JP2020004245A - Program update device, program update system, program update method and program update program - Google Patents

Abstract

To provide a program update device, a program update system, a program update method and a program update program which can dissolve inconvenience of a user when repro is performed.SOLUTION: A program update device comprises an acquisition unit, a determination unit and an updating unit. The acquisition unit acquires control program of a vehicle. The determination unit checks for a control device of the vehicle and determines whether update of the control program can be performed normally before writing of the control program to the control device of the vehicle performing the control program. The updating unit updates the control program memorized by the control device to the control program acquired by the acquisition unit when the determination unit determines that the update can be performed normally.SELECTED DRAWING: Figure 1

Description

  The disclosed embodiments relate to a program update device, a program update system, a program update method, and a program update program.

  2. Description of the Related Art Conventionally, there is a program update device that updates a vehicle control program stored in an in-vehicle device to the latest control program when a new vehicle control function is added to the in-vehicle device or when a vehicle control problem is solved. For example, see Patent Document 1).

  The program update device updates a control program in a state where the control program is connected via a connector to a vehicle-mounted device of a vehicle that is brought into a maintenance shop by a vehicle owner, so-called reprogramming (hereinafter, referred to as “repro”). ) Is common.

  In recent years, even if a vehicle is not brought into a maintenance shop, it is connected to an in-vehicle device via, for example, a communication network such as the Internet. 2. Description of the Related Art There is a program updating device that reproduces a device.

JP-A-2006-103155

  A program update device that reproduces a vehicle while it is not brought to a garage, such as reproducing by wireless communication, basically stops the engine of the vehicle while the user is using the vehicle, and turns off the ignition. Reproducing is performed when the switch is in the ON state.

  For this reason, for example, in the case of a vehicle that requires the user to turn on / off the power when performing the repro, it is necessary to have the user stay in the vehicle while performing the repro, and turn off the ignition switch after the repro is completed. Yes, for example, if re-producing fails and re-producing is attempted again, the user is restrained in the vehicle for a long time.

  Further, for example, even in the case of a vehicle that can automatically perform power ON / OFF at the time of performing a repro, if the repro fails and the repro is attempted again, the user wants to use the vehicle. This means that the device cannot be used for a long time.

  An aspect of an embodiment has been made in view of the above, and is a program updating apparatus, a program updating system, a program updating method, and a program updating program capable of eliminating inconvenience for a user when performing repro. The purpose is to provide.

  A program update device according to an aspect of an embodiment includes an acquisition unit, a determination unit, and an update unit. The acquisition unit acquires a control program for the vehicle. The determination unit checks the control device of the vehicle before writing the control program to the control device of the vehicle that executes the control program, and determines whether the control program can be updated normally. judge. The update unit updates the control program stored by the control device to the control program acquired by the acquisition unit when the determination unit determines that the update can be performed normally.

  The program update device, the program update system, the program update method, and the program update program according to one embodiment of the embodiment can eliminate inconvenience to a user when performing a repro.

FIG. 1 is an explanatory diagram illustrating an outline of a program updating method according to the embodiment. FIG. 2 is an explanatory diagram illustrating an example of a configuration of the program update system according to the embodiment. FIG. 3 is an explanatory diagram of the temporary repro determination according to the embodiment. FIG. 4 is an explanatory diagram illustrating an example of a procedure of a repro function test according to the embodiment. FIG. 5 is an explanatory diagram of a provisional repro failure process according to the embodiment. FIG. 6 is a flowchart illustrating an example of a process executed by the control unit of the program updating device according to the embodiment.

  Hereinafter, embodiments of a program update device, a program update system, a program update method, and a program update program will be described in detail with reference to the accompanying drawings. The present invention is not limited by the embodiments described below.

  FIG. 1 is an explanatory diagram illustrating an outline of a program updating method according to the embodiment. As shown in FIG. 1A, for example, a center B operated by a manufacturer of a vehicle C needs to add a new vehicle control function to the vehicle C or to solve a problem in vehicle control. The program providing device 10 provides the latest control program for the vehicle.

  The program updating device 1 mounted on the vehicle C acquires the latest control program from the program providing device 10 provided at a center or the like via wireless communication (step S1). The program updating device 1 updates a control program stored in a plurality of control devices (hereinafter, referred to as “ECU: Electronic Control Unit” 2) mounted on the vehicle C by updating the acquired control program to the acquired latest control program. I do. Hereinafter, the rewriting process of the control program, that is, the so-called reprogramming is abbreviated as repro.

  As described above, since the program updating device 1 obtains the latest control program from the program providing device 10 by wireless communication and reproduces the ECU, even if the user does not bring the vehicle C to a maker, a dealer, a maintenance shop, or the like. Reproducing is possible anywhere.

  However, the program updating device 1 needs electric power to execute the repro. For example, when performing the repro of the engine ECU, the engine needs to be stopped. Therefore, the program updating apparatus 1 performs the repro- duction in a state where the engine of the vehicle C is stopped and the ignition switch (hereinafter, referred to as "IG") is turned on.

  Therefore, since the user of the vehicle C cannot leave the vehicle C until the repro- duction is completed and the IG is turned off, the user is restrained in the vehicle C during this time. At this time, the program updating device 1 retries the repro when the repro cannot be completed due to some internal factor or external factor.

  In such a case, the program updating apparatus 1 restrains the user in the vehicle C for a long time, which causes inconvenience to the user. Therefore, as shown in FIG. 1B, before executing the repro, the program updating apparatus 1 makes a temporary repro determination whether the ECU 2 can perform the repro normally (step S2).

  At this time, the program updating apparatus 1 determines whether or not the vehicle C can complete the repro, and whether the repro function of the ECU 2 is normal, as the temporary repro determination. The provisional repro determination here can be said to be a pre-check process to be performed before starting the real repro or to check whether the repro can be performed normally. A specific example of the provisional repro determination will be described later with reference to FIGS.

  Then, as a result of the provisional repro determination, only when it is determined that repro can be executed (step S3), the program updating apparatus 1 executes the repro of the ECU 2 as shown in FIG. 1C (step S4).

  Thus, the program updating device 1 does not perform the repro when the repro cannot be normally completed, and thus does not retry the repro due to interruption or failure of the repro. Therefore, the program updating apparatus 1 can eliminate the inconvenience by shortening the binding time of the user when performing the repro.

  Further, in a vehicle capable of automatically performing power ON / OFF at the time of performing a repro, the program updating apparatus 1 is configured such that, even if an IG switch is turned off by a user operation, if there is a repro request, the IG is turned off. The power supply line is held by a relay provided in parallel with the IG switch, and power is supplied to the ECU to be repro- duced. When the repro is completed, the relay is turned off and the power is turned off.

  Also in the case of such a configuration, since the program updating device 1 does not perform the repro when the repro cannot be normally completed, the user wants to use the vehicle by failing the repro and retrying the repro. It is possible to prevent the device from becoming unusable at times.

  Further, as shown in FIG. 1B, when it is determined that the repro can not be executed (step S5), the program updating apparatus 1 performs a temporary repro failure process. For example, when it is determined that the repro function of the ECU 2 has failed and the repro execution cannot be performed, the program updating device 1 notifies the program providing device 10 of the abnormality of the ECU 2 as shown in FIG. (Step S6). Note that a specific example of the provisional repro failure process will be described later with reference to FIG.

  As described above, the program update device 1 can detect an abnormality of the ECU 2 at an early stage by performing the provisional repro determination, for example, and thus can prevent an accident due to the abnormality of the ECU 2 from occurring.

  In addition, when the center B is notified of the abnormality of the ECU 2 from the program update device 1, for example, the center B notifies the presence of the abnormality and a measure against the abnormality by using a lamp or a display provided in the vehicle C, or It is possible to notify the dealer of the problem with the ECU 2 of the vehicle C to the dealer and recommend the user of the vehicle C to check the vehicle C. Thus, the center B can prevent the occurrence of an accident due to the abnormality of the ECU 2 beforehand.

  Next, an example of a configuration of the program update system 100 according to the embodiment will be described with reference to FIG. FIG. 2 is an explanatory diagram illustrating an example of a configuration of the program update system 100 according to the embodiment. As shown in FIG. 2, the program updating system 100 includes a program providing device 10 and a program updating device 1 mounted on the vehicle C.

  The program updating apparatus 1 and the program providing apparatus 10 are connected to each other via a communication network N such as the Internet so as to be capable of wireless communication in two directions. The vehicle C is equipped with a car navigation device (hereinafter, referred to as “car navigation system 5”), a BMS (Battery Management System) 6, and a plurality of ECUs 2.

  The car navigation 5 is a device that provides route guidance to a destination input by a user of the vehicle C, for example. The car navigation 5 stores map information, and outputs map information including a stop position of the vehicle C to the program updating device 1 by a GPS (Global Positioning System).

  In addition, the car navigation 5 has a function of connecting to the weather information providing device via the communication network N and acquiring weather information at the stop position of the vehicle C from the weather information providing device. The weather information includes information such as weather, temperature, and humidity. The car navigation 5 outputs the acquired weather information to the program updating device 1.

  The BMS 6 is a device that monitors a charge / discharge state of a battery mounted on the vehicle C. The BMS 6 outputs information indicating the remaining amount of power charged in the battery (hereinafter, referred to as “battery remaining amount”) to the program updating device 1. The program update device 1 operates using a battery monitored by the BMS 6 as a power supply.

  Each ECU 2 includes a control unit 21 and a storage unit 22. The storage unit 22 is, for example, an information storage device such as a data flash which is a rewritable nonvolatile memory, and stores a control program 23. The control unit 21 includes a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and various circuits.

  The control unit 21 controls the operation of a control target to be controlled by each ECU 2 by the CPU executing a control program stored in the storage unit 22. The control target of the ECU 2 is wide-ranging, for example, such as an engine, a transmission, a hybrid system, an automatic brake, and support for automatic driving in the same lane. The control unit 21 may be configured by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

  The program update device 1 is a device that manages the execution of repro when the control program stored in the ECU 2 needs to be updated. The program update device 1 includes a control unit 3 and a storage unit 4.

  The control unit 3 includes a microcomputer having a CPU, a ROM, a RAM, and the like, and various circuits. The control unit 3 is configured to execute an acquisition unit 31 that functions by executing a program update program (a program for performing update control of a control program described later) stored in a ROM using a RAM as a work area. A unit 32, an update unit 33, and a notification unit 34 are provided.

  The control unit 3 may be configured by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The storage unit 4 is an information storage device such as a data flash, which is a rewritable nonvolatile memory, and stores a latest control program 41 and test information 42.

  The latest control program 41 is the latest control program to be executed by the ECU 2. The test information 42 is test information written in the storage unit 22 of the ECU 2 when a test is performed to determine whether the repro function of the ECU 2 is normal.

  The acquisition unit 31 acquires the latest control program 41 from the program providing device 10 via the communication network N, and causes the storage unit 4 to store the acquired latest control program 41. Further, the acquisition unit 31 outputs information indicating that the latest control program 41 is stored in the storage unit 4 to the determination unit 32.

  Further, the acquisition unit 31 acquires map information including the stop position of the vehicle C and weather information at the stop position of the vehicle C from the car navigation system 5, and outputs the acquired map information and weather information to the determination unit 32. Further, the obtaining unit 31 obtains information indicating the remaining battery level from the BMS 6, and outputs the obtained information indicating the remaining battery level to the determining unit 32.

  The determination unit 32 makes a provisional repro determination by the ECU 2 when the latest control program 41 is acquired by the acquisition unit 31 or when the latest control program 41 is stored in the storage unit 4. The determination unit 32 determines whether or not the updating unit 33 can complete the repro by performing a provisional repro determination.

  The updating unit 33 causes the control program 23 stored in the storage unit 22 of the ECU 2 to be rewritten to the latest control program 41 when the determination unit 32 determines that reproducing can be completed as a result of the provisional repro determination. Perform a repro.

  Here, a specific example of the temporary repro determination performed by the determination unit 32 will be described with reference to FIGS. 3 and 4. FIG. 3 is an explanatory diagram of the temporary repro determination according to the embodiment. FIG. 4 is an explanatory diagram illustrating an example of a procedure of a repro function test according to the embodiment.

  The determination unit 32 performs a check (provisional repro determination) on each item according to the execution order shown in FIG. The determination unit 32 first checks each of the first to third items in the execution order (prerequisite check for repro- duction) to determine whether or not the situation of the vehicle C is such that the repro- duction can be completed. When it is determined that all three checks can be completed, a fourth check (repro function check of a memory or the like) is performed. The order in which the first to third items are checked is not limited to the order shown in FIG.

  As described above, the determination unit 32 reduces the use of unnecessary repro function checks by setting repro function checks that perform writing and reading to the memory, which require more time than other checks, after the other check items. This can reduce the time required for checking when it is determined that repro execution is not possible.

  Then, the updating unit 33 executes the repro when the determining unit 32 determines that the repro-executable condition is satisfied in the fourth check. Accordingly, the update unit 33 can prevent the useless execution of the fourth check when any one of the first to third items is not satisfied with the repro-executable condition. it can.

  In addition, if the reproducibility condition is not satisfied by the check of the fourth item, the updating unit 33 does not execute the repro. As a result, the renewal unit 33 keeps the user in the vehicle C for a long time by retrying the repro as a result of executing the repro, even though the repro Binding can be prevented.

  Specifically, when starting the provisional repro determination, the determination unit 32 first performs a battery check. Here, the determination unit 32 checks the remaining battery level based on the information indicating the remaining battery level input from the BMS 6, as described in the item of the battery check.

  Then, the determination unit 32 determines whether the remaining battery capacity satisfies the reproducible condition. The determination unit 32 determines that the battery remaining amount satisfies the reproducible execution condition and that the reproducing can be completed when there is a battery remaining amount capable of completing the reproducing.

  Therefore, when there is not enough battery power to complete the repro, the updating unit 33 does not execute the repro. Accordingly, the updating unit 33 can prevent the repro- duction from failing to be completed due to a shortage of the remaining battery power.

  Subsequently, the determination unit 32 performs a weather check. Here, the determination unit 32 acquires the weather information (including the humidity) from the car navigation 5 as described in the contents of the weather check. Then, the determining unit 32 determines whether the weather around the vehicle C satisfies the reproducible condition.

  For example, when the weather is sunny or cloudy and the humidity is equal to or less than the threshold, the determination unit 32 determines that the reproducible condition is satisfied, the weather is suitable for the repro, and the repro can be completed.

  Therefore, if the weather around the vehicle C is not suitable for the repro, the updating unit 33 does not execute the repro. Thus, for example, when the weather is higher than the threshold value of rain or humidity, the updating unit 33 can prevent the repro- duction from failing to be completed due to electric leakage due to water droplets, power interruption due to lightning, or the like.

  Subsequently, the determination unit 32 performs a location check. Here, the determination unit 32 acquires the stop position of the vehicle C from the car navigation 5 as described in the contents of the location check. Then, the determination unit 32 determines whether or not the stop position satisfies the reproducible condition.

  When the stop position is a position where the vehicle is stopped for a time required for repro or more, the determination unit 32 determines that the repro can be executed and the repro can be completed. For this reason, the updating unit 33 stops at a place where the vehicle C resumes traveling in a relatively short time, such as when the vehicle C is stopped on the road or at a convenience store, a station, or a parking lot in a service area of a highway. If so, do not run the repro.

  Thus, the updating unit 33 can prevent the engine of the vehicle C from being started and failing to complete the repro, after the repro is started and before the repro is completed. When the determination unit 32 determines that all the reproducibility conditions are satisfied by the above three checks, it performs a fourth repro function check.

  Here, the determination unit 32 writes the test information 42 into the storage unit 22 by the control unit 21 of the ECU 2 as described in the execution of the repro function check, Of the test information 42 is read out.

  At this time, the determination unit 32 reads the test information 42 from the storage unit 4 of the program update device 1, and outputs the test information 42 to the control unit 21 of the ECU 2. The control unit 21 writes the test information 42 input from the determination unit 32 into the storage unit 22 of the ECU 2, then reads the written test information 42 from the storage unit 22 and outputs the test information 42 to the determination unit 32.

  Then, the determining unit 32 determines whether or not the result of the repro function test satisfies the repro executable condition. The determination unit 32 includes write test information 42 prepared in advance for writing to the storage unit 22 and test information 42 read from the storage unit 22 after writing the test information 42 to the storage unit 22. When they match, it is determined that the reproducibility condition is satisfied.

  At this time, for example, as shown in FIG. 4A, the determination unit 32 controls the ECU 2 at three locations, namely, at the beginning, the middle, and the end of the storage area where the control program 23 is stored in the storage unit 22 of the ECU 2. The test area 24a, 24b, 24c is secured by the unit 21.

  The control unit 21 secures test areas 24a, 24b, and 24c before the control program 23 (first half), between the control program 23 (first half) and the control program 23 (second half), and after the control program (second half). . These three test areas 24a, 24b, 24c are areas not used as storage areas for the control program 23.

  Then, for example, as shown in FIG. 4B, the control unit 21 stores test information 42 such as a test 001 in the first test area 24a, a test 002 in the middle test area 24b, and a test 003 in the last test area 24c. Write each. After that, the control unit 21 reads out the written test information 42 from each of the test areas 24a, 24b, 24c and outputs it to the determination unit 32 of the program updating apparatus 1.

  As shown in FIG. 4C, when the tests 001, 002, 003 (read) and the tests 001, 002, 003 (write) all match, as shown in FIG. Then, the repro function is determined to be normal.

  As described above, the determination unit 32 performs a verification check whether the ECU 2 can normally write the test information 42 into the storage unit 22 that stores the control program 23, that is, whether the repro function is normal. Thereby, the determination unit 32 can detect an abnormality of the control unit 21 of the ECU 2 at an early stage before the repro- duction is executed.

  Note that the method of checking whether the repro function is normal (memory check) is not limited to the above-described method. As a memory check method, various generally known memory check methods such as a checksum method for checking the total value of data read after writing data to the memory can be applied.

  In addition, as a memory check method, a read check on an area where a control program is written (an area where a currently used control program is written) is performed on a partial area or an entire area of an area where a currently used control program is written. It may be.

  In the read check by this method, writing is not performed at the time of the check, but error detection data (data such as parity) is preliminarily embedded in the area together with the data, and the read data is checked based on the error detection data. To detect.

  The updating unit 33 executes the repro when the determination result indicating that the repro function is determined to be normal is input from the determining unit 32. For this reason, the update unit 33 does not execute the repro unless a determination result indicating that the repro function is normal is input. Accordingly, when there is a problem with the control unit 21 of the ECU 2, the updating unit 33 can prevent the malfunction of the ECU 2 caused by executing the reprotocol.

  If the reproducible execution condition is not satisfied by checking the four items of the provisional repro determination, the determining unit 32 outputs a determination result indicating that to the updating unit 33. The updating unit 33 performs a temporary repro failure process when a determination result indicating that the repro executable condition is not satisfied is input from the determining unit 32.

  Here, a specific example of the provisional repro failure process will be described with reference to FIG. FIG. 5 is an explanatory diagram of a provisional repro failure process according to the embodiment. As shown in FIG. 5, when any one of the battery check, the weather check, and the location check does not satisfy the repro-executable condition, the update unit 33 performs the next vehicle IG as a provisional repro failure process. Postpone repro until is turned off.

  As a result, the renewal unit 33 keeps the user in the vehicle C for a long time by retrying the repro as a result of executing the repro, even though the repro Binding can be prevented.

  Further, by postponing the repro, the next time the IG of the vehicle C is turned off, it is expected that the remaining battery level, the weather, the location, and the like will be in a state suitable for the repro. Therefore, when the remaining battery capacity, weather, location, and the like become suitable for the repro later, the updating unit 33 can normally complete the repro by performing the repro.

  Further, when the repro-executable condition is not satisfied in the re-pro function check, the updating unit 33 causes the notification unit 34 to notify the program providing device 10 that the re-pro function of the ECU 2 is abnormal.

  Thus, the center B in which the program providing device 10 is installed can prevent the occurrence of an accident due to the abnormality of the ECU 2 by taking measures such as recommending the user of the vehicle C to inspect the vehicle C. .

  Note that, when the repro- duction is successfully completed, the updating unit 33 causes the notification unit 34 to notify the program providing device 10 of a result indicating that. Thereby, at the center B, it can be confirmed that the ECU 2 of the vehicle C is operating by executing the latest control program 41.

  Next, a process executed by the control unit 3 of the program updating device 1 according to the embodiment will be described with reference to FIG. FIG. 6 is a flowchart illustrating an example of a process executed by the control unit 3 of the program updating device 1 according to the embodiment.

  When the information indicating that the IG is turned off is input from the vehicle C, the control unit 3 executes the process illustrated in FIG. Specifically, as shown in FIG. 6, the control unit 3 first determines whether there is a control program that has not been acquired (the latest control program 41) (step S101).

  When the control unit 3 determines that there is an unacquired latest control program 41 (step S101, Yes), the control unit 3 acquires the latest control program 41 from the program providing device 10 and stores it in the storage unit 4 (step S102). To step S103.

  When the control unit 3 determines that there is no unacquired latest control program 41 (step S101, No), the control unit 3 determines whether the latest control program 41 is already stored in the storage unit 4 (step S112). .

  When the control unit 3 determines that the latest control program 41 has not been stored (No at Step S112), the control unit 3 shifts the processing to Step S111. When the control unit 3 determines that the latest control program 41 has been stored (step S112, Yes), the process proceeds to step S103.

  In step S103, the control unit 3 determines whether there is no problem with the battery remaining amount of the vehicle C. When determining that there is a problem with the remaining battery level (No at Step S103), the control unit 3 shifts the processing to Step S111.

  When the control unit 3 determines that there is no problem with the remaining battery level (step S103, Yes), the control unit 3 determines whether there is no problem with the weather (step S104). When determining that there is a problem with the weather around the vehicle C (No at Step S104), the control unit 3 shifts the processing to Step S111.

  When determining that there is no problem in the weather (step S104, Yes), the control unit 3 determines whether there is no problem in the location where the vehicle C is stopped (step S105). When determining that there is a problem in the location (Step S105, No), the control unit 3 shifts the processing to Step S111.

  When it is determined that there is no problem in the location (step S105, Yes), the control unit 3 performs the repro function test of the ECU 2, which is the repro function check described above (step S106). As a result, the control unit 3 determines whether or not there is a problem with the repro-function of the ECU 2 (step S107).

  When determining that there is a problem with the repro function (step S107, No), the control unit 3 shifts the processing to step S110, and notifies the program providing device 10 to that effect. When determining that there is no problem with the repro function (step S107, Yes), the control unit 3 notifies the user of the vehicle C of repro to start repro (step S108).

  Thereafter, the control unit 3 executes the repro to complete the repro (step S109), and notifies the program providing device 10 that the repro has been successfully completed (step S110). Finally, the control unit 3 turns off the IG of the vehicle C (step S111), and ends the processing.

  Note that, in the above-described embodiment, the control unit 3 of the program updating apparatus 1 executes the repro after notifying the user of the vehicle C of the repro to start in step S108 shown in FIG. A process for confirming whether or not a repro is desired may be added.

  In such a case, for example, the control unit 3 may confirm with the user immediately before starting the provisional repro determination (immediately before step S103 shown in FIG. 6), or immediately after determining that there is no problem in the provisional repro determination (see FIG. 6). (Just before step S108 shown in FIG. 7).

  In the former case, the control unit 3 turns off the IG of the vehicle C immediately after the user does not want to reproduce. Thereby, the control unit 3 can minimize the time for restraining the user in the vehicle C.

  On the other hand, in the latter case, the control unit 3 can complete the provisional repro judgment before confirming whether the user wants the repro. Therefore, if the user wishes the repro, the control unit 3 waits for the user. The time is only the time when the repro is running. Thus, the control unit 3 can minimize the repro waiting time felt by the user.

  Further, in the above-described embodiment, the control unit 3 performs the provisional repro determination in the execution order illustrated in FIG. 3. However, after performing the repro function check, the control unit 3 may perform the battery check, the weather check, and the location check sequentially. Good.

  Thus, for example, when it is determined in the repro function check that there is a problem with the repro function of the ECU 2, the control unit 3 does not need to perform the subsequent battery check, weather check, and location check, thereby reducing the processing load. be able to.

  In addition, by performing the repro function check at the beginning of the provisional repro determination, the control unit 3 can quickly detect the abnormality of the ECU 2 and notify the program providing device 10 when there is a problem with the repro function of the ECU 2.

  When performing the repro function check, the control unit 3 may perform the repro function check by writing the test information 42 in an area where the beginning, middle, and end programs of the control program 23 are actually stored.

  At this time, when the control unit 3 can operate without using the control program 23, the control unit 3 temporarily stores the first, middle, and last programs of the control program 23 stored in the ECU 2 in another storage. After being saved in the area and stored, the test information 42 is written to perform the repro function check.

  Accordingly, the control unit 3 can perform the repro function check using the area in which the control program 23 is actually stored and the latest control program 41 is written at the time of the repro. It can be carried out.

  Then, after performing the repro function check, the control unit 3 returns the saved program to the original area. If it is difficult for the control unit 3 to operate without using the control program 23, a test area in which the control program 23 is not stored is provided in advance in the area storing the control program 23. Alternatively, the repro function check may be performed by writing the test information 42 to this area.

  Thus, the ECU 2 can execute the control program 23 and perform the same operation until the next time the IG of the vehicle C is turned off, for example. The control unit 3 immediately notifies the program providing device 10 when it is determined that there is a problem with the repro function even if the repro function is checked at the beginning of the provisional repro determination.

  In the above-described embodiment, basically, an embodiment in which test areas 24a, 24b, and 24c that are not used as storage areas for the control program 23 are secured in the storage unit 22 of the ECU 2 has been described. Is an example, and various modifications are possible.

  For example, when the ECU 2 includes two ROMs, the control unit 3 keeps the currently stored control program 23 in the first ROM, and stores the latest control program 41 in the second ROM. The repro function check may be performed by writing the test information 42 into the repro function.

  In this case, the control unit 3 performs the repro function check by writing the test information 42 in an area where the first, middle, and last programs of the latest control program 41 in the second ROM are actually written.

  Then, when it is determined that there is no problem in the repro function check, the control unit 3 writes the latest control program 41 in the second ROM and causes the ECU 2 to execute the latest control program 41. Thereafter, when the repro- duction is required again, the control unit 3 performs a repro function check using the first ROM.

  As described above, the control unit 3 performs a more accurate repro function check by performing the repro function check of the ECU 2 using the area where the latest control program 41 is actually written.

  Further, the control unit 3 is configured such that the ECU 2 divides a storage area of one ROM into a plurality of areas in advance, and a part of the area is the first ROM, and the other area is the second ROM. To perform the same repro function check as when two ROMs are provided.

  When performing the repro function check using the second ROM, the control unit 3 performs the repro function check using an area randomly selected each time in the area where the latest control program 41 is written. You can also.

  Thus, the control unit 3 can check the function of writing information in an arbitrary area where the latest control program 41 is to be written. In the case of such a configuration, the control unit 3 may perform a write check on all areas where the program is written.

  Further, the control unit 3 reproduces the plurality of ECUs 2. However, if there is an ECU 2 that cannot be reproduced among the plurality of ECUs 2, the operation is dependent on only the reproducible ECU 2 or the ECU 2 that cannot be reproduced. Only the ECU 2 having no relation is reproduced. Thus, the control unit 3 can reproduce as many ECUs 2 as possible without causing a problem due to reproducing.

  Further, in the above-described embodiment, the configuration in which reproducing is performed when the IG is off is described. However, when reproducing a device that is turned on when the ACC is on, such as a car navigation device, the reproducing is performed when the ACC is off. May be configured.

  Further, the method of acquiring the update program performed by the program update device 1 is not limited to wireless acquisition. For example, in a vehicle such as an EV (Electric Vehicle) or a plug-in HV (Hybrid Electric Vehicle), the program update device 1 is configured to obtain the update program by wire when a power plug is connected at the time of charging, or the user can update the program. A configuration in which the stored storage medium is obtained by connecting to a vehicle may be used.

  Further effects and modifications can be easily derived by those skilled in the art. Thus, the broader aspects of the present invention are not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof.

100 program update system 1 program update device 2 ECU
Reference Signs List 21 control unit 22 storage unit 23 control program 3 control unit 31 acquisition unit 32 determination unit 33 update unit 34 notification unit 4 storage unit 41 latest control program 42 test information 5 car navigation 6 BMS

Claims (11)

An acquisition unit that acquires a vehicle control program;
Before writing the control program in the control device of the vehicle that executes the control program, a determination unit that checks the control device of the vehicle to determine whether the control program can be updated normally. When,
And an update unit that updates the control program stored by the control device to the control program acquired by the acquisition unit when the determination unit determines that the update can be performed normally. Program update device to do. The determination unit includes:
2. The program updating device according to claim 1, wherein, as the check, a writing test is performed to determine whether information can be normally written in test areas distributed and provided in a plurality of locations in the storage unit of the control device. 3. . A notification unit that notifies the control program providing device of an abnormality of the control device when the storage unit determines in the check by the determination unit that the control program is not in a state in which the control program can be updated normally. The program updating device according to claim 2, wherein The determination unit includes:
It is determined whether or not the status of the vehicle is a status where the update of the control program can be completed, and when it is determined that the update can be completed, the check is performed. Program update device. The determination unit includes:
The program updating device according to claim 4, wherein when the remaining amount of the battery mounted on the vehicle is equal to or more than a predetermined amount, it is determined that the update can be completed. The acquisition unit,
Obtaining information about the weather around the vehicle,
The determination unit includes:
The program update device according to claim 4, wherein when the weather around the vehicle is weather suitable for updating the control program, it is determined that the update can be completed. The acquisition unit,
Obtain the stop position of the vehicle,
The determination unit includes:
It is determined that the update can be completed when the stop position is a position where a stop of the update time or more is expected. 7. The method according to claim 4, wherein the update is completed. Program update device. The acquisition unit,
The program update device according to any one of claims 1 to 7, wherein the control program for the vehicle is acquired wirelessly from a center. A providing device that provides a vehicle control program;
An acquisition unit that acquires the control program from the providing device;
Before writing the control program in the control device of the vehicle that executes the control program, a determination unit that checks the control device of the vehicle to determine whether the control program can be updated normally. When,
An update unit that updates a control program stored by the control device to the control program acquired by the acquisition unit when the determination unit determines that the update can be performed normally; and A program update system comprising: A program update method executed by a computer,
An acquisition step of acquiring a vehicle control program;
Before writing the control program in the control device of the vehicle that executes the control program, a determining step of checking the control device of the vehicle to determine whether the control program can be updated normally. When,
An updating step of updating a control program stored by the control device to the control program acquired by the acquiring step when it is determined that the updating can be performed normally by the determining step. How to update programs. An acquisition procedure for acquiring a vehicle control program;
Before writing the control program into the control device of the vehicle that executes the control program, a determination procedure is performed to check whether the control program of the vehicle can be updated normally by checking the control device of the vehicle. When,
And updating the control program stored by the control device to the control program acquired by the acquisition procedure when the update procedure is determined to be normally performed by the determination procedure. A program update program characterized by the following.

Images