JP5989190B1 - Gateway and in-vehicle software update system using the same - Google Patents

Abstract

A gateway for controlling an update so as not to cause inconsistency between SWs even when the SW of an in-vehicle apparatus is interrupted by the update SW is interrupted. By transmitting configuration information of the in-vehicle device and the in-vehicle software collected from the in-vehicle device by the configuration management unit 205 to the server 500, update software candidates and their dependency information are acquired from the server 500, and based on this information Then, the dependency relationship resolution unit 206 extracts update software to be distributed to the in-vehicle device from the update software candidates based on the configuration information, further generates a dependency group of the update software, and the SW update control unit 208 causes the in-vehicle device to When the interruption control unit 204 accepts an operation for interrupting the user's update processing during the update, the dependency control unit 207 determines that the update software in the dependency group is being updated. Control to not interrupt the update. [Selection] Figure 1

Description

  The present invention relates to a gateway that acquires update software from a server mounted on a vehicle and connected via a network and updates the in-vehicle software of the in-vehicle device, and an in-vehicle software update system using the gateway.

The in-vehicle software (hereinafter referred to as SW) update function sends an update SW from the cloud to the vehicle by a method such as wireless update using wireless communication or external storage device update using an external storage device, and updates the SW of the in-vehicle device. Platform.
As an example of use, it is assumed that SW having an improved algorithm from the time of shipment is distributed after shipment, thereby improving the performance of existing SW control or adding a new function.
For example, Patent Document 1 describes a method for updating a SW whose size is so large that it is difficult to update the SW due to a communication band by using another high-speed communication path and an external storage device in wireless communication. ing.
Patent Document 2 describes a method of extracting not only the SW to be updated but also the SW having a dependency relationship, distributing the SW from the server to the terminal, and installing in the order according to the dependency relationship.

JP2013-125517A (pages 6-11, FIG. 2) JP 2001-67232 A (pages 3 to 8, FIG. 1)

However, in Patent Document 1 and Patent Document 2, the SW update may be interrupted for the convenience of the user, and in the case of a system that is coordinated and controlled by a plurality of in-vehicle devices and programs, only a part is updated. There is a problem that inconsistency occurs.
Another problem is that wireless SW updates from the external storage device and the server are not linked, and inconsistency occurs due to wireless update during update processing in the external storage device.

  The present invention has been made to solve the above-described problems, and controls updating so as not to cause inconsistency between SWs even when interrupted during the updating of the SW of the in-vehicle device by the updating SW. An object is to obtain a gateway and an in-vehicle software update system using the gateway.

  The gateway according to the present invention is a gateway that acquires update software from a server that is mounted on a vehicle and connected via a network, and updates the in-vehicle software of the in-vehicle device mounted on the vehicle. A configuration holding unit that collects and holds the configuration information of the in-vehicle software of the in-vehicle device, and the configuration information held by the configuration holding unit is transmitted to the server, so that the update software candidates for the in-vehicle software from the server and the dependency information thereof Dependent on using the information acquired from this server and selecting update software to be used for in-vehicle software update from the update software candidates based on the configuration information, and generating a group of update software with dependencies Relationship generation unit interrupts user update processing An interruption operation was performed in the interruption control unit during the updating of the in-vehicle software of the in-vehicle device by the update software, the update control unit for updating the in-vehicle software in the group by the update software, and the update software in the group by the update control unit In this case, a dependency control unit that controls the update so as not to be interrupted is provided.

  According to the present invention, there is provided a gateway for acquiring update software from a server mounted on a vehicle and connected via a network, and updating the in-vehicle software of the in-vehicle device mounted on the vehicle. Collects configuration information of the in-vehicle software of the device, stores the configuration information that is retained, and transmits the configuration information retained by the configuration retention unit to the server, thereby obtaining information about update software candidates for the in-vehicle software and their dependency relationships Then, using the information acquired from this server, based on the configuration information, select the update software to be used for updating the in-vehicle software from the update software candidates, and generate dependency groups that generate dependency update software groups Accepting operations to interrupt user update processing The control unit, the update control unit that updates the in-vehicle software of the in-vehicle device using the update software, and the update control unit interrupts the update if an interruption operation is performed in the interruption control unit while updating the update software in the group Since the dependence control unit that controls so as not to be included is provided, the update can be controlled so as not to cause inconsistency between the software even when interrupted during the update of the software of the in-vehicle device by the update software.

It is a block diagram which shows the vehicle-mounted software update system by Embodiment 1 of this invention. It is a flowchart which shows operation | movement of the vehicle-mounted software update system by Embodiment 1 of this invention. It is a block diagram which shows the vehicle-mounted software update system by Embodiment 2 of this invention. It is a flowchart which shows operation | movement of the vehicle-mounted software update system by Embodiment 2 of this invention. It is a block diagram which shows the vehicle-mounted software update system by Embodiment 3 of this invention. It is a flowchart which shows operation | movement of the vehicle-mounted software update system by Embodiment 3 of this invention.

Embodiment 1 FIG.
The first embodiment performs update control so that in-vehicle SW mismatch does not occur in response to a user's interruption operation.
Further, in order not to cause inconsistency in the dependency relationship of the in-vehicle SW, it is configured to select which method is executed so that the SW is not updated by the wireless update during the update process by the external storage device.

FIG. 1 is a configuration diagram showing an in-vehicle software update system according to Embodiment 1 of the present invention.
In FIG. 1, a vehicle 100 is a vehicle in which a gateway 200 and in-vehicle devices 300 and 400 are connected to each other via a network such as a CAN (Controller Area Network).
The in-vehicle devices 300 and 400 hold configuration information such as the identifier and SW of the in-vehicle device, communicate with the gateway 200, transmit configuration information, receive an update SW, and update SW.
The communication device 600 is a computer such as a personal computer that can communicate with the outside of the communication device using communication means such as Ethernet (registered trademark).
The server 500 is a computer that can communicate with the outside of the server by communication means such as Ethernet (registered trademark), for example, a server computer in a data center.
The network 700 is a communication network such as the Internet that enables vehicles and computers to communicate with each other by communication means such as Ethernet (registered trademark), a wide area communication network, and a mobile phone network.
The vehicle 100 and the communication device 600 can communicate with the server 500 via the network 700.

Next, an in-vehicle device included in the vehicle 100 will be described.
The gateway 200 is an in-vehicle device that performs communication control with the outside of a vehicle connected by a communication method such as a mobile phone network and communication control between in-vehicle devices inside the vehicle connected by a network such as CAN.
The in-vehicle device 300 is a control device that controls devices such as an engine, for example.
The in-vehicle device 400 is a control device that controls devices such as a power window, for example.
The in-vehicle devices 300 and 400 are not limited to the above-described control, and may be any control in the vehicle.
Moreover, the vehicle-mounted apparatus which the vehicle 100 has is not limited to the above, and may be three or more.

Next, functions of the gateway 200 will be described.
The communication unit 201 is a communication device or a communication chip that communicates with an external device via the network 700 and transmits / receives data.
The update selection unit 202 is a storage device that stores a program for selecting which of wireless update and external storage device update is used, and its setting.
The external storage device read / write unit 203 is a device that writes data to an external storage device such as an SD card and reads data from the external storage device.
The interruption control unit 204 is an apparatus and a program that accepts an interruption operation including an apparatus such as a switch or a program that accepts an operation in which the user interrupts the SW update process.
The configuration management unit 205 (configuration holding unit) is a program that collects and holds information on the configuration of the in-vehicle device included in the vehicle 100 and the configuration of the SW on the in-vehicle device.

The dependency relationship resolution unit 206 (dependency relationship generation unit) extracts the update SW to be distributed to the in-vehicle device from the configuration of the SW on the in-vehicle device, and the update candidate SW (update software candidate) and the information on the dependency relationship. This is a program that sets a related update SW as a dependency group.
The dependency control unit 207 is a program that controls to prevent the processing of the dependency group of the update SW from being interrupted.
The SW update control unit 208 is a program that operates an SW update protocol such as ISO 13400 of the in-vehicle device.
The in-vehicle communication unit 209 is a communication chip that controls network communication in the vehicle and transmits / receives data to / from a communication target in-vehicle device.

Next, functions of the communication device 600 will be described.
The communication unit 601 is a communication device or a communication chip that communicates with an external device via the network 700 and transmits / receives data.
The external storage device read / write unit 602 is a device that writes data to an external storage device such as an SD card and reads data from the external storage device.

Next, functions of the server 500 will be described.
The update SW storage unit 501 is a storage device that stores an update SW database composed of update SWs and dependency information thereof, and distributes requested update SWs in response to acquisition requests.
The communication unit 502 is a communication device or a communication chip that communicates with an external device via the network 700 and transmits / receives data.

Next, the operation of the first embodiment will be described.
FIG. 2 shows an example of an operation in which the vehicle in the first embodiment updates the SW of the in-vehicle device by wireless update from the server or external storage device update.
Hereinafter, a description will be given with reference to FIG.
With the start of an event such as time or ignition on, the configuration management unit 205 of the gateway 200 collects configuration information such as a vehicle body number, information on the in-vehicle device and SW from the in-vehicle devices 300 and 400 (S100). At this time, the configuration management unit 205 may inquire the configuration information to the in-vehicle devices 300 and 400 through the in-vehicle communication unit 209, or may use the configuration information stored in the previous SW update. .
Next, the update selection unit 202 determines whether to perform wireless update or external storage device update (S101). The update selection unit 202 may store information selected by the user in the gateway 200 in advance, or may inquire the user each time.

In the case of updating the external storage device (No in S101), the external storage device read / write unit 203 writes the configuration information to the external storage device previously inserted in the gateway 200 (S102).
Next, the user inserts the external storage device into the communication device 600. The external storage device read / write unit 602 reads configuration information from the external storage device, transmits the configuration information to the server 500 through the communication unit 601, and requests acquisition of the update candidate SW (S103).
The server 500 receives configuration information via the communication unit 502. The update SW storage unit 501 extracts dependency relationship information indicating update candidate SWs and other SWs that cooperate when they cooperate from the update SW database and the configuration information (S104). At this time, for example, all the SWs corresponding to the vehicle body number may be extracted as the update candidate SWs, or all the SWs corresponding to the in-vehicle devices may be extracted.

Next, the communication device 600 acquires the update candidate SW and dependency relationship information from the server 500 through the communication unit 502 and the communication unit 601, and writes them to the external storage device through the external storage device read / write unit 602 (S105). At this time, the current configuration information of the vehicle 100 may be left in the external storage device for verification.
The user inserts the external storage device into the gateway 200, and the vehicle 100 acquires the update candidate SW and the dependency relationship information from the external storage device by the external storage device read / write unit 203 (S106).
Next, the dependency relationship resolution unit 206 matches the current SW configuration of the in-vehicle device acquired from the configuration management unit 205 with the dependency relationship information of the update candidate SW acquired from the external storage device read / write unit 203, and updates the SW. A dependency group is generated by extracting and grouping the updated SWs in the dependency relationship (S107). Thus, the dependency relationship of the update SW in the present invention is solved.
At this time, the dependency relationship resolution unit 206 matches the configuration information of the vehicle 100 stored in the external storage device in advance with the configuration information acquired from the configuration management unit 205, and the update SW of the external storage device is correct. It may be verified whether or not.

In the case of wireless update (Yes in S101), the communication unit 201 transmits the configuration information to the server 500, and requests acquisition of only the update candidate SW information (S108).
The server 500 receives the configuration information via the communication unit 502, and the update SW storage unit 501 extracts the update candidate SW information and its dependency information from the update SW database and the configuration information, and transmits them to the vehicle 100. (S109).
The vehicle 100 receives the update candidate SW information and the dependency relationship information via the communication unit 201 of the gateway 200. The dependency relationship resolution unit 206 extracts the SW to be updated from the information of the update candidate SW, the dependency relationship information, and the configuration information, and also generates a dependency group of the update SW (S110). At this time, when the size of the update SW is large, the wireless update may be stopped and switched to the external storage device update.
Next, the dependency relationship resolution unit 206 requests the server 500 via the communication unit 201 to acquire the extracted SW (S111), and the server 500 receives the request via the communication unit 502, The corresponding update SW is extracted from the update SW storage unit 501 and transmitted to the vehicle 100 (S112).

The dependency control unit 207 of the gateway 200 sequentially sends the update SW to the SW update control unit 208 from the update SW acquired from the dependency relationship resolution unit 206 and the information on the dependency relationship group, and according to a predetermined protocol, 400 SW is updated (S113).
The interruption control unit 204 checks whether there is an interruption operation by the user sequentially during the update (S114).
When the suspension control unit 204 confirms the suspension operation (Yes), the dependency control unit 207 confirms whether or not the update SW being updated is in a dependency group associated with a plurality of update SWs (S115). If it is in the dependency group (Yes), the dependency control unit 207 does not accept the interruption. Or you may interrupt after updating all the update SW of a dependency group.
In S115, when it is not in the dependency group (No), the process is immediately terminated.
In S114, when there is no interruption operation, the dependency control unit 207 confirms whether or not all the update SWs are written in the in-vehicle device (S116). When the update is completed (Yes), the update process is terminated. If the update SW remains (No), the update process is continued.

According to the first embodiment, with the above configuration, since the user sets either external storage device update or wireless update, wireless update does not occur during external storage device update, and external storage device update and wireless update are performed. It is possible to prevent the inconsistency of the SW of the in-vehicle device due to the two types of update methods.
In addition, even if the user performs an interruption operation during the update, it is possible to prevent the SW mismatch of the in-vehicle device from occurring.

Embodiment 2. FIG.
The second embodiment relates to an example of a configuration in which the server 500 includes the dependency relationship resolution unit 206 in the first embodiment.
FIG. 3 is a block diagram showing an in-vehicle software update system according to Embodiment 2 of the present invention.
3, reference numerals 100, 200 to 205, 207 to 209, 300, 400, 500 to 502, and 600 to 602 are the same as those in FIG. In FIG. 3, the dependency relationship resolution unit 206 is provided in the server 500.

Next, the operation of the second embodiment will be described.
FIG. 4 shows an example of an operation in which the vehicle updates the SW of the in-vehicle device by wireless update or external storage device update from the server in the second embodiment.
In FIG. 4, S100 to S103, S108, and S111 to S116 are the same operations as those in FIG. In FIG. 4, operations S204 to S206 are inserted after S103, and operations S209 and S210 are inserted after S108.
In the case of external storage device update (No in S101), the server 500 passes the configuration information acquired through the communication unit 502 to the dependency relationship resolution unit 206. The dependency relationship resolution unit 206 acquires the update SW database and configuration information of the update SW storage unit 501, extracts the update SW, and generates its dependency relationship group (S204).

Next, the server 500 transmits the update SW and its dependency group to the communication device 600 via the communication unit 502. The communication device 600 receives the update SW and its dependency group through the communication unit 601, and the external storage device read / write unit 602 writes the update SW and its dependency group to the external storage device (S205).
The user takes out the external storage device from the communication device 600 and inserts it into the gateway 200 of the vehicle 100. The vehicle 100 reads the update SW and its dependency group by the external storage device read / write unit 203 (S206).

In the case of wireless update (Yes in S <b> 101), the server 500 passes the configuration information acquired through the communication unit 502 to the dependency relationship resolution unit 206. The dependency relationship resolution unit 206 acquires the update SW database and configuration information of the update SW storage unit 501, extracts the update SW, and generates a dependency group thereof (S209).
Next, the server 500 transmits the update SW and its dependency group to the vehicle 100 via the communication unit 502. The vehicle 100 receives information on the update SW and its dependency group via the communication unit 201 of the gateway 200 (S210).
The operation of S206 continues to S113, and the operation of S210 continues to S111.

According to the second embodiment, with the above configuration, it is not necessary to perform the processing for solving the dependency relationship in the vehicle, and the calculation capability of the in-vehicle device of the vehicle can be saved.
In addition, it is sufficient to transmit and receive only the minimum necessary data in the case of updating the external storage device, and the communication load and cost can be reduced.

Embodiment 3 FIG.
The third embodiment relates to an example of a configuration that prevents the occurrence of SW inconsistency without setting whether the user performs wireless update or external storage device update.
FIG. 5 is a block diagram showing an in-vehicle software update system according to Embodiment 3 of the present invention.
In FIG. 5, reference numerals 100, 200, 201, 203 to 209, 300, 400, 500 to 502, and 600 to 602 are the same as those in FIG. In FIG. 5, vehicle 100 is provided with matching unit 210 in gateway 200 except for update selection unit 202 from the configuration of the first embodiment. The matching unit 210 compares the configuration information of the current vehicle 100 with the configuration information at the time of transmission to the server 500, and if different, matches the configuration information of the current vehicle 100 with the dependency group information of the update SW. This is a program for extracting an update SW having no dependency in the current SW.

Next, the operation of the third embodiment will be described.
FIG. 6 shows an example of an operation in which the vehicle updates the SW of the in-vehicle device by wireless update or external storage device update from the server in the third embodiment.
In FIG. 6, S100 and S102 to S116 are the same operations as those in FIG.
In FIG. 6, S301 is inserted after S100, and S308 is inserted after S107.

The external storage device read / write unit 203 of the gateway 200 checks whether or not an external storage device is inserted (S301).
If an external storage device has been inserted (Yes), the operations from S102 to S107 are performed.
After that, the matching unit 210 of the gateway 200 acquires the configuration information of the external storage device and the current configuration information of the vehicle 100 anew, matches, confirms whether there is a change in the configuration information, and if there is a change Then, an update SW having no dependency in the current SW is extracted (S308).
When wireless update is performed while updating the external storage device, the configuration information of the external storage device may be different from the current configuration information of the vehicle 100. At this time, the matching unit 210 stops updating the external storage device. Alternatively, only the update SW whose update SW dependency relationship does not become inconsistent is extracted, transferred to the dependency control unit 207, and updated in the same manner as in the first embodiment.
At this time, the user may be notified that some or all of the update SWs cannot be updated.

  According to the third embodiment, with the above configuration, the user is prevented from generating SW inconsistency while selecting a feasible update method without particularly setting whether to update the external storage device or wirelessly. be able to.

  It should be noted that the present invention can be freely combined with each other within the scope of the invention, and each embodiment can be appropriately modified or omitted.

100 vehicle, 200 gateway, 201 communication unit, 202 update selection unit,
203 external storage device read / write unit, 204 interruption control unit, 205 configuration management unit,
206 dependency relationship resolution unit, 207 dependency control unit, 208 SW update control unit,
209 in-vehicle communication unit, 210 matching unit, 300 in-vehicle device, 400 in-vehicle device,
500 server, 501 update SW storage unit, 502 communication unit, 600 communication device,
601 Communication unit, 602 External storage device read / write unit, 700 network

Claims (6)

A gateway that is installed in a vehicle and acquires update software from a server connected via a network, and updates the in-vehicle software of the in-vehicle device installed in the vehicle,
A configuration holding unit that collects and holds configuration information of the in-vehicle device and the in-vehicle software of the in-vehicle device;
By transmitting the configuration information held by the configuration holding unit to the server, the update software candidates for the in-vehicle software and the dependency information thereof are acquired from the server, and the information acquired from the server is used. Based on the configuration information, a dependency generation unit that selects update software to be used for updating the in-vehicle software from the update software candidates and generates a group of update software having a dependency relationship;
An interruption control unit that accepts an operation to interrupt the user update process,
An update control unit for updating the in-vehicle software of the in-vehicle device by the update software;
And a dependency control unit that controls the updating not to be interrupted when an interruption operation is performed in the interruption control unit while the update software in the group is being updated by the update control unit. gateway.   The gateway according to claim 1, further comprising an update selection unit configured to select one of an update of the in-vehicle software of the in-vehicle device using an external storage device and an update of the in-vehicle software using radio.   When the configuration information sent to the server and the configuration information collected from the in-vehicle device anew when the updated software is received from the server and the two configuration information are different, It is provided with a matching unit that stops updating all of the updated software or extracts only the updated software that does not have inconsistent dependencies and passes it to the dependency control unit to update only the extracted updated software. The gateway according to claim 1, wherein: A gateway that is installed in a vehicle and acquires update software from a server connected via a network, and updates the in-vehicle software of the in-vehicle device installed in the vehicle,
A configuration holding unit that collects and holds configuration information of the in-vehicle device and the in-vehicle software of the in-vehicle device;
Using the information on the update software and the group of update software having a dependency relationship with the on-vehicle software acquired from the server by transmitting the configuration information held by the configuration holding unit to the server, the on-vehicle device Update control unit that updates the in-vehicle software
An interruption control unit that accepts an operation to interrupt the user update process,
And a dependency control unit that controls the updating not to be interrupted when an interruption operation is performed in the interruption control unit while the update software in the group is being updated by the update control unit. gateway. The gateway according to any one of claims 1 to 3,
In addition, the update software connected to the gateway via the network and used to update the in-vehicle software of the in-vehicle device and the dependency information thereof are stored, and the in-vehicle is installed based on the configuration information transmitted from the gateway. An in-vehicle software update system comprising a server for extracting information on the update software candidate and its dependency relationship for updating software. The gateway according to claim 4,
In addition, the update software connected to the gateway via the network and used to update the in-vehicle software of the in-vehicle device and the dependency information thereof are stored, and the in-vehicle is installed based on the configuration information transmitted from the gateway. A server for extracting information about software update candidates and their dependency relationships for updating software;
The server
Based on the configuration information, the update software candidate and the dependency information thereof are used to select update software to be used for updating the in-vehicle software from the update software candidate, and a group of update software having a dependency relationship is selected. An in-vehicle software update system comprising a dependency generation unit for generating.

Images