JP6547904B2 - CONTROL DEVICE, PROGRAM UPDATE METHOD, AND COMPUTER PROGRAM - Google Patents

Description

The present invention relates to a control device, a program update method, and a computer program.
This application claims the priority based on Japanese Patent Application No. 2017-016545 filed Feb. 1, 2017, and incorporates all the contents described in the aforementioned Japanese application.

2. Description of the Related Art In recent years, in the technical field of automobiles, vehicles are becoming more sophisticated, and various in-vehicle devices are mounted on the vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are control devices for controlling each on-vehicle device, are mounted on the vehicle.
The types of ECUs include, for example, those related to a travel system that controls the engine, brakes, EPS (Electric Power Steering), etc. in response to accelerator, brake, and steering wheel operations; There are a body system ECU that controls lighting / extinguishing of a headlight and sounding of an alarm device, and a meter system ECU that controls the operation of meters disposed near the driver's seat.

Generally, the ECU is configured by an arithmetic processing unit such as a microcomputer, and the control of the on-vehicle device is realized by reading and executing the control program stored in a ROM (Read Only Memory).
The control program of the ECU may differ depending on the destination and grade of the vehicle, and it is necessary to rewrite the control program of the old version to the control program of the new version in response to the upgrade of the control program.

  For example, Patent Document 1 discloses a technology in which an update program downloaded from an external center is accumulated in a relay device mounted on a vehicle, and program update for each ECU of the vehicle is executed based on a predetermined command. It is disclosed.

International Publication No. 2015/194652

  According to an embodiment, the control device is a control device that controls updating of a control program of an on-vehicle control device that controls a target device mounted on a vehicle, and acquires a maintenance schedule for updating the control program , A determination unit that determines the start time of the download of the control program update program based on the start time of maintenance, and a control unit that controls the download of the update program, the control unit is determined by the determination unit Start downloading the update program at the start time.

  According to another embodiment, the program updating method is a method of updating a control program of an on-vehicle control device that controls a target device mounted on a vehicle, and obtaining a maintenance schedule for updating the control program; Determining the start time of the download of the control program update program based on the start time of the maintenance, and controlling the download of the update program, wherein the download control step determines the start time of the download Starting the download of the update program at the start determined by the step of

  According to another embodiment, the computer program is a computer program for causing a computer to function as a control device that controls updating of a control program of an in-vehicle control device that controls a target device mounted on a vehicle. An acquisition unit that acquires a maintenance schedule for updating a control program, a determination unit that determines when to start downloading a control program update program based on maintenance start time, and a control unit that controls downloading of the update program , And the control unit starts downloading the update program at the start determined by the determination unit.

FIG. 1 is an overall configuration diagram of a program update system according to an embodiment. FIG. 2 is a block diagram showing an internal configuration of the gateway. FIG. 3 is a block diagram showing an internal configuration of the ECU. FIG. 4 is a block diagram showing an internal configuration of the management server. FIG. 5 is a sequence diagram showing an example of control program update executed in the program update system according to the first embodiment. FIG. 6 is a flowchart showing specific contents of the schedule determination process of step S2 of FIG. FIG. 7 shows an example (A) of the time relationship of updating the control program and an example (B) of a time relationship of updating the control program as a comparative example in the program updating system according to the first embodiment; FIG. FIG. 8 is a sequence diagram showing an example of control program update executed in the program update system according to the second embodiment. FIG. 9 is a flowchart showing an example of the schedule determination process according to the third embodiment.

<Issues the present disclosure is trying to solve>
An example of a predetermined command to execute program update is a command to start rewriting which is input at the time of maintenance at the dealer. In this case, if the download of the update program is started after the start of maintenance at the dealer, the maintenance time at the dealer becomes long, and some users may find it inconvenient. On the other hand, if the update program is downloaded for a long time before the start of the maintenance, the update program is accumulated in the relay device for a long time, which squeezes the memory.

  An object in one aspect of the present disclosure is to provide a control device capable of downloading a control program update program at an appropriate timing taking into consideration the start of maintenance at a dealer, a program update method, and a computer program. It is.

<Effect of the present disclosure>
According to this disclosure, the control program update program can be downloaded at an appropriate timing in consideration of the start of maintenance at the dealer.

[Description of the embodiment]
The present embodiment includes at least the following.
That is, the control device included in the present embodiment is a control device that controls the update of the control program of the onboard control device that controls the target device mounted on the vehicle, and acquires the maintenance schedule for the update of the control program And a control unit that controls download of the update program based on the start time of the maintenance, and the control unit controls the download of the update program. Start downloading the update program at the start determined by.
Since the start time of the download of the update program is determined based on the start time of the maintenance, even if the download of the update program is requested from the server, the update program is downloaded at the timing based on the start of the maintenance Be done. Therefore, according to this configuration, it is possible to download the control program update program at an appropriate timing in consideration of the start of maintenance.

Preferably, the determination unit determines the start time of the download of the update program so as to start the download of the update program at least before the start of the maintenance.
As a result, the total time for maintenance can be shortened as compared with the case where the download of the update program is started after the start of maintenance.

Preferably, the acquisition unit further acquires the download required time of the update program, and the determination unit determines the start time of the download of the update program so that the download of the update program is completed before the start of the maintenance.
As a result, the download of the update program has already been completed at the start of maintenance, and it is not necessary to download the update program after the start of maintenance. Therefore, the total time for maintenance can be shortened compared to the case of downloading the update program during maintenance.

Preferably, the determination unit determines the start time of the download of the update program such that the period from the completion of the download of the update program to the start of the maintenance is equal to or less than a specified time.
This makes it possible to shorten the period for which the update program is stored in the memory from the completion of the download to the start of the maintenance. Thus, long-term memory pressure can be avoided.

Preferably, the determination unit waits for the download of the update program, when the download period of the update program includes the start time of maintenance for the update of another control program.
As a result, no other update program is downloaded during maintenance. Therefore, it is possible to prevent the maintenance memory from being compressed by the download of the other update program, and it is possible to avoid the trouble that may occur in the maintenance.

Preferably, the apparatus further includes a memory for storing the update program, and the determination unit includes a start time of maintenance for updating another control program in the download period of the update program, and the free space of the memory Is less than the predefined capacity, it waits for the download of the update program.
As a result, when the free space of the memory is equal to or more than a predetermined capacity, downloading of another update program is performed as needed. Therefore, the total time of maintenance for updating the control program using the other update program can be shortened.

Preferably, when the in-vehicle control device includes a backup memory, the control unit controls writing of the update program to the backup memory, and the determination unit completes the download of the update program before the start of maintenance. And, the start time of the download of the update program is determined so that the writing of the update program to the backup memory is completed.
Thus, at the start of maintenance, writing of the update program in the backup memory of the on-vehicle control device is completed. Therefore, maintenance for updating the control program is only required to restart and switch between the backup memory and the operation memory, compared with the case where the update program is written to the backup memory. The total maintenance time for updating can be further shortened.

The program updating method included in the present embodiment is a method of updating a control program of an on-vehicle control device that controls a target device mounted on a vehicle, and acquires a maintenance schedule for updating the control program; Determining the start time of the download of the control program update program based on the start time of the control program, and controlling the download of the update program, wherein the download control step determines the start time of the download Initiating the download of the update program at the start determined by the step.
Since the start time of the download of the update program is determined based on the start time of the maintenance, even if the download of the update program is requested from the server, the update program is downloaded at the timing based on the start of the maintenance Be done. Therefore, according to this configuration, it is possible to download the control program update program at an appropriate timing in consideration of the start of maintenance.

The computer program included in the present embodiment is a computer program for causing a computer to function as a control device that controls updating of a control program of an in-vehicle control device that controls a target device mounted in a vehicle. An acquisition unit for acquiring a maintenance schedule for program update; a determination unit for determining the start time of download of a control program update program based on maintenance start time; and a control unit for controlling download of the update program, Function, and the control unit starts downloading the update program at the start determined by the determination unit.
Since the start time of the download of the update program is determined based on the start time of the maintenance, even if the download of the update program is requested from the server, the update program is downloaded at the timing based on the start of the maintenance Be done. Therefore, according to this configuration, it is possible to download the control program update program at an appropriate timing in consideration of the start of maintenance.

[Details of the embodiment]
Hereinafter, preferred embodiments will be described with reference to the drawings. In the following description, the same parts and components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, these descriptions will not be repeated.

First Embodiment
[Whole system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to the first embodiment.
As shown in FIG. 1, the program update system of the present embodiment includes a vehicle 1 that can communicate via the wide area communication network 2, a management server 5, and a DL (download) server 6.
The management server 5 manages the update information of the vehicle 1. The DL server 6 stores the update program. The management server 5 and the DL server 6 are operated, for example, by a car maker of the vehicle 1 and can communicate with a large number of vehicles 1 owned by a user who has been registered as a member in advance.

The vehicle 1 is mounted with a gateway 10, a wireless communication unit 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the respective ECUs 30.
The vehicle 1 has a communication group by a plurality of ECUs 30 bus-connected to a common in-vehicle communication line, and the gateway 10 relays communication between the communication groups. For this reason, a plurality of in-vehicle communication lines are connected to the gateway 10.

The wireless communication unit 15 is communicably connected to a wide area communication network 2 such as a cellular phone network, and is connected to the gateway 10 by an in-vehicle communication line. The gateway 10 transmits the information received by the wireless communication unit 15 from the external device such as the management server 5 and the DL server 6 through the wide area communication network 2 to the ECU 30.
The gateway 10 transmits the information acquired from the ECU 30 to the wireless communication unit 15, and the wireless communication unit 15 transmits the information to an external device such as the management server 5 or the like.

As the wireless communication unit 15 mounted on the vehicle 1, in addition to the dedicated communication terminal mounted on the vehicle, for example, a device such as a mobile phone owned by the user, a smartphone, a tablet terminal, a notebook PC (Personal Computer) can be considered.
Although FIG. 1 exemplifies a case where the gateway 10 communicates with an external device via the wireless communication unit 15, when the gateway 10 has a wireless communication function, the gateway 10 itself may be a management server 5 or the like. The configuration may be such that wireless communication is performed with an external device.
Moreover, in the program update system of FIG. 1, although the management server 5 and the DL server 6 are comprised by a separate server, you may comprise these servers 5 and 6 by one server apparatus.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing an internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a CPU 11, a random access memory (RAM) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected via the wireless communication unit 15 and the in-vehicle communication line, but these may be configured by one device.

The CPU 11 causes the gateway 10 to function as a relay device for various information by reading out one or more programs stored in the storage unit 13 to the RAM 12 and executing the program.
The CPU 11 can execute a plurality of programs in parallel by switching and executing a plurality of programs in time division, for example. The CPU 11 may represent a plurality of CPU groups. In this case, the functions realized by the CPU 11 are realized by the cooperation of a plurality of CPU groups. The RAM 12 is configured by a memory element such as an SRAM (Static RAM) or a DRAM (Dynamic RAM), and temporarily stores programs executed by the CPU 11 and data required for the execution.

The computer program realized by the CPU 11 can be transferred while being recorded in a known recording medium such as a CD-ROM or a DVD-ROM, or transferred by information transmission (downloading) from a computer device such as a server computer. You can also.
The same applies to a computer program executed by the CPU 31 (see FIG. 3) of the ECU 30 described later and a computer program executed by the CPU 51 (see FIG. 4) of the management server 5 described later.

  The storage unit 13 is configured by a non-volatile memory element such as a flash memory or an EEPROM. The storage unit 13 stores a program executed by the CPU 11 and data required for the execution, and has a storage memory 131 which is a storage area for storing an update program of each ECU 30 received from the DL server 6 and the like. . The storage memory 131 is also used for program backup.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1. The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark), etc. The communication with the ECU 30 is performed in accordance with the standard.
The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11. The in-vehicle communication unit 14 may communicate not only with the above communication standard but also with another communication standard used for the in-vehicle network.

The wireless communication unit 15 is a wireless communication device including an antenna and a communication circuit that performs transmission and reception of a wireless signal from the antenna. The wireless communication unit 15 can communicate with an external device by being connected to a wide area communication network 2 such as a cellular phone network.
The wireless communication unit 15 transmits the information given from the CPU 11 to the device outside the vehicle such as the management server 5 via the wide area communication network 2 formed by the base station (not shown), and sends the information received from the device outside the vehicle to the CPU 11 give.

Instead of the wireless communication unit 15 shown in FIG. 2, a wired communication unit functioning as a relay device in the vehicle 1 may be employed. The wired communication unit has a connector to which a communication cable conforming to the standard such as USB (Universal Serial Bus) or RS232C is connected, and performs wired communication with another communication device connected via the communication cable.
When another communication device and an external device such as the management server 5 can wirelessly communicate through the wide area communication network 2, the external device → another communication device → the wired communication unit → the communication path of the gateway 10 Communication between the device and the gateway 10 becomes possible.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing an internal configuration of the ECU 30. As shown in FIG.
As shown in FIG. 3, the ECU 30 includes a CPU 31, a RAM 32, a storage unit 33, a communication unit 34, and the like. The ECU 30 is an on-vehicle control device that individually controls target devices mounted on the vehicle 1. The types of ECUs 30 include, for example, a power supply control ECU, an engine control ECU, a steering control ECU, and a door lock control ECU.

The CPU 31 reads one or more programs stored in advance in the storage unit 33 into the RAM 32 and executes the programs to control the operation of the target device that the CPU 31 takes charge of. The CPU 31 may also represent a plurality of CPU groups, and the control by the CPU 31 may be control by cooperation of a plurality of CPU groups.
The RAM 32 is configured by a memory element such as an SRAM or a DRAM, and temporarily stores programs executed by the CPU 31 and data necessary for the execution.

The storage unit 33 is configured by a non-volatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The storage unit 33 includes a function memory 331 which is an area for storing a program read and executed by the CPU 31. The information stored in the function memory 331 includes, for example, a computer program (hereinafter referred to as "control program") for causing the CPU 31 to execute information processing for controlling a target device to be controlled in the vehicle. .

A gateway 10 is connected to the communication unit 34 via an in-vehicle communication line disposed in the vehicle 1. Communication unit 34 communicates with gateway 10 in accordance with a standard such as CAN, Ethernet, or MOST, for example.
The communication unit 34 transmits the information given from the CPU 31 to the gateway 10, and gives the information received from the gateway 10 to the CPU 31. The communication unit 34 may communicate not only with the above communication standard but also with another communication standard used for the in-vehicle network.

The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode of the CPU 31 to either the “normal mode” or the “reprogramming mode” (hereinafter also referred to as “repro mode”).
Here, the normal mode refers to a control mode in which the CPU 31 of the ECU 30 executes the inherent control (for example, engine control for the fuel engine, door lock control for the door lock motor, etc.) for the target device.

The reprogramming mode is a control mode in which a control program used to control a target device is updated.
That is, the reprogramming mode is a control mode in which the CPU 31 erases and rewrites the control program with respect to the ROM area of the storage unit 33. The CPU 31 can update the control program stored in the ROM area of the storage unit 33 to a new version only in this control mode.

When the CPU 31 writes the control program of the new version in the storage unit 33 in the repro mode, the activation unit 35 once restarts (resets) the ECU 30 and executes verification processing on the storage area in which the control program of the new version is written. .
The start-up unit 35 operates the CPU 31 with the control program after the update after the completion of the verification process.

[Internal configuration of management server]
FIG. 4 is a block diagram showing an internal configuration of the management server 5.
As illustrated in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads one or a plurality of programs stored in advance in the ROM 52 into the RAM 53 and executes them to control the operation of each hardware, and causes the management server 5 to function as an external device capable of communicating with the gateway 10. The CPU 51 may also represent a plurality of CPU groups, and a function realized by the CPU 51 may be realized by a plurality of CPU groups in cooperation.
The RAM 53 is configured of a memory element such as an SRAM or a DRAM, and temporarily stores programs executed by the CPU 51 and data required for the execution.

The storage unit 54 is configured of a non-volatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 is a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to a wide area communication network 2 such as a mobile telephone network to execute the communication processing. The communication unit 55 transmits the information provided from the CPU 51 to an external device via the wide area communication network 2, and supplies the information received via the wide area communication network 2 to the CPU 51.

[Control program update sequence]
FIG. 5 is a sequence diagram showing an example of control program update executed in the program update system of the present embodiment. As an example, the management server 5 determines the timing which updates the control program of ECU of the said vehicle 1 about the vehicle 1 registered beforehand. The timing of the update may be set by, for example, a car maker of the vehicle 1 or the like.

  When it is time to update the control program of the ECU, the management server 5 sends the storage destination URL of the update program for the ECU 30 and the download request to the gateway 10 of the corresponding vehicle 1 (step S1).

  The gateway 10 having received the update request from the management server 5 executes a process of determining a schedule for downloading the update program for updating the control program (step S2). In step S2, the gateway 10 determines the schedule (start time) for downloading the update program based on the scheduled time (hereinafter, also referred to as a maintenance schedule) at which the dealer warehousing and start maintenance for updating the control program. Do. The maintenance schedule may be the date of receipt of the vehicle 1 into the dealer. Details of the process will be described later. Then, the gateway 10 downloads an update program for the ECU 30 from the DL server 6 at the timing defined by the schedule (steps S3, 4). The gateway 10 stores and stores the received update program in the storage unit 13 of its own device (step S5).

  When the download of the update program is completed and stored in the storage unit 13 in step S5, the gateway 10 notifies the management server 5 of the completion of the download (step S6). Thus, the management server 5 can manage distribution of the update program to the vehicle 1 of the control program. Further, when the completion of the download within the predetermined period is not notified from the step S1, the management server 5 distributes the update program to the vehicle 1 again.

  After the download of step S4 is started, the vehicle 1 is received by the dealer and maintenance starts. In the maintenance at the dealer, a device (not shown) such as a portable terminal is connected to the gateway 10, and the device communicates with the gateway 10 directly or via the wireless communication unit 15 to start updating the gateway 10. Pass the command.

  The gateway 10 that has received the command passes the update program to the target ECU 30 and requests update of the control program (step S7). In accordance with the request, the ECU 30 updates the control program (step S8). Since the download of the update program is already completed in the above steps S4 and 5, and stored in the storage unit 13 of the gateway 10, in step S8, the update program only needs to be performed using the update program. The update of the control program can be completed in a short time as compared with the case of starting.

  The management server 5 may be notified of the completion of the update instead of or in addition to the notification of the download completion in step S6. Thereby, the management server 5 can manage the update of the control program in the vehicle 1. In addition, when completion of updating within the predetermined period is not notified from the step S1, the management server 5 distributes the updating program to the vehicle 1 again to reliably update the control program in the vehicle 1 be able to.

[Functional configuration of gateway]
The CPU 11 of the gateway 10 determines a schedule for downloading the update program, and executes the functions represented by the acquisition unit 111, the determination unit 112, and the control unit 113 in FIG. 2 as functions for executing the download according to the schedule. Including. These functions are functions realized by the CPU 11 by reading and executing one or a plurality of programs stored in the storage unit 13 by the CPU 11. However, at least a part of the functions may be realized by hardware such as an electronic circuit.

  The function of the CPU 11 represented by the acquisition unit 111 (hereinafter, the acquisition unit 111) acquires a maintenance schedule of the vehicle 1. The maintenance schedule for the vehicle 1 may be registered in the management server 5 by the user of the vehicle 1. In this case, the acquisition unit 111 acquires a maintenance schedule from the management server 5.

  The maintenance schedule may ask the user. In this case, as an example, the acquisition unit 111 may communicate with the user's mobile phone, smartphone, tablet terminal, notebook PC, etc., and may prompt the user to input a maintenance schedule. The acquisition unit 111 acquires a maintenance schedule by receiving user's input from a mobile phone or the like.

  In addition, the acquisition unit 111 acquires a time (hereinafter, referred to as a DL required time) Td required to download the update program. The DL required time Td may be acquired from the management server 5. As an example, when the download of the update program is requested from the management server 5 in step S1, the DL required time Td may be passed to the gateway 10 as information necessary for the download. Alternatively, the acquisition unit 111 may calculate the DL required time Td using the information of the data size passed from the management server 5 as information necessary for downloading the update program.

  The function of the CPU 11 represented by the determination unit 112 (hereinafter, the determination unit 112) determines the download start time of the update program based on the maintenance schedule acquired by the acquisition unit 111 and the DL required time Td. At this time, the determination unit 112 determines the download start time so that the download starts at least before the start of maintenance. As a result, it is possible to reduce the time required for downloading after the start of maintenance, and to shorten the entire maintenance time.

  Preferably, the determination unit 112 determines the download start time so that the download is completed before the maintenance start. The start of the download is, for example, the start time of the download. In addition, it may be the start date and time, the start timing such as an elapsed time from a predetermined event or timing, or the like. As a result, since the download of the control program has already been completed at the start of maintenance, the time for downloading after the start of maintenance can be eliminated. Therefore, it is because the whole maintenance time can be shortened more.

  More preferably, after the download is completed, the period Ts stored in the storage unit 13 and stored until the start of maintenance (hereinafter referred to as storage period) Ts becomes shorter than a predetermined time Th after the download is completed. As (Ts ≦ Th), the download start time is determined. For example, the download start time is determined such that the storage period Ts becomes a specified time Th (Ts = Th). The specified time Th is, for example, about several minutes to several tens of minutes. As a result, the entire maintenance time can be further shortened, and the memory pressure until the start of maintenance can be suppressed in a short time.

  The function of the CPU 11 (hereinafter referred to as the control unit 113) represented by the control unit 113 controls to start downloading the update program at the timing determined by the determination unit 112. Specifically, the control unit 113 requests the DL server 6 for the update program at the timing determined by the determination unit 112. Then, the downloaded update program is stored in the storage unit 13.

Schedule determination processing
FIG. 6 is a flowchart showing specific contents of the schedule determination process of step S2 of FIG. The process shown in the flowchart of FIG. 6 is mainly realized by the CPU 11 by the CPU 11 of the gateway 10 reading out one or more programs stored in the storage unit 13 onto the RAM 12 and executing the program. The process of FIG. 6 starts when the management server 5 requests update of the control program in step S1.

  Referring to FIG. 6, first, CPU 11 of gateway 10 acquires a maintenance schedule (step S101). Further, the CPU 11 acquires the DL required time Td of the update program used for updating the requested control program (step S103). Then, the CPU 11 determines a download schedule of the update program based on the maintenance schedule and the DL required time Td (step S105). In step S105, for example, the download of the update program is performed before the specified time Th of the maintenance start time and the DL required time Td so that the download is completed before the specified time Th of the maintenance start time. Determine the schedule to start.

  Thereafter, the CPU 11 stands by until the determined download start time is reached, and when the time is reached (YES in step S107), the download is started (step S109).

[Effect of the First Embodiment]
In the program update system according to the first embodiment, the download of the update program necessary for updating the control program is started at least before the maintenance start time. Therefore, it is possible to reduce the download time after the start of maintenance rather than when the download of the update program is started after the start of maintenance. As a result, the total maintenance time can be reduced.

  Preferably, in the program update system according to the first embodiment, the download of the update program is completed at least before the maintenance start time. Therefore, the control program can be updated immediately without the update program being downloaded after the maintenance is started. As a result, the total maintenance time can be further reduced.

  More preferably, in the program update system according to the first embodiment, the update program is performed before the maintenance start time and when the storage period from the download completion to the maintenance start becomes equal to or less than the specified time. The download is complete. Therefore, the control program can be updated immediately without the update program being downloaded after the maintenance is started. Further, after the download is completed, the period until the start of maintenance becomes equal to or less than the specified time, and the storage period can be shortened. As a result, the total maintenance time can be further reduced, and the memory compression period can also be reduced.

  FIG. 7A is a diagram showing an example of a time relationship of control program update in the program update system according to the first embodiment. Referring to FIG. 7A, in the program update system according to the present embodiment, maintenance start time T3 is completed so that the download of the update program is completed at time Ts1 before maintenance start time T3. Start the download of the update program at time T2 before the storage period Ts1 and the DL required time Td. In other words, if the download start timing is as shown in FIG. 7A, after the time T1 at which the management server 5 requests the download of the update program, the update program is not downloaded until the time T2 is reached. Start downloading at. Then, maintenance starts at time T3 thereafter. This makes it possible to reduce the total time for maintenance as compared with the case where the download starts after the start of maintenance.

  On the other hand, FIG. 7B is a diagram showing an example of a time relationship when downloading of the update program is started at time T4 immediately after the maintenance start time T3 as a comparative example. Referring to FIG. 7B, when the download start timing is as shown in FIG. 7B, the download is completed before the maintenance start time T3. Therefore, as in the example of FIG. 7A, the maintenance is performed. The total maintenance time can be reduced compared to when the download starts after the start. However, the storage period Ts2 in which the update program is stored in the storage unit 13 after the download is completed is significantly longer than the storage period Ts1 in the case of FIG. 7A. Therefore, in the example of FIG. 7 (B), the period when the memory of the gateway 10 is compressed by the update program becomes long. Therefore, by downloading the update program at the timing as shown in FIG. 7A, it is possible to suppress the period in which the memory of the gateway 10 is compressed by the update program.

Second Embodiment
As represented by dotted lines in FIG. 3, the storage unit 33 of the ECU 30 may include a function memory 331 which is an area for storing a program, and a storage memory 332 for backup of the program.

  In this case, the control program in the ECU 30 is updated by writing the new program generated by applying the update program to the old program in the storage memory 332, and holding the old program by restarting the ECU 30. And processing for replacing the functions of the function memory 331 and the storage memory 332 in which the new program is written. Then, in the program update system according to the second embodiment, upon the maintenance at the dealer, the update instruction is received, the above-mentioned restart is performed, and the function memory 331 and the storage memory 332 are exchanged. .

  FIG. 8 is a sequence diagram showing an example of control program update executed in the program update system according to the second embodiment. In FIG. 8, the same step numbers are added to the same operations as the sequence shown in FIG. Here, the description of the same operation as the sequence shown in FIG. 5 will not be repeated.

  Referring to FIG. 8, in the program update system according to the second embodiment, gateway 10 having received the update request from management server 5 further performs the update for ECU 30 in the process of determining the schedule in step S2. Identify the required time for writing the program to the storage memory 332, download the update program by the maintenance start time, and download it so that the writing of the update program by the ECU 30 is completed. Determine the schedule (start time). Preferably, in the process of step S2, the gateway 10 determines a download schedule such that the storage period from the completion of the writing of the update program in the ECU 30 to the start time of the maintenance becomes shorter than the specified time Th.

  The gateway 10 downloads an update program for the ECU 30 from the DL server 6 at the timing defined by the schedule (steps S3, 4). When the download of the update program is completed, the gateway 10 passes the update program to the target ECU 30 and requests writing of the update program (step S15). According to the request, the target ECU 30 writes a new program based on the received update program into the storage memory 332 (step S16).

  In the program update system according to the second embodiment, after the new program is written to the storage memory 332, maintenance at the dealer starts. Then, in maintenance, an update command is passed to the gateway 10, and the gateway 10 passes the update program to the target ECU 30 to request update of the control program (step S7). In the program update system according to the second embodiment, the ECU 30 is restarted according to the request (step S17), and the function memory 331 holding the old program and the storage memory 332 in which the new program is written Swap the features of.

[Effect of Second Embodiment]
In the program update system according to the second embodiment, the ECU 30 has a storage memory 332 in the storage unit 33. Therefore, writing of the new program in the storage memory 332 is completed prior to the start of maintenance at the dealer. As a result, updating of the control program is completed only by restarting without writing to the storage memory 332 of the new program after the start of maintenance. As a result, the total maintenance time can be further reduced.

Third Embodiment
In the program update system according to the third embodiment, in the schedule determination process of step S2, the gateway 10 further prevents the download from overlapping with the maintenance period based on the maintenance schedule for updating different control programs. You may decide to start the download as follows. When performing maintenance for updating a control program at a dealer, the update program for the other control program is downloaded and memory to the maintenance memory is compressed, thereby avoiding any trouble in maintenance It is.

  FIG. 9 is a flow chart showing schedule determination processing in the third embodiment. In FIG. 9, the process to which the same step number as the flowchart of FIG. 6 is attached is the same as the process to which the step number is attached in the schedule determination process in the first embodiment. Therefore, the description here is not repeated.

  The CPU 11 of the gateway 10 according to the third embodiment acquires a maintenance schedule for updating a control program different from the control program requested to be updated from the management server 5. Then, after the CPU 11 performs the same process as in the first embodiment to determine the download timing of the update program (steps S101 to S105), the CPU 11 executes the other control programs during the download period started at that timing. Check if maintenance start time for updating is included.

  If maintenance for updating another control program is started during the download period (YES in step S201), the download is started until the completion of the other maintenance even when the download start time of the update program is reached It waits without doing (NO in step S205). Then, when the other maintenance is completed (YES in step S205), the download of the update program is started (step S109).

  In the program update system according to the third embodiment, even if the download of the update program is requested from the management server 5, if the download period of the update program overlaps with the maintenance period, at least the maintenance period Later, the download of the update program is started. Therefore, the download is not performed during the maintenance, and it is possible to avoid the occurrence of the download failure in the maintenance.

  In the third embodiment, when the memory of the gateway 10 has a margin, there may be cases where the maintenance does not fail even if another update program is downloaded during the maintenance. Therefore, preferably, referring to FIG. 9, even if maintenance for updating another control program is started during the download period, CPU 11 of gateway 10 (YES in step S201), gateway 10 If the free space of the memory is larger than the predetermined capacity (YES in step S203), the download of the update program may be started according to the determined schedule (step S109). In other words, maintenance for updating another control program is started during the download period (YES in step S201), and the free space of the memory of the gateway 10 is less than a predetermined capacity (step S203). (NO in step S205), without starting the download until completion of the other maintenance (NO in step S205).

Fourth Embodiment
In the program update system according to the first to third embodiments, it is assumed that the gateway 10 performs a process of determining a schedule for downloading the update program. However, the schedule determination process may be performed by a device different from the gateway 10. As another example, it may be performed by the management server 5.

  As an example, in the program updating system according to the fourth embodiment, when the management server 5 requests the vehicle 1 to update the control program in step S1 of FIG. Determine the schedule for downloading the program. Then, the management server 5 requests the gateway 10 of the vehicle 1 to download the update program at the determined timing. In this case, the gateway 10 downloads the update program at a timing when the update is requested, and requests the target ECU 30 for the update.

  In this case, as illustrated in FIG. 4, the determination unit 511 corresponding to the determination unit 112 and the control unit 113 have a function for determining the schedule for downloading the update program by the CPU 51 of the management server 5. Control unit 512 corresponding to FIG. These functions are mainly realized by the CPU 51 as the CPU 51 reads and executes one or a plurality of programs stored in the ROM 52. However, at least a part of the functions may be realized by hardware such as an electric circuit.

  It should be understood that the embodiments disclosed herein are illustrative and non-restrictive in every respect. The scope of the present invention is shown not by the above description but by the scope of claims, and is intended to include all modifications within the scope and meaning equivalent to the scope of claims.

1 vehicle 2 wide area communication network 5 management server 6 server 10 gateway 15 radio communication unit 30 ECU
11, 31, 51 CPU
12, 32 and 53 RAM
13, 33, 54 Storage unit 14 In-vehicle communication unit 34, 55 Communication unit 35 Activation unit 52 ROM
111 Acquisition Unit 112 Determination Unit 113 Control Unit 131, 332 Storage Memory 331 Function Memory 511 Determination Unit 512 Control Unit

Claims (8)

A control device that controls updating of a control program of an on-board control device that controls a target device mounted on a vehicle, comprising:
An acquisition unit configured to acquire, from an external device provided outside the vehicle, a maintenance schedule of the vehicle input from a user of the vehicle regarding updating of the control program in a dealer;
A determination unit that determines the start time of the download of the update program of the control program based on the start time of the maintenance;
A control unit that controls download of the update program;
Wherein the control unit, the downloading of the update program starts at the start determined by the determination unit,
The determination unit waits for the download of the update program, when the download period of the update program includes the start time of maintenance for the update of another control program.
Control device.   The control device according to claim 1, wherein the determination unit determines the start time of the download of the update program so as to start the download of the update program at least before the start of the maintenance. The acquisition unit further acquires the download required time of the update program,
The control device according to claim 2, wherein the determination unit determines the start time of the download of the update program such that the download of the update program is completed before the start of the maintenance.   The control device according to claim 3, wherein the determination unit determines the start time of the download of the update program such that a period from the completion of the download of the update program to the start of the maintenance is equal to or less than a specified time. . A memory for storing the update program;
The determination unit includes the start time of maintenance for updating another control program in the download period of the update program, and the free space of the memory is less than a predetermined capacity. The control device according to any one of claims 1 to 4, wherein the control device waits for download of the update program. When the in-vehicle control device includes a storage memory, the control unit controls writing of the control program to which the update program is applied to the storage memory.
The determination unit is configured to complete the download of the update program before the start of the maintenance and to complete the writing of the control program to which the update program is applied to the storage memory. The control device according to claim 3, wherein the control unit determines the start time of the download of the file. A method of updating a control program of an in-vehicle control device for controlling a target device mounted on a vehicle, comprising:
Acquiring, from an external device provided outside the vehicle, a maintenance schedule of the vehicle input from a user of the vehicle, regarding updating of the control program at a dealer.
Determining the start time of the download of the control program update program based on the start time of the maintenance;
Controlling the download of the update program.
Step of controlling the downloading, viewing including initiating a download of the update program at the start determined by determining the beginning of the download,
The step of determining the start time of the download includes waiting for the download of the update program, when the download period of the update program includes the start of maintenance for update of another control program.
Program update method. A computer program for causing a computer to function as a control device that controls updating of a control program of an in-vehicle control device that controls a target device mounted on a vehicle, the computer comprising
An acquiring unit configured to acquire, from an external device provided outside the vehicle, a maintenance schedule of the vehicle input from a user of the vehicle regarding updating of the control program in a dealer;
It functions as a determination unit that determines the start time of download of the update program for the control program based on the start time of the maintenance, and a control unit that controls download of the update program,
Wherein the control unit, the downloading of the update program starts at the start determined by the determination unit,
The determination unit waits for the download of the update program, when the download period of the update program includes the start time of maintenance for the update of another control program.
Computer program.

Images