcomputer, and the control of the in-vehicle device is realized by reading and executing a control program stored in a ROM (Read Only Memory).
The ECU control program may differ depending on the destination, grade, etc. of the vehicle, and it is necessary to rewrite the old version control program to the new version control program in response to the upgrade of the control program.

  For example, in Patent Document 1, a gateway such as an in-vehicle communication device receives an update program from a management server, and an ECU rewrites a control program from an old version to a new version by using the received update program. A technique for performing program update remotely by wireless communication is disclosed.

JP 2007-65856 A

  According to the disclosure of Patent Document 1, the program providing device transmits a vehicle control program corresponding to the vehicle type of the vehicle in a lump for each vehicle type. However, depending on the vehicle model, the number of vehicles may be enormous, and if update programs are distributed all at once, the processing load on the distribution server may become excessive.

  An object of an aspect of the present invention is to provide a program distribution system, a server, a program distribution method, and a program distribution system capable of reliably distributing an update program to a plurality of vehicles while suppressing a processing load on the server when the update program is distributed to the plurality of vehicles. And providing a computer program.

  According to an embodiment, a program distribution system relays communication between an in-vehicle device and an in-vehicle control device connected to the in-vehicle control device via an in-vehicle communication line in a vehicle equipped with the in-vehicle control device that controls the in-vehicle device. A relay device, and a control device that controls downloading of the update program of the in-vehicle control device from the server to the relay device, the control device prioritizing the update program download process for each of the plurality of vehicles. A processing unit that determines the order; and a download control unit that starts the download process according to the determined priority order.

  According to another embodiment, in a vehicle equipped with an in-vehicle control device that controls an in-vehicle device, the server is connected to the in-vehicle control device via an in-vehicle communication line and relays communication between the external device and the in-vehicle control device. A server that downloads an update program for an in-vehicle control device to a device, a processing unit that determines the priority of the update program download process for each relay device of a plurality of vehicles, and the determined priority And a download control unit that starts the download process according to

  According to another embodiment, the program distribution method is a method of distributing an update program of an in-vehicle control device that controls a target device mounted on a vehicle to a plurality of vehicles, and is updated for the plurality of vehicles. A step of determining a priority of the download process of the program; and a download control unit that starts the download process according to the determined priority.

  According to another embodiment, a computer program causes a computer to function as a control device that controls downloading of an update program for an in-vehicle control device that controls a target device mounted on each of the plurality of vehicles. A computer program comprising: a processing unit for determining a priority of a download process for an update program for a relay device of each of a plurality of vehicles; and a download control unit for starting a download process according to the determined priority. And make it work.

  According to the present invention, it is possible to reliably distribute the update program while suppressing the processing load on the server that distributes the update program.

1 is an overall configuration diagram of a program update system according to an embodiment of the present invention. It is a block diagram which shows the internal structure of a gateway. It is a block diagram which shows the internal structure of ECU. It is a block diagram which shows the internal structure of a management server. It is a sequence diagram which shows an example of the update of the control program of ECU. 6 is a flowchart illustrating an example of a flow of scheduling processing in step S2 of FIG. 5. It is the block diagram which showed the specific example of the function structure of the management server. It is a figure showing the specific example of the traveling model of a vehicle. It is a figure showing the specific example of the traveling model of a vehicle. It is a block diagram which shows the internal structure of the gateway concerning 5th Embodiment. It is a sequence diagram which shows an example of the update of the control program of ECU in the program update system concerning 5th Embodiment.

[Description of Embodiment]
This embodiment includes at least the following.
That is, the program distribution system included in the present embodiment is connected to an in-vehicle control device through an in-vehicle communication line in a vehicle equipped with an in-vehicle control device that controls the in-vehicle device, and communicates between the outside device and the in-vehicle control device. A relay device for relaying, and a control device for controlling downloading of the update program of the in-vehicle control device from the server to the relay device, wherein the control device downloads the update program to each relay device of the plurality of vehicles. And a download control unit for starting download processing according to the determined priority.
According to this configuration, the start of the download process is not concentrated on each of the plurality of relay apparatuses, but is started according to the determined priority order. That is, the start of the download process is distributed among the plurality of relay devices. Therefore, it is possible to reliably distribute the update program to each of the plurality of relay devices while suppressing an increase in the processing load on the server.

Preferably, the processing unit determines the priority order based on a travel pattern predicted based on a travel history of each of the plurality of vehicles.
Thereby, for example, the download process is started earlier for a traveling pattern suitable for updating the control program. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, the processing unit determines the priority order based on the usage status of each of the plurality of vehicles.
Thereby, the download process is started in the order corresponding to the usage status. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, the usage status includes at least one of the usage frequency of the vehicle, the version of the control program of the in-vehicle control device, and the setting for the in-vehicle device.
Thereby, the update program can be distributed in an order suitable for a plurality of relay devices while suppressing an increase in the processing load of the server.

Preferably, the processing unit determines the priority order based on a communication index indicating a communication state between each of the plurality of relay apparatuses and the server.
Thereby, the download process is started in the order based on the communication index. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, the processing unit determines the priority order based on the communication state of the vehicle during the download period of the update program.
Thereby, the download process is started in the order based on the communication state of the vehicle during the download period. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, the processing unit determines the priority order based on correlation information correlated with a communication state between each of the plurality of relay apparatuses and the server.
Thereby, the download process is started in the order based on the correlation information. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, the processing unit determines the priority order based on attributes set in advance for each of the plurality of vehicles.
Thereby, the download process is started in the order based on the attributes of the vehicle. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, a processing part determines a priority based on the attribute of the vehicle-mounted control apparatus and / or relay apparatus which are mounted in each of several vehicles.
Thereby, the download process is started in the order based on the attributes of the in-vehicle control device and / or the relay device mounted on each vehicle. The order based on the attribute is, for example, the order in which the free space of the memory is large. Therefore, it is possible to distribute update programs in an order suitable for a plurality of relay devices while suppressing an increase in server processing load.

Preferably, the processing unit determines a priority using a traveling pattern predicted based on a traveling history of each of the plurality of vehicles as a scheduling condition.
Even with this configuration, the start of the download process is not concentrated on the relay devices of the plurality of vehicles at once, but is distributed among the relay devices.

Preferably, the download can be executed while the in-vehicle control device is activated, and the relay device activates the in-vehicle control device at a timing based on the schedule and the communication unit that receives the notification of the download schedule from the server. And a processing unit that executes processing.
By setting the timing based on the download schedule of the update program to the in-vehicle control device to be at least a timing before the download schedule, the in-vehicle control device can be activated at the start of the download. Therefore, it is possible to execute download according to the schedule.

Preferably, the processing unit determines the priority when the type of the update program is not an exceptional type.
As a result, it is possible to achieve both the reduction of the server processing load and the necessity of downloading the update program.

Preferably, the exceptional type is a type indicating that the update program is highly important or urgent.
As a result, it is possible to achieve both reduction in the processing load on the server and the importance and urgency of the update program.

The server included in the present embodiment is a relay device that is connected to an in-vehicle control device through an in-vehicle communication line and relays communication between an out-of-vehicle device and the in-vehicle control device in a vehicle equipped with an in-vehicle control device that controls the in-vehicle device. On the other hand, it is a server that downloads an update program for an in-vehicle control device, and for each relay device of a plurality of vehicles, a processing unit that determines the priority of download processing of the update program, and the determined priority A download control unit for starting the download process.
According to this configuration, the start of the download process is not concentrated on each of the plurality of relay apparatuses, but is started according to the determined priority order. That is, the start of the download process is distributed among the plurality of relay devices. Therefore, it is possible to reliably distribute the update program to each of the plurality of relay devices while suppressing an increase in the processing load on the server.

Preferably, the processing unit determines a download schedule for the relay device based on the priority, and the server further includes a communication unit that notifies the relay device of the schedule.
By notifying the determined schedule to the relay apparatus, the relay apparatus executes a predetermined process according to the download schedule, such as a process of starting the in-vehicle control apparatus at a timing based on the above schedule, for example. Can do.

The program delivery method included in the present embodiment is a method of delivering an update program for an in-vehicle control device that controls a target device mounted on a vehicle to a plurality of vehicles, A step of determining the priority order of the download process of the update program; and a download control unit that starts the download process according to the determined priority order.
According to this configuration, the start of the download process is not concentrated on each of the plurality of relay apparatuses, but is started according to the determined priority order. That is, the start of the download process is distributed among the plurality of relay devices. Therefore, it is possible to reliably distribute the update program to each of the plurality of relay devices while suppressing an increase in the processing load on the server.

A computer program included in the present embodiment is a computer for causing a computer to function as a control device that controls downloading of an update program for an in-vehicle control device that controls a target device mounted on each of the plurality of vehicles. A processing unit that determines a priority of a download process of an update program for a relay device of each of a plurality of vehicles, and a download control unit that starts a download process according to the determined priority; To function as.
According to this configuration, the start of the download process is not concentrated on each of the plurality of relay apparatuses, but is started according to the determined priority order. That is, the start of the download process is distributed among the plurality of relay devices. Therefore, it is possible to reliably distribute the update program to each of the plurality of relay devices while suppressing an increase in the processing load on the server.

[Details of the embodiment]
Hereinafter, preferred embodiments will be described with reference to the drawings. In the following description, the same parts and components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, these descriptions will not be repeated.

<First Embodiment>
[Overall system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to an embodiment of the present invention.
As shown in FIG. 1, the program update system of the present embodiment includes a plurality of vehicles 1, a management server 5, and a DL (download) server 6 that can communicate via a wide area communication network 2.
The management server 5 and the DL server 6 are operated by, for example, a car manufacturer of the vehicle 1 and can communicate with a large number of vehicles 1 owned by users who are registered as members in advance.

Each vehicle 1 is equipped with a gateway 10, a wireless communication unit 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the respective ECUs 30.
Each vehicle 1 has a communication group of a plurality of ECUs 30 that are bus-connected to a common in-vehicle communication line, and the gateway 10 relays communication between the communication groups. Therefore, a plurality of in-vehicle communication lines are connected to the gateway 10.

The wireless communication unit 15 is communicably connected to a wide area communication network 2 such as a mobile phone network, and is connected to the gateway 10 via an in-vehicle communication line. The gateway 10 transmits information received by the wireless communication unit 15 from the external devices such as the management server 5 and the DL server 6 to the ECU 30 through the wide area communication network 2.
The gateway 10 transmits information acquired from the ECU 30 to the wireless communication unit 15, and the wireless communication unit 15 transmits the information to an external device such as the management server 5.

Examples of the wireless communication unit 15 mounted on the vehicle 1 include devices such as mobile phones, smartphones, tablet terminals, and notebook PCs (Personal Computers) owned by users.
In FIG. 1, the case where the gateway 10 communicates with an external device via the wireless communication unit 15 is illustrated, but when the gateway 10 has a wireless communication function, the gateway 10 itself is a management server 5 or the like. It is good also as a structure which performs radio | wireless communication with an external device.

  In the program update system of FIG. 1, the management server 5 and the DL server 6 are configured as separate servers, but the servers 5 and 6 may be configured as a single server device.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing the internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected via the wireless communication unit 15 and the in-vehicle communication line, but these may be configured by a single device.

The CPU 11 causes the gateway 10 to function as a relay device for various types of information by reading one or more programs stored in the storage unit 13 into the RAM 12 and executing them.
The CPU 11 can execute a plurality of programs in parallel, for example, by switching and executing a plurality of programs in a time division manner. The RAM 12 is composed of a memory element such as SRAM (Static RAM) or DRAM (Dynamic RAM), and temporarily stores a program executed by the CPU 11, data necessary for execution, and the like.

The storage unit 13 includes a nonvolatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory).
The storage unit 13 has a storage area for storing programs executed by the CPU 11 and data necessary for execution. The storage unit 13 also stores an update program for each ECU 30 received from the DL server 6.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1. The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark). Communication with the ECU 30 is performed according to the standard.
The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11. The in-vehicle communication unit 14 may communicate according to other communication standards used for the in-vehicle network as well as the above communication standards.

The wireless communication unit 15 includes a wireless communication device including an antenna and a communication circuit that performs transmission / reception of a wireless signal from the antenna. The wireless communication unit 15 can communicate with an external device by being connected to a wide area communication network 2 such as a mobile phone network.
The wireless communication unit 15 transmits information given from the CPU 11 to an external device such as the management server 5 via the wide area communication network 2 formed by a base station (not shown), and receives information received from the external device to the CPU 11. give.

Instead of the wireless communication unit 15 illustrated in FIG. 2, a wired communication unit that functions as a relay device in the vehicle 1 may be employed. The wired communication unit has a connector to which a communication cable conforming to a standard such as USB (Universal Serial Bus) or RS232C is connected, and performs wired communication with another communication device connected via the communication cable.
When another communication device and an outside device such as the management server 5 are capable of wireless communication through the wide area communication network 2, the outside of the vehicle depends on the communication path of the outside device → another communication device → the wired communication unit → the gateway 10. The apparatus and the gateway 10 can communicate with each other.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing an internal configuration of the ECU 30.
As shown in FIG. 3, the ECU 30 includes a CPU 31, a RAM 32, a storage unit 33, a communication unit 34, and the like. The ECU 30 is an in-vehicle control device that individually controls target devices mounted on the vehicle 1. Examples of the ECU 30 include an engine control ECU, a steering control ECU, and a door lock control ECU.

The CPU 31 controls the operation of the target device that it is in charge of by reading one or more programs stored in advance in the storage unit 33 into the RAM 32 and executing them.
The RAM 32 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 31, data necessary for execution, and the like.

The storage unit 33 is configured by a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The information stored in the storage unit 33 includes, for example, a computer program (hereinafter referred to as “control program”) for causing the CPU 31 to perform information processing for controlling a target device that is a control target in the vehicle.

The communication unit 34 is connected to the gateway 10 via an in-vehicle communication line disposed in the vehicle 1. The first communication unit 34 communicates with the gateway 10 according to a standard such as CAN, Ethernet, or MOST.
The communication unit 34 transmits the information given from the CPU 31 to the gateway 10 and gives the information received from the gateway 10 to the CPU 31. The first communication unit 34 may communicate according to other communication standards used for the in-vehicle network, as well as the above communication standards.

The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode by the CPU 31 to either “normal mode” or “reprogramming mode” (hereinafter also referred to as “repro mode”).
Here, the normal mode is a control mode in which the CPU 31 of the ECU 30 executes an original control for the target device (for example, engine control for the fuel engine, door lock control for the door lock motor, etc.).

The reprogramming mode is a control mode in which a control program used for controlling the target device is updated.
That is, the reprogramming mode is a control mode in which the CPU 31 erases or rewrites the control program in the ROM area of the storage unit 33. Only in this control mode, the CPU 31 can update the control program stored in the ROM area of the storage unit 33 to a new version.

When the CPU 31 writes the new version of the control program in the storage unit 33 in the repro mode, the activation unit 35 once restarts (resets) the ECU 30 and executes the verify process on the storage area in which the new version of the control program is written. .
The activation unit 35 causes the CPU 31 to operate according to the updated control program after the above-described verification processing is completed.

[Management Server internal configuration]
FIG. 4 is a block diagram showing the internal configuration of the management server 5.
As shown in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads out one or more programs stored in advance in the ROM 52 to the RAM 53 and executes them, thereby controlling the operation of each hardware and causing the management server 5 to function as an external device that can communicate with the gateway 10.
The RAM 53 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 51 and data necessary for execution.

The storage unit 54 includes a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 includes a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to the wide area communication network 2 such as a mobile phone network to execute the communication processing. The communication unit 55 transmits the information given from the CPU 51 to the external device via the wide area communication network 2 and gives the information received via the wide area communication network 2 to the CPU 51.

[Control program update sequence]
FIG. 5 is a sequence diagram illustrating an example of control program update for the ECU, which is executed in the program update system of the present embodiment. The update program is placed in the DL server 6 by a car maker of the vehicle 1, and it is set that the update program can be distributed to the management server 5.

  Preferably, when the management server 5 is in a state where the control program can be distributed, the management server 5 acquires update information that is information about the update program from the DL server 5 in which the update program is stored (step S1). The update information is, for example, information related to the distribution destination of the update program and information related to the data size.

The management server 5 executes the scheduling process when the update program can be distributed (step S2). The scheduling process is a process for determining an update program distribution schedule so that the update program download start times are distributed among the gateways 10A to 10C of each of the plurality of vehicles 1. Then, the management server 5 requests the gateways 10A to 10C to update the update program of the ECU 30 in the order according to the determined schedule (steps S3A to S3C). In steps S3A to S3C, for example, the management server 5 transmits the update program storage destination URL and the download request to the gateway 10 of the corresponding vehicle 1.
Thereby, each gateway 10 downloads the update program for ECU30 from the DL server 6 in the order according to the order of the said request | requirement (step S4A-S4C).

  When the update program is downloaded, each gateway 10 executes an update process to update the control program using the update program downloaded and stored in the memory (steps S5A to S5C). In the update process of steps S5A to S5C, for example, the gateway 10 requests the corresponding ECU 30 to update the control program. As a result, the control mode of the ECU 30 is switched from the normal mode to the repro mode, and the ECU can be updated by the control program. The ECU 30 rewrites the control program from the old version to the new version by developing the update program received from the gateway 10 and applying it to the control program of the old version.

[Scheduling process]
FIG. 6 is a flowchart showing specific contents of the scheduling process in step S2 of FIG. The processing shown in the flowchart of FIG. 6 is mainly realized by the CPU 51 when the CPU 51 of the management server 5 reads the program stored in the ROM 52 onto the RAM 53 and executes it. In the present embodiment, it is assumed that the operations after step S103 in FIG. 6 are performed. Step S101 in FIG. 6 will be described in the second embodiment.

  Referring to FIG. 6, CPU 51 of management server 5 acquires scheduling information that is information used for the scheduling process (step S103). The CPU 51 determines the download priority order between the gateways 10A to 10C using the acquired scheduling information (step S105). The determination method in step S105 will be described later. The CPU 51 requests download to the gateway 10 of the corresponding vehicle 1 in accordance with the determined priority order (step S107). Thereby, the download of the update program to the gateway 10 concerned is started.

[Functional configuration of Management Server]
FIG. 7 is a block diagram illustrating a specific example of a functional configuration of the management server 5 for performing the scheduling process. Each function of FIG. 7 is mainly realized by the CPU 51 when the CPU 51 of the management server 5 reads the program stored in the ROM 51 onto the RAM 52 and executes it.

  Specifically, referring to FIG. 7, the CPU 51 of the management server 5 includes a scheduling information acquisition unit 511 for acquiring scheduling information, a scheduling unit 512 for determining a schedule, and a DL for controlling the download process. A control unit 513 and an update information acquisition unit 514 for acquiring update information are included. Note that the determination unit 515 illustrated in FIG. 7 will be described in the second embodiment.

  The download process is, for example, a process (step S3) for requesting the gateway 10 to download an update program (notification of necessary information). If the management server 5 and the DL server 6 are configured as a single server device as described above, the download process may be the start of transmission (download) of the update program to the gateway 10. Alternatively, the download may fail and another download (retry) may be started.

(Scheduling method 1)
As a first method for determining the download priority in the scheduling unit 512 and determining the schedule, the travel state of each vehicle 1 is predicted (travel prediction) using the travel model of the vehicle 1, and the predicted travel pattern is set. There is a method for determining the priority order based on this. The travel model is a model of the travel pattern of the vehicle 1 that is generated based on the accumulation (travel history) of the travel state of the vehicle 1. The travel model includes, for example, a travel pattern for each day of the week and time.

  The scheduling information acquisition unit 511 includes a travel prediction unit 516 for performing travel prediction. The travel prediction unit 516 acquires the current date and time and the travel model for each vehicle 1. Preferably, scheduling information acquisition unit 511 further includes learning unit 518. The storage unit 54 is also provided with a model map storage unit 541 that stores a travel model for each vehicle 1 generated by the learning unit 518. The learning unit 518 and the model map storage unit 541 are an example of a travel model acquisition unit that acquires a travel model. For example, the travel prediction unit 516 reads the travel model of the corresponding vehicle 1 from the model map storage unit 541.

  The learning unit 518 generates a travel model for each vehicle 1 based on the accumulation of the travel state for a predetermined period. As an example, the learning unit 518 communicates with the gateway 10 of the corresponding vehicle 1 through the communication unit 55, thereby obtaining a vehicle obtained from a user's mobile terminal device such as an ECU 30 of the vehicle 1 or a smartphone (not shown), a car navigation device, or the like. Information indicating the running state of 1 is collected for a predetermined period. The information indicating the traveling state of the vehicle 1 includes, for example, the traveling position of the vehicle 1, the ON / OFF state of the engine, the operating state, the ON / OFF state of the power source, and the like. The learning unit 518 statistically processes these pieces of information for a predetermined period, thereby generating a travel pattern for each vehicle 1 such as every time zone, every day of the week, every season, and the like, and models it as a travel model. The statistical processing method used to generate the running pattern is not limited to a specific method, and any method can be adopted.

  As another example, the travel model acquisition unit may acquire a travel model generated by the gateway 10 of each vehicle 1 and stored in the storage unit 13 of the gateway 10 from the gateway 10.

  FIGS. 8 and 9 are diagrams illustrating specific examples of a traveling model of a certain vehicle 1. FIG. 8 shows a specific example of a travel model when the vehicle 1 is used for commuting. FIG. 9 shows a specific example of a travel model when the vehicle 1 is used mainly on holidays (Saturday and Sunday).

  In this case, the learning unit 518 acquires the traveling state of the vehicle 1 (whether traveling or stopped) and date / time information at a predetermined timing such as a fixed time interval over a predetermined period. And as an example, the learning part 518 produces | generates and models the driving | running | working pattern of the said vehicle 1 by totaling a driving | running state for every day of the week and every time slot | zone, and grasping | ascertaining the tendency.

  As an example, the travel model is generated as a model map MM, which is information in a map format as shown in FIGS. The learning unit 518 stores the generated model map MM in the model map storage unit 541 for each vehicle 1.

  The travel prediction unit 516 predicts the travel pattern (travel position, travel route) after the current date and time represented in the travel model as the travel pattern of the vehicle 1. For example, it is assumed that the model map MM for a certain vehicle 1 represents the travel model of FIG. If the current date and time is immediately before 9:00 am on weekdays, the travel prediction unit 516 predicts that the vehicle 1 is likely to be parked on the go after the determination time based on the travel model of FIG. To do. If the current date and time is 18:30 on Thursday, the travel prediction unit 516 predicts that the vehicle 1 will continue to travel for a while after the determination time based on the travel model of FIG.

  In addition, as another example, the travel prediction unit 516 may acquire a travel prediction result by another device such as the gateway 10 of the corresponding vehicle 1 from the other device.

  In the first scheduling method, the scheduling unit 512 stores in advance the correspondence between the running pattern and the priority order as the scheduling condition C. The scheduling condition C includes measures such as increasing the download priority for vehicles predicted to be parked soon, and decreasing the download priority for vehicles predicted to continue running for a while. Note that the priority order of download may rank one or a plurality of vehicles 1, and the above correspondence may be a correspondence with a specific rank. This is because the control mode of the corresponding ECU 30 is switched from the normal mode to the repro mode while the control program is being updated, and normal traveling is not possible. Therefore, the possibility that the control program can be updated becomes higher as the vehicle parks and stops, and the possibility that the control program can be updated becomes lower as the vehicle continues to travel. The scheduling unit 512 determines the download priority for each vehicle 1 according to the correspondence relationship included in the scheduling condition C based on the traveling pattern of each vehicle 1.

  By determining the download priority according to the first method, the start of the download is distributed among the plurality of gateways 10A to 10C, and the update program is efficient according to the travel prediction of the corresponding vehicle 1 Downloaded automatically.

(Scheduling method 2-1)
As a second method for determining the schedule, there is a method for determining the priority order based on the usage situation of each vehicle 1. The usage status includes the usage frequency of the vehicle 1.

  The scheduling information acquisition unit 511 acquires the usage frequency for each vehicle 1. The usage frequency can be obtained, for example, by communicating with the ECU that controls the traveling of the vehicle 1 via the gateway 10. Alternatively, the usage frequency may be obtained by reading the travel model for each vehicle 1 from the model map storage unit 541.

  The scheduling unit 512 stores in advance the correspondence between the usage frequency and priority for each vehicle 1 as the scheduling condition C. Scheduling condition C is, for example, when the weekly running time is less than 10 hours (low usage frequency), the download priority is increased, and the weekly running time is 30 hours or more (usage frequency is low). In the case of (high), it includes measures such as lowering the download priority. This is because the power source of the corresponding vehicle 1 needs to be in the ON state during the update of the control program. For this reason, the more frequently used vehicles are more likely to be able to update the control program, and the less frequently used vehicles are less likely to be able to update the control program. The scheduling unit 512 determines the download priority for each vehicle 1 according to the correspondence relationship included in the scheduling condition C based on the usage frequency of each vehicle 1.

  By determining the download priority in accordance with the second method described above, the start of download is distributed among the plurality of gateways 10A to 10C, and the update program is efficient according to the usage frequency of the corresponding vehicle 1 Downloaded automatically.

(Scheduling method 2-2)
The usage status may include version information of the corresponding control program of the ECU 30, and the priority order may be determined based on the version information.

  The scheduling information acquisition unit 511 acquires the version information of the control program of the corresponding ECU 30 for each vehicle 1 by communicating with the gateway 10 of the vehicle 1.

  The scheduling unit 512 stores in advance the correspondence between the version of the control program of the ECU 30 and the priority order as the scheduling condition C. Scheduling condition C includes measures such as increasing the download priority as the version of the control program of ECU 30 is older. This is because update to the current (latest) version is urgent as the version of the control program is older. The scheduling unit 512 determines the download priority for each vehicle 1 in accordance with the correspondence relationship included in the scheduling condition C based on the version of the control program of the corresponding ECU 30 of each vehicle 1.

  By determining the download priority in accordance with the second method described above, the start of the download is distributed among the plurality of gateways 10A to 10C, and the update program is downloaded according to the necessity of update.

(Scheduling method 2-3)
The usage status may include ON / OFF setting of the function controlled by the corresponding ECU 30, and the priority order may be determined based on the setting.

  The scheduling information acquisition unit 511 acquires information indicating ON / OFF setting of a function controlled by the corresponding ECU 30 for each vehicle 1 by communicating with the gateway 10 of the vehicle 1.

  The scheduling unit 512 stores in advance the correspondence between the ON / OFF setting of the ECU 30 and the priority order as the scheduling condition C. The scheduling condition C includes measures such as increasing the download priority when the function controlled by the ECU 30 is set ON, and decreasing the download priority when the function controlled by the ECU 30 is set OFF. This is less likely to be used when the function controlled by the ECU 30 is set to OFF, so the necessity for updating the control program of the ECU 30 is low, and may be used when the function is set to ON. This is because the necessity for updating is high. The scheduling unit 512 determines the download priority for each vehicle 1 in accordance with the correspondence relationship included in the scheduling condition C based on the ON / OFF setting of the function controlled by the corresponding ECU 30 of each vehicle 1.

  By determining the download priority according to the second method described above, the start of download is distributed among the plurality of gateways 10A to 10C, and the update program is downloaded in accordance with the necessity of update. Is done.

  The download priority may be determined by combining the second methods. That is, the download priority order may be determined using at least one of the use frequency of the vehicle, the version of the control program, and the setting for the ECU. That is, the priority order may be determined by combining two or three of the use frequency of the vehicle, the version of the control program, and the setting for the ECU.

(Scheduling method 3)
As a third method for determining the schedule, there is a method for determining the priority order based on a communication index indicating a communication state with the DL server 6 of each vehicle 1. The communication index is, for example, the number of packets transmitted in the wide area communication network 2 between the DL server 6 of the vehicle 1, the communication amount, the measured value (index value) of the communication speed, or the value calculated from the measured value. (Index value).

  The scheduling information acquisition unit 511 acquires a communication index for each vehicle 1. It is assumed that the number of packets, the amount of communication, and the like are measured by, for example, a telecommunications carrier that manages the wide area communication network 2 and the measured values are provided on a website or the like. The scheduling information acquisition unit 511 can store the URL of the website in advance and acquire a measurement value from the website. When using a value calculated from the actual measurement value as an index, the scheduling information acquisition unit 511 acquires the actual measurement value from the website and calculates the index value using the actual measurement value. The index value calculated from the actual measurement value is, for example, a line usage rate. For example, the scheduling information acquisition unit 511 stores the maximum number of packets that can be transmitted in the wide area network 2 and calculates the line usage rate by dividing the actually measured number of packets by the maximum number of packets that can be transmitted. To do.

  The scheduling unit 512 stores in advance the correspondence between the index value and the priority order for each vehicle 1 as the scheduling condition C. The scheduling condition C includes measures such as increasing the download priority when the usage rate is less than 70%, and lowering the download priority when the usage rate is 70% or more. This is because the vehicle 1 having a high possibility that the communication line used for downloading the update program is congested will be downloaded later, and the vehicle 1 having a high possibility that the communication state of the communication line is good will be downloaded first. It is to do. Based on the index value of each vehicle 1, the scheduling unit 512 determines the download priority for each vehicle 1 according to the correspondence relationship included in the scheduling condition C.

  By determining the download priority according to the third method, the start of download is distributed among the plurality of gateways 10A to 10C, and the update program is reliably distributed to each vehicle 1.

(Scheduling method 4)
As a fourth method for determining the schedule, there is a method for determining the priority order based on the correlation information correlated with the communication state with the DL server 6 of each vehicle 1. The correlation information is information related to an event that is a causal event that can cause the number of communication accesses that imposes a strain on the communication circuit. The above events are, for example, events that are temporally and geographically specified. For example, sports events (matches, athletic meet, etc.), music events (concerts, etc.), festival events such as festivals, explosion accidents, public events, etc. Includes large-scale man-made disasters such as traffic accidents and terrorist attacks, and natural phenomena such as abnormal weather (typhoons, local heavy rains, floods, etc.) and natural disasters (earthquakes, tsunamis, etc.). The correlation information includes the occurrence period and the influence range of the event.

  The scheduling information acquisition unit 511 stores at least a part of the correlation information in advance. The scheduling information acquisition unit 511 may access and acquire a server (not shown) that provides at least a part of the correlation information. For example, for the correlation information in which the event is an earthquake, the scheduling information acquisition unit 511 can acquire the occurrence position and date of occurrence of the earthquake by accessing the site of the Japan Meteorological Agency. In this case, the scheduling information acquisition unit 511 stores, as part of the correlation information, for example, the occurrence period as one week from the occurrence date and time, the affected area as the prefecture adjacent to the prefecture including the occurrence position, and the like.

  The scheduling information acquisition unit 511 further acquires the current position of each vehicle 1. The current position of the vehicle 1 is acquired, for example, by communicating with the gateway 10 of the corresponding vehicle 1. For example, the gateway 10 can obtain position information of the vehicle 1 by communicating with a navigation device (not shown) or communicating with a GPS (Global Positioning System).

  The scheduling unit 512 stores in advance the association between the event for each vehicle 1 and the correspondence between the priorities as the scheduling condition C. For example, the scheduling condition C is such that the download priority is lowered when the current date and time are included in the occurrence period of the event and the current position is included in the influence range of the event, and the download is performed otherwise. Including measures such as increasing the priority of This is because the vehicle 1 having a high possibility that the communication line used for downloading the update program is congested will be downloaded later, and the vehicle 1 having a high possibility that the communication state of the communication line is good will be downloaded first. It is to do. The scheduling unit 512 determines the download priority order for each vehicle 1 according to the correspondence relationship included in the scheduling condition C based on the association with the event of each vehicle 1.

  By determining the download priority according to the fourth method, the start of the download is distributed among the plurality of gateways 10A to 10C, and the update program is reliably distributed to each vehicle 1.

(Scheduling method 5)
As a fifth method for determining the schedule, there is a method in which the priority order is determined based on the communication state of the wireless communication unit 15 of the vehicle 1 in the download period (DL period). The DL period refers to a period from when transmission of the update program is started in wireless communication from the DL server 6 to the wireless communication unit 15 of the gateway 10 until reception by the wireless communication unit 15 is completed. The quality of the communication state of the vehicle 1 during the DL period can be determined by whether or not the travel route predicted to pass by the vehicle 1 is included in a dead area where the communication state is poor.

  In this case, the scheduling information acquisition unit 511 acquires an area map including a dead area. The area map is information indicating the communication strength at the position or range for each position or range, for example, −100 [dBm] for mountainous areas, −120 [dBm] for tunnels and underground. For example, the area map is assumed to be generated by a communication company that manages wireless communication performed by the wireless communication unit 15 and provided on a website or the like. The scheduling information acquisition unit 511 can store the URL of the website in advance and acquire an area map from the website.

  The scheduling information acquisition unit 511 acquires a travel route. As an example, the scheduling information acquisition unit 511 acquires a travel route from the navigation device by communicating with a navigation device (not shown) mounted on the vehicle 1 via the gateway 10. The travel route generated by the navigation device includes the travel route and the time until the vehicle passes each position. Therefore, the travel prediction unit 516 predicts the travel route generated by the navigation device as the travel route of the vehicle 1.

  As another example, the scheduling information acquisition unit 511 acquires a travel history of the vehicle 1 and predicts a travel route from the travel history. The travel history is obtained by statistically processing the travel position (for example, latitude and longitude) of the vehicle 1 for each predetermined period such as day of the week and time, and can be said to be a model of a travel pattern for each predetermined period. As an example, the statistical process is a process in which a position having the highest possibility of traveling every predetermined period is specified and determined as the traveling position of the period. For example, when the vehicle 1 is used for work from Monday to Friday, the travel history in the commuting time zone (for example, from 8 am to 8:30 am) indicates the travel route from home to the office. The method of statistical processing is not limited to a specific method, and any method can be adopted. When the travel history is generated in each vehicle 1 and stored in the storage unit 13 of the gateway 10, the scheduling information acquisition unit 511 acquires the travel history by communicating with the gateway 10. When the management server 5 acquires the travel position of each vehicle 1 and accumulates it to generate a travel history, the scheduling information acquisition unit 511 acquires the travel history from the storage unit 54. The travel prediction unit 516 predicts the travel route of the vehicle 1 based on the travel history of each vehicle 1. For example, the scheduling information acquisition unit 511 reads a travel history for a period corresponding to the current date and time and sets it as a predicted travel route. The travel history for the period corresponding to the current date and time is predicted to be a route on which the vehicle 1 travels.

  The scheduling unit 512 compares the predicted travel route with the area map, and determines whether the communication state is good or not based on whether at least a part of the predicted travel route is included in the insensitive area. That is, when the predicted travel route of the vehicle 1 does not pass through the dead area, the scheduling unit 512 determines that the communication state of the vehicle 1 is good. If not, or for the vehicle 1 that is not, the scheduling unit 512 does not determine that the communication state is good.

  The scheduling unit 512 stores in advance the correspondence between the determination result of the communication state for each vehicle 1 and the priority order as the scheduling condition C. The scheduling condition C includes measures such as increasing the download priority when it is determined that the communication state is good, and decreasing the download priority otherwise. This is because it is likely that the communication state of the wireless communication unit 15 during the DL period is good after downloading to the vehicle 1 where the communication state of the wireless communication unit 15 is likely to deteriorate during the DL period. This is to download the vehicle 1 first. Based on the determination result of the communication state of each vehicle 1, the scheduling unit 512 determines the download priority for each vehicle 1 according to the correspondence relationship included in the scheduling condition C.

  By determining the download priority according to the fifth method, the start of the download is distributed among the plurality of gateways 10A to 10C, and the update program is reliably distributed to each vehicle 1.

(Other examples of scheduling methods)
The management server 5 may notify the gateway 10 of each vehicle 1 that there is an update program, and may notify information necessary for downloading such as access information of the DL server 6 in response to a request from the gateway 10. The process of notifying information necessary for download is included in the download process. In this case, the scheduling unit 512 may determine the download priority order based on the order of requests from the gateway 10. If the request is distributed, the start of the download is also distributed.

  As another example, the scheduling unit 512 may have a random number generation function, and may use the random number to randomly determine download priorities for the plurality of gateways 10A to 10C. Such a scheduling method also distributes the start of download.

  As another example, the scheduling unit 512 may determine download priorities based on preset attributes of the vehicles 1. The attribute of the vehicle is a rank of a vehicle or a rank of a user of the vehicle set in advance, and may be registered in the management server 5 by, for example, a car manufacturer or the user himself / herself. In this case, the scheduling information acquisition unit 511 reads the vehicle attribute from the storage unit 54. The scheduling unit 512 stores in advance the correspondence between the attribute of the vehicle and the priority order, including the correspondence such that the higher the rank of the vehicle, the higher the priority of download, and the like for each vehicle 1 according to the correspondence relation. Determine download priority. When the ranks of a plurality of vehicles 1 are distributed, the start of download is distributed.

[Effect of the first embodiment]
According to the program update system according to the first embodiment, the start of downloading the update program of the ECU is distributed among the plurality of gateways 10A to 10C that are download destinations of the update program. Thereby, increase of the processing load of DL server 6 can be controlled.

  Moreover, in the program update system according to the first embodiment, in order to distribute the start of downloading, prediction of travel pattern for each vehicle 1, usage frequency, control program version, function ON / OFF setting, etc. Download priority order is determined based on the communication status indicating the communication status with the DL server 6, the correlation information correlated with the communication status, or the predicted value of the communication index. Thereby, the update program can be reliably distributed in an appropriate order while suppressing an increase in the processing load of the DL server 6.

<Second Embodiment>
In the program update system according to the second embodiment, when the update information of the update program to be downloaded includes type information indicating an exceptional type, the download process is executed without performing the scheduling process. The The exceptional type includes information representing a type such as the importance of the update program and the urgency of the update, and includes, for example, flag information such as an important flag and an urgent flag. As an example, an update program related to information security such as dealing with security holes, an update program necessary to ensure driving safety, an update program that is highly urgent to update such as map information used for automatic operation mode, Etc. The exceptional types such as the importance of the update program and the urgency of the update are set by a car manufacturer that provides the update program.

  That is, with reference to FIG. 6, in the program update system according to the second embodiment, the management server 5 refers to the type information when executing the scheduling process, and determines whether the scheduling process is necessary or not ( Step S101). If it is determined that the scheduling process is necessary (YES in step S101), the processes after step S103 are executed.

  As shown in FIG. 7, the CPU 51 of the management server 5 according to the second embodiment further includes a determination unit 515 for determining whether or not scheduling processing is necessary. The determination unit 515 determines whether or not scheduling processing is necessary with reference to the update information. When the update information includes type information indicating the above-mentioned exceptional type, the DL control unit 513 downloads the data to a plurality of gateways 10A to 10C at the same time, for example, at a timing set by the car manufacturer. Request. That is, update programs with high importance and urgency are transmitted even when the processing load of the DL server 6 increases, and update programs that are not so are distributed and distributed. Thereby, reduction of the processing load of DL server 6 and the importance and urgency of an update program can be made compatible.

  The exceptional type may include that the data size is equal to or less than a specified size. The data size of the update program is added to the update program as update information by, for example, a car manufacturer that provides the update program. The determination unit 515 stores in advance a processing amount threshold that does not require scheduling processing. The processing amount is, for example, the data size of the update program multiplied by the number of download destinations. The processing amount threshold is a processing amount that does not give a large processing load to the DL server 6. The determination unit 515 calculates the processing amount by multiplying the data size of the update program by the number of download destinations, and compares it with a threshold value. Then, the determination unit 515 determines that the scheduling process is performed when the calculated processing amount is larger than the threshold value. As a result, update programs with a processing amount smaller than the threshold are distributed without being distributed, and update programs with a processing amount larger than the threshold are distributed and distributed. Thereby, the processing load of the DL server 6 can be efficiently reduced.

<Third Embodiment>
In the program update system according to the first and second embodiments, the scheduling process is executed in the management server 5 which is a control device that executes the update program download process. As another example, the DL server 6 that downloads the update program may also function as a control device that executes the download process and execute the scheduling process. That is, in this case, each function of FIG. 7 is provided by a CPU (not shown) of the DL server 6.

<Fourth embodiment>
As another example, the attribute of the vehicle in the scheduling process based on the attribute of the vehicle described above is the attribute of both the ECU 30 (also referred to as the target ECU) and the gateway 10 that download the control program, or the target ECU and the gateway 10. And at least one of the attributes of the device. The attribute is, for example, an available memory capacity. In this case, the scheduling information acquisition unit 511 acquires the available capacity of the target ECU 30 of the vehicle 1 and / or the memory of the gateway 10 from the gateway 10 of each vehicle. The scheduling unit 512 preliminarily sets the correspondence between the attribute of the vehicle and the priority order as the scheduling condition C, including the correspondence such that the priority of the download is increased as the vehicle has a larger memory capacity in the target ECU 30 and / or the gateway 10. The priority order of download is determined for each vehicle 1 according to the correspondence relationship. When the free capacity of the memory of the target ECU 30 and / or the gateway 10 in a plurality of vehicles 1 is distributed, the start of download is distributed.

<Fifth embodiment>
In the program update system according to the first to fourth embodiments, it is assumed that the update program can be downloaded to the gateway 10 of the vehicle 1 when the vehicle 1 is in the power ON state (starting up). Therefore, in the scheduling process, the timing when each of the plurality of vehicles 1 is in the power-on state is predicted, and the download priority order is determined based on the timing.

  However, even if the update program is downloaded at a timing according to the determined priority, if the target vehicle 1 is not in the power-on state at that timing, the download is not successful.

  Therefore, in the program update system according to the fifth embodiment, in addition to the processing in the program update system according to the first to fourth embodiments, the target vehicle 1 is turned on at least at the start of download. A wake-up process, which is a process for setting (activating) the state, is executed.

  FIG. 10 is a block diagram illustrating an internal configuration of the gateway 10 according to the fifth embodiment. Referring to FIG. 10, CPU 11 of gateway 10 includes a timer 111. The CPU 11 of the gateway 10 includes a wakeup processing unit 112 that is a function for executing the wakeup process. This function is a function realized in the CPU 11 when the CPU 11 reads and executes one or more programs stored in the storage unit 13. However, at least a part may be realized by hardware such as an electronic circuit.

  The wake-up processing unit 112 generates a message for turning on the ECU 30 and causes the ECU 30 corresponding to the in-vehicle communication unit 14 to transmit the message. As a result, the corresponding ECU 30 is turned on. The wake-up processing unit 112 confirms the power state of all the ECUs 30 mounted on the vehicle 1 and sets the ECU 30 in the power-off state to the power-on state. Thereby, all ECU30 mounted in the vehicle 1 can be made into a power ON state by simple process.

  Preferably, the wake-up processing unit 112 confirms the power supply state of only the ECU 30 that is the update target of the control program and the ECU 30 that is necessary for the update and download of the update program. Let me. The ECU 30 necessary for downloading the update program is, for example, another ECU 30 connected to an in-vehicle communication line connecting the gateway 10 and the ECU 30 to be updated, or relaying the connection between the gateway 10 and the ECU 30 to be updated. ECU 30 and the like. Thereby, power consumption can be suppressed. The ECU 30 necessary for downloading the update program may be stored in advance for each ECU 30 to be updated of the control program, or the configuration of the in-vehicle network shown in FIG. You may specify.

  FIG. 11 is a sequence diagram illustrating an example of a control program update for the ECU, which is executed in the program update system according to the fifth embodiment. In FIG. 11, the process with the same step number as that in the sequence diagram of FIG. 5 is common to the process shown in the sequence diagram of FIG.

  Referring to FIG. 11, in the program update system according to the fifth exemplary embodiment, a schedule for downloading an update program for each gateway is determined by the scheduling process in management server 5 (step S2 '). In step S <b> 2 ′, the management server 5 executes the scheduling process described above to determine the priority order, and determines the download timing (schedule) for each gateway 10 based on the priority order. For example, the download timing of the gateway 10 with the highest priority may be set immediately after the completion of the scheduling process, and thereafter, the download timing of each gateway 10 may be set in the priority order at a predetermined time interval.

  In the program update system according to the fifth embodiment, when the download schedule is determined by the management server 5, the update schedule download schedule for the gateway 10 is notified from the management server 5 to the target gateway 10. (Step S11). The notification in step S11 includes at least information that can specify the timing at which the download is started. The information with which the download start timing can be specified is, for example, information indicating a period t1 from the notification until the download determined by the scheduling process starts. Another example of the information that can specify the timing at which the download is started may be information indicating the date and time when the download starts, which is determined by the scheduling process.

  The gateway 10 that has received the notification sets a timer for measuring a period t2 from the reception of the notification to execution of a wake-up process described later based on the period t1 (step S12). The period t2 is a period that is equal to or less than the period t1 and is defined based on the period t1. The gateway 10 stores the relationship between the period t1 and the period t2 in advance, and specifies the period t2 based on the period t1. The relationship between the period t1 and the period t2 is, for example, t2 = α × t1 (α is a coefficient such as 0.8) or t2 = t1−β (β is a constant such as 1 [ms]). .

  When the time period t2 is counted by the timer, the gateway 10 executes a wake-up process (step S13).

  After the vehicle 1 is turned on by the wake-up process in step S13, the management server 5 requests the gateway 10 to update the update program of the ECU 30 according to the determined schedule (step S3). Thereby, the gateway 10 downloads the update program from the DL server 6.

  In the program update system according to the fifth embodiment, at least when the update program determined by the scheduling process is started, at least the ECU 30 necessary for updating the control program can be turned on. For this reason, the update program can be downloaded at the timing.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 Vehicle 2 Wide Area Communication Network 5 Management Server (Control Device)
6 DL server 10 Gateway (control device)
11 CPU
12 RAM
DESCRIPTION OF SYMBOLS 13 Memory | storage part 14 In-vehicle communication part 15 Wireless communication part 30 ECU (vehicle-mounted control apparatus)
31 CPU
32 RAM
33 Storage Unit 34 Communication Unit 35 Start-up Unit 51 CPU
52 ROM
53 RAM
54 storage unit 55 communication unit 111 timer 112 wake-up processing unit (processing unit)
511 Scheduling information acquisition unit 512 Scheduling unit 513 DL control unit 514 Update information acquisition unit 515 Judgment unit 516 Travel prediction unit 518 Learning unit 541 Model map storage unit

Claims (17)

In a vehicle equipped with a vehicle-mounted control device that controls a vehicle-mounted device, the relay device connected to the vehicle-mounted control device via an in-vehicle communication line and relaying communication between an external device and the vehicle-mounted control device;
A control device that controls the download of the update program of the in-vehicle control device from the server to the relay device, and
The controller is
A processing unit that determines the priority of the download process of the update program for the relay device of each of a plurality of vehicles;
A download control unit that starts the download process according to the determined priority order.   The program distribution system according to claim 1, wherein the processing unit determines the priority order based on a travel pattern predicted based on a travel history of each of the plurality of vehicles.   The program distribution system according to claim 1, wherein the processing unit determines the priority order based on a usage situation of each of the plurality of vehicles.   The program distribution system according to claim 3, wherein the usage status includes at least one of a usage frequency of the vehicle, a version of a control program of the in-vehicle control device, and a setting for the in-vehicle device.   The program distribution system according to claim 1, wherein the processing unit determines the priority based on a communication index indicating a communication state between each of the plurality of relay devices and the server.   The program distribution system according to claim 5, wherein the processing unit determines the priority order based on a communication state of the vehicle during a download period of the update program.   The program distribution system according to claim 1, wherein the processing unit determines the priority based on correlation information correlated with a communication state between each of the plurality of relay apparatuses and the server.   The program distribution system according to claim 1, wherein the processing unit determines the priority order based on attributes set in advance for each of the plurality of vehicles.   The program distribution system according to claim 1, wherein the processing unit determines the priority order based on attributes of the in-vehicle control device and / or the relay device mounted on each of the plurality of vehicles.   The program distribution system according to claim 1, wherein the processing unit determines the priority by using a traveling pattern predicted based on a traveling history of each of the plurality of vehicles as a scheduling condition. The download can be executed while the in-vehicle control device is running,
The relay device is
A communication unit for receiving a notification of the download schedule from the server;
The program delivery system as described in any one of Claims 1-10 including the process part which performs the process which starts the said vehicle-mounted control apparatus at the timing based on the said schedule.   The program distribution system according to any one of claims 1 to 11, wherein the processing unit determines the priority when the type of the update program is not an exceptional type.   The program delivery system according to claim 12, wherein the exceptional type is a type indicating that the update program is highly important or urgent. In a vehicle equipped with an in-vehicle control device that controls an in-vehicle device, the in-vehicle control device is connected to the in-vehicle control device via an in-vehicle communication line and relays communication between an external device and the in-vehicle control device. A server for downloading the update program of
A processing unit that determines the priority of the download process of the update program for the relay device of each of a plurality of vehicles;
A download control unit that starts the download process in accordance with the determined priority order. The processing unit determines the download schedule for the relay device based on the priority,
The server according to claim 14, further comprising a communication unit that notifies the relay apparatus of the schedule. An update program for an in-vehicle control device that controls a target device mounted on a vehicle is a method of distributing to a plurality of vehicles,
Determining a priority of the update program download process for a plurality of vehicles;
And a download control unit that starts the download process in accordance with the determined priority order. A computer program for causing a computer to function as a control device that controls downloading of an update program of an in-vehicle control device that controls a target device mounted on each of the plurality of vehicles for a plurality of vehicles, the computer comprising:
A computer that causes the relay device of each of a plurality of vehicles to function as a processing unit that determines a priority of download processing of the update program, and a download control unit that starts the download processing according to the determined priority. program.

Images