JP2021015618A - On-vehicle update device, update processing program, and program update method - Google Patents

Abstract

To provide an on-vehicle update device capable of preventing storage capacity of a storage unit of an own device from becoming insufficient when updating a program of an on-vehicle control device.SOLUTION: An on-vehicle update device for acquiring an update program transmitted from an external server outside a vehicle, and performing a process for updating a program of an on-vehicle control device mounted on the vehicle, includes a storage unit and a control unit. The storage unit stores the update program and the control unit controls transmission of the update program to the on-vehicle control device to be updated. When acquiring the update program from the external server, the control unit transmits saved data stored in the storage unit to the external server or a vehicle control device not to be updated other than the vehicle control device to be updated, and stores at least a part of the update program acquired from the external server in the storage unit.SELECTED DRAWING: Figure 1

Description

The present invention relates to an in-vehicle update device, an update processing program, and a program update method.

The vehicle is equipped with an in-vehicle ECU (Electronic Control Unit) for controlling in-vehicle devices such as a power train system such as engine control and a body system such as air conditioner control. The in-vehicle ECU includes an arithmetic processing unit such as an MPU, a rewritable non-volatile storage unit such as a RAM, and a communication unit for communicating with another in-vehicle ECU, and reads and executes a program stored in the storage unit. Controls the in-vehicle device. Further, the vehicle is equipped with a relay device having a wireless communication function, which communicates with the program providing device connected to the network outside the vehicle via the relay device, and the program of the in-vehicle ECU is transmitted from the program providing device. Can be downloaded (received) to update the program of the in-vehicle ECU (see, for example, Patent Document 1). In the relay device of Patent Document 1, the program of the vehicle-mounted ECU received from the program providing device is stored in the storage unit of the own device.

JP-A-2017-97851

However, when updating the program of the in-vehicle control device (in-vehicle ECU), the total data capacity of the program acquired from the program providing device, such as when a plurality of programs are acquired or when the file size of a single program increases. Therefore, there is a concern that the total data capacity may exceed the storage capacity of the storage unit of the relay device.

An object of the present invention is to provide an in-vehicle update device capable of preventing the storage capacity of the storage unit of the own device from becoming insufficient when updating a program of the in-vehicle control device.

The in-vehicle update device according to one aspect of the present disclosure is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs a process for updating the program of the in-vehicle control device mounted on the vehicle. A storage unit and a control unit are provided, the storage unit stores the update program, and the control unit controls transmission of the update program to the in-vehicle control device to be updated. When the control unit acquires the update program from the external server, the save data stored in the storage unit is used for in-vehicle control of a non-update target other than the external server or the in-vehicle control device to be updated. It is transmitted to the device, and at least a part of the update program acquired from the external server is stored in the storage unit.

The in-vehicle update device according to one aspect of the present disclosure is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs a process for updating the program of the in-vehicle control device mounted on the vehicle. A storage unit and a control unit are provided, the storage unit stores the update program, and the control unit controls transmission of the update program to the in-vehicle control device to be updated. When the control unit acquires the update program from the external server, if the total data capacity of the update program is smaller than the free capacity of the storage unit, the update program acquired from the external server in the storage unit. When the total data capacity of the update program is equal to or greater than the free capacity of the storage unit, the saved data stored in the storage unit is not stored in the external server or the in-vehicle control device to be updated. It is transmitted to the in-vehicle control device to be updated, and the update program is overwritten in the storage area in which the saved data is stored in the storage unit.

The in-vehicle update device according to one aspect of the present disclosure is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs a process for updating the program of the in-vehicle control device mounted on the vehicle. A storage unit and a control unit are provided, the storage unit stores the update program, and the control unit controls transmission of the update program to the in-vehicle control device to be updated. When the control unit acquires the update program from the external server, the control unit derives the total data capacity of the update program, and when the total data capacity of the update program is equal to or greater than the free capacity of the storage unit, the storage unit The saved data stored in the unit is saved in a storage unit other than the own device, and the storage unit other than the own device is the external server or the in-vehicle control device other than the in-vehicle control device to be updated. Includes at least one of the storage units of.

According to one aspect of the present disclosure, there is provided an in-vehicle update device capable of preventing the storage capacity of the storage unit of the own device from becoming insufficient when updating the program of the in-vehicle control device.

FIG. 1 is a schematic diagram illustrating the configuration of the vehicle-mounted update system according to the first embodiment. FIG. 2 is a block diagram illustrating the configuration of an in-vehicle update device and the like. FIG. 3 is an explanatory diagram illustrating one aspect of the saved data stored in the storage unit. FIG. 4 is an explanatory diagram (sequence diagram) illustrating one mode of updating by the in-vehicle updating device. FIG. 5 is a flowchart illustrating the processing of the control unit of the in-vehicle update device. FIG. 6 is a flowchart illustrating the processing of the control unit of the vehicle-mounted update device according to the second embodiment.

[Explanation of Embodiments of the present disclosure]
First, embodiments of the present disclosure will be listed and described. In addition, at least a part of the embodiments described below may be arbitrarily combined.

(1) The in-vehicle update device according to one aspect of the present disclosure is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs a process for updating the program of the in-vehicle control device mounted on the vehicle. A storage unit and a control unit are provided, and the storage unit stores the update program, and the control unit controls transmission of the update program to the in-vehicle control device to be updated. When the control unit acquires the update program from the external server, the control unit transfers the save data to the external server or the update target based on the data type of the save data stored in the storage unit. At least a part of the update program acquired from the external server is stored in the area of the storage unit in which the saved data transmitted by transmitting to a non-update target vehicle-mounted control device other than the vehicle-mounted control device is stored.

In this embodiment, when the control unit acquires the update program from the external server, the control unit transfers the save data to the external server or the in-vehicle control device to be updated based on the data type of the save data stored in the storage unit. It is transmitted to the in-vehicle control device to be non-updated, and at least a part of the update program is stored in the storage area where the transmitted saved data is stored. That is, when the control unit acquires an update program from an external server, even if the free space in the storage unit of its own device (vehicle-mounted update device) is smaller than the total data capacity of the update program, at least the update program By storing a part in the area of the storage unit in which the transmitted saved data is stored, all of the update program can be stored in the storage unit. When a part of the update program is stored in the area where the transmitted backup data is stored, the remaining part of the update program is stored in the free area of the storage unit before the backup data is transmitted. Alternatively, all of the update programs may be stored in the area where the transmitted saved data is stored. Therefore, by using the area where the saved data is stored as the area for storing the update program, it is possible to prevent the storage capacity of the storage unit of the in-vehicle update device from becoming insufficient, and it is appropriate based on the data type of the saved data. Saved data can be saved to various destinations (save destinations).

(2) In the in-vehicle update device according to one aspect of the present disclosure, the evacuation data transmitted to the external server is more important in the own device or the vehicle than the evacuation data transmitted to the in-vehicle control device to be non-updated. Low.

In this embodiment, the evacuation data transmitted to the external server is less important in the own device than the evacuation data transmitted to the in-vehicle control device to be non-updated. Therefore, the highly important evacuation data is the non-update target. It will be transmitted to the in-vehicle control device. Therefore, since the in-vehicle control device to be non-updated is installed in the vehicle, for example, even in a situation where communication with an external server is difficult, the relay device can control the in-vehicle control to be non-updated. The saved data transmitted to the device and saved can be acquired from the non-updated in-vehicle control device.

(3) In the vehicle-mounted update device according to one aspect of the present disclosure, the data type and the importance of the saved data are stored in the storage unit in association with each other.

In this embodiment, since the storage unit stores the data type of the saved data and the importance of the saved data in association with each other, the control unit efficiently transmits the saved data based on the data type of the saved data. The destination can be derived.

(4) In the vehicle-mounted update device according to one aspect of the present disclosure, the control unit acquires the total data capacity of the update program from the external server before acquiring the update program, and the free capacity of the storage unit and the free capacity of the storage unit When the total value of the total data capacity of the backup data transmitted to the external server is smaller than the total data capacity of the update program, the backup data other than the backup data transmitted to the external server is stored in the non-update target in-vehicle control device. Send to.

In this embodiment, when the total value of the free space of the storage unit and the total data capacity of the backup data to be transmitted to the external server at the present time is smaller than the total data capacity of the update program, the control unit transmits to the external server. Since the saved data other than the data is transmitted to the in-vehicle control device to be non-updated, it is possible to suppress an increase in the communication amount of the communication path between the relay device and the in-vehicle control device.

(5) In the in-vehicle update device according to one aspect of the present disclosure, the control unit acquires the total data capacity of the update program from the external server before acquiring the update program, and the free capacity of the storage unit, When the total value of the backup data transmitted to the external server and the total value of the backup data transmitted to the non-update target in-vehicle control device is larger than the total data capacity of the update program, the data type of the backup data is selected. Based on this, the saved data is transmitted to the external server and the non-updated in-vehicle control device.

In this embodiment, in the control unit, the free space of the storage unit at the time, the total data capacity of the backup data transmitted to the external server, and the total value of the backup data transmitted to the in-vehicle control device to be non-updated are the data of the update program. If the total capacity or more, the saved data is transmitted to the external server and the in-vehicle control device to be non-updated. Therefore, only when the area of the storage unit for storing the update program can be secured by transmitting the save data, the control unit transmits the save data and acquires the update program, so that the acquired update program is surely stored. can do.

(6) In the in-vehicle update device according to one aspect of the present disclosure, the control unit transmits the save data to the external server while the update program is being acquired from the external server, and the update program is being acquired. When the free space of the storage unit becomes equal to or less than a predetermined value, the saved data other than the saved data to be transmitted to the external server is transmitted to the in-vehicle control device to be non-updated.

In this embodiment, since the control unit transmits the saved data from the external server to the external server while the update program is being acquired, the preparatory work for acquiring the update program is not required, and the in-vehicle control device to be updated is updated. The time required for a series of processes can be shortened.

(7) In the vehicle-mounted update device according to one aspect of the present disclosure, the vehicle is equipped with a plurality of the vehicle-mounted control devices, and a plurality of in-vehicle communication units for communicating with the plurality of vehicle-mounted control devices are provided. The control unit simultaneously transmits the saved data to each of the non-updated in-vehicle control devices connected to the different in-vehicle communication units.

In this embodiment, the in-vehicle update device includes a plurality of in-vehicle communication units, and the control unit transmits the saved data in parallel to each of the non-update target in-vehicle control devices directly connected to the different in-vehicle communication units. .. Therefore, the control unit can transmit the saved data to each of the in-vehicle control devices to be non-updated by using the communication amount (bandwidth) which is the sum of the communication amounts (bandwidth) allowed by each in-vehicle communication unit. It is possible to shorten the time required for the transmission.

(8) The update processing program according to one aspect of the present disclosure transmits the saved data to an external server or an in-vehicle update target mounted on a vehicle based on the data type of the saved data stored in the storage unit in the computer. The update program acquired from the external server is stored in the area of the storage unit in which the saved data transmitted by transmitting to a non-update target in-vehicle control device other than the control device is stored, and the stored update program is stored. The process of transmitting to the in-vehicle control device to be updated is executed.

In this embodiment, the computer can function as an in-vehicle update device that can prevent the storage capacity of the storage unit of the own device from becoming insufficient when updating the program of the in-vehicle control device.

(9) The method of updating the program according to one aspect of the present disclosure is based on the data type of the saved data stored in the storage unit, and the saved data is stored in an external server or an in-vehicle control device to be updated mounted on the vehicle. The update program acquired from the external server is stored in the area of the storage unit in which the saved data transmitted and transmitted to the non-update target in-vehicle control device other than the above is stored, and the stored update program is updated. Send to the target in-vehicle control device.

In this embodiment, it is possible to provide a program updating method that can prevent the storage capacity of the storage unit of the own device from becoming insufficient when updating the program of the in-vehicle control device.

[Details of Embodiments of the present disclosure]
The present disclosure will be specifically described with reference to the drawings showing the embodiments thereof. The vehicle-mounted renewal device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. It should be noted that the present disclosure is not limited to these examples, and is indicated by the scope of claims, and is intended to include all modifications within the meaning and scope equivalent to the scope of claims.

(Embodiment 1)
Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating the configuration of the vehicle-mounted update system according to the first embodiment. FIG. 2 is a block diagram illustrating the configuration of an in-vehicle update device and the like. The vehicle-mounted update system S includes the vehicle-mounted communication device 1 and the vehicle-mounted update device 2 mounted on the vehicle C, and the program or data acquired from the external server S1 connected via the vehicle-mounted network N is mounted on the vehicle C. It transmits to the in-vehicle ECU 3 (Electronic Control Unit).

Communication between the external server S1 and the vehicle-mounted updater 2 is performed via the vehicle-mounted communication device 1, and the bandwidth (communication speed / throughput) between the external server S1 and the vehicle-mounted updater 2 via the vehicle-mounted communication device 1 is , It is larger than the bandwidth (communication speed / throughput) between the vehicle-mounted update device 2 and the vehicle-mounted ECU 3. Therefore, in order to absorb the difference in the bandwidth, the in-vehicle update device 2 temporarily stores (caches) a program or the like (update program) acquired from the external server S1 in the storage unit 21 of its own device. Then, the in-vehicle update device 2 temporarily stores some data or all the data of the program (update program) in the storage unit 21, and then transmits the program or the like (update program) to the in-vehicle ECU 3.

The external server S1 is a computer such as a server connected to an external network N such as the Internet or a public network, and is a RAM (Random Access Memory) or ROM.
(Read Only Memory) or a storage unit S11 using a hard disk or the like is provided, and corresponds to a program providing device outside the vehicle. In the storage unit S11 of the external server S1, a program or data for controlling the in-vehicle ECU 3 created by the manufacturer of the in-vehicle ECU 3 or the like is stored. Although the details will be described later, the saved data transmitted from the in-vehicle update device 2 is stored in the storage unit S11 of the external server S1. The program or data is transmitted to the vehicle C as an update program as described later, and is used to update the program or data of the vehicle-mounted ECU 3 mounted on the vehicle C. The external server S1 configured in this way is also referred to as an OTA (Over The Air) server. The in-vehicle ECU 3 mounted on the vehicle C acquires an update program transmitted by wireless communication from the external server S1 and applies it as a program for executing the update program to update the program executed by the own ECU (repro). can do.

Hereinafter, the program will be described as including a program code including a control syntax and the like for the in-vehicle ECU 3 to perform processing, and an external file in which data to be referred to when executing the program code is described. At the time of transmitting the update program, the external file in which these program codes and data are described is transmitted from the external server S1 as, for example, an encrypted archive file.

The vehicle C is equipped with an external communication device 1, an in-vehicle update device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The out-of-vehicle communication device 1 and the in-vehicle update device 2 are communicably connected by a harness such as a serial cable. The in-vehicle update device 2 and the in-vehicle ECU 3 are communicably connected by an in-vehicle LAN 4 corresponding to a communication protocol such as CAN (Control Area Network / registered trademark) or Ethernet (registered trademark). The in-vehicle LAN 4 is composed of communication lines (CAN bus or Ethernet cable) corresponding to CAN or Ethernet, and the in-vehicle LAN 4 is segmented by each of these communication lines.

The out-of-vehicle communication device 1 includes an out-of-vehicle communication unit 11 and an input / output I / F (interface) 12 for communicating with the in-vehicle update device 2. The out-of-vehicle communication unit 11 is a communication device for wireless communication using mobile communication protocols such as 3G, LTE, 4G, and WiFi, and is an external server S1 via an antenna 13 connected to the out-of-vehicle communication unit 11. And send and receive data. Communication between the external communication device 1 and the external server is performed via, for example, a public network or an external network such as the Internet.

The input / output I / F 12 is a communication interface for serial communication with the in-vehicle update device 2, for example. The out-of-vehicle communication device 1 and the in-vehicle update device 2 communicate with each other via harnesses such as a serial cable connected to the input / output I / F12 and the input / output I / F12. In the present embodiment, the vehicle-mounted communication device 1 is a separate device from the vehicle-mounted update device 2, and these devices are communicably connected by input / output I / F12 and the like, but the present invention is not limited to this. The vehicle-mounted communication device 1 may be built in the vehicle-mounted update device 2 as a component of the vehicle-mounted update device 2.

The in-vehicle update device 2 includes a control unit 20, a storage unit 21, and an in-vehicle communication unit 23. The in-vehicle update device 2 acquires an update program received from the external server S1 by the in-vehicle communication device 1 by wireless communication from the in-vehicle communication device 1, and transfers the update program to a predetermined in-vehicle ECU 3 (in-vehicle to be updated) via the in-vehicle LAN 4. It is configured to transmit to the ECU 3). The in-vehicle update device 2 controls segments of a plurality of systems such as a control system in-vehicle ECU 3, a safety in-vehicle ECU 3, and a body-based in-vehicle ECU 3, and relays communication between the in-vehicle ECUs 3 between these segments. It is a gateway (repeater). Alternatively, the in-vehicle update device 2 may be configured as a functional unit of the body ECU that controls the entire vehicle C.

The control unit 20 is composed of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, and can perform various control processes by reading and executing a control program and data stored in advance in the storage unit 21. It is designed to perform arithmetic processing and the like.

The storage unit 21 is a volatile memory element such as a RAM (Random Access Memory) or a ROM.
It is composed of non-volatile memory elements such as (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and the control program and data to be referred to during processing are stored in advance. The control program stored in the storage unit 21 may be one that stores the control program read from the recording medium 22 that can be read by the vehicle-mounted updater 2. Further, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21. Further, the storage unit 21 relates to the configuration information (vehicle configuration information) of all the vehicle-mounted ECUs 3 mounted on the vehicle C, the update program acquired from the external server S1, and the progress status when the update program is transmitted to the vehicle-mounted ECU 3. Information (log data of update process) is stored. Further, the storage unit 21 stores the log data of the communication flowing through the in-vehicle LAN and the saved data including all the data (freeze frame data) flowing in the in-vehicle LAN when an abnormality occurs in the vehicle.

Configuration information (vehicle configuration information) of each in-vehicle ECU 3 stored in the storage unit 21, for example, the serial number (serial number), ECU part number (model number), Software part number, current version, old version, and operation of the in-vehicle ECU 3. Includes number of screens, operating plane, MAC (Media Access Control) address, IP address, last update completion date and time, repro status and VIN (Vehicle Identification Number). When the vehicle-mounted ECU 3 is connected by CAN, the configuration information of the vehicle-mounted ECU 3 may include a CAN-ID used (included) when the vehicle-mounted ECU 3 transmits a message. These vehicle configuration information are managed in association with ECU-IDs having serial numbers or the like set so as not to be duplicated in each in-vehicle ECU 3, and are stored in the storage unit 21 as, for example, table-type data. The control unit 20 is constantly mounted on the vehicle C from all the vehicle-mounted ECUs 3 or a specific vehicle-mounted ECU 3 at a predetermined timing such as when the IG switch for starting and stopping the vehicle is turned on or off. , The configuration information of each of the vehicle-mounted ECUs 3 is acquired and stored in the storage unit 21. Further, the vehicle configuration information may include the storage capacity of the storage unit 31 of each of the vehicle-mounted ECUs 3 and the free capacity at the present time. Control based on the serial number (serial number), ECU part number (model number), number of operating surfaces, operating surface, storage capacity, and free capacity of the vehicle-mounted ECU 3 included in the vehicle configuration information stored in the storage unit 21. The unit 20 recognizes the hardware configuration of the vehicle-mounted ECU 3 and can derive the non-operating surface, the storage capacity, and the current free capacity of the storage unit 31 of the vehicle-mounted ECU 3.

The control unit 20 corresponds to an update program acquisition unit that acquires an update program transmitted from the external server S1 via the external communication device 1 by executing a control program stored in the storage unit 21. The control unit 20 executes the control program stored in the storage unit 21 to obtain the total data capacity of the update program acquired from the external server S1 based on the update information (campaign data) transmitted from the external server S1. Corresponds to the total data capacity derivation unit to be derived. By executing the control program stored in the storage unit 21, the control unit 20 derives the amount of saved data (saveable data capacity) that can be transmitted to the external server S1 or the in-vehicle ECU 3 to be non-updated. Corresponds to the save data capacity derivation unit. The control unit 20 executes the control program stored in the storage unit 21, and based on the total data capacity of the derived update program and the free capacity of the storage unit 21 of the own device at present, the external server S1 or It corresponds to a determination unit that determines whether or not to transmit saved data to the in-vehicle ECU 3 to be non-updated. The control unit 20 corresponds to a save data transmission unit that transmits the save data to the external server S1 or the in-vehicle ECU 3 to be non-updated based on the determination result of the determination unit by executing the control program stored in the storage unit 21. To do. The control unit 20 corresponds to an update program transmission unit that transmits an update program acquired from the external server S1 to the vehicle-mounted ECU 3 to be updated by executing the control program stored in the storage unit 21.

The in-vehicle communication unit 23 is an input / output interface using a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark), and the control unit 20 is connected to the in-vehicle LAN 4 via the in-vehicle communication unit 23. It communicates with an in-vehicle device such as an in-vehicle ECU 3 or another relay device. A plurality of in-vehicle communication units 23 (three in the drawing) are provided, and communication lines (CAN bus or Ethernet cable) constituting the in-vehicle LAN 4 are connected to each of the in-vehicle communication units 23. By providing a plurality of in-vehicle communication units 23 in this way, the in-vehicle LAN 4 is divided into a plurality of segments, and an in-vehicle ECU is provided for each segment, and the functions of the in-vehicle ECU (control system function, safety system function, body system function). ) To connect. Alternatively, when the vehicle C has an automatic driving function (cognitive system function, judgment system function, operation system function), the vehicle-mounted ECU 3 responds to the function of the vehicle-mounted ECU 3 (cognitive system function, judgment system function, operation system function). It may be connected to each segment.

The in-vehicle ECU 3 includes a control unit 30, a storage unit 31, and an in-vehicle communication unit 32. The storage unit 31 is composed of a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory. The program or data of the in-vehicle ECU 3 is stored. This program or data is the target to be updated by the update program transmitted from the vehicle-mounted update device 2.

The storage unit 31 includes a first storage area (first surface) 311 and a second storage area (second surface) 312. The storage unit 31 stores two programs, a program currently executed (applied) by the in-vehicle ECU 3 (current version) and a program previously applied to the current version (old version). The current version of the program and the old version of the program are stored separately in either the first storage area 311 or the second storage area 312. That is, when the current version of the program is stored in the first storage area 311, the old version of the program is stored in the second storage area 312. When the old version program is stored in the first storage area 311, the current version program is stored in the second storage area 312. By storing the two programs of the current version and the old version as so-called two-sided programs in this way, even if a problem should occur in the program of the current version, the control unit 30 applies it before and is normal. The reliability of the in-vehicle ECU 3 (in-vehicle ECU 3 having two sides) can be ensured by reading and executing (switching) the program of the old version that was operating in.

The storage unit 31 stores information on each version of the two programs, the current version and the old version, and information on the area (operating surface) in which the program currently being executed (applied) is stored. That is, when the program stored in the first storage area (first surface) 311 is being executed at present, the storage unit 31 stores that the operating surface is the first storage area (first surface) 311. Will be done. When the program stored in the second storage area (second surface) 312 is being executed at present, the storage unit 31 stores that the operating surface is the second storage area (second surface) 312. .. The storage unit 31 contains the configuration information of the own ECU and the information on the progress status when receiving the update program from the in-vehicle update device 2, including the version information and the information on the operation surface of the program (current version and the old version). , Will be remembered.

The control unit 30 is composed of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, and reads and executes programs and data stored in the storage unit 31 (operating surface) to perform control processing and the like. An in-vehicle device or actuator including the in-vehicle ECU 3 is controlled.

The control unit 30 of the in-vehicle ECU 3 receives the update program transmitted from the in-vehicle update device 2 via the in-vehicle communication unit 32, and acquires the update program. Therefore, the control unit 30 of the vehicle-mounted ECU 3 acquires the update program transmitted from the external server S1 via the vehicle-mounted communication device 1 and the vehicle-mounted update device 2. The control unit 30 stores the acquired update program in a storage area (first storage area 311 or second storage area 312) that is not an operating surface. That is, when acquiring the update program transmitted from the vehicle-mounted update device 2, the control unit 30 deletes the program stored in the storage area (non-operating surface) other than the operating surface as a preparatory process for the acquisition. Normally, the program stored in the storage area other than the operation surface is an old version of the program that was executed before the current version of the program, so that the old version of the program is not stopped without stopping the control function of the in-vehicle ECU 3 for the in-vehicle device. You can remove the version. The control unit 30 deletes the old version program stored in the storage area (non-operating surface) that is not the operating surface, and stores the update program transmitted from the vehicle-mounted update device 2 in the non-operating surface.

After normally completing the reception of the update program, the control unit 30 of the in-vehicle ECU 3 switches the operation surface, applies the received update program as the current version of the program, and executes the program. When the control unit 30 of the in-vehicle ECU 3 normally ends the reception of the update program and switches the operation surface normally, the control unit 30 stores in the storage unit 31 that the program update is completed (normal end), and further in-vehicle update. Send (notify) to device 2. When the operation surface is switched normally, the control unit 30 determines that the update of the program is completed (normally terminated), so that the accuracy of the determination can be guaranteed.

Alternatively, the control unit 30 of the in-vehicle ECU 3 normally ends the reception of the update program, switches the operation surface, and then performs the self-diagnosis process based on the function of the in-vehicle ECU 3. The self-diagnosis processing program for performing the self-diagnosis processing based on the function of the vehicle-mounted ECU 3 is stored in advance in 31 in the storage unit of each of the vehicle-mounted ECU 3. Alternatively, the self-diagnosis processing program may be included in the update program and transmitted from the in-vehicle update device 2 together with the update program.

When the result of the self-diagnosis process for the switched update program is normal, the control unit 30 stores in the storage unit 31 that the program update is completed (normal end), and further transmits (notifies) to the in-vehicle update device 2. You may. When the result of the self-diagnosis process is normal, the control unit 30 determines that the update of the program is completed (normally completed), so that the accuracy of the determination can be further improved.

Alternatively, the control unit 30 of the in-vehicle ECU 3 performs self-diagnosis processing on the update program stored in the storage area of the non-operating surface and updates the update program before normally ending the reception of the update program and switching the operating surface. When the result of the self-diagnosis process for the program is normal, the storage unit 31 stores that the update of the program is completed (normal end), and further transmits (notifies) to the in-vehicle update device 2. Before the reception of the update program is normally completed and the operation surface is switched, that is, before the update program is applied, the control unit 30 performs a self-diagnosis process on the update program stored in the storage area of the non-operation surface. Therefore, the correctness of the update by the update program can be determined without affecting the operation of the control function for the vehicle-mounted device currently being executed by the vehicle-mounted ECU 3.

When the control unit 30 of the in-vehicle ECU 3 fails to switch to the update program, or when the result of the self-diagnosis process for the update program is abnormal, the rollback process, that is, the program of the previous version (old version) of the update program is executed. The stored non-operating surface storage area is switched (rolled back) as the operating surface storage area, and the previous version of the program is executed (applied). The control unit 30 of the in-vehicle ECU 3 stores in the storage unit 31 that the update has failed (abnormal termination) when the switching to the update program fails or the result of the self-diagnosis process for the update program is abnormal. Further, it may be transmitted (notified) to the in-vehicle update device 2.

The program of the previous version of the update program is a program that has an operation record because it is the program that was executed when the update program was transmitted. Therefore, even if the update program fails to be updated, the control unit 30 returns to the program having the operation record (switches the operation surface) by performing the rollback process, and executes the program. The control function for the in-vehicle device can be continued.

The determination of success or failure of the update by the update program by the control unit 30 of the in-vehicle ECU 3 is determined based on the result of switching to the update program (switching of the operation surface) or the self-diagnosis process, but the determination is not limited thereto. After switching to the update program and executing the update program, the control unit 30 of the vehicle-mounted ECU 3 waits for, for example, the elapse of a predetermined period, the cumulative operating time of the vehicle C, the number of trips, the driving distance, and the like to exceed a predetermined value. In addition, if an abnormality caused by the update program is not detected, it may be determined that the update was successful.

The display device 5 is an HMI (Human Machine Interface) device such as a car navigation display. The display device 5 is communicably connected to the input / output I / F 24 of the vehicle-mounted update device 2 by a harness such as a serial cable. The display device 5 displays data or information output from the control unit 20 of the vehicle-mounted update device 2 via the input / output I / F 24. The connection form between the display device 5 and the in-vehicle update device 2 is not limited to the connection form by the input / output I / F24 or the like, and the display device 5 and the in-vehicle update device 2 may be connected via the in-vehicle LAN 4. Good.

FIG. 3 is an explanatory diagram illustrating one aspect of the saved data stored in the storage unit 21. In FIG. 3, for various data transmitted to the external server S1 or the in-vehicle ECU 3 as save data, data in which the importance of the data, the data type, and the save location (destination) to be the destination are set is displayed in a table format (). It is illustrated in table format).

As described above, in the storage unit 21 of the vehicle-mounted update device 2, in addition to the control program or data for controlling the own device, the vehicle-mounted configuration information acquired from each of the vehicle-mounted ECUs 3 and the update program related to the update process of the vehicle-mounted ECU 3 are stored. It is remembered. Further, the storage unit 21 of the vehicle-mounted update device 2 stores various log data regarding the operating state of the vehicle C, that is, information indicating the operating state as time-series data.

The evacuation data transmitted by the vehicle-mounted update device 2 to the external server S1 or the non-update target to the vehicle-mounted ECU 3 is mainly composed of various log data relating to the operating state of the vehicle C. As shown in FIG. 3, various log data treated as saved data include, for example, freeze frame data, update processing log data, and communication log data.

The control unit 20 of the vehicle-mounted update device 2 receives data transmitted from each of the vehicle-mounted ECUs 3 when performing relay control of communication between the vehicle-mounted ECUs 3, extracts a failure abnormality code included in the data, and stores the storage unit 21. Remember in. By executing the control program, the control unit 20 of the in-vehicle update device 2 exerts, for example, the self-diagnosis function (OBD / On-board diagnostics) of the own device, and outputs a failure abnormality code based on the diagnosis result of the self-diagnosis. Is stored in the storage unit 21 as log data related to the operating state of the own device. When the control unit 20 of the in-vehicle update device 2 stores these failure / abnormality codes, it acquires data such as a CAN message or an Ethernet frame flowing in the in-vehicle LAN4 at that time, and stores the data as freeze frame data in the storage unit 21. Remember in. The control unit 20 of the vehicle-mounted update device 2 transmits an update program to the vehicle-mounted ECU 3 to be updated, and stores the processing history when the vehicle-mounted ECU 3 is updated (repro-processed) as log data of the update process in the storage unit 21. Remember. The control unit 20 of the in-vehicle update device 2 stores communication log data such as the amount of transmission / reception data per unit time, the amount of traffic, and the number of transmissions / receptions of each message type in each segment when performing relay control of communication between the in-vehicle ECU 3. It is stored in the part 21.

The evacuation data of various log data and the like stored in the storage unit 21 of the in-vehicle update device 2 is set to the importance for the use of the in-vehicle update device 2 or the running of the vehicle C, and the transmission destination is based on the importance. (Evacuation location) has been decided. The evacuation data of low importance is transmitted to the external server S1, and the evacuation data of medium importance is transmitted to the in-vehicle ECU 3 to be non-updated. That is, the saved data transmitted to the external server S1 is less important to the vehicle-mounted update device 2 or the vehicle C than the saved data transmitted to the vehicle-mounted ECU 3 to be non-updated. By saving the saved data, which is relatively important for the vehicle-mounted update device 2 or the vehicle C, into the vehicle C (inside the own vehicle) in this way, the saved data can be reliably saved.

Even if it is various log data related to the operating state of the vehicle C, important data for using the in-vehicle update device 2 such as a failure abnormality code and security information is set as non-saveable data to the external server S1 or a non-update target. Transmission to the in-vehicle ECU 3 may be prohibited.

Although the saved data has been described as being various log data related to the operating state of the vehicle C, the evacuation data is not limited to this. The control unit 20 of the in-vehicle update device 2 has a storage location of either the external server S1 or the in-vehicle ECU 3 to be non-updated based on the importance of the various data stored in the storage unit 21 of the own device. The data may be transmitted as saved data to the destination device) and saved.

FIG. 4 is an explanatory diagram (sequence diagram) illustrating one mode of updating by the in-vehicle updating device 2. In FIG. 4, when the vehicle-mounted update device 2 acquires the update program from the external server S1, the saved data stored in the storage unit 21 of the own device is transmitted to the external server S1 or the vehicle-mounted ECU 3 to be non-updated. The process of saving the saved data will be described with reference to a sequence diagram including the processes of the external server S1 and the in-vehicle ECU 3.

The in-vehicle update device 2 acquires update information (campaign information) (S1). The in-vehicle update device 2 accesses the external server S1, for example, constantly, periodically, or when the IG switch for activating the vehicle C is turned on, and relates to the necessity of updating the in-vehicle ECU 3 mounted on the own vehicle. The existence of the update information is confirmed, and if there is the update information, the update information is acquired from the external server S1. The update information includes, for example, information on the model number of the vehicle-mounted ECU 3 to be updated, the version of the program, the file name and size of the archive file including the program. The update information may include the maximum capacity of saved data that can be transmitted from the vehicle-mounted update device 2 to the external server S1. The maximum capacity of the saved data means the size (quota) of the storage area of the storage unit S11 of the external server S1 in which the vehicle-mounted update device 2 can use the saved data as a storage location.

The in-vehicle update device 2 derives the total data capacity of the update program (S2). The in-vehicle update device 2 derives the total data capacity of the update program based on the acquired update information. Needless to say, when the update program is composed of a plurality of files, the total data capacity of the update program is the total value of the sizes (data capacity) of the plurality of files.

The in-vehicle update device 2 transmits the saved data to the external server S1 (S3). The in-vehicle update device 2 refers to the storage unit 21, specifies the save data of importance that can be transmitted to the external server S1 and saves the data, and transmits the specified save data to the external server S1. The identification may be performed by referring to a table showing the data type of the saved data as shown in FIG.

The vehicle-mounted update device 2 transmits the saved data to the vehicle-mounted ECU 3 to be non-updated (S4). The vehicle-mounted update device 2 refers to the vehicle-mounted configuration information stored in the storage unit 21 and identifies the vehicle-mounted ECU 3 to be non-updated, which is the transmission destination of the saved data. The in-vehicle update device 2 can, for example, extract the in-vehicle ECU 3 having two sides and delete the previous version of the program stored in the non-operating surface without the need for rollback processing. It may be specified as a non-update target in-vehicle ECU 3 as a transmission destination. The in-vehicle update device 2 is not limited to specifying a single non-update target in-vehicle ECU 3 as a transmission destination of the saved data, and specifies a plurality of non-update target in-vehicle ECUs 3 (non-update target in-vehicle ECU 3 group). It may be something to do.

When the vehicle-mounted update device 2 specifies a plurality of vehicle-mounted ECUs 3 as a group of vehicle-mounted ECUs 3 to be non-updated, it is desirable that each of the plurality of vehicle-mounted ECUs 3 to be non-updated is connected to different in-vehicle communication units 23. By connecting the non-updated vehicle-mounted ECUs 3 to which the saved data is transmitted to different in-vehicle communication units 23, the vehicle-mounted ECUs 3 are connected to different segments. Therefore, even if the vehicle-mounted update device 2 performs the process of transmitting the evacuation data to the vehicle-mounted ECUs 3 connected to the different vehicle-mounted communication units 23 in parallel, the traffic of the segment to which each vehicle-mounted ECU 3 is connected is performed. Can be suppressed and the saved data can be efficiently transmitted to each in-vehicle ECU 3.

The in-vehicle update device 2 refers to the storage unit 21, specifies the save data of importance that can be transmitted to the in-vehicle ECU 3 to be non-updated, and saves the specified save data to the in-vehicle ECU 3 to be non-updated. Send. As described above, the save data that can be transmitted to the non-update target vehicle-mounted ECU 3 and saved is more important to the vehicle-mounted update device 2 or the vehicle C than the save data that can be transmitted to the external server S1 and saved. Is high data.

The transmission to the external server S1 and the transmission to the non-update target in-vehicle ECU 3 are not limited to the case where the transmission is sequentially performed, and the in-vehicle update device 2 sends back data to the external server S1 and the non-update target in-vehicle ECU 3, respectively. May be transmitted in parallel.

The external server S1 stores the saved data in the storage unit S11 of the own device (S5). The vehicle-mounted ECU 3 to be non-updated stores the saved data in the storage unit 31 (storage area of the non-operating surface) of the own device (S6). When the external server S1 and the in-vehicle ECU 3 to be non-updated store the evacuation data transmitted from the in-vehicle update device 2, the evacuation of these evacuation data is completed. The external server S1 that has completed the storage of all the saved data transmitted from the in-vehicle update device 2 and the in-vehicle ECU 3 to be non-updated output information regarding the completion of the saved saved data transmitted to the in-vehicle update device 2. It may be (send, notify).

The vehicle-mounted update device 2 deletes the saved data transmitted to the external server S1 or the vehicle-mounted ECU 3 to be non-updated (S7). The vehicle-mounted update device 2 that has completed the transmission of the saved data to the external server S1 or the external server S1 and the vehicle-mounted ECU 3 to be non-updated deletes the saved data that has completed the transmission. By deleting the saved data, the free capacity in the storage unit 21 of the in-vehicle update device 2 can be increased.

The in-vehicle update device 2 acquires the update program (S8) and stores the transmitted saved data in the storage area (S9). The in-vehicle update device 2 sends the free area (storage area) secured by deleting the saved data, the free area secured by deleting the saved data, and the free area before deleting the saved data from the external server S1. Memorize the acquired (received) update program. The storage area for storing the update program is a free area secured by deleting the saved data, but the storage area is not limited to this. The in-vehicle update device 2 may overwrite and store the update program in the storage area in which the save data is stored without deleting the save data.

The vehicle-mounted update device 2 transmits the update program to the vehicle-mounted ECU 3 to be updated (S10). The in-vehicle update device 2 transmits the update program stored in the storage unit 21 of the own device to the in-vehicle ECU 3 to be updated, and thereafter, starts the update process for starting the update process for the in-vehicle ECU 3 to be updated. It may output a signal.

The in-vehicle ECU 3 to be updated stores the update program in the non-operating surface of the storage unit 31 (S11), and switches to the update program at a predetermined timing. The in-vehicle ECU 3 to be updated executes switching to the update program, and when the update process (repro process) is completed, outputs (transmits, notifies) information regarding the completion of the update process to the in-vehicle update device 2. May be good.

The in-vehicle update device 2 deletes the update program stored in the storage unit 21 (S12). The in-vehicle update device 2 deletes the update program after the transmission is completed or when the in-vehicle ECU 3 to be updated acquires (receives) information regarding the completion of the update process.

The vehicle-mounted update device 2 acquires data saved from the external server S1 and the vehicle-mounted ECU 3 to be updated (S13, 14). The in-vehicle update device 2 stores the evacuation data acquired from the external server S1 or the external server S1 as the evacuation destination and the in-vehicle ECU 3 to be non-updated in the free area of the storage unit 21 secured by deleting the update program.

FIG. 5 is a flowchart illustrating the processing of the control unit 20 of the vehicle-mounted update device 2. The control unit 20 of the vehicle-mounted update device 2 charges the power storage device (not shown) of the vehicle-mounted update device 2 even when the vehicle C is in the activated state (IG switch is on) or stopped (IG switch is off). When is greater than or equal to a predetermined value, the program is steadily or periodically communicated with the program providing device via the external communication device 1 to perform the following processing.

The control unit 20 of the in-vehicle update device 2 acquires the update information (S101). The control unit 20 periodically communicates with the external server S1 via the external communication device 1 to check for the presence or absence of updated information, and if there is updated information, acquires the updated information from the external server S1.

The control unit 20 of the in-vehicle update device 2 derives the total data capacity of the update program (S102). The control unit 20 extracts, for example, the total data capacity of the update program included in the acquired update information, and derives the total data capacity.

The control unit 20 of the vehicle-mounted update device 2 determines whether or not the total data capacity is smaller than the free capacity of the storage unit 21 (S103). The control unit 20 confirms the free space of the storage unit 21 of the own device, compares the derived total data capacity with the free capacity, and determines whether the total data capacity is smaller than the free capacity of the storage unit 21. judge.

When the total data capacity is smaller than the free space of the storage unit 21 (S103: YES), the control unit 20 of the vehicle-mounted update device 2 acquires and stores the update program (S104). When the total data capacity of the update program to be acquired is smaller than the free capacity of the storage unit 21, the control unit 20 can store (save) the update program without deleting the saved data.

The control unit 20 of the vehicle-mounted update device 2 transmits the update program to the vehicle-mounted ECU 3 to be updated (S105). The vehicle-mounted ECU 3 to be updated, which has acquired (received) the update program, applies the update program at a predetermined timing and executes the update process.

When the total data capacity is not smaller than the free capacity of the storage unit 21 (S103: NO), that is, when the total data capacity is larger than the free capacity of the storage unit 21, the control unit 20 of the vehicle-mounted update device 2 has the total data capacity. Determines whether or not it is smaller than the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1 (S106). The control unit 20 extracts, for example, the capacity of the usable storage area in the external server S1 (the maximum capacity of the saved data that can be transmitted to the external server S1) included in the acquired update information. Alternatively, the control unit 20 may communicate with the external server S1 to acquire the capacity of the usable storage area in the external server S1. The control unit 20 calculates the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1 as the capacity of the usable storage area in the external server S1 as the capacity that can be saved in the external server S1. Compare with total capacity.

When the total data capacity is smaller than the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1 (S106: YES), the control unit 20 of the vehicle-mounted update device 2 transmits the saved data to the external server S1. , Delete (S107). When the total data capacity of the update program is smaller than the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1, it is not necessary to transmit the saved data to the in-vehicle ECU 3 to be non-updated. Therefore, the control unit 20 transmits the saved data to the external server S1 and deletes the saved data for which the transmission has been completed.

When the total data capacity is not smaller than the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1 (S106: NO), the control unit 20 of the in-vehicle update device 2 determines that the total data capacity is the storage unit 21. It is determined whether or not it is smaller than the total value of the free space of the external server S1 and the amount of evacuation to the in-vehicle ECU 3 to be non-updated (S1061). When the total data capacity is not smaller than the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1, that is, the total data capacity is equal to the total value of the free capacity of the storage unit 21 and the capacity that can be saved in the external server S1. If is also large, even if the saved data transmitted to the external server S1 is deleted, a storage area for storing all the data of the update program cannot be secured. Therefore, the control unit 20 refers to, for example, the vehicle-mounted configuration information stored in the storage unit 21 to specify a two-sided non-updated vehicle-mounted ECU 3 that can be used as a transmission destination of the saved data. The control unit 20 may specify one or more in-vehicle ECUs 3 to be non-updated. The control unit 20 acquires the storage capacity of the non-operating surface storage unit 31 of each of the non-updated vehicle-mounted ECUs 3 by referring to the vehicle-mounted configuration information or communicating with the specified non-updated vehicle-mounted ECUs 3. The control unit 20 calculates the total value of the amount of evacuation to the in-vehicle ECU 3 to be non-updated based on the total value of each acquired storage capacity, and compares it with the total data capacity.

When the total data capacity is smaller than the total value of the free space of the storage unit 21 and the amount of data saved to the external server S1 and the vehicle-mounted ECU 3 to be non-updated (S1061: YES), the control unit 20 of the vehicle-mounted update device 2 saves data. The data is transmitted to the external server S1 and the in-vehicle ECU 3 to be non-updated, and deleted (S1062). When the total data capacity of the update program is smaller than the total value of the free space of the storage unit 21 and the amount of data saved to the external server S1 and the non-updated in-vehicle ECU 3, the saved data to the external server S1 and the non-updated in-vehicle ECU 3 By saving (transmitting and deleting) the data, a storage area for storing all the data of the update program can be secured.

When the total data capacity is not smaller than the total value of the free space of the storage unit 21 and the amount of evacuation to the external server S1 and the in-vehicle ECU 3 to be non-updated (S1061: NO), the control unit 20 of the in-vehicle update device 2 determines. The series of processes for acquiring the update program and transmitting it to the in-vehicle ECU 3 to be updated is terminated (cancelled). When the total data capacity of the update program is not smaller than the total value of the free space of the storage unit 21, the amount saved to the external server S1 and the in-vehicle ECU 3 to be non-updated, that is, when the total data capacity is larger than the total value. , Even if the storage area of the saved data is used, the storage area for storing all the data of the update program cannot be secured. Therefore, the control unit 20 cancels a series of processes for acquiring the update program and transmitting the update program to the vehicle-mounted ECU 3 to be updated. The control unit 20 may store information regarding the cancellation of the series of processes in the storage unit 21 and output the information to the external server S1, the display device 5, or both. Information regarding the cancellation of a series of processes related to the acquisition of the update program and the like can be notified to the operator of the vehicle C or the administrator of the external server S1.

After executing the process of S107 or S1062, the control unit 20 of the vehicle-mounted update device 2 acquires and stores the update program in the same manner as the process of S104 (S108). The area of the storage unit 21 in which the update program is stored is the area in which the transmitted backup data is stored, the free area before the backup data is transmitted (the free area corresponding to the free capacity in the processing of S103), and the transmission. This is the area where the saved data was stored. That is, the control unit 20 stores at least a part or all of the update program in the area where the transmitted saved data is stored.

The control unit 20 of the vehicle-mounted update device 2 transmits the update program to the vehicle-mounted ECU 3 to be updated in the same manner as the process of S105 (S109).

The control unit 20 of the in-vehicle update device 2 deletes the update program (S110). The control unit 20 of the in-vehicle update device 2 acquires the transmitted save data (S111). The control unit 20 can store the saved data transmitted (saved) to the external server S1, the external server S1 and the vehicle-mounted ECU 3 to be non-updated in the free area of the storage unit 21 secured by deleting the update program. it can.

The control unit 20 of the in-vehicle update device 2 finishes the process of this flowchart after performing the process of S105 or S111. Alternatively, the control unit 20 may perform the loop processing in order to execute the processing of S101 again after performing the processing of S105 or S111.

The control unit 20 of the vehicle-mounted update device 2 stores the determination result regarding the determination (S103, S106, S1061) in the processing of this flowchart in the storage unit 21, outputs the determination result to the display device 5 or the external server S1, and outputs the information to the vehicle C. The operator or the administrator of the external server S1 may be notified.

In the present embodiment, the control unit 20 of the in-vehicle update device 2 is described as performing each series of processes, but the present invention is not limited to this. The control unit 20 of the in-vehicle update device 2 performs interprocess communication or redirect processing with a device other than the in-vehicle update device 2 such as the in-vehicle ECU 3 or the external server S1, and performs each process in cooperation with these devices. It may be what you do. Alternatively, the control unit 20 of the in-vehicle update device 2 may perform each of the processes in cooperation with a hardware processing unit composed of circuits such as FPGA or ASIC included in the own device.

When the in-vehicle update device 2 acquires the update program from the external server S1, the in-vehicle update device 2 is stored in the storage unit 21 even when the capacity of the free area of the storage unit 21 is smaller than the total data capacity of the update program. The update program can be stored by transmitting the save data to the external server S1 or the in-vehicle ECU 3 to be non-updated and saving the data. Therefore, it is possible to suppress an increase in the storage capacity of the storage unit 21 included in the vehicle-mounted update device 2 and reduce the cost of parts for forming the storage unit 21.

When the vehicle-mounted update device 2 transmits the saved data to the external server S1 or the vehicle-mounted ECU 3 to be non-updated and saves the data, the vehicle-mounted update device 2 determines the transmission destination according to the importance of the saved data. Since the importance of the saved data transmitted to the external server S1 is lower than the importance of the saved data transmitted to the in-vehicle ECU 3 to be non-updated, the saved data having a relatively high importance is not in the own vehicle C. It will be transmitted to the in-vehicle ECU 3 to be updated, and reliable storage can be achieved.

In order to secure the free space of the storage unit 21 of the in-vehicle update device 2, first, since the save data having a relatively low priority is transmitted to the external server S1, the save data having a relatively high importance is unnecessarily saved. Can be suppressed.

The in-vehicle update device 2 identifies a plurality of non-update target in-vehicle ECUs 3 as transmission destinations of the saved data, and the plurality of non-update target in-vehicle ECUs 3 are connected to different in-vehicle communication units 23 and connected to different segments. To. Therefore, even when the vehicle-mounted update device 2 simultaneously transmits the save data to each of the plurality of non-updated vehicle-mounted ECUs 3, that is, the transmission process is performed in parallel to each of the vehicle-mounted ECUs 3, the traffic of a specific segment Can be suppressed and the transmission process can be performed in a short time. By performing transmission processing in parallel to each of the in-vehicle ECUs 3 connected to different in-vehicle communication units 23, the total value of the individual bandwidths (transmission speeds) determined by these communication units and segments is calculated by the in-vehicle update device 2 Can be used as a substantial bandwidth when transmitting from to each of the in-vehicle ECUs 3.

(Embodiment 2)
FIG. 6 is a flowchart illustrating the processing of the control unit 20 of the vehicle-mounted update device 2 according to the second embodiment. The control unit 20 of the vehicle-mounted update device 2 according to the second embodiment transmits the saved data from the external server S1 to the external server S1 while acquiring the update program, and the free space of the storage unit 21 at the present time becomes a predetermined value or less. This case is different from the first embodiment in that the saved data other than the saved data to be transmitted to the external server S1 is transmitted to the in-vehicle control device to be non-updated.

In the control unit 20 of the vehicle-mounted update device 2 of the second embodiment, the vehicle C is in the activated state (IG switch is on) or stopped (IG switch is off) as in the control unit 20 of the vehicle-mounted update device 2 of the first embodiment. Even so, when the charge amount of the power storage device (not shown) of the in-vehicle update device 2 is equal to or higher than a predetermined value, the program providing device is constantly or periodically communicated via the external communication device 1 to perform the following processing. I do.

The control unit 20 of the vehicle-mounted update device 2 performs the processes of S201, S202, and S203 in the same manner as the processes of the first embodiment (S101, S102, S103).

When the total data capacity is smaller than the free capacity of the storage unit 21 (S203: YES), the control unit 20 of the vehicle-mounted update device 2 controls the vehicle-mounted update device 2 as in the process of the first embodiment (S104, S105). The unit 20 acquires and stores the update program (S204), and transmits the update program to the vehicle-mounted ECU 3 to be updated (S205).

When the total data capacity is not smaller than the free capacity of the storage unit 21 (S203: NO), the control unit 20 of the vehicle-mounted update device 2 acquires and stores the update program (S206). The control unit 20 performs the process of S206 in the same manner as the process of the first embodiment (S108). Further, the control unit 20 of the vehicle-mounted update device 2 transmits the saved data to the server and deletes it (S207). The control unit 20 performs the process of S207 in the same manner as the process of the first embodiment (S107). Further, the control unit 20 of the vehicle-mounted update device 2 determines whether or not the free space of the storage unit 21 at the present time during the acquisition of the update program is equal to or less than a predetermined value (S208). The control unit 20 of the vehicle-mounted update device 2 performs processing of S206, S207, and S208 when the total data capacity is not smaller than the free space of the storage unit 21, that is, when the total data capacity is larger than the free space of the storage unit 21. Do it in parallel.

When the control unit 20 performs the processes of S206, S207, and S208 in parallel, for example, two sub-processes are generated from the main process, and interprocess communication is performed in these three processes to synchronize the processes. It may be a plan. When the control unit 20 is a multi-CPU or multi-core composed of a plurality of CPUs or cores, the control unit 20 may execute these three by separate CPUs or cores.

The acquisition of the update program from the external server S1, that is, the transmission (transfer, download) of the update program from the external server S1 is performed in block units in which the file of the update program is divided into a predetermined size. Therefore, after the process of acquiring the update program is started, the number of acquired blocks increases with the passage of time, and the total value of the data sizes of each of these blocks, that is, the amount of data of the update program being acquired is The number increases, and the free area of the storage unit 21 decreases.

The saved data transmitted to the external server S1 is composed of a plurality of files generated when storing individual log data. The control unit 20 of the in-vehicle update device 2 sequentially transmits each of the plurality of files constituting the saved data to the external server S1, and sequentially deletes the transmitted files. Therefore, after the transmission of the saved data to the external server S1 is started, the free area of the storage unit 21 is increased by sequentially deleting the files for which the transmission has been completed with the passage of time.

The control unit 20 of the in-vehicle update device 2 processes the acquisition of the update program and the transmission of the saved data in parallel, so that even if the free area of the storage unit 21 due to the acquisition of the update program is reduced, the saved data whose transmission is completed By deleting the file, a storage area for storing the update program can be secured. However, when the capacity of the usable storage area in the external server S1 is limited, or the total capacity of the saved data that can be transmitted to the external server S1 is relatively low in importance, the total capacity of the saved data is smaller than the total capacity of the update program. It may not be possible to secure a storage area for storing the update program only by saving to the external server S1. Therefore, the control unit 20 of the in-vehicle update device 2 continuously executes the process of confirming the current free space in the storage unit 21 of the own device in parallel with the process of acquiring the update program and transmitting the saved data. That is, the control unit 20 performs a process of monitoring the free space of the storage unit 21 during the process of acquiring the update program and transmitting the saved data.

The control unit 20 of the vehicle-mounted update device 2 continuously monitors the free space of the storage unit 21, and if the free space of the storage unit 21 at the present time is not equal to or less than a predetermined value (S208: NO), the process of S208 is executed again. As a result, the process of monitoring the free space of the storage unit 21 and determining whether or not the value is equal to or less than the predetermined value is continued.

The control unit 20 of the in-vehicle update device 2 continuously monitors the free space of the storage unit 21, and when the free space of the storage unit 21 at the present time becomes equal to or less than a predetermined value (S208: YES), the control unit 20 determines. Similar to the process of the first embodiment (S1062), the saved data is transmitted to the vehicle-mounted ECU 3 to be non-updated, and the saved data for which the transmission is completed is deleted (S209). The predetermined value is determined, for example, as a ratio to the storage capacity of the storage unit 21 of the vehicle-mounted update device 2, and can be determined as 10% of the storage capacity. The predetermined value is determined by the storage unit 21 of the vehicle-mounted update device 2. It is remembered. Alternatively, the control unit 20 may store the predetermined value in the storage unit 21 as, for example, 100 Mbyte.

After executing the processes of S206, S207 and S209, the control unit 20 of the vehicle-mounted update device 2 performs the processes of S210, S211 and S212 in the same manner as the processes of the first embodiment (S109, S110, S111). In the processing of S208, if the state in which the free space of the storage unit 21 at the present time is not equal to or less than a predetermined value (S208: NO) continues, the control unit 20 performs the processing of S208 (monitoring and determining the free space of the storage unit 21). It will continue (loop processing). On the other hand, the control unit 20 acquires all the data (all blocks) of the update program, stores them in the storage unit 21, and then suspends the processing of S208 (terminates the subprocess that performs the processing of S208). You may.

The control unit 20 of the in-vehicle update device 2 finishes the process of this flowchart after performing the process of S205 or S212 as in the first embodiment. Alternatively, the control unit 20 may perform the loop processing in order to execute the processing of S201 again after performing the processing of S205 or S212.

The control unit 20 of the in-vehicle update device 2 stores the determination result regarding the determination (S203, S208) in the processing of this flowchart in the storage unit 21, outputs the determination result to the display device 5 or the external server S1, and outputs this information to the operation of the vehicle C. It may notify the person or the administrator of the external server S1.

The in-vehicle update device 2 transmits the save data to the external server S1 while the update program is being acquired from the external server S1, that is, the process of acquiring the update program and the process of transmitting the save data to the external server S1 in parallel (parallel processing). To do. Therefore, the preparatory work for acquiring the update program is unnecessary, and the time required for a series of processes for updating the in-vehicle ECU 3 to be updated can be shortened.

The in-vehicle update device 2 also performs a process of monitoring the free space of the storage unit 21 in parallel with a process of acquiring the update program and a process of transmitting the saved data to the external server S1, and is not updated based on the free space. It is determined whether or not it is necessary to transmit the saved data to the target vehicle-mounted ECU 3. Then, when it is determined that transmission to the saved data is necessary for the vehicle-mounted ECU 3 to be non-updated, the vehicle-mounted update device 2 does not perform the process of acquiring the update program, the process of transmitting the saved data to the external server S1, and the saved data. The process of transmitting to the in-vehicle ECU 3 to be updated is performed in parallel. Therefore, when acquiring the update program, it is possible to shorten the time for securing the area for storing the update program.

The embodiments disclosed this time should be considered as exemplary in all respects and not restrictive. The scope of the present disclosure is indicated by the scope of claims, not the above-mentioned meaning, and is intended to include all modifications within the meaning and scope equivalent to the scope of claims.

C Vehicle S In-vehicle update system S1 External server S11 Storage unit 1 External communication device 11 External communication unit 12 Input / output I / F
13 Antenna 2 In-vehicle update device 20 Control unit 21 Storage unit 22 Recording medium 23 In-vehicle communication unit 24 Input / output I / F
3 In-vehicle ECU (in-vehicle control device)
30 Control unit 31 Storage unit 311 First storage area (first surface)
312 Second storage area (second surface)
32 In-vehicle communication unit 4 In-vehicle LAN
5 Display device

Claims (16)

It is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs processing for updating the program of the in-vehicle control device mounted on the vehicle, and includes a storage unit and a control unit.
The storage unit stores the update program and stores the update program.
The control unit controls transmission of the update program to the in-vehicle control device to be updated.
The control unit
When the update program is acquired from the external server, the saved data stored in the storage unit is transmitted to the external server or a non-update target vehicle control device other than the update target vehicle control device.
An in-vehicle update device that stores at least a part of the update program acquired from the external server in the storage unit. When the total data capacity of the update program is larger than the free capacity of the storage unit, the control unit uses the saved data stored in the storage unit other than the external server or the in-vehicle control device to be updated. The vehicle-mounted renewal device according to claim 1, which is transmitted to a non-renewal target vehicle-mounted control device. It is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs processing for updating the program of the in-vehicle control device mounted on the vehicle, and includes a storage unit and a control unit.
The storage unit stores the update program and stores the update program.
The control unit controls transmission of the update program to the in-vehicle control device to be updated.
When the control unit acquires the update program from the external server, the control unit
When the total data capacity of the update program is smaller than the free space of the storage unit, the update program acquired from the external server is stored in the storage unit.
When the total data capacity of the update program is equal to or greater than the free space of the storage unit
The saved data stored in the storage unit is transmitted to the external server or a non-update target vehicle control device other than the update target vehicle control device.
An in-vehicle update device that overwrites the update program in a storage area in which saved data is stored in the storage unit. It is an in-vehicle update device that acquires an update program transmitted from an external server outside the vehicle and performs processing for updating the program of the in-vehicle control device mounted on the vehicle, and includes a storage unit and a control unit.
The storage unit stores the update program and stores the update program.
The control unit controls transmission of the update program to the in-vehicle control device to be updated.
The control unit
When acquiring the update program from the external server, the total data capacity of the update program is derived.
When the total data capacity of the update program is equal to or greater than the free capacity of the storage unit, the saved data stored in the storage unit is saved in a storage unit other than the own device.
The storage unit other than the own device is an in-vehicle update device including at least one storage unit of the external server or at least one of the non-update target in-vehicle control devices other than the update target in-vehicle control device. The save data transmitted to the external server is described in any one of claims 1 to 4, which is less important in the own device or the vehicle than the save data transmitted to the in-vehicle control device to be non-updated. In-vehicle update device. The vehicle-mounted update device according to claim 5, wherein the data type and importance of the saved data are stored in the storage unit in association with each other. The control unit
Before acquiring the update program, the total data capacity of the update program is acquired from the external server.
When the total value of the free space of the storage unit and the total data capacity of the backup data transmitted to the external server is smaller than the total data capacity of the update program, the backup data other than the backup data transmitted to the external server is used. The vehicle-mounted renewal device according to any one of claims 1 to 6, which is transmitted to a non-renewable vehicle-mounted control device. The control unit
Before acquiring the update program, the total data capacity of the update program is acquired from the external server.
When the total value of the free space of the storage unit, the total data capacity of the backup data transmitted to the external server, and the backup data transmitted to the non-update target in-vehicle control device is larger than the total data capacity of the update program. The vehicle-mounted update device according to any one of claims 1 to 7, which transmits the saved data to the external server and the vehicle-mounted control device to be non-updated based on the data type of the saved data. The control unit
While acquiring the update program from the external server, the saved data is transmitted to the external server.
1. When the free space of the storage unit during acquisition of the update program becomes equal to or less than a predetermined value, save data other than the save data to be transmitted to the external server is transmitted to the in-vehicle control device to be non-updated. The vehicle-mounted renewal device according to any one of claims 8. The vehicle is equipped with a plurality of the in-vehicle control devices.
A plurality of in-vehicle communication units for communicating with each of the plurality of in-vehicle control devices are provided.
The one according to any one of claims 1 to 9, wherein the control unit transmits the saved data in parallel to each of the non-updated in-vehicle control devices connected to different in-vehicle communication units. In-vehicle update device. When acquiring an update program from an external server, the saved data stored in the storage unit is transmitted to the external server or a non-update target vehicle control device other than the update target vehicle control device.
At least a part of the update program acquired from the external server is stored in the storage unit.
A method of updating a program for transmitting the stored update program to the in-vehicle control device to be updated. When getting updates from an external server
When the total data capacity of the update program is smaller than the free space of the storage unit, the update program acquired from the external server is stored in the storage unit.
When the total data capacity of the update program is equal to or greater than the free space of the storage unit
The saved data stored in the storage unit is transmitted to the external server or a non-update target vehicle control device other than the update target vehicle control device.
The update program is overwritten in the storage area in which the saved data is stored in the storage unit.
A method of updating a program for transmitting the stored update program to the in-vehicle control device to be updated. When acquiring an update program from an external server, the total data capacity of the update program is derived.
When the total data capacity of the update program is equal to or greater than the free capacity of the storage unit, the saved data stored in the storage unit is saved in a storage unit other than the own device.
The storage unit other than the own device includes at least one storage unit of the external server or a non-update target in-vehicle control device other than the update target in-vehicle control device.
A method of updating a program for transmitting the stored update program to the in-vehicle control device to be updated. On the computer
When acquiring an update program from an external server, the saved data stored in the storage unit is transmitted to the external server or a non-update target vehicle control device other than the update target vehicle control device.
At least a part of the update program acquired from the external server is stored in the storage unit.
An update processing program for executing a process of transmitting the stored update program to the in-vehicle control device to be updated. On the computer
When getting updates from an external server
When the total data capacity of the update program is smaller than the free space of the storage unit, the update program acquired from the external server is stored in the storage unit.
When the total data capacity of the update program is equal to or greater than the free space of the storage unit
The saved data stored in the storage unit is transmitted to the external server or a non-update target vehicle control device other than the update target vehicle control device.
The update program is overwritten in the storage area in which the saved data is stored in the storage unit.
An update processing program for executing a process of transmitting the stored update program to the in-vehicle control device to be updated. On the computer
When acquiring an update program from an external server, the total data capacity of the update program is derived.
When the total data capacity of the update program is equal to or greater than the free capacity of the storage unit, the saved data stored in the storage unit is saved in a storage unit other than the own device.
The storage unit other than the own device includes at least one storage unit of the external server or a non-update target in-vehicle control device other than the update target in-vehicle control device.
An update processing program for executing a process of transmitting the stored update program to the in-vehicle control device to be updated.

Images