JP2021077169A - On-vehicle system, repeating device, on-vehicle device and program replacement method - Google Patents

Abstract

To provide an on-vehicle system, a repeating device, an on-vehicle device and a program replacement method by which restoration from a failure of an application program of an on-vehicle device can be expected.SOLUTION: In an on-vehicle system concerning an embodiment, a plurality of on-vehicle devices are connected with one another via a network, and the on-vehicle system comprises: a detection part which detects a failure concerning programs to be executed by the on-vehicle devices; a search part which searches for other on-vehicle device having a program replaceable with the program of which the failure is detected by the detection part; and an instruction part which instructs transmission of the replaceable program to other on-vehicle device searched by the search part, in which each on-vehicle device comprises a replacement part which receives the replaceable program to be transmitted by other on-vehicle device according to an instruction to replace the program of which the failure is detected with the replaceable program.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to an in-vehicle system, a relay device, an in-vehicle device, and a program replacement method for replacing a program in which a defect is detected.

In recent years, technologies such as automatic driving or driving assistance of vehicles have been researched and developed, and the sophistication of vehicles is being promoted. With the increasing functionality of vehicles, various application programs are being executed in information processing devices such as ECUs (Electronic Control Units) mounted on vehicles. When a malfunction or failure occurs in the application program in the in-vehicle device, it is desired that the recovery be performed promptly.

Patent Document 1 proposes a communication relay device that recovers from an abnormal state based on an operating state before the occurrence of an abnormality when an abnormality occurs in communication between an in-vehicle device and a portable terminal device. ..

Japanese Unexamined Patent Publication No. 2015-888948

When a malfunction or failure occurs in the application program of the in-vehicle device, the application program has been restored by the following two methods in the past. The first method is a method of replacing a defective application program by, for example, downloading an application program from a server device outside the vehicle. The second method is to replace the application program with a tool provided in the vehicle dealer. However, these methods cannot always be implemented depending on the surrounding environment of the vehicle and the like, and it has been difficult to recover from a defect in the application program at an early stage. The communication relay device described in Patent Document 1 cannot solve this problem either.

The present disclosure has been made in view of such circumstances, and an object of the present invention is to provide an in-vehicle system, a relay device, an in-vehicle device, and a program replacement method that can be expected to recover from a defect in an application program of the in-vehicle device. To provide.

The in-vehicle system according to this aspect is an in-vehicle system in which a plurality of in-vehicle devices are connected via a network, and a detection unit that detects a defect related to a program executed by the in-vehicle device and the detection unit detect a defect. It is provided with a search unit for searching for another in-vehicle device having a program that can be substituted for the program, and an instruction unit for instructing the other in-vehicle device searched by the search unit to transmit the substitutable program. The in-vehicle device receives the substitutable program transmitted by the other in-vehicle device in response to the instruction, and replaces the program in which the defect is detected with the substitutable program.

The present application can be realized not only as a device such as a relay device or an in-vehicle device provided with such a characteristic processing unit, but also as a program replacement method in which such a characteristic processing is a step, or such a step can be realized. It can be realized as a computer program to be executed by a computer. It can be realized as a semiconductor integrated circuit that realizes a part or all of these devices, or can be realized as another device or system including these devices.

According to the above, recovery from a defect in the application program of the in-vehicle device can be expected.

It is a schematic diagram for demonstrating the outline of the in-vehicle system which concerns on this Embodiment. It is a block diagram which shows the structure of GW which concerns on Embodiment 1. FIG. It is a schematic diagram which shows one configuration example of a substitution table. It is a block diagram which shows the structure of the ECU which concerns on this embodiment. It is a flowchart which shows an example of the procedure of the process performed by GW which concerns on this Embodiment. It is a flowchart which shows an example of the procedure of the process performed by GW which concerns on this Embodiment. It is a flowchart which shows an example of the procedure of application replacement processing performed by the ECU which concerns on Embodiment 1. FIG. It is a flowchart which shows an example of the procedure of application transmission processing performed by the ECU which concerns on Embodiment 1. FIG. It is a block diagram which shows the structure of the ECU which concerns on Embodiment 2. FIG. It is a schematic diagram which shows one structural example of the substitution table which concerns on Embodiment 2.

[Explanation of Embodiments of the present disclosure]
First, embodiments of the present disclosure will be listed and described. At least a part of the embodiments described below may be arbitrarily combined.

(1) The in-vehicle system according to this embodiment is an in-vehicle system in which a plurality of in-vehicle devices are connected via a network, and a detection unit for detecting a defect related to a program executed by the in-vehicle device and the detection unit A search unit that searches for another in-vehicle device that has a program that can be substituted for the program that detected the defect, and an instruction unit that instructs the other in-vehicle device that the search unit has searched to transmit the substitutable program. The in-vehicle device receives the substitutable program transmitted by the other in-vehicle device in response to the instruction, and replaces the program in which the defect is detected with the substitutable program.

In this embodiment, it is possible to detect a defect related to a program executed by the in-vehicle device, search for another in-vehicle device having a program that can be substituted for the program that detected the defect, and substitute for the searched other device. Instruct to send the program. An in-vehicle device in which a program defect is detected receives an alternative program transmitted by another in-vehicle device and replaces the defective program with the received program. As a result, the in-vehicle system can replace the defective program by exchanging the program between a plurality of in-vehicle devices existing in the vehicle, and recovery from the defect can be expected.

(2) The in-vehicle device has an operation confirmation unit for confirming the operation of the received alternative program, and the in-vehicle device replaces the program when normal operation is confirmed by the operation confirmation unit. It is preferable to do.

In this embodiment, the in-vehicle device that has received the substitutable program replaces it after confirming the operation of the received program. As a result, it can be expected that the occurrence of new problems due to the execution of the received program can be suppressed.

(3) The in-vehicle device has an adjusting unit for adjusting parameters used by the received substitutable program, and the operation checking unit operates the substitutable program with parameters adjusted by the adjusting unit. It is preferable to confirm.

In this aspect, the vehicle-mounted device that has received the substitutable program adjusts the parameters used by the received program. This makes it possible to perform processing suitable for the own device using a substitutable program.

(4) It is preferable that the in-vehicle device having the program in which the defect is detected limits a part of the functions of the program.

In this embodiment, the in-vehicle device in which a defect is detected in the program executes the program by limiting a part of the functions of the program. As a result, it is possible to prevent a defect that occurs in the program in one in-vehicle device from adversely affecting another in-vehicle device.

(5) It is preferable that the relay device includes a relay device that relays communication between a plurality of in-vehicle devices, and the relay device has the detection unit, the search unit, and the instruction unit.

In this embodiment, processing such as detection of a program defect, search for an in-vehicle device having an alternative program, and an instruction to transmit an alternative program to the in-vehicle device is relayed through communication between a plurality of in-vehicle devices. The relay device does. As a result, it is not necessary for each in-vehicle device to perform the above processing, so that the processing load of the in-vehicle device can be reduced.

(6) The in-vehicle device preferably has the detection unit, the search unit, and the instruction unit.

In this embodiment, each in-vehicle device performs processing such as detection of a program defect, search for an in-vehicle device having a substitutable program, and an instruction to transmit an alternative program to the in-vehicle device. As a result, each in-vehicle device can accurately detect a defect in its own program, and it is possible to prevent the load of these processes from being concentrated on one device such as a relay device.

(7) The relay device according to this aspect is a relay device that relays communication between a plurality of in-vehicle devices and includes a processing unit, and the processing unit detects a defect related to a program executed by the in-vehicle device. Then, another in-vehicle device having a program that can be substituted for the program in which the defect is detected is searched for, and the other in-vehicle device that has been searched is instructed to transmit the substitutable program.

In this aspect, as in the aspect (1), the defective program can be replaced, and recovery from the defect can be expected.

(8) The in-vehicle device according to the present embodiment is an in-vehicle device connected to another in-vehicle device via a network and includes a processing unit, which detects a defect related to a program to be executed and has a defect. Searches for another in-vehicle device having a program that can be substituted for the detected program, instructs the searched other in-vehicle device to transmit the substitutable program, and in response to the instruction, the other in-vehicle device. Upon receiving the substitutable program transmitted by the device, the program in which the defect is detected is replaced with the substitutable program.

In this aspect, as in the aspect (1), the defective program can be replaced, and recovery from the defect can be expected.

(8) The program replacement method according to this aspect detects a defect related to a program executed by the in-vehicle device, searches for another in-vehicle device having a program that can substitute for the program in which the defect is detected, and searches for the other in-vehicle device. The in-vehicle device is instructed to transmit the substitutable program, and the in-vehicle device receives the substitutable program transmitted by the other in-vehicle device in response to the instruction, and the defect is detected. The program is replaced with the alternative program.

In this aspect, as in the aspect (1), the defective program can be replaced, and recovery from the defect can be expected.

[Details of Embodiments of the present disclosure]
Specific examples of the in-vehicle system according to the embodiment of the present disclosure will be described below with reference to the drawings. The present disclosure is not limited to these examples, but is shown by the scope of claims and is intended to include all modifications within the meaning and scope equivalent to the scope of claims.

<System overview>
FIG. 1 is a schematic diagram for explaining an outline of an in-vehicle system according to the present embodiment. The in-vehicle system according to the present embodiment is a system in which the GW (gateway) 2 mounted on the vehicle 1 and the plurality of ECUs 4A to 4D communicate with each other via the communication lines 1a and 1b. In the illustrated example, the vehicle 1 is provided with two bus-type communication lines 1a and 1b. The GW2 and the two ECUs 4A and 4B are connected to the first communication line 1a. The GW2 and the two ECUs 4C and 4D are connected to the second communication line 1b. The GW 2 performs a process in which two communication lines 1a and 1b are connected together and communication between the two communication lines 1a and 1b is relayed. As a result, the four ECUs 4A to 4C can communicate with each other via the communication lines 1a and 1b and the GW2.

In the ECUs 4A to 4D according to the present embodiment, the application (application program) stored in the flash memory or the like is executed by a processor such as a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit), whereby the vehicle 1 Various processes such as running control are performed. In the illustrated example, the ECU 4B executes the application 101, and the ECU 4C executes the application 102. The application executed by the ECUs 4A and 4D is not shown.

Here, it is assumed that some kind of trouble occurs in the application 101 of the ECU 4B. The defect can be caused by, for example, damage to the program code or unauthorized rewriting. In the in-vehicle system according to the present embodiment, defects related to the applications executed by the ECUs 4A to 4D are detected. When a defect is detected in the application 101 of the ECU 4B, the in-vehicle system according to the present embodiment searches for another application 102 that can substitute for the application 101 and another ECU 4C having this application. The ECU 4C transmits the application 102 to the ECU 4B. The ECU 4B receives the application 102 transmitted from the ECU 4C and replaces it with its own application 101. After that, the in-vehicle system is restored by executing the application 102 replaced by the ECU 4B.

For example, when a plurality of cameras for photographing the outside of the vehicle are mounted on the vehicle 1, the ECU that controls each camera is provided with an application for camera control. The camera control application provided by each of these ECUs is often the same application or a similar application, and if a problem occurs in the camera control application in one of the ECUs, it is replaced with the application of the other ECU. It can be expected that the problem will be solved. Further, for example, when a plurality of sensors for detecting obstacles around the vehicle are mounted on the vehicle 1, it can be expected that the problem can be solved by replacing the application in the same manner. The replacement of the application is not limited to the ECU that controls the camera, the sensor, and the like. The vehicle 1 may be equipped with devices having the same or similar configuration at a plurality of locations, and the application may be replaced between these devices.

In the in-vehicle system according to the present embodiment, some configurations may be adopted as to which device performs processing such as detection of a defect of the application and search for a substitute application. Hereinafter, the configuration in which the GW2 performs these processes will be described in the first embodiment, and the configuration in which the ECUs 4A to 4D perform these processes will be described in the second embodiment.

<Embodiment 1>
FIG. 2 is a block diagram showing a configuration of GW2 according to the first embodiment. The GW 2 according to the present embodiment includes a processing unit (processor) 21, a storage unit (storage) 22, two communication units (transceivers) 23, and the like. The processing unit 21 is configured by using an arithmetic processing unit such as a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit). The processing unit 21 can perform various processes by reading and executing the program stored in the storage unit 22. In the present embodiment, the processing unit 21 reads the program 22a stored in the storage unit 22 and executes the program to relay the message between the communication lines 1a and 1b and the program of the ECUs 4A to 4D in which a problem occurs. Performs various processes such as a process of replacing.

The storage unit 22 is configured by using a non-volatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory). The storage unit 22 stores various programs executed by the processing unit 21 and various data required for processing by the processing unit 21. In the present embodiment, the storage unit 22 stores the program 22a executed by the processing unit 21, a program that can replace the program in which the problem has occurred, and a replacement table 22b for searching the ECUs 4A to 4D having the program. ing.

The program 22a may be written in the storage unit 22 at the manufacturing stage of the GW2, for example, or the GW2 may acquire what is distributed by a remote server device or the like by communication, or may be, for example, a memory card or an optical disk. The program recorded on the recording medium 99 such as the above may be read by the GW 2 and stored in the storage unit 22, or the writing device may read the program recorded on the recording medium 99 and write it in the storage unit 22 of the GW 2. Good. The program 22a may be provided in the form of distribution via the network, or may be provided in the form recorded on the recording medium 99.

FIG. 3 is a schematic view showing a configuration example of the replacement table 22b. In the replacement table 22b according to the present embodiment, for example, information about ECUs 4A to 4D and an application provided therein is associated with information regarding an application that can be replaced when a problem occurs in this application and ECUs 4A to 4D including the application. Is remembered. In the illustrated example, for example, ECU 4A includes apps A1 and A2. The application A1 of the ECU 4A can be replaced with the application B1 provided by the ECU 4B and the application C1 provided by the ECU 4C. The application A2 of the ECU 4A can be replaced with the application D1 of the ECU 4D. Further, for example, the ECU 4B includes the application B1. The application B1 of the ECU 4B can be replaced with the application A1 of the ECU 4A and the application C1 of the ECU 4C. In the present embodiment, the replacement table 22b is stored in the storage unit 22 in advance at the design stage, the manufacturing stage, or the like of the vehicle 1 and the in-vehicle system. Further, when the applications of ECUs 4A to 4D are updated or changed after manufacturing, the information in the replacement table 22b is updated. The replacement table 22b may be updated, for example, by the GW2, by receiving information transmitted by, for example, an external device, or by manually rewriting the information, for example.

The two communication units 23 are connected to the communication lines 1a or 1b and communicate with the ECUs 4A to 4D via the communication lines 1a and 1b. In the present embodiment, the communication unit 23 transmits / receives data according to, for example, a communication standard of CAN (Controller Area Network). The communication unit 23 can be configured by using, for example, an IC of a CAN controller. However, the communication standard used by the communication unit 23 is not limited to CAN, and the communication unit 23 may perform communication using a communication standard other than CAN, for example, a communication standard such as Ethernet (registered trademark). The communication unit 23 transmits data by outputting the data given by the processing unit 21 as an electric signal to the communication lines 1a and 1b. Further, the communication unit 23 converts the electric signals on the communication lines 1a and 1b into digital data by sampling and acquiring the potentials of the communication lines 1a and 1b, and gives the converted data to the processing unit 21 as reception data. ..

Further, in the present embodiment, the GW 2 reads and executes the program 22a stored in the storage unit 22, so that the relay processing unit 21a, the defect detection unit 21b, the replacement search unit 21c, the replacement instruction unit 21d, etc. Is realized in the processing unit 21 as a software-like functional unit. The relay processing unit 11a performs a process of relaying data between the communication lines 1a and 1b by transmitting the data received by one of the two communication units 23 from the other communication unit 23.

The defect detection unit 21b performs a process of detecting a defect related to the application included in the ECUs 4A to 4D by monitoring the data transmitted by the ECUs 4A to 4D. For example, the defect detection unit 21b stores the ID and transmission cycle of the data periodically transmitted by each application of each ECU 4A to 4D, and whether or not the data transmission cycle by each application is a defined transmission cycle. Judge whether there is a defect based on. Further, for example, the defect detection unit 21b stores an appropriate range of information such as a sensor detection value or an actuator control value included in the data transmitted by each application of each ECU 4A to 4D, and stores the appropriate range of information in the data transmitted by each application. The presence or absence of a defect is determined based on whether or not the contained information is within the appropriate range. The method for detecting a defect in the application by the defect detection unit 21b is not limited to the above, and any method may be adopted.

The replacement search unit 21c performs a process of searching for an application that can be replaced with respect to the application in which the defect is detected by the defect detection unit 21b. By referring to the replacement table 22b stored in the storage unit 22, the replacement search unit 21c searches for the presence or absence of an application that can be replaced by the application in which the defect is detected, and the ECUs 4A to 4D having the replaceable application. ..

Based on the search result of the replacement search unit 21c, the replacement instruction unit 21d performs a process of giving an instruction to replace the application in which the defect is detected with a replaceable application. The replacement instruction unit 21d gives an instruction to the ECUs 4A to 4D having the replaceable application to transmit the replaceable application to the ECUs 4A to 4D in which the defect of the application is detected. As a result, the replaceable application is transmitted to the defective ECUs 4A to 4D, and the received ECUs 4A to 4D can replace the defective application with the received application.

FIG. 4 is a block diagram showing a configuration of the ECU 4 according to the present embodiment. In the following, when it is necessary to distinguish between a plurality of ECUs provided in the in-vehicle system, individual reference numerals are given as in ECUs 4A to 4D, and in the case of functions common to these, the reference numerals of the ECU 4 are given. It will be explained with reference to it. The ECU 4 according to the present embodiment includes a processing unit (processor) 41, a storage unit (storage) 42, a communication unit (transceiver) 43, and the like. The processing unit 41 is configured by using an arithmetic processing unit such as a CPU or an MPU. The processing unit 41 can perform various processes by reading and executing the program stored in the storage unit 42. In the present embodiment, the processing unit 41 reads and executes the program 42a and the application 42b stored in the storage unit 42, thereby performing various control processing related to the running of the vehicle 1 and replacement processing of the application in which a problem occurs. Is processed.

The storage unit 42 is configured by using a non-volatile memory element such as a flash memory or EEPROM. The storage unit 42 stores various programs executed by the processing unit 41 and various data required for processing by the processing unit 41. In the present embodiment, the storage unit 42 stores the program 42a and the application 42b executed by the processing unit 41 and the parameter 42c necessary for executing the application 42b.

In the present embodiment, the program 42a is a computer program that performs processing at a lower level than the application program, such as an operating system or firmware. The program 42a provides an execution environment for the application 42b by interposing between the hardware of the ECU 4 and the application 42b and performing processing such as communication with another ECU 4 for example.

The application 42b is an application program that performs processing such as running control of the vehicle 1 or service provision to the occupants of the vehicle 1, and is a computer program that performs processing at a higher level than the program 42a. In the illustrated example, one application 42b is stored in the storage unit 42, but a plurality of types of applications 42b may be stored in the storage unit 42 of the ECU 4.

The parameter 42c is data used in the execution of the application 42b. For example, in the case of the application 42b that controls the camera of the vehicle 1, information such as the mounting position of the camera or the shooting direction of the camera in the vehicle 1 is stored as the parameter 42c. The parameter 42c is determined at the design stage, the manufacturing stage, or the like of the vehicle 1 or the ECU 4, and is stored in the storage unit 42 in advance.

The program 42a, the application 42b, and the parameter 42c may be written in the storage unit 42, for example, at the manufacturing stage of the ECU 4, or may be acquired by the ECU 4 by communication, for example, as being delivered by a remote server device or the like. Further, for example, the ECU 4 may read out the program 42a, the application 42b and the parameter 42c recorded on a recording medium such as a memory card or an optical disk and store them in the storage unit 42. May read and write to the storage unit 42 of the ECU 4. The program 42a, the application 42b, and the parameter 42c may be provided in a mode of distribution via a network, or may be provided in a mode recorded on a recording medium.

The communication unit 43 is connected to the communication lines 1a or 1b and communicates with the GW 2 and other ECU 4 via the communication lines 1a and 1b. In the present embodiment, the communication unit 43 transmits / receives data according to, for example, a CAN communication standard. The communication unit 43 can be configured by using, for example, an IC of a CAN controller. However, the communication standard used by the communication unit 43 is not limited to CAN, and the communication unit 43 may perform communication using a communication standard other than CAN, for example, a communication standard such as Ethernet. The communication unit 43 transmits data by outputting the data given by the processing unit 41 as an electric signal to the communication lines 1a and 1b. Further, the communication unit 43 converts the electric signals on the communication lines 1a and 1b into digital data by sampling and acquiring the potentials of the communication lines 1a and 1b, and gives the converted data to the processing unit 41 as reception data. ..

Further, in the present embodiment, the ECU 4 reads and executes the program 42a stored in the storage unit 42 by the processing unit 41, so that the application execution unit 41a, the application transmission unit 41b, the application reception unit 41c, and the parameter adjustment unit 41d The operation confirmation unit 41e, the mode switching unit 41f, and the like are realized in the processing unit 41 as software-like functional units. The application execution unit 41a performs a process related to the execution of the application 42b stored in the storage unit 42. The application execution unit 41a performs, for example, processing such as starting and stopping the application 42b, and managing execution schedules of a plurality of applications 42b.

The application transmission unit 41b performs a process of transmitting the application 42b stored in the storage unit 42 to another ECU 4 in response to an instruction given from the GW 2. The GW 2 gives the ECU 4 a transmission instruction including information such as, for example, the ID or name of the application to be transmitted and the ID of the destination ECU 4. Upon receiving this instruction, the application transmission unit 41b of the ECU 4 reads the designated application 42b from the storage unit 42, divides the application 42b into an appropriate data size, and sequentially transmits the application 42b to the designated ECU 4.

The application receiving unit 41c performs a process of receiving an application transmitted as a substitute from another ECU 4 when a problem occurs in its own application 42b. The application receiving unit 41c receives the divided data of the application 42b transmitted by the other ECU 4 in the communication unit 43, and stores the received data in the free area of the storage unit 42. The application receiving unit 41c restores the alternative application to the storage unit 42 by receiving and combining all the divided data.

When the parameter is attached to the alternative application received by the application receiving unit 41c, the parameter adjusting unit 41d replaces the parameter 42c stored in the storage unit 42 with the parameter of the alternative application. Performs the process of adjusting.

The operation confirmation unit 41e performs a process of confirming whether or not the alternative application operates correctly by trial-operating the alternative application stored in the storage unit 42. The operation check unit 41e stores, for example, information that combines the expected values of the test input pattern and the output pattern for the alternative application, inputs a predetermined input pattern to the alternative application, and substitutes. Whether or not the alternative application operates correctly is determined depending on whether or not the output pattern output by the application matches the expected value. The operation confirmation method performed by the operation confirmation unit 41e is not limited to the above method, and any method may be adopted.

The mode switching unit 41f performs a process of switching the operation mode of the ECU 4. In the present embodiment, the ECU 4 can switch between a normal operation mode in which normal operation is performed and a degenerate mode in which functions are restricted more than usual. The mode switching unit 41f changes the operation mode from the normal operation mode to the degraded mode, for example, when receiving a notification from GW2 that a defect has been detected for its own application 42b, or when detecting a defect by itself. Switch. Further, the mode switching unit 41f has detected that the degenerate mode is switched to the normal operation mode according to an instruction from, for example, a terminal device provided in the dealer of the vehicle 1 or a maintenance shop, or, for example, the problem is solved by itself. Do it in some cases. In the degenerate mode in the present embodiment, the ECU 4 limits and executes at least a part of the functions of the application 42b in which the defect is detected.

5 and 6 are flowcharts showing an example of the processing procedure performed by the GW 2 according to the present embodiment. The defect detection unit 21b of the processing unit 21 of the GW 2 according to the present embodiment detects a defect of the application 42b of the ECU 4 by examining the transmission cycle, the value of the data, etc. of the data received by the communication unit 23. Perform the process (step S1). The defect detection unit 21b determines whether or not there is a defect in the application 42b of the ECU 4 by the defect detection process (step S2). If there is no defect (S2: NO), the defect detection unit 21b returns the process to step S1 and continues the defect detection process.

When it is determined that there is a problem in the application 42b of the ECU 4 (S2: YES), the processing unit 21 causes a problem by displaying a message regarding the problem of the application on a display provided near the driver's seat of the vehicle 1, for example. Notify the user. In response to this notification, the user of the vehicle 1 stops the running of the vehicle 1, and the processing unit 21 of the GW 2 that confirms the stop of the vehicle 1 goes to the recovery preparation state for performing the recovery processing of the application 42b of the ECU 4 in which the problem has occurred. The in-vehicle system is migrated (step S3). The processing unit 21 notifies the ECU 4 in which the defect of the application 42b is detected to switch the ECU 4 to the degenerate mode (step S4).

The replacement search unit 21c of the processing unit 21 refers to the replacement table 22b of the storage unit 42, and searches for the app 42b that can be replaced with respect to the application 42b in which the defect is detected (step S5). The replacement search unit 21c determines whether or not there is a replaceable application 42b in the application 42b for which a defect has been detected by the search process (step S6). When the replaceable application 42b does not exist (S6: NO), the processing unit 21 cannot perform recovery by replacing the application 42b, so that recovery using a dealer or the like or recovery using communication with a server device outside the vehicle is used. The in-vehicle system is shifted to the recovery standby state, which waits for the implementation of the above (step S10), and the process is terminated. In the recovery standby state, for example, the ECU 4 in which a defect is detected operates in the degenerate mode or is stopped, and the function of the vehicle 1 is partially restricted.

When there is a replaceable application 42b (S6: YES), the replacement instruction unit 21d of the processing unit 21 stores the ECU 4 by exchanging information with the ECU 4 having the application 42b in which the defect is detected. A process for confirming the free space of the unit 42 is performed (step S7). Based on the result of the free space confirmation process, the replacement instruction unit 21d determines whether or not the storage unit 42 of the ECU 4 that replaces the application 42b has free space for storing the replacement application 42b (step). S8). When there is not enough free space (S8: NO), the processing unit 21 shifts the in-vehicle system to the recovery standby state, which waits for the execution of recovery by a dealer or the like or recovery using communication with a server device outside the vehicle. (Step S10), and the process is terminated.

When the storage unit 42 of the ECU 4 in which the defect is detected has sufficient free space (S8: YES), the replacement instruction unit 21d has a defect in this application 42b with respect to another ECU 4 having the replaceable application 42b. An instruction to transmit to the detected ECU 4 is given (step S9). As a result, the application 42b is transmitted from the normal ECU 4 to the ECU 4 in which the defect is detected, and the application 42b in which the defect is detected is replaced by the received application 42b in the ECU 4 that has received the application 42b. However, the ECU 4 checks the operation of the received application 42b, replaces it when it is determined by the operation check that it is an appropriate application 42b, and does not replace it when it is determined that it is not an appropriate application 42b. .. The processing unit 21 determines whether or not the replacement is completed by the ECU 4 that has received the application 42b (step S11). When the replacement of the application 42b is not completed (S11: NO), the processing unit 21 returns to step S5 and searches for another application 42b that can be replaced with respect to the application 42b in which the defect is detected.

When the replacement of the application 42b is completed in the ECU 4 (S11: YES), the processing unit 21 has recovered from the problem of the application 42b by displaying a message on a display provided near the driver's seat of the vehicle 1, for example. Is notified to the user, and the in-vehicle system is shifted to the restored state indicating that the defect of the application 42b has been restored (step S12), and the process is terminated. The processing unit 21 may shift the ECU 4 from the degenerate mode to the normal operation mode in step S12, but may maintain the degenerate mode. The recovery state is a state in which information indicating that the recovery process has been performed by replacing the application 42b in the vehicle 1 is retained, and the running or the like of the vehicle 1 may be the same as the normal state. For example, if it is confirmed that there is no problem due to replacement when an inspection is performed by a dealer or the like after the recovery state is reached, the recovery state is canceled by the operation of a worker such as the dealer, and the in-vehicle system is normally used. Transition to the state of.

FIG. 7 is a flowchart showing an example of the procedure of the application replacement process performed by the ECU 4 according to the first embodiment. The mode switching unit 41f of the processing unit 41 of the ECU 4 according to the first embodiment switches from the normal operation mode to the degraded mode in response to receiving a notification from the GW2 that a defect of the application 42b has been detected (the mode switching unit 41f). Step S21). The application receiving unit 41c of the processing unit 41 determines whether or not the replacement application 42b has been received from another ECU 4 by the application 42b in which the defect has been detected (step S22). When the application 42b is not received (S22: NO), the application receiving unit 41c waits until the replacement application 42b is received (step S22).

When the replacement application 42b is received (S22: YES), the application receiving unit 41c stores the received replacement application 42b in the free area of the storage unit 42 (step S23). The parameter adjusting unit 41d of the processing unit 41 adjusts the parameters to be applied to the application 42b that has received the parameter 42c stored in the storage unit 42 (step S24). Next, the operation confirmation unit 41e of the processing unit 41 performs an operation using a predetermined test pattern on the replacement application 42b whose parameters have been adjusted, and compares the operation result with the expected value. (Step S25). The operation confirmation unit 41e determines whether or not the operation of the replacement application 42b is normal based on the result of the operation confirmation process (step S26).

When the operation of the replacement application 42b is normal (S26: YES), the processing unit 41 excludes the application 42b in which the defect is detected from the execution target, and the replacement application stored in the free area of the storage unit 42. By targeting 42b as an execution target, the application 42b is replaced (step S27). After that, the processing unit 41 notifies the GW2 of the completion of the replacement of the application 42b (step S28), and ends the processing.

When the operation of the replacement application 42b is not normal (S26: NO), the processing unit 41 erases the replacement application 42b stored in the free area of the storage unit 42 (step S29). After that, the processing unit 41 requests the GW2 to transmit another application 42b for replacement by notifying the GW2 that the replacement of the application 42b has not been completed normally (step S30), and processes to step S22. And wait for the reception of another application 42b.

FIG. 8 is a flowchart showing an example of the procedure of the application transmission processing performed by the ECU 4 according to the first embodiment. The application transmission unit 41b of the processing unit 41 of the ECU 4 according to the first embodiment determines whether or not the transmission instruction of the application 42b has been received from the GW 2 (step S41). When the transmission instruction is not received (S41: NO), the application transmission unit 41b waits until the transmission instruction is received. When the transmission instruction is received (S41: YES), the application transmission unit 41b reads the application 42b specified in the transmission instruction from the storage unit 42 (step S42). The application transmission unit 41b transmits the application 42b read from the storage unit 42 to the ECU 4 designated in the transmission instruction (step S43), and ends the process.

The GW 2 according to the first embodiment of the above configuration detects a defect of the application 42b executed by the ECU 4, searches for another ECU 4 having an application 42b that can be substituted for the detected application 42b, and causes the searched other ECU 4 to search. On the other hand, the transmission of the alternative application 42b is instructed. The ECU 4 in which the defect of the application 42b is detected receives the application 42b transmitted by another ECU 4 and replaces the defective application 42b with the received application 42b. As a result, the in-vehicle system can replace the application 42b in which the defect is detected by exchanging the application 42b between the plurality of ECUs 4 existing in the vehicle 1, and recovery from the defect can be expected.

Further, the ECU 4 according to the first embodiment replaces the application 42b after confirming the operation of the replacement application 42b received from another ECU 4. As a result, it can be expected that the occurrence of new problems due to the execution of the received application 42b can be suppressed.

Further, the ECU 4 according to the first embodiment performs a parameter adjustment process for applying the parameter 42c stored in its own storage unit 42 to the replacement application 42b received from another ECU 4. As a result, the ECU 4 can perform processing suitable for its own device by using the application 42b received from another ECU 4.

Further, the ECU 4 according to the first embodiment limits at least a part of the functions of the application 42b in which the defect is detected by switching to the degenerate mode when the defect is detected in the application 42b. As a result, it is possible to prevent a defect that occurs in the application 42b of one ECU 4 from adversely affecting the other ECU 4.

<Embodiment 2>
In the in-vehicle system according to the second embodiment, processing such as detection of a defect of the application 42b, search for another ECU 4 having the replacement application 42b, and transmission instruction of the replacement application 42b to the other ECU 4 is performed by GW2. Instead, it is a configuration performed by each ECU 4. The GW2 according to the second embodiment does not include the defect detection unit 21b, the replacement search unit 21c, and the replacement instruction unit 21d, and does not store the replacement table 22b in the storage unit 22. The GW 2 according to the second embodiment performs a communication relay process.

FIG. 9 is a block diagram showing a configuration of the ECU 4 according to the second embodiment. In the ECU 4 according to the second embodiment, when the processing unit 41 executes the program 42a stored in the storage unit 42, in addition to the application execution unit 41a to the mode switching unit 41f, the defect detection unit 41g and the replacement search unit 41h And the replacement instruction unit 41i and the like are provided in the processing unit 41 as software-like functional units. Further, the replacement table 42d is stored in the storage unit 42 of the ECU 4 according to the second embodiment.

The defect detection unit 41g performs a process of detecting a defect related to the application 42b executed by the application execution unit 41a. For example, the defect detection unit 41g monitors the input / output data to the application 42b and determines whether or not there is a defect depending on whether or not the application 42b outputs appropriate data with respect to the input data. Further, for example, the defect detection unit 41g determines the presence or absence of a defect in the data periodically transmitted by the application 42b to the other ECU 4 based on whether or not the transmission cycle is the defined transmission cycle. Further, for example, the defect detection unit 41g determines the presence or absence of a defect based on whether or not the information such as the sensor detection value or the actuator control value included in the data transmitted by the application 42b is within an appropriate range. The method of detecting the defect of the application 42b by the defect detection unit 41g is not limited to the above, and any method may be adopted.

The replacement search unit 41h performs a process of searching for another ECU 4 having the app 42b that can be replaced with respect to the application 42b in which the defect is detected by the defect detection unit 41g. By referring to the replacement table 42d stored in the storage unit 42, the replacement search unit 41h determines whether or not there is an application that can be replaced with the application 42b in which the defect is detected, and another ECU 4 having the replaceable application 42b. Explore.

FIG. 10 is a schematic view showing a configuration example of the replacement table 42d according to the second embodiment. The illustrated replacement table 42d is a replacement table 42d stored in the ECU 4A, and corresponds to a replacement table 22b shown in FIG. 3 in which only information about the ECU 4A is extracted. The replacement table 42d stored in the storage unit 42 by the ECU 4 according to the second embodiment stores information on the replaceable application and other ECUs having the replaceable application 42b only for the application 42b executed by itself as alternative information. ..

Based on the search result of the replacement search unit 41h, the replacement instruction unit 41i gives an instruction to the other ECU 4 having the replaceable application 42b to transmit the replaceable application 42b to the application 42b in which the defect is detected. In response to this instruction, the other ECU 4 reads out the replaceable application 42b stored in the storage unit 42, and transmits the application 42b to the instruction source ECU 4.

That is, in the in-vehicle system according to the second embodiment, each ECU 4 detects a defect of its own application 42b, searches for another ECU 4 having an application 42b that can be replaced with the application 42b in which the defect is detected, and searches for another ECU 4 Is instructed to send the replacement application 42b. The other ECU 4 that has received this instruction transmits its own replaceable application 42b to the supporting ECU 4. The ECU 4 that has received the replaceable application 42b adjusts the parameters based on the parameter 42c stored in the storage unit 42, confirms the operation of the received application 42b, and then replaces it with the application 42b in which the defect is detected. Do.

Since the other configurations of the vehicle-mounted system according to the second embodiment are the same as those of the vehicle-mounted system according to the first embodiment, the same reference numerals are given to the same parts, and detailed description thereof will be omitted.

(Modification example)
In the in-vehicle system according to the first embodiment, the GW2 performs processing such as detection of a defect in the application 42b, search for another ECU 4 having the replacement application 42b, and transmission instruction of the replacement application 42b to the other ECU 4. In the in-vehicle system according to the second embodiment, each ECU 4 performs the operation. These processes are not performed by either the GW 2 or the ECU 4, but the GW 2 and the ECU 4 may cooperate with each other.

In the in-vehicle system according to the modified example, each ECU 4 performs a process of detecting a defect of the application 42b. Further, in the in-vehicle system according to the modified example, the GW 2 performs processing such as searching for another ECU 4 having the replacement application 42b and transmitting an instruction for the replacement application 42b to the other ECU 4. Therefore, the ECU 4 according to the modified example does not have to have, for example, a defect detection unit 41g, a replacement search unit 41h, a replacement instruction unit 41i, and a replacement table 42d. Further, the GW 2 according to the modified example has, for example, a replacement search unit 21c, a replacement instruction unit 21d, and a replacement table 22b, and does not have to have a defect detection unit 21b.

When each ECU 4 according to the modified example detects a defect of the application 42b executed by itself, it switches to the degenerate mode and requests the GW 2 to transmit an application 42b that can be replaced with the application 42b that has detected the defect. Upon receiving this request, the GW 2 according to the modified example searches for another ECU 4 having the application 42b that can be replaced with the application 42b in which the defect is detected, and transmits the application 42b to the other ECU 4 found by the search. Instruct. The requesting ECU 4 that has received the application 42b transmitted by the other ECU 4 adjusts the parameters and confirms the operation of the received application 42b, and detects the problem stored in its own storage unit 42. Replace with the application 42b received from another ECU 4.

In this embodiment, the network configuration shown in FIG. 1, the number of ECUs 4A to 4D mounted, the configuration of the replacement table 22b shown in FIG. 3, the processing procedure shown in FIGS. 5 to 8, and FIG. 10 are shown. The configuration of the substitution table 42d and the like is an example and is not limited to this.

Each device in the in-vehicle system includes a computer including a microprocessor, ROM, RAM, and the like. An arithmetic processing unit such as a microprocessor reads a computer program including a part or all of each step of a sequence diagram or a flowchart as shown in FIGS. 5 to 8 from a storage unit such as a ROM or a RAM and executes the program. You can. The computer programs of these plurality of devices can be installed from an external server device or the like. Further, the computer programs of these plurality of devices are distributed in a state of being stored in a recording medium such as a CD-ROM, a DVD-ROM, or a semiconductor memory, respectively.

The embodiments disclosed this time should be considered as exemplary in all respects and not restrictive. The scope of the present disclosure is indicated by the scope of claims, not the above-mentioned meaning, and is intended to include all modifications within the meaning and scope equivalent to the scope of claims.

1 Vehicle 1a, 1b Communication line 2 GW
4,4A-4D ECU
21 Processing unit 21a Relay processing unit 21b Defect detection unit (detection unit)
21c Substitution search unit (search unit)
21d Replacement indicator (indicator)
22 Storage unit 22a Program 22b Replacement table 23 Communication unit 41 Processing unit (replacement unit)
41a Application execution unit 41b Application transmission unit 41c Application reception unit 41d Parameter adjustment unit (adjustment unit)
41e Operation check unit 41f Mode switching unit 41g Defect detection unit 41h Replacement search unit 41i Replacement instruction unit 42 Storage unit 42a Program 42b App 42c Parameter 43 Communication unit 99 Recording medium

Claims (9)

An in-vehicle system in which multiple in-vehicle devices are connected via a network.
A detection unit that detects a defect related to the program executed by the in-vehicle device, and
A search unit that searches for another in-vehicle device having a program that can be replaced by a program in which the detection unit detects a defect, and a search unit.
It is provided with an instruction unit that instructs the other in-vehicle device searched by the search unit to transmit the alternative program.
The in-vehicle device receives the substitutable program transmitted by the other in-vehicle device in response to the instruction, and replaces the program in which the defect is detected with the substitutable program.
In-vehicle system. The in-vehicle device has an operation confirmation unit for confirming the operation of the received alternative program.
The in-vehicle device replaces the program when normal operation is confirmed by the operation confirmation unit.
The in-vehicle system according to claim 1. The in-vehicle device has an adjusting unit that adjusts parameters used by the received alternative program.
The operation confirmation unit confirms the operation of the substitutable program with the parameters adjusted by the adjustment unit.
The in-vehicle system according to claim 2. The vehicle-mounted system according to any one of claims 1 to 3, wherein the vehicle-mounted device having a program in which a defect is detected limits a part of the functions of the program. Equipped with a relay device that relays communication between multiple in-vehicle devices
The relay device has the detection unit, the search unit, and the instruction unit.
The in-vehicle system according to any one of claims 1 to 4. The in-vehicle device has the detection unit, the search unit, and the instruction unit.
The in-vehicle system according to any one of claims 1 to 4. A relay device that relays communication between multiple in-vehicle devices.
Equipped with a processing unit
The processing unit
Detecting a defect related to the program executed by the in-vehicle device,
Search for other in-vehicle devices that have a program that can replace the program in which the defect was detected.
Instructing the searched other in-vehicle device to transmit the alternative program.
Relay device. An in-vehicle device connected to another in-vehicle device via a network.
Equipped with a processing unit
The processing unit
Detects a defect related to the program to be executed
Search for other in-vehicle devices that have a program that can replace the program in which the defect was detected.
Instructing the searched other in-vehicle device to transmit the alternative program,
Upon receiving the substitutable program transmitted by the other in-vehicle device in response to the instruction, the program in which the defect is detected is replaced with the substitutable program.
In-vehicle device. Detects a defect related to the program executed by the in-vehicle device and detects it.
Search for other in-vehicle devices that have a program that can replace the program in which the defect was detected.
Instructing the searched other in-vehicle device to transmit the alternative program,
The in-vehicle device receives the substitutable program transmitted by the other in-vehicle device in response to the instruction, and replaces the program in which the defect is detected with the substitutable program.
Program replacement method.

Images