JP6394678B2 - Control device, control program update determination method, and computer program - Google Patents

Description

The present invention relates to a control device, a method for determining whether a control program can be updated, and a computer program.

In recent years, in the technical field of automobiles, functions of vehicles have been advanced, and a wide variety of in-vehicle devices are mounted on vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are control devices for controlling each in-vehicle device, are mounted on the vehicle.
The types of ECUs include, for example, those related to the traveling system that controls the engine, brakes, EPS (Electric Power Steering), etc. for the operation of the accelerator, brake, and steering wheel, the interior lighting and the head according to the switch operation by the occupant There are body-type ECUs that control the turning on / off of lights and the sounding of alarms, and the meter-type ECUs that control the operation of meters arranged near the driver's seat.

In general, the ECU is configured by an arithmetic processing device such as a microcomputer, and the control of the in-vehicle device is realized by reading and executing a control program stored in a ROM (Read Only Memory).
The control program of the ECU may differ depending on the destination and grade of the vehicle, and it is necessary to rewrite the old version control program to the new version control program in response to the upgrade of the control program.

For example, in Patent Document 1, when it is necessary to update an ECU control program, a travel route in which the ECU does not execute control processing is set, and when the vehicle is traveling along this travel route, the ECU control processing is performed. There is disclosed a vehicle control device that determines that the ECU does not perform the program update of the ECU.
According to the vehicle control device of Patent Document 1, since the program update is executed when the vehicle travels without ECU control processing, the program update can be executed early.

JP 2011-79486 A

In the vehicle control device disclosed in Patent Document 1, a travel route that satisfies conditions (such as vehicle travel conditions, road conditions, and surrounding environmental conditions) in which the control function of the ECU to be updated does not operate is set. Program update is performed while driving.
Accordingly, since the program is updated during traveling, a traveling route that is not assumed by the user of the vehicle may be set, which may cause the user to feel bothered.

  In view of such conventional problems, the present invention provides a control device and the like that can appropriately determine whether or not a control program can be updated during vehicle travel without setting a travel route in which the vehicle control device does not execute the control function. For the purpose.

  (1) An apparatus according to an aspect of the present invention is an apparatus that controls update of a control program of an in-vehicle control device that controls a target device mounted in a vehicle, and the control function of the in-vehicle control device during vehicle travel An acquisition unit for acquiring the usage pattern, and a control unit for determining whether or not the control program for the in-vehicle control device can be updated based on the acquired usage pattern.

  (6) A method according to an aspect of the present invention is a method of controlling update of a control program of an in-vehicle control device that controls a target device mounted on a vehicle, and the control function of the in-vehicle control device during vehicle travel And a step of determining whether or not the control program can be updated based on the acquired usage pattern.

  (7) A computer program according to an aspect of the present invention is a computer program for causing a computer to function as a control device that controls updating of a control program of an in-vehicle control device that controls a target device mounted on a vehicle. The computer functions as an acquisition unit that acquires a usage pattern of a control function of the in-vehicle control device when the vehicle is traveling, and a control unit that determines whether the control program can be updated based on the acquired usage pattern. Let

  ADVANTAGE OF THE INVENTION According to this invention, even if it does not set the driving | running route which does not perform a control function, a vehicle control apparatus can determine appropriately whether the control program can be updated during vehicle driving | running | working.

1 is an overall configuration diagram of a program update system according to an embodiment of the present invention. It is a block diagram which shows the internal structure of a gateway. It is a block diagram which shows the internal structure of ECU. It is a block diagram which shows the internal structure of a management server. It is a sequence diagram which shows an example of the update of the control program with respect to object ECU. It is a flowchart which shows an example of the determination process of repro execution availability. It is explanatory drawing which shows an example of the production | generation process of a usage pattern.

<Outline of Embodiment of the Present Invention>
Hereinafter, an outline of embodiments of the present invention will be listed and described.
(1) The control device according to the present embodiment is a control device that determines whether or not a control program of a plurality of types of on-vehicle control devices that control target devices mounted on a vehicle can be updated. an acquisition unit that acquires for each of the vehicle control device corresponding availability control functions, based on the amount of the acquired availability, control for determining the updatability of the control program for the vehicle control apparatus A section.

According to the control device of the present embodiment, the acquisition unit acquires the availability of the control function of the in-vehicle control device when the vehicle is traveling for each corresponding in-vehicle control device, and the control unit acquires a large amount of availability. Therefore, it is determined whether the control program can be updated or not while the vehicle is running without setting a travel route in which the on-vehicle control device does not execute the control function. can do.

( 2 ) More specifically, the control unit determines that the control program can be updated when the availability is equal to or less than a predetermined threshold.
Therefore, it is possible to prevent the user from feeling inconvenient by being recommended to update the control program of the in-vehicle control device corresponding to the control function while the user is using a certain control function. .

(3) control device of this embodiment, the on availability, it is preferred to include the set availability for each identification information of the user may operate the vehicle.
In this case, the control unit can execute whether or not the control program of the in-vehicle control device can be updated based on the availability for each user. Therefore, the update process by the in-vehicle control device can be permitted at an appropriate timing that the user does not feel inconvenient.

( 4 ) In the control device of the present embodiment, it is preferable that the identification information of the user includes identification information when the vehicle is in automatic driving.
In this way, it is possible to determine whether or not the control program for the in-vehicle control device can be updated based on the degree of availability even for a vehicle that is operating automatically.

( 5 ) The control method of the present embodiment relates to a method for determining whether or not the control program can be updated, which is executed by the control device according to any one of (1) to ( 4 ) described above.
Therefore, the control method of the present embodiment has the same effects as the control device described in any one of (1) to ( 4 ) above.

( 6 ) The computer program of this embodiment is related with the computer program for functioning a computer as a control apparatus in any one of said (1)-( 4 ).
Therefore, the computer program of this embodiment has the same operational effects as the control device described in any one of (1) to ( 4 ) above.

<Details of Embodiment of the Present Invention>
Hereinafter, details of embodiments of the present invention will be described with reference to the drawings. In addition, you may combine arbitrarily at least one part of embodiment described below.

[Overall system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to an embodiment of the present invention.
As shown in FIG. 1, the program update system of this embodiment includes a vehicle 1, a management server 5, and a DL (download) server 6 that can communicate via a wide area communication network 2.
The management server 5 and the DL server 6 are operated by, for example, a car manufacturer of the vehicle 1 and can communicate with a large number of vehicles 1 owned by a user who is registered as a member in advance.

Each vehicle 1 is equipped with a gateway 10, a wireless communication unit 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the respective ECUs 30.
Each vehicle 1 has a communication group of a plurality of ECUs 30 that are bus-connected to a common in-vehicle communication line, and the gateway 10 relays communication between the communication groups. Therefore, a plurality of in-vehicle communication lines are connected to the gateway 10.

The wireless communication unit 15 is communicably connected to a wide area communication network 2 such as a mobile phone network, and is connected to the gateway 10 via an in-vehicle communication line. The gateway 10 transmits the information received by the wireless communication unit 15 from the vehicle external devices such as the management server 5 and the DL server 6 to the ECU 30 through the wide area communication network 2.
The gateway 10 transmits information acquired from the ECU 30 to the wireless communication unit 15, and the wireless communication unit 15 transmits the information to an external device such as the management server 5.

Examples of the wireless communication unit 15 mounted on the vehicle 1 include devices such as a mobile phone, a smartphone, a tablet terminal, and a notebook PC (Personal Computer) owned by the user.
In FIG. 1, the case where the gateway 10 communicates with an external device via the wireless communication unit 15 is illustrated, but when the gateway 10 has a wireless communication function, the gateway 10 itself is a management server 5 or the like. It is good also as a structure which performs radio | wireless communication with an external device.

  Further, in the program update system of FIG. 1, the management server 5 and the DL server 6 are configured as separate servers, but the servers 5 and 6 may be configured as a single server device.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing the internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected to the wireless communication unit 15 via the in-vehicle communication line, but these may be configured by one device.

The CPU 11 causes the gateway 10 to function as a relay device for various information by reading one or more programs stored in the storage unit 13 into the RAM 12 and executing them.
The CPU 11 can execute a plurality of programs in parallel, for example, by switching and executing a plurality of programs in a time division manner.

The CPU 11 includes one or a plurality of large scale integrated circuits (LSIs). In the CPU 11 including a plurality of LSIs, the plurality of LSIs cooperate to realize the function of the CPU 11.
The RAM 12 is composed of a memory element such as SRAM (Static RAM) or DRAM (Dynamic RAM), and temporarily stores programs executed by the CPU 11, data necessary for execution, and the like.

The computer program executed by the CPU 11 can be transferred while being recorded on a known recording medium such as a CD-ROM or DVD-ROM, or can be transferred by information transmission (downloading) from a computer device such as a server computer. You can also.
The same applies to a computer program executed by a CPU 31 (see FIG. 3) of an ECU 30 described later and a computer program executed by a CPU 51 (see FIG. 4) of a management server 5 described later.

The storage unit 13 includes a nonvolatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory).
The storage unit 13 has a storage area for storing programs executed by the CPU 11, data necessary for execution, and the like. The storage unit 13 also stores an update program for each ECU 30 received from the DL server 6.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1. The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark). Communication with the ECU 30 is performed according to the standard.
The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11. The in-vehicle communication unit 14 may communicate according to other communication standards used for the in-vehicle network as well as the above communication standards.

The wireless communication unit 15 includes a wireless communication device including an antenna and a communication circuit that performs transmission / reception of a wireless signal from the antenna. The wireless communication unit 15 can communicate with an external device by being connected to a wide area communication network 2 such as a mobile phone network.
The wireless communication unit 15 transmits information given from the CPU 11 to an external device such as the management server 5 via the wide area communication network 2 formed by a base station (not shown), and receives information received from the external device to the CPU 11. give.

Instead of the wireless communication unit 15 illustrated in FIG. 2, a wired communication unit that functions as a relay device in the vehicle 1 may be employed. The wired communication unit has a connector to which a communication cable conforming to a standard such as USB (Universal Serial Bus) or RS232C is connected, and performs wired communication with another communication apparatus connected via the communication cable.
When another communication device and an outside device such as the management server 5 are capable of wireless communication through the wide area communication network 2, the outside of the vehicle depends on the communication path of the outside device → another communication device → the wired communication unit → the gateway 10. The apparatus and the gateway 10 can communicate with each other.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing an internal configuration of the ECU 30.
As shown in FIG. 3, the ECU 30 includes a CPU 31, a RAM 32, a storage unit 33, a communication unit 34, and the like. The ECU 30 is an in-vehicle control device that individually controls target devices mounted on the vehicle 1. The types of ECU 30 include, for example, a travel system ECU related to an engine, a brake and a steering function, a body system control ECU such as a headlight and a door lock, and an automatic travel system ECU such as a lane keep assist.

The CPU 31 controls the operation of the target device that it is in charge of by reading one or more programs stored in advance in the storage unit 33 into the RAM 32 and executing them. The CPU 31 includes one or a plurality of large scale integrated circuits (LSIs). In the CPU 31 including a plurality of LSIs, the functions of the CPU 31 are realized by the cooperation of the plurality of LSIs.
The RAM 32 is composed of a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 31, data necessary for execution, and the like.

The storage unit 33 is configured by a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The information stored in the storage unit 33 includes, for example, a computer program (hereinafter referred to as “control program”) for causing the CPU 31 to execute information processing for controlling a target device that is a control target in the vehicle.

The communication unit 34 is connected to the gateway 10 via an in-vehicle communication line disposed in the vehicle 1. The communication unit 34 communicates with the gateway 10 according to a standard such as CAN, Ethernet, or MOST.
The communication unit 34 transmits the information given from the CPU 31 to the gateway 10 and gives the information received from the gateway 10 to the CPU 31. The communication unit 34 may communicate according to other communication standards used for the in-vehicle network, in addition to the above communication standards.

The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode by the CPU 31 to either “normal mode” or “reprogramming mode” (hereinafter also referred to as “repro mode”).
Here, the normal mode is a control mode in which the CPU 31 of the ECU 30 executes an original control on the target device (for example, engine control on the fuel engine, door lock control on the door lock motor, etc.).

The reprogramming mode is a control mode in which a control program used for controlling the target device is updated.
That is, the reprogramming mode is a control mode in which the CPU 31 erases or rewrites the control program in the ROM area of the storage unit 33. Only in this control mode, the CPU 31 can update the control program stored in the ROM area of the storage unit 33 to a new version.

When the CPU 31 writes the new version of the control program in the storage unit 33 in the repro mode, the activation unit 35 once restarts (resets) the ECU 30 and executes the verify process on the storage area in which the new version of the control program is written. .
The activation unit 35 causes the CPU 31 to operate according to the updated control program after the above-described verification processing is completed.

[Management Server internal configuration]
FIG. 4 is a block diagram showing the internal configuration of the management server 5.
As shown in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads out one or more programs stored in advance in the ROM 52 to the RAM 53 and executes them, thereby controlling the operation of each hardware and causing the management server 5 to function as an external device that can communicate with the gateway 10. The CPU 51 includes one or a plurality of large scale integrated circuits (LSIs). In the CPU 51 including a plurality of LSIs, the functions of the CPU 51 are realized by the cooperation of the plurality of LSIs.
The RAM 53 is configured by a memory element such as SRAM or DRAM, and temporarily stores programs executed by the CPU 51 and data necessary for execution.

The storage unit 54 includes a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 includes a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to the wide area communication network 2 such as a mobile phone network to execute the communication processing. The communication unit 55 transmits the information given from the CPU 51 to the external device via the wide area communication network 2 and gives the information received via the wide area communication network 2 to the CPU 51.

The information stored in the storage unit 54 includes a service management table (not shown) for managing personal information of a registered member user, version information of a control program executed by the ECU 30 mounted on the vehicle 1, and the like. Is included.
For example, the service management table is a reference that summarizes the vehicle identification number (VIN) of the vehicle 1 owned by the registered member, the type of the ECU 30 for each vehicle identification number, and the history of version information of the control program executed by each ECU 30. It consists of a table.

The DL server 6 stores an update program for each version of the control program executed by the ECU 30 for all types of ECUs 30.
The update program held by the DL server 6 may be the latest version of the control program to be installed in the ECU 30, or a difference program (hereinafter referred to as a difference program) between the old version control program and the new version control program. The update program may be described as “Δ”).

The gateway 10 of the vehicle 1 transmits a communication packet including version information of the control program being used by the ECU 30 mounted on the host vehicle and the vehicle identification number of the host vehicle to the management server 5 every predetermined time. .
The CPU 51 of the management server 5 determines whether or not the version information of the control program included in the communication packet received from the gateway 10 is the latest version with reference to the service management table.

If the version information of the control program notified from the gateway 10 is not the latest as a result of the determination, the CPU 51 transmits a communication packet including the URL of the DL server 6 that is the storage destination of the update program to the gateway 10.
The gateway 10 that has received the communication packet transmits a download request including the URL notified from the management server 5 and the type of the ECU 30 to be reprogrammed to the DL server 6.

The DL server 6 that has received the download request transmits an update program corresponding to the type of the ECU 30 notified from the gateway 10 to the gateway 10 that is the transmission source of the download request.
The CPU 31 of the gateway 10 that has received the update program transfers the received update program to the ECU 30 and causes the ECU 30 to execute processing for updating the control program to the latest version.

[Control program update sequence]
FIG. 5 is a sequence diagram illustrating an example of control program update for the target ECUs 30 </ b> A to 30 </ b> C, which is executed in the program update system of the present embodiment.
In FIG. 5, the “target ECU” refers to the ECU 30 that is a control program update target. The “information system ECU” is an ECU 30 that controls information-related target devices such as a car navigation device, a liquid crystal display (display device), and an input device of the device.

As shown in FIG. 5, the gateway 10 transmits to the management server 5 a communication packet including the version information of the control program of the target ECUs 30A to 30C of the own vehicle and the vehicle identification number (VIN) of the own vehicle (step S1). ).
The management server 5 determines the necessity of updating the control program related to the target ECUs 30A to 30C by searching the service management table based on the version information and the vehicle identification number included in the received communication packet.

Here, it is assumed that the management server 5 determines that the target ECUs 30A to 30C of the vehicle 1 need to be updated.
In this case, the management server 5 transmits a download request including the update program storage destination URL (URL of the update program storage folder in the DL server 6) of the target ECUs 30A to 30C to the gateway 10 that is the packet transmission source (step S2). ).

Next, the gateway 10 accesses the storage destination URL, and transmits a communication packet requesting the update program Δ of the target ECUs 30A to 30C to the DL server 6 (step S3). The DL server 6 transmits the update program Δ to the gateway 10 (Step S4).
When the download of the update program is completed, the gateway 10 temporarily stores and saves the update program in the storage unit 13 of its own device, and transmits a download completion notification to the management server 5 (step S5).

In the present embodiment, the gateway 10 includes the current vehicle information of the vehicle 1 that is used by the management server 5 for the “repro execution determination process” (step S6) described later in the download completion notification.
The current vehicle information includes, for example, a user ID, driving status (parking / stopped / running), current position, current time, OD (Origin-Destination) information (including travel route), and remaining battery power. The amount is included.

The user ID is identification information defined separately from the vehicle identification information so that the driver of the vehicle 1 can be identified. User IDs of a plurality of users who drive the same vehicle 1 can be defined using smart key information or the like.
For example, when three users (such as the owner of the vehicle 1, its spouse, and their eldest son) share one vehicle 1, the values of three smart key information corresponding to one vehicle identification information (VIN) May be the user ID of each person.

Receiving the download completion notification, the management server 5 executes “repro execution determination process” (step S6).
This determination process is a process of determining whether or not the control program can be updated according to the availability of the control function performed by the target ECUs 30A to 30C. The availability of the control functions of the target ECUs 30A to 30C is determined based on the usage pattern stored in advance by the management server 5. Details of the repro execution determination process (FIG. 6) based on the usage pattern will be described later.

Here, it is assumed that the determination result of whether or not repro execution is possible by the management server 5 is positive (when repro execution is possible). In this case, the management server 5 transmits a control program update execution request to the gateway 10 (step S7).
The gateway 10 that has received the execution request transmits a confirmation request to the information system ECU 30D in order to make the user confirm whether or not the update of the control program using the update program Δ is necessary (step S8).

Receiving the confirmation request, the information system ECU 30D displays a confirmation screen as to whether execution is necessary or not on a display device such as a liquid crystal display of the car navigation device (step S9).
On the confirmation screen, for example, “Do you want to update the control program of the target ECUs 30A to 30C?”, “Can update the control program of the target ECUs 30A to 30C. Run now? Run later?” A display that allows the user to select whether or not to perform the update is included.

Here, it is assumed that the user selects execution of updating the control program for the target ECUs 30 </ b> A to 30 </ b> C by an operation input to the input device of the vehicle 1.
In this case, an update execution input signal is transmitted to the information system ECU 30D, and the information system ECU 30D transmits an update permission to the gateway 10 (step S10). The gateway 10 that has received the update permission transmits a control program update request to the target ECUs 30A to 30C (step S11), and transfers the update program Δ to the target ECUs 30A to 30C.

The target ECUs 30 </ b> A to 30 </ b> C that have received the update request execute control program update processing (step S <b> 12).
Specifically, the activation unit 35 of the CPU 31 of the target ECUs 30A to 30C switches its own control mode from the normal mode to the repro mode (see FIG. 3), expands the received update program Δ, and controls the old version of the control program By applying to, the control program is rewritten from the old version to the new version.

When the update process of the control program is completed, the target ECUs 30A to 30C each transmit a notification of completion of the update process of the own machine to the gateway 10 (step S13).
When the completion notification is received, the gateway 10 transmits to the management server 5 a vehicle identification number of the host vehicle and a completion notification indicating that the update processing of the target ECUs 30A and 30B has been completed (step S14).

The management server 5 that has received the completion notification updates the contents of the service management table managed by its own device.
Specifically, the management server 5 searches for the vehicle identification number included in the completion notification received from the gateway 10, and updates the version information of the control program of the target ECUs 30A to 30C associated with the identification number to the new version. To do.

[Repro Execution Judgment Processing]
FIG. 6 is a flowchart showing an example of repro execution determination processing executed by the CPU 51 of the management server 5.
As shown in FIG. 6, the CPU 51 of the management server 5 continuously determines whether or not a downlink completion notification has been received from the gateway 10 (step ST10).

The CPU 51 that has received the download completion notification extracts the current vehicle information of the vehicle 1 from the completion notification (step ST11), and “uses” the control functions of the target ECUs 30A to 30C from the storage unit 54 of the own device during vehicle travel. "Pattern" is read (step ST12).
The usage pattern refers to a usage tendency of the control target of the ECU 30 by the user of the vehicle 1, for example, whether a specific user or all users use the control target of the ECU 30 or not. Means.

Next, whether the CPU 51 of the management server 5 has low availability of the target ECUs 30 </ b> A to 30 </ b> C during vehicle travel based on the current vehicle information of the vehicle 1 and the use pattern during vehicle travel stored by the own device. It is determined whether or not (step ST13).
Specifically, for example, when the availability of the target ECUs 30A to 30C based on the usage pattern is equal to or less than a predetermined threshold (for example, 5%), the CPU 51 determines that the availability is low and exceeds the predetermined threshold. In the case, it is determined that the availability is high.

When the determination result of step ST13 is affirmative, the CPU 51 transmits an update execution request to the gateway 10 (step ST14).
As described above, the gateway 10 that has received the execution request transmits a confirmation request to the information system ECU 30D of the host vehicle (step S8 in FIG. 5). This notifies the user of the vehicle 1 whether or not the target ECUs 30A to 30C are to be executed (step S9 in FIG. 5).

If the determination result of step ST13 is negative, the CPU 51 transmits an update standby command to the gateway 10 (step ST15).
The standby command includes, for example, a communication packet that commands retransmission of a download completion notification after a predetermined time (for example, about 1 hour to 1 day) has elapsed. Therefore, the CPU 51 of the management server 5 executes again the repro-executable determination process (FIG. 6) triggered by the download completion notification received from the gateway 10 after a predetermined time has elapsed.

Next, specific examples 1 to 3 of the determination method in step ST13 will be described.
(Specific example 1 of determination method)
In specific example 1 of the determination method, it is assumed that the control function updated by the target ECU 30 </ b> A is “auto light” (a function of turning on or off a headlight or the like according to illuminance).

Here, it is assumed that the usage pattern stored in the management server 5 is “the user 1 has a 1% possibility of using auto light”.
In this case, when the user ID included in the download completion notification of the gateway 10 is “user 1”, the CPU 51 of the management server 5 determines that the availability of the target ECU 30A is low (Yes in step ST13). An update execution request for the target ECU 30A is transmitted (step ST14).

Alternatively, the usage pattern stored in the management server 5 is “For user 1, the possibility of using autolight during the daytime (12:00 to 15:00) is 1%, and autolight is used at other times. The possibility of use is 10%. "
In this case, the CPU 51 of the management server 5 determines that the availability of the target ECU 30A is high when the user ID notified from the gateway 10 is “user 1” and the current time is a time zone other than daytime. (No in step ST13), an update standby request for the target ECU 30A is transmitted (step ST15).

Alternatively, the usage pattern stored in the management server 5 is “For user 1, the possibility of using auto light when passing through the tunnel is 20%, and the possibility of using auto light in other sections is 1%. . "
In this case, if the user ID notified from the gateway 10 is “user 1” and the traveling of the tunnel section is predicted from the current time and OD information, the CPU 51 of the management server 5 can use the target ECU 30A. Is determined to be high (No in step ST13), and an update standby request for the target ECU 30A is transmitted (step ST15).

(Specific example 2 of determination method)
In specific example 2 of the determination method, it is assumed that the control function updated by the target ECU 30B is “lane keep assist” (a function of automatically steering to keep a lane: hereinafter also referred to as “LKA”).

Here, the usage pattern stored in the management server 5 is “the user 2 has a 1% possibility of using LKA in a predetermined road section on the expressway”.
In this case, the CPU 51 of the management server 5 has a user ID “user 2” included in the download completion notification of the gateway 10 and is expected to travel on a predetermined road section from the current time, current position, and OD information. Is determined that the availability of the target ECU 30B is low (Yes in step ST13), and an update execution request for the target ECU 30B is transmitted (step ST14).

(Specific example 3 of determination method)
In specific example 3 of the determination method, it is assumed that the control function updated by the target ECU 30C is “wiper control”.

Here, it is assumed that the usage pattern stored in the management server 5 is “the possibility of using the wiper during traveling on a sunny day is 30% for the user 3”.
In this case, when the user ID included in the download completion notification of the gateway 10 is “user 3” and the current weather is clear, the CPU 51 of the management server 5 determines that the availability of the target ECU 30C is high ( No in step ST13), an update standby request relating to the target ECU 30C is transmitted (step ST15).

[Use pattern generation processing]
FIG. 7 is an explanatory diagram illustrating an example of usage pattern generation processing executed by the CPU 51 of the management server 5. “Use pattern generation processing” refers to the use pattern (use of predetermined ECU control function) from vehicle information acquired from the vehicle 1 and information (weather, road type, etc.) that the management server 5 can acquire from other than the vehicle 1. (Trend) is generated.

As shown in FIG. 7, a vehicle information database 56 and a usage pattern database 57 are stored in the storage unit 54 of the management server 5.
The vehicle information database 56 includes a plurality of “vehicle information management tables”. The vehicle information included in this management table is extracted from communication packets that the management server 5 receives from the gateway 10 of the vehicle 1 every predetermined time (for example, 1 to 5 seconds).

The vehicle information includes vehicle identification information (VIN), user ID, driving status (parking / stopping / running), current position, current time, OD (Origin-Destination) information (running) for each vehicle 1. Including the route), and the operation status (Either ON / OFF) for each ECU control function.
One vehicle information management table includes a driving situation and a current position for each user ID related to one vehicle identification number.

When the CPU 51 of the management server 5 receives a communication packet including a predetermined vehicle identification number from the gateway 10, the user information, the driving situation, and the current position included in the received communication packet are included in the vehicle information management table of the corresponding vehicle identification number. In addition, information such as the current time is stored. The accumulation period is, for example, several months to one year.
The CPU 51 of the management server 5 executes predetermined statistical processing on the vehicle information stored in the database 56 and generates a usage pattern database 57 for each user.

  For example, the CPU 51 extracts an explanatory variable that affects the operation status of a predetermined control function (for example, auto light) from the vehicle information management table of the user 1 included in the vehicle information database 56, so that the user 1 related to auto light. Usage pattern 1 is generated.

Further, the CPU 51 extracts an explanatory variable that affects the operating status of a predetermined control function (for example, LKA) from the vehicle information management table of the user 2 included in the vehicle information database 56, thereby using the user 2 related to LKA. Pattern 2 is generated.
Further, the CPU 51 extracts from the vehicle information management table of the user 3 included in the vehicle information database 56 an explanatory variable that affects the operating status of a predetermined control function (for example, wiper control), thereby enabling the user 3 related to the wiper control. Usage pattern 3 is generated.

[Effect of this embodiment]
As described above, according to the management server 5 of the present embodiment, the storage unit 54 acquires the usage pattern of the control function of the target ECUs 30A to 30C when the vehicle is traveling, and the CPU 51 is based on the acquired usage pattern. Since it is determined whether or not the control program can be updated by the target ECUs 30A to 30C, even if the target ECUs 30A to 30C do not set a travel route that does not execute the control function, it is appropriately determined whether or not the control program can be updated while the vehicle is traveling. Can do.

  Specifically, the CPU 51 determines the degree of availability of the target ECUs 30A to 30C while the vehicle is traveling based on the acquired usage pattern (steps ST12 and ST13 in FIG. 6), and performs control according to the determination result. Whether to update the program is determined (steps ST14 and ST15 in FIG. 6).

That is, the CPU 51 determines that the control program can be updated when the availability of the target ECUs 30A to 30C during traveling of the vehicle is equal to or less than a predetermined threshold.
Therefore, while a user is using a certain control function (for example, “auto light”, “LKA”, and “wiper control” described above), the control program of the target ECUs 30A to 30C corresponding to the control function. By recommending the update, it is possible to prevent the user from feeling inconvenient.

According to the management server 5 of the present embodiment, the usage patterns stored in the storage unit 54 include usage patterns 1 to 3 set for each identification information (users 1 to 3) of users who can drive the vehicle 1. (See FIG. 7).
For this reason, CPU51 can perform the determination of the update possibility of the control program of object ECU30A-30C based on the usage patterns 1-3 for every user 1-3. Accordingly, it is possible to transmit an update processing execution request (step S7 in FIG. 5) at an appropriate timing at which each of the users 1 to 3 does not feel inconvenient.

[First Modification]
In the above-described embodiment, since the user IDs of a plurality of drivers who drive the same vehicle 1 are defined using smart key information or the like, the user identified by the user ID actually drives the vehicle 1. Limited to humans.
However, assuming that almost completely automatic driving can be put into practical use in the future, it is preferable that the user ID includes identification information when the vehicle 1 is in automatic driving.

For example, in the case of level 4 fully automatic driving (automatic driving in which the occupant only determines the destination and does not need to perform driving operation) as defined by the US National Road Traffic Safety Administration (NHTSA), the automatic driving mode It is also preferable to assign a user ID.
If it does in this way, also about the vehicle 1 in automatic driving | running | working, it will become possible to determine the update possibility of the control program about ECU30A-30C based on a utilization pattern.

[Second Modification]
In the above-described embodiment, the management server 5 transmits an execution request to the gateway 10 of the vehicle 1 in order to inquire the user of the vehicle 1 whether or not to update the control program (step S7 in FIG. 5).
However, if there is a business server of a business entity that has multiple business vehicles, such as a taxi company or a bus company, and this business server collectively manages the control program for business vehicles, an execution request is issued. It may be transmitted to the business server.

[Third Modification]
In the above-described embodiment, the CPU 51 of the management server 5 executes the process of determining whether or not the control program for the target ECUs 30A to 30C can be updated based on the usage pattern. The CPU 11 of the gateway 10 executes this process. You may decide. In other words, the gateway 10 may be the execution subject for determining whether or not update is possible.
In this case, the usage pattern of the control function of the ECU 30 related to the user of the host vehicle may be created by the gateway 10 itself or received from the management server 5.

  The embodiments disclosed herein are illustrative and non-restrictive in every respect. The scope of rights of the present invention is not limited to the above-described embodiments, but includes all modifications within the scope equivalent to the configurations described in the claims.

1 Vehicle 2 Wide Area Communication Network 5 Management Server (Control Device)
6 DL server 10 Gateway (control device)
11 CPU (control unit)
12 RAM
13 Storage unit (acquisition unit)
14 in-vehicle communication unit 15 wireless communication unit 30 ECU (on-vehicle control device)
30A Target ECU (vehicle-mounted control device)
30B Target ECU (on-vehicle control device)
30C Target ECU (on-vehicle controller)
30D information system ECU
31 CPU
32 RAM
33 Storage Unit 34 Communication Unit 35 Start-up Unit 51 CPU (Control Unit)
52 ROM
53 RAM
54 Storage unit (acquisition unit)
55 Communication Department 56 Vehicle Information Database 57 Usage Pattern Database

Claims (7)

A control device that determines whether or not to update a control program of a plurality of types of in-vehicle control devices that control a target device mounted on a vehicle,
An acquisition unit that acquires the availability of the control function of the in-vehicle control device during vehicle travel for each of the in-vehicle control devices,
A control device comprising: a control unit that determines whether or not the control program for the in-vehicle control device can be updated based on the obtained availability. The control device according to claim 1 , wherein the control unit determines that the control program can be updated when the availability is equal to or less than a predetermined threshold. The available possibilities, the control device according to claim 1 or claim 2 includes the availability of set for each identification information of the user may operate the vehicle. The control device according to claim 3 , wherein the user identification information includes identification information in a case where the vehicle is in automatic driving. The control device according to any one of claims 1 to 4 , further comprising a generation unit that generates the availability based on accumulation of operation statuses of the control function. A method for determining whether or not to update a control program of a plurality of types of in-vehicle control devices that control a target device mounted on a vehicle,
Acquiring for each of the in-vehicle control devices corresponding to the availability of the control function of the in-vehicle control device during vehicle travel;
A step of determining whether or not the control program for the in-vehicle control device can be updated based on the obtained availability. A computer program for causing a computer to function as a control device that determines whether or not to update a control program of a plurality of types of in-vehicle control devices that control a target device mounted on a vehicle, the computer comprising:
An acquisition unit that acquires the availability of the control function of the in-vehicle control device during vehicle traveling for each of the in-vehicle control devices, and
Based on the obtained amount of the availability, a computer program to function as the control unit determines updatability of the control program for the vehicle control device.

Images