JP6733726B2 - Replog system, replog master, and notification method for replog system - Google Patents

Description

The present invention relates to a replog system, a replog master, and a notification method for the replog system.

A large number of electronic control units (ECUs) are mounted on a vehicle, and these electronic control units cooperate with each other through an in-vehicle network to control vehicle devices. Conventionally, a technique for updating a program stored in the internal memory of this electronic control device has been provided (see, for example, Patent Document 1). According to the technique described in Patent Document 1, it is described that the program update device receives an update file for updating the program from the center device and updates the program corresponding to this update file.

JP, 2014-106875, A

In recent years, it has become possible to update a program by connecting to an in-vehicle network using various wireless communication technologies like the technology described in Patent Document 1. However, when remotely updating by wireless communication in response to a request from a terminal that can be operated by the vehicle user, there is a possibility that the program update process can be executed even in an environment in which the vehicle user can drive and operate the vehicle. In such a case, there is a possibility that the vehicle user may drive the vehicle while the program is being rewritten. For example, if the vehicle user operates the vehicle while the program rewriting process is insufficient, the vehicle may behave unintentionally.

An object of the disclosure of the present invention is a replog system, a replog master, and a replog that enable a vehicle user to safely drive and ensure safety when a program is updated in response to a request from a terminal operable by a vehicle user. It is to provide a method of informing the system.

According to the first aspect of the present invention, one of the electronic control devices connected to the in-vehicle network, which is a relog slave (RS) for updating a stored program, and one of the electronic control devices are also included. A replog master (RM) that downloads a program update file based on a request from the outside and performs control for updating the program stored in the replog slave, and a notification medium that notifies a user of the vehicle of information regarding the update And a relog system having.

The traveling propriety determination unit determines whether the vehicle is capable of traveling or not capable of traveling during updating of the program stored in the replog slave, and sets it as traveling propriety information. The notification command unit notifies the travel permission/inhibition information determined by the travel permission/inhibition determination unit from the notification medium before the program update file is downloaded, and allows the user to select whether or not to download the program update file. Give a command.

A block diagram schematically showing a configuration of a vehicle system in the first embodiment. Block diagram showing an electrical configuration example of the gateway device Block diagram showing an electrical configuration example of the ECU Block diagram showing a part of network connection configuration Block diagram showing an example of the electrical configuration of the mobile terminal Appearance of mobile terminal and in-vehicle display Explanatory drawing of contents of travel permission/inhibition table Sequence diagram showing the overall operation Sequence diagram showing operation during interruption Display contents of the display unit (1) Display contents of the display unit (Part 2) Display contents of display unit (3) Display contents of display unit (4) Display contents of display unit (5) The flowchart which shows the processing content of the replog master in 2nd Embodiment. Flowchart showing the flow of the method of determining the notification medium Display contents of display unit (6) Flowchart showing processing during interruption Flowchart showing the processing contents of Replog Master The flowchart which shows the processing content of the replog slave in 3rd Embodiment. Flowchart showing the processing contents of Replog Master

Hereinafter, some embodiments of a replog system, a replog master, and a notification method of the replog system will be described with reference to the drawings. In each embodiment described below, configurations that perform the same or similar operations are denoted by the same or similar reference numerals, and description thereof will be omitted as necessary. In addition, in the following embodiments, the same or similar configurations are described by assigning the same reference numerals to the tens place and the ones place.

(First embodiment)
1 to 14 show explanatory views of the first embodiment. As shown in FIG. 1, the vehicle system 1 according to the present embodiment makes it possible to update a program installed in a vehicle electronic control unit (hereinafter referred to as an ECU: Electronic Control Unit) installed in a vehicle. The system is a center device 4 including a file server 2 and a web server 3, a mobile terminal (corresponding to a terminal) 5 that is carried and operated by a vehicle user and is wirelessly connectable to the web server 3, and is installed in a vehicle. The in-vehicle system 6 is connected to each other. As will be described later, a monitor tool 48 can be externally connected to the in-vehicle system 6.

The file server 2 and the web server 3 are network-connected. The web server 3 can communicate with the mobile terminal 5 through the network 7 outside the vehicle. The web server 3 can communicate with the in-vehicle system 6 through the communication interface 8. The out-of-vehicle network 7 represents various communication networks such as a mobile communication network with 3G lines and 4G lines, an internet network, and a wireless LAN (for example, WiFi (registered trademark)).

Program update files are stored in the file server 2 by a program provider. The file server 2 has a program management function and is capable of transmitting an update file to the in-vehicle system 6 through the communication interface 9 to a vehicle equipped with an ECU that requires update processing.

An in-vehicle system 6 in a vehicle is connected to a central gateway device (CGW: Central GateWay: hereinafter abbreviated as a gateway device) 10, buses 11 to 15 of an in-vehicle LAN connected to the gateway device 10, and buses 11 to 15 A data communication module (hereinafter, referred to as DCM) 21 and various ECUs 22 to 31 are provided and operate by receiving a battery voltage supply. The DCM 21 is an interface module for wirelessly performing data communication with the center device 4 and the mobile terminal 5.

The gateway device 10 can use the DCM 21 to communicate with the external file server 2, web server 3, and mobile terminal 5. The gateway device 10 has a function as a replog master RM that downloads the update file from the file server 2 and transmits the update file to the program update target ECU to control the update. Replog master RM is an abbreviation for a master device for reprogramming.

Hereinafter, the program update process will be referred to as a “reprogram”, and the program update target ECU will be referred to as a replog slave RS as necessary. The replog slave RS is an abbreviation for a slave device for reprogramming. Here, one or more ECUs among the ECUs 22 to 31 serve as the replog slave RS.

FIG. 2 shows an electrical configuration example of the gateway device 10. The gateway device 10 is connected to all of the plurality of buses 11 to 15. The gateway device 10 includes a CPU 32, a ROM 33, a RAM 34, a microcomputer (hereinafter referred to as a microcomputer) 36 including a flash memory 35, and a transceiver 37, and the CPU 32 performs various operations based on programs stored in a memory as a non-transitional recording medium. Although processing is performed, the gateway device 10 operates using a power supply circuit 39 that receives power from the battery power supply +B for operating the vehicle device, and has a built-in timer. The accessory power supply ACC and the ignition power supply IG are also input to the power supply circuit 39.

For example, an LED 38 is connected to the microcomputer 36 of the gateway device 10, and the microcomputer 36 turns on/blinks the LED 38 so that internal information (for example, whether or not the vehicle can travel and the progress of reprogramming) can be displayed outside. ing.

The buses 11 to 15 of the vehicle-mounted LAN shown in FIG. 1 are constructed by, for example, a plurality of networks whose communication protocols are different from each other or the same, and these networks are, for example, a body network N1, a traveling network N2, and a multi-network. It can be divided into a plurality of networks such as the media network N3. Various ECUs 22 to 31 are connected to the buses 12 to 14 of these networks N1 to N3.

A bus 12 of the body network N1 (hereinafter referred to as a body bus) 12 has, for example, a door ECU 22 having various functions for locking/unlocking the door, and a display control of a meter to be controlled. ECUs such as a meter ECU 23 having various functions, an air conditioner ECU 24 for controlling an air conditioner, and a window ECU 25 for controlling opening/closing of a window glass are connected. These ECUs 22 to 25 will be referred to as body system ECUs 22 to 25 as necessary. The door ECU 22 is configured by connecting a door lock motor.

Further, an ECU having various other functions (for example, an airbag ECU having an airbag control function, a keyless entry ECU having a keyless entry control function based on an operation of a wireless key or a smart key, etc.) is connected to the body system bus 12. However, illustration and description thereof are omitted. For example, the meter ECU 23 displays various information such as a vehicle speed based on the vehicle speed information, an engine speed based on the engine speed information, and a remaining amount information of gasoline acquired by a remaining amount sensor (not shown) on an instrument panel or the like. It is an electronic control device for displaying on a container.

The bus 13 of the traveling network N2 (hereinafter, referred to as traveling system bus) 13 includes, for example, an engine ECU 26 having various functions for controlling an engine to be controlled, and a brake ECU 27 having various functions for controlling a brake. A power train system ECU such as an ECT ECU 28 having various functions for controlling the automatic transmission and a power steering ECU 29 for controlling the power steering is connected. These ECUs 26 to 29 are referred to as traveling system ECUs 26 to 29 as necessary. The engine ECU 26 makes the vehicle runable by driving an engine using gasoline fuel, for example.

An ECU having various other functions (for example, a parking ECU that detects the on/off state of the parking brake) is connected to the traveling bus 13, but the description thereof is omitted. Although not shown, various sensors such as a vehicle speed sensor, a throttle opening sensor, and an accelerator pedal opening sensor are connected to the engine ECU 26. A brake pedal sensor is connected to the brake ECU 27. The above-mentioned sensor for detecting the on/off state of the parking brake may be connected to the brake ECU 27.

Further, a shift lever position sensor or the like is connected to the ECT ECU 28. The shift lever position is a position such as parking (P), reverse (R), neutral (N), drive (D), etc., and the ECT ECU 28 can detect this position by a shift lever position sensor.

A bus (hereinafter referred to as a multimedia bus) 14 of the multimedia network N3 includes, for example, a navigation ECU (hereinafter referred to as a navigation ECU) 30 for controlling a navigation device to be controlled, an electronic fee collection system. An ECU such as an ETC ECU 31 for controlling (ETC: Electronic Toll Collection System: registered trademark) is connected. These ECUs 30 and 31 will be referred to as multimedia system ECUs 30 and 31 as necessary. These multimedia system ECUs 30 and 31 are vehicle electronic control devices that control multimedia electrical components for providing various types of information to users as control targets.

FIG. 3 shows a basic electrical configuration example of various ECUs such as a navigation ECU. For example, the navigation ECU 30 communicates with other ECUs using a transceiver 40 for sending/acquiring data to/from the bus 14 and a communication controller (not shown) that controls communication via the bus 14. A microcomputer (hereinafter, referred to as a microcomputer) 41 that realizes various functions assigned to its own ECU in cooperation with the above ECU. The microcomputer 41 includes a CPU 42, a ROM 43, a RAM 44, and a flash memory 45, and the CPU 42 performs various processes based on a program stored in a memory as a nontransitional recording medium. The gateway device 10 operates using the output voltage of the power supply circuit 49 which receives power from the battery power supply +B. Various storage devices are connected to the navigation ECU 30, and map data, music data, and the like are stored in these storage devices. Then, the navigation ECU 30 periodically sends to the multimedia bus 14 the information on the current position of the vehicle, which is acquired based on the map data stored in the position detector (for example, GPS receiver) and the storage device.

The ECUs 22 to 31 have substantially the same hardware configuration as the navigation ECU 30 shown in FIG. 3, although the loads (sensors and actuators) connected to the ECUs 22 to 31 may be different from each other. 2 and 3, the gateway device 10 or the ECUs 22 to 31 detect the voltage value of the battery power source +B, the voltage value of the accessory power source ACC, and the voltage value of the ignition power source IG, and respectively detect them. The detectors 39a and 49a for comparing with a predetermined threshold voltage and outputting the comparison result to the microcomputers 36 and 46 are provided.

A temperature sensor (not shown) that acquires the operating temperature of each of the ECUs 22 to 31 is connected to all or any of the ECUs 22 to 31, and each of the ECUs 22 to 31 acquires the sensor information of the temperature sensor. The operating temperature information can be obtained with.

A switch signal based on an ignition switch or a push button for starting/stopping the engine is input to the body system ECUs 22 to 25, and the microcomputer 41 of the body system ECUs 22 to 25 responds to the switch signal by the accessory power supply ACC. , ON/OFF of the output of the ignition power supply IG is controlled using a relay (not shown).

When the switch signal is OFF, only the battery power source +B is supplied to the ECU to be supplied, and when the switch signal is ACC, the accessory power source ACC is supplied to the ECU to be supplied (any one or more of 22 to 31) to be IG. Then, the ignition power supply IG is supplied to the ECU (any one or more of 22 to 31) to be supplied together with the accessory power supply ACC.

As shown in FIG. 4, each of the ECUs 22 to 31 is network-connected to the gateway device 10, but each of the ECUs 22 to 31 is connected with the sensor SE such as the various sensors described above and the switch SW. The sensor SE is a general term for various sensors (for example, a vehicle speed sensor, a water temperature sensor, a camera, an engine speed, a temperature sensor, an air temperature sensor, and a gasoline remaining amount sensor) connected to each of the ECUs 22 to 31. The switches SW are various switches connected to the ECUs 22 to 31 (for example, an ignition switch, a parking brake on/off detection sensor, a shift lever position sensor, a lock position switch, a seat belt determination switch, a seating switch, etc.). Are collectively referred to.

Any one or more ECUs (e.g., the navigation ECU 30) of the large number of ECUs 22 to 31 are configured by connecting a display 46. Hereinafter, description will be made assuming that the display 46 is connected to the navigation ECU 30. The display 46 is a vehicle-mounted display device such as a center information display (CID) or a head-up display (HUD). The display 46 may be a meter display on the instrument panel.

An external view of a CID is shown as the display 46 in FIG. 6B, but the display 46 has a display 46a and an operating unit 46b. The operation unit 46b is configured using a group of operation switches mounted on the side of the display unit 46a of the display device 46 and/or a touch panel below the display screen of the display unit 46a, and is configured to be operated by the vehicle user. .. When the operation unit 46b is operated by the user, a signal related to the operation is transmitted to the navigation ECU 30, and the microcomputer 41 of the navigation ECU 30 executes various processes.

As shown in the electrical configuration example of the mobile terminal 5 in FIG. 5, the mobile terminal 5 includes a display unit 5a, an operation unit 5b, a communication unit 5c, and a microcomputer 50. The microcomputer 50 includes a CPU, a ROM, a RAM, and the like (none of which are shown), and accepts and displays operation information of the operation unit 5b based on a program stored in a memory as a non-transitional recording medium. Various processing such as display processing on 5a is performed. The communication unit 5c allows the microcomputer 50 to access the DCM 21 shown in FIG. 1 by the short-distance wireless communication (for example, Bluetooth (registered trademark)) in addition to the vehicle exterior network 7. An application (for example, a browser) for accessing the web server 3 is pre-installed in the memory of the microcomputer 50 of the mobile terminal 5 according to a user instruction, and a program is executed through the web server 3 when the user executes this application. Update instructions can be given. Further, FIG. 6A shows an external view of the mobile terminal 5, which includes a display unit 5a and an operation unit 5b on the external appearance.

The program stored in the microcomputer 41 of each of the ECUs 22 to 31 shown in FIG. 1 is a program required when each of the ECUs 22 to 31 controls a device to be controlled assigned to its own ECU, and is to be updated. It consists of the update file and other non-update target files. That is, the update file refers to at least some or all of the program files among all the program files.

Further, as shown in FIG. 1, the gateway device 10 is connected to a bus 15 of a development, test, and analysis network, and an OBD (On-board diagnostics) connector 47 is connected to the bus 15. The OBD connector 47 can be connected to the monitor tool 48 from the outside when a vehicle designer, a dealer, or a worker in a repair shop needs it, for example.

The gateway device 10 receives all the data transmitted to all the buses 11 to 15, and detects the state inside the vehicle, that is, the operation state by the driver, the vehicle state, and the vehicle behavior. In addition, the gateway device 10 includes, in the flash memory 35, a traveling propriety determination table TA1 in which a condition for updating the program is defined for each of the ECUs 22 to 31.

As shown in FIG. 7, the traveling propriety determination table TA1 describes relationship information that correlates traveling propriety of each of the ECUs 22 to 31 with a CANID connecting the ECUs 22 to 31, a connection bus, and a name. In this traveling propriety determination table TA1, traveling propriety may not be described in association with all of CANID, connection bus, and name, and traveling propriety may be associated with any one of CANID, connection bus, or name. It should be written.

A part of the content of the travelability determination table TA1 will be described. For example, although the door ECU 22 is connected to the body system bus 12, when the monitor tool 48 or the gateway device 10 assigns 0x700 as the CANID and transmits, for example, the door ECU 22 accepts this request, and the door ECU 22 sets the CANID as 0x708. It is also described in association with the fact that the door ECU 22 can respond to the request, and that the door ECU 22 can travel (running propriety=possible) even while the program is being updated.

Further, for example, the power steering ECU 29 is connected to the traveling system bus 13, but when the monitor tool 48 and the gateway device 10 send 0x702 as the CANID to the power steering ECU 29 via the bus 13, the power steering ECU 29 accepts this request and the power steering ECU 29 receives the request. It is written that the ECU 29 sends a response with 0x70A as the CANID, and it is written that the power steering ECU 29 is incapable of running (running propriety=no) during the updating of the internal program.

Also in the other ECUs, when the monitor tool 48 or the gateway device 10 transmits with a number in the 700 range as a CANID, the corresponding ECU accepts this request, and the CANID received by this ECU is a number that adds 8 to the number. It is described that a response is returned with a mark, and information on whether or not the vehicle can travel is stored corresponding to each of these ECUs. As shown in FIG. 7, the relationship information in which the CAN ID, the ECU name, the connection bus, and the traveling propriety are associated with each other is also associated with the standard format or the extended format defined in the CAN specifications, for example.

When the contents shown in FIG. 7 are roughly summarized and described, it is described in the traveling propriety determination table TA1 that the traveling system ECUs 26 to 29 cannot travel while the internal program is being updated. The multimedia ECUs 30 and 31 are associated with each other and can run even while the internal program is being updated. Further, it is stored that the meter ECU 23 and the air conditioner ECU 24 connected to the body system bus 12 can run even while the internal program is being updated. In the traveling propriety determination table TA1, detailed update conditions when the vehicle is traveling/stopped (for example, high/low battery remaining amount, high/low connected bus load, high/low vehicle load, vehicle interior temperature condition, etc.) are set, The travel availability information may be associated with these update conditions and stored as related information, or exceptional conditions may be provided and set for these.

Then, the microcomputer 36 of the gateway device 10 executes the program update process by referring to the travelability determination table TA1 stored in the flash memory 35 based on the program stored in the memory by the CPU.

Hereinafter, the flow of the program update process in the entire system will be described with reference to the sequence diagrams of FIGS. 8 and 9 and the display screens of FIGS. 9 to 13.
In the following description, it is assumed that the user can remotely operate a device inside the vehicle (for example, engine start/stop, that is, turning on the power supply ACC, IG, etc.) from outside the vehicle using a wireless key or a smart key, and program update is performed. An example of displaying the progress of processing on the display 5a of the mobile terminal 5 owned by the user will be described. Further, the display content of the display 5a of the mobile terminal 5 in the following operation description may be displayed on the display 46 by the navigation ECU 30, so the description will be added as necessary.

Further, the processing of the gateway device 10 in FIG. 8 described below is processing performed by the microcomputer 36 executing the program, and the processing of the mobile terminal 5 is performed by the built-in microcomputer 50 executing the program. It is a process that is performed.

First, as shown in FIG. 8, when an update file is stored in the file server 2 of the center apparatus 4 in step S1, the file server 2 reprograms the web server 3 through the network in step S2 of FIG. Notify that an event has occurred. When the vehicle user operates the portable terminal 5 to access the web server 3, the event occurrence notification is received in step S3 of FIG. The mobile terminal 5 may automatically access the web server 3 to receive the event notification. At this time, the mobile terminal 5 displays the event content on the display 5a as shown in FIG. For example, as shown in FIG. 10, the mobile terminal 5 causes the display device 5a to display "The update data of the in-vehicle program has been confirmed. Do you want to download it?", and the download button B1 on the display device 5a. Display it. When the vehicle user presses the download button B1 displayed on the display 5a of the mobile terminal 5, for example, the update file of the program is requested to be updated (download DL). The mobile terminal 5 accepts this request through the operation unit 5b using the touch panel. The mobile terminal 5 specifies the update file by requesting the gateway device 10 to download through the web server 3 in step S4 of FIG. At this time, as shown in FIG. 10, the mobile terminal 5 may display the traveling propriety information X2 on the display 5a, and in this case, the traveling propriety information X2 may be displayed as “permissible”.

When the update file is designated, the web server 3 instructs the gateway device 10 to download the update file through the DCM 21 in step S4. The gateway device 10 determines whether or not the download is possible by determining the free space and resources of the flash memory 35 and the like. This determination as to whether or not the download is possible is made when the remaining amount of the battery power source +B installed in the vehicle is sufficiently higher than a predetermined amount, for example, the voltage of the battery power source +B is a predetermined voltage or higher, and the DCM 21 and the communication interface. It may include any one or more or all of the conditions that the communication radio wave environment with 8 or/and 9 is stable, for example, the mutual reception electric field strength level is a predetermined level or more.

Then, the gateway device 10 requests the update file from the file server 2 through the DCM 21 in step S5 of FIG. 8 on condition that the download is possible. As a result, the file server 2 delivers the update file to the gateway device 10 through the DCM 21 in step S6 of FIG. 8, and the gateway device 10 can download the update file in step S6.

When the gateway device 10 completes the download of the update file, the mobile terminal 5 is notified of the completion of the download in step S7a of FIG. 8, and the mobile terminal 5 displays the completion of the download on the display 5a. Further, the gateway device 10 may notify the navigation ECU 30 of the completion of the download as shown in step S7b of FIG. 8, and cause the navigation ECU 30 to display the completion of the download on the display 46. FIG. 11 shows a display example of the download completion screen. The portable terminal 5 is still displaying the traveling propriety information on the screen of the display unit 5a at this time. The mobile terminal 5 also displays the update start button B2 on the download completion screen, and the mobile terminal 5 accepts the user's instruction to press the update start button B2. When the vehicle user confirms the download completion screen, he or she operates the operation unit 5b of the mobile terminal 5 or the operation unit 46b mounted on the display 46 to instruct the reprogram start of the update file. When issuing a reprogram start instruction, the user issues an operation command for the in-vehicle device (for example, an engine start command) in response to operating a wireless key or a smart key from outside the vehicle. Then, power supplies for various operations are applied to the power supply circuit 39 of the gateway device 10 and the power supply circuit 49 of each of the ECUs 22 to 31.

When the vehicle user issues an update start instruction by executing the application stored in the mobile terminal 5 to issue a reprogram execution instruction in step S8a, this instruction information is transmitted to the web server 3. Then, the web server 3 notifies the gateway device 10 of the command through the DCM 21 in step S8a.

On the other hand, when the vehicle user makes an update request to the navigation ECU 30 by operating the operation unit 46b in step S8b, the navigation ECU 30 notifies the gateway device 10 of the update request to request reprogram execution in step S8b of FIG. ..

The gateway device 10 identifies the ECU (any one or more of 22 to 31) to be the replog slave RS according to the content of the update file. Then, the gateway device 10 determines the getting-on/off state in step S9 of FIG. 8, the vehicle state in step S10 of FIG. 8, and is identified when these states satisfy the necessary conditions. An update file is transmitted to the reprog slave RS to issue a reprogram command.

Prior to performing the processing of steps S9 and S10 of FIG. 10 or in parallel, the gateway device 10 collates the CANID, the connection bus, or the name of the replog slave RS with the traveling propriety determination table TA1 to determine whether traveling is possible. May be determined, and the mobile station 5 and the navigation ECU 30 may be informed of this information as an initial notification in step SA.

In particular, the gateway device 10 determines that traveling is not possible when the replog slave RS is the ECU 26 to 29 connected to the traveling bus 13. In this case, the gateway device 10 may give the mobile terminal 5 an initial notification command of the traveling propriety information X2 indicating that traveling is not possible. Then, by displaying the traveling propriety information X2 indicating that the portable terminal 5 is incapable of traveling, the vehicle user can recognize the traveling propriety information X2 that the traveling is impossible. In this case, the gateway device 10 does not output the reprogram execution command.

Hereinafter, an example of the determination conditions of steps S9 and S10 will be described in detail. The determination conditions in step S9 are, for example, condition A1: an occupant does not exist in the vehicle, condition A2: the voltage of battery power source +B is a predetermined value or more, condition A3: the door lock position is in a locked state. Conditions A4: the shift position is parked and the parking brake is on, condition A5: the above conditions A1 to A4 are satisfied within a predetermined time from the reprogramming start timing, and the like. That is to satisfy some or all of them.

At this time, the gateway device 10 acquires necessary information from the gateway device 10 itself or the ECUs 22 to 31 and determines whether or not the conditions A1 to A5 are satisfied, or the target ECU among the ECUs 22 to 31 determines the conditions A1 to A5. It is better to voluntarily determine whether or not the condition is satisfied.

The condition A1 may be determined by the boarding determination process described above. The condition A2 may be determined based on the output result of the detectors 39a and 49a that detect the detected value of the voltage of the battery power source +B, and/or the output of the power supply circuits 39 and 49. The condition A3 may be determined based on, for example, a door lock/unlock state obtained by driving the door lock motor acquired by the door ECU 22. The condition A4 may be determined based on, for example, the sensor information of the shift lever position sensor acquired by the ECT ECU 28 or the like, or the information of the on/off state detection sensor of the parking brake acquired from the ECU such as the parking ECU or the brake ECU 27. Regarding the condition A5, it is preferable that the gateway device 10 or another ECU measures time using, for example, a timer, and conditions A1 to A4 are satisfied before the measured time exceeds a predetermined time. As a result, it is possible to determine the entry/exit state in step S9.

Further, the determination condition of step S10 is that condition A10: the gateway device 10, the DCM 21, and the replog slave RS do not have any diagnostic abnormality, and the condition A11: the operating temperature of the gateway device 10, the DCM 21, and the replog slave RS is high. No, for example, it is operating within an appropriate operating temperature range, condition A12: the replog slave RS or the ECU related to the replog slave RS is not used, condition A13: the remaining amount of the battery power source +B is sufficient, the condition A14: The remaining amount of gasoline is sufficient, for example, the remaining amount of gasoline is a predetermined amount or more, condition A15: user confirmation is obtained when remote rewriting is performed according to a vehicle user instruction, condition A16: intermediate of gateway device 10. The predetermined condition is that the update file to be reprogrammed is stored in the buffer area (corresponding to the storage unit). The gateway device 10 obtains these pieces of information from the gateway device 10 itself, the DCM 21, the ECUs 22 to 31, and determines the conditions A10 to A16, or the condition A10 to which the target ECU of the ECUs 22 to 31 corresponds. ~A16 may be voluntarily determined, and the result may be transmitted to the gateway device 10 to determine whether the gateway device 10 comprehensively satisfies the conditions A10 to A16.

The condition A10 is preferably determined by the gateway device 10 by acquiring diagnostic information indicating the content of the abnormality from the DCM 21, the ECUs 22 to 31, or the target ECU that is the replog slave RS. The condition A11 may be determined based on the detection information of the temperature sensors installed in the gateway device 10, the DCM 21, and the replog slave RS, for example. The condition A12 may be determined based on the operation information of the replog slave RS and the operation information of the ECU related to this operation information. The condition A13 may be set, for example, when the detection voltage of the battery power source +B by the detection units 39a and 49a is equal to or higher than a threshold voltage, or the output voltage of the power supply circuits 39 and 49 is equal to or higher than a predetermined value. The condition A14 may be determined, for example, based on the detection information of the gasoline remaining amount sensor connected to the meter ECU 23.

Under condition A15, the gateway device 10 instructs the display device 5a of the mobile terminal 5 to display a confirmation button (not shown) together with a message such as "Can you start program rewriting?" A confirmation completion signal is transmitted to the gateway device 10 on condition that the confirmation button is depressed by the vehicle user and the depression signal is accepted through the operation unit 5b, and condition A15 is established on condition that the gateway device 10 accepts the confirmation completion signal. It is good to judge that it satisfies. The condition A16 may be determined to be acceptable when the download DL is completed without any abnormality in step S6 of FIG. Thereby, the vehicle state can be determined.

When the conditions of steps S9 and S10 are not satisfied, the gateway device 10 commands the mobile terminal 5 to display the travel permission/prohibition information X2 indicating that traveling is not possible, and causes the display device 5a to display the information. Then, the vehicle user can recognize that the vehicle cannot travel. In this case, the gateway device 10 does not output the reprogram execution command until the conditions of steps S9 and S10 are satisfied.

When it is determined that the conditions of steps S9 and S10 are satisfied, the gateway device 10 transmits the update file to the relog slave RS in step S11 of FIG. 8 and issues a reprogram execution command.

Even if the gateway device 10 issues a reprogram execution command on the condition that the traveling propriety described in the traveling propriety table TA1 related to the ECU corresponding to the reprog slave RS is not traveling and the conditions of steps S9 and S10 are satisfied. good. Furthermore, the gateway device 10 may issue a reprogram execution command on the condition that the travel propriety described in the travel propriety table TA1 of all ECUs corresponding to the reprog slave RS is travelable.

When the gateway device 10 transmits the update file to the replog slave RS and issues a reprogram execution command in step S11 of FIG. 8, the replog slave RS receives the update file and executes reprogram processing in step S12. This rewriting process includes an entry, an old program erasing process, a new updating file writing process, a written updating file verifying process, and a post-process thereof.

In this way, when the gateway device 10 issues a reprogram execution command, in steps SB and SC of FIG. 8, information indicating that the reprogram is being executed and a stable state maintenance request are included in the reprog slave RS and the navigation ECU 30. It transmits to all the other ECUs 22 to 31. By performing this process, the gateway device 10 can request all the ECUs 22 to 31 including the replog slave RS to maintain the reprogrammable state and the traveling state.

This stable state maintenance request is issued by, for example, state C1: maintaining the reprogrammable state of each of the ECUs 22 to 31, state C2: engine start/stop key switch (or push button) or wireless key switch. Even if operated, the state of the ignition power source IG or the accessory power source ACC is maintained and the power supply to each of the ECUs 22 to 31 cannot be stopped. State C3: In response to a wireless operation instruction by a wireless key or smart key used for keyless entry Also requests the ECUs 22 to 31 to maintain the door lock state, state C4: maintain the shift position in the parking state, and the like. Further, the gateway device 10 changes the subroutine of its own program so that the state C5: the download is not executed even when the user instruction of the download is received.

When each of the ECUs 22 to 31 receives the stable state maintenance request, the ECUs 22 to 31 rewrite the contents held in the memory (for example, the RAM 44 and the flash memory 45) or control the connection load (actuator) so as to maintain the states C1 to C4. In order to maintain the state C1, each of the ECUs 22 to 31 retains data in the memory so as to set the reprogrammability state to rewritable. In order to maintain the state C2, the body system ECUs 22 to 25 disable the output stop by the relay control of the accessory power supply ACC and the ignition power supply IG according to the change of the switch signal. Further, in order to maintain the state C3, the door ECU 22 maintains the state of the door lock motor M1 to maintain the door lock state, and to maintain the state C4, the ECT ECU 28 maintains the shift position in the parking state.

The stable state maintenance request is provided to stably maintain the reprogrammable state by satisfying the conditions of steps S9 and S10 for each of the ECUs 22 to 31 including the replog slave RS. In other words, this stable state maintenance request is stable even during reprogramming of each state inside the vehicle (for example, the state of power supply voltage by the ignition power source IG, the accessory power source ACC, the shift position, the unmanned state of the vehicle interior, etc.). Indicates the requirements that are set to hold. The gateway device 10 can maintain each state of the vehicle, for example, by prohibiting the door lock operation or keeping the parking brake in the on state by the request for maintaining the stable state, and the reprogram processing is performed. The stable execution can be completed.

After this, the reprog slave RS starts reprogramming. The replog slave RS notifies the gateway device 10 of a travel enable/disable signal at the start timing of executing the rewriting process of the update file. ECUs (especially ECUs 26 to 29 connected to the traveling system bus 13) other than the ECUs forming the replog slave RS also transmit a travel permission/prohibition signal to the gateway device 10 in response to a request from the gateway device 10, for example. At this time, when the gateway device 10 receives the plurality of traveling permission/prohibition signals from any one of the ECUs in step S13, the gateway device 10 receives the traveling prohibition information with priority. And good.

If the gateway device 10 determines that the vehicle is allowed to travel in step S13 of FIG. 8 without receiving such information indicating that the vehicle cannot be traveled, the gateway device 10 outputs a travel-enabled notification signal to, for example, the travel bus 13. Then, the ECUs 26 to 29 connected to the travel system bus 13 return the program processing routine to the travelable state. Further, when the gateway device 10 determines in step S13 of FIG. 8 that traveling is possible, the gateway device 10 issues a notification command in step S14 of FIG. 8 that traveling is possible. At this time, for example, the gateway device 10 notifies the user's mobile terminal 5 and/or the navigation ECU 30 of the travel enable notification signal. For example, when the mobile terminal 5 receives the travel enable notification signal, as shown in FIG. 12A, the mobile terminal 5 displays the progress status X1, the travel availability information X2, and the cancel button B3 related to the program update on the display 5a. Display it. On the display screen of the display 5a, a message indicating that the vehicle can run even while the program is being updated is displayed.

When the gateway device 10 receives a travel enable/disable signal indicating that travel is not possible from any one of the ECUs in step S13, the gateway device 10 does not output the travel enable notification signal to the travel bus 13. At this time, the ECUs 26 to 29 connected to the traveling bus 13 determine that traveling is not possible and disable traveling control. Further, the gateway device 10 may output a travel-disabled notification signal to the travel bus 13. At this time as well, the ECUs 26 to 29 connected to the traveling bus 13 determine that traveling is not possible and disable traveling control.

At this time, the gateway device 10 issues an instruction to issue the traveling propriety information X2 indicating that traveling is not possible in step S15 of FIG. When the portable terminal 5 receives the signal indicating that traveling is not possible, or when the signal indicating that traveling is possible is not received, as shown in FIG. 12B, traveling propriety information X2 indicating that traveling is not possible is displayed. Display on the display 5a. At this time, it is desirable to display, on the display 5a of the mobile terminal 5, the remaining time information X3b indicating, for example, how many seconds the vehicle can travel, together with the traveling propriety information X2.

Then, after that, when the relog slave RS completes the execution of the reprogram processing, the replay completion information is notified to the gateway device 10, and the gateway device 10 notifies the portable terminal 5 of the reprogram completion information. Then, as shown in FIG. 12C, the mobile terminal 5 makes the traveling permission/prohibition information X2 acceptable after the reprogramming is completed, and indicates to the vehicle user by displaying that traveling is possible.

FIG. 9 shows a sequence diagram when an interruption request is made. Here, an example in which the vehicle user operates the mobile terminal 5 and presses the cancel button B3 to make an interruption request is shown. When the vehicle user operates the portable terminal 5 in step S20 of FIG. 9 to press the cancel button B3 to make an interruption request, the interruption request is given to the gateway device 10 through the web server 3 and the DCM 21. Upon accepting this interruption request, the gateway device 10 makes an interruption request by transmitting an interruption command to the replog slave RS in step S21 of FIG. At this time, the replog slave RS stops the program update process in a state where it does not affect traveling, or sets the program update process as an initial state to return to a runnable state and interrupt rewriting.

Further, when the gateway device 10 receives the interruption request and then receives the interruption completion signal indicating that the interruption is completed from the replog slave RS in step S22 of FIG. 9, the gateway device 10 transmits the traveling enable notification signal as the traveling permission/prohibition signal in step S23 of FIG. The data is transmitted to the mobile terminal 5 or the navigation ECU 30 through the DCM 21 and the web server 3. When the mobile terminal 5 receives the travel enable notification signal, the mobile terminal 5 causes the display 5a of the mobile terminal 5 to display the travel enable/disable information X2 indicating that travel is possible, as shown in FIG. As a result, the vehicle user can determine that the vehicle can travel. The gateway device 10 also transmits a travel enable notification signal to the travel bus 13. Then, the ECUs 26 to 29 connected to the travel system bus 13 can determine that the vehicle can travel, and the process is returned to the vehicle travel enable processing routine.

In the example described above, the mobile terminal 5 makes an interruption request through the web server 3, but when making an interruption request in the vehicle, another ECU (for example, the navigation ECU 30) transmits an interruption request to the gateway device 10. To do. This interrupts the processing.

<Summary>
According to the present embodiment, the gateway device 10 instructs the mobile terminal 5 to display the traveling propriety information X2, so that the display device 5a can appropriately notify the vehicle user of the propriety of driving. As a result, the vehicle user can confirm whether or not the vehicle can travel, and can immediately determine whether or not the vehicle can be driven. For example, when the system 1 is reprogramming a portion that does not directly affect traveling, it can be informed that the vehicle can be driven, so that the vehicle user can drive as quickly as possible.

Further, for example, when the vehicle user determines that it is urgent, the vehicle user presses the cancel button B3 so that the gateway device 10 accepts the interruption request. At this time, when the gateway device 10 accepts the interruption request, it sends an interruption command to request the interruption of the update file rewriting process. At this time, even in an emergency, the replog slave RS stops the program update process in a state where it does not affect traveling, or sets the program update process as an initial state to return to a travelable state and interrupt rewriting. Then, the gateway device 10 issues a display command to the mobile terminal 5 to indicate that the mobile device 5 is ready to run after the interruption is completed. As a result, the vehicle user will not accidentally operate even during reprogramming, and the vehicle user can drive and travel in a safe state even during remote rewriting. Note that the gateway device 10 may transmit the interruption command when the rewriting interruption is required by determining the operation of the mobile terminal 5 by the vehicle user.

The gateway device 10 determines the traveling propriety by collating the CANID, the connection bus, or the name of the replog slave RS with the traveling propriety determination table TA1, and when displaying the traveling propriety information to the mobile terminal 5, the display device 5a displays this. Since the traveling propriety information X2 is displayed, the vehicle user can immediately confirm the traveling propriety information X2.

When the gateway device 10 issues a reprogram execution command to the replog slave RS on condition that it is determined that the ECU corresponding to the replog slave RS stored in the executability judging table TA1 is ok to travel, the reprogram processing is performed. Can be executed immediately without having to wait.

When the gateway device 10 receives a travel permission/prohibition signal from the replog slave RS or an ECU other than the ECUs configuring the replog slave RS, the gateway device 10 instructs the mobile terminal 5 or the like to display the travel permission/prohibition information X2 related to the travel permission/prohibition signal. Therefore, the vehicle user can confirm the traveling propriety information X2.

FIG. 14 shows a display screen in place of FIG. 11 as a modified example, but before starting reprogramming, for example, the waiting time after the start of updating may be displayed. That is, as shown in FIG. 14, in response to the display command of the gateway device 10, the mobile terminal 5 displays the remaining time information X3b that "after the start of the update, it is necessary to wait for x0 seconds to run." It may be displayed on the container 5a.

<Modification>
Hereinafter, a case where the user gives a reprogram start instruction in a state where the user gets in the vehicle will be described. In the above description, the form in which the user starts the engine from outside the vehicle and gives a reprogram instruction is shown, but it is applicable even when the user operates the key switch (or push button) to start the engine while the user is in the vehicle. ..

For example, any of the conditions A1 to A5 of the entry/exit state determined in step S9 of FIG. 8 may be provided as necessary, but there are vehicles that are not equipped with a seating sensor or an intrusion sensor, for example. .. Therefore, the case where the condition A1 is excluded will be considered.

In such a case, in the entry/exit state of step S9 in FIG. 8, the determination condition is satisfied when the conditions A2 to A5 are satisfied. Therefore, even if the user is in the vehicle, for example, the door is locked. If the door lock condition A3 is satisfied by setting the lock state, the condition A4 is satisfied by holding the shift lever and the parking brake in the predetermined state described above, and the vehicle power supply condition A2 and the time condition A5 are satisfied, the step The condition of the entry/exit state of S9 is satisfied.

It is assumed that the user starts the engine in response to the operation of the key switch or the push button in the vehicle, and then operates the operation unit 46b of the display 46 to instruct the reprogram. Since it is necessary to satisfy steps S9 and S10 of FIG. 8 to start reprogramming, the vehicle equipment (eg, shift lever, door lock, etc.) is designed so that the user intentionally satisfies the conditions A3, A4, etc. of step S9. , Parking brake), the condition of step S9 is satisfied. In this case, in step S11 of FIG. 8, the reprogram execution command is output to the reprog slave RS. Since the user is in the vehicle, if the user subsequently performs various operations on the vehicle equipment, the vehicle state may change and reprogramming may fail.

In consideration of such a situation, it is particularly desirable that the gateway device 10 provides a process of outputting a stable state retention request to the replog slave RS or another ECU in steps SB and SC of FIG. 8. Then, each of the ECUs 22 to 31 can stably hold the vehicle state, and in particular, an erroneous operation of the vehicle operation unit (the operation unit 46b, the key switch or the push switch, the shift lever, the steering wheel, the accelerator, etc.) by the user, the erroneous operation. It is possible to prevent the vehicle from erroneously starting, the reprogramming process failing, and the user's escape from the vehicle.

Similarly, any one of the determination conditions A10 to A16 in step S10 may be provided as needed. Further, the same can be applied to the case where the status of the program update processing is displayed on the display screen of the display device 46 which is an in-vehicle display device.

(Second embodiment)
15 to 19 show additional explanatory views of the second embodiment. Since the present embodiment is characterized by the progress display command processing and the progress determination processing, the progress display command processing and the progress determination processing will be described. As shown in the first embodiment, the reprog slave RS executes the reprogram processing when receiving the update file.

The progress display command process and the progress determination process according to the present embodiment are processes performed by the gateway device 10 that is the replog master RM, and are performed in parallel while the replog slave RS is performing the reprogram process. It is a process that is performed.

Also in this embodiment, the gateway device 10 is shown to function as the replog master RM. The mobile terminal 5 according to the present embodiment is equipped with a GPS receiver that receives GPS signals, and has a position specifying function that specifies a position based on this GPS receiver.

First, as indicated by U1 in FIG. 15, the gateway device 10 determines a notification medium. The notification medium indicates various display media such as a display 46 connected to various ECUs, a mobile terminal 5, a display such as an LED 38 mounted on the gateway device 10, for example. FIG. 16 is a flowchart showing the flow of the method of determining the notification medium.

As shown in FIG. 16, the gateway device 10 identifies the distance of the mobile terminal 5 from the vehicle in step V1. For example, the gateway device 10 receives the current position by the position specifying function of the mobile terminal 5, compares the current position with the current position specified by the navigation ECU 30, and determines whether the mobile terminal 5 exists around the vehicle. Determine whether or not. Further, for example, it may be determined whether or not communication is established by a short-range wireless technology (for example, a communication range of about 10 to 100 m). For example, when Bluetooth technology is used, it is determined whether or not pairing is performed. Alternatively, it may be determined whether or not the vehicle exists around the vehicle based on this determination result.

Then, when it is determined that the mobile terminal 5 does not exist around the vehicle, the gateway device 10 determines NO in step V2, and determines the notification medium to be the mobile terminal 5 owned by the user in step V3. On the other hand, when the gateway device 10 determines that the mobile terminal 5 is present around the vehicle, the gateway device 10 determines YES in step V2, and the gateway device 10 determines whether the user is aboard or alights in step V4. Identify. For example, at this time, the gateway device 10 may be identified by using a seating sensor or an intrusion sensor installed in advance in the vehicle compartment as shown in the above embodiment.

When it is determined in step V5 that the driver is in the vehicle, the gateway device 10 determines the in-vehicle display device as the notification medium in step V6. This in-vehicle display device represents the display device 46, and is a display device such as a CID, a HUD, an instrument panel, etc., which is installed in a position directly visible from the inside of the vehicle in which it is determined that the driver is present. Therefore, the driver can immediately check the information displayed on the display screens of these in-vehicle display devices while the driver is in the vehicle.

On the contrary, when the gateway device 10 determines in step V5 that the driver is not in the vehicle, the gateway device 10 determines the user's mobile terminal 5 and the LED 38 as the notification medium in step V7. At this time, when the gateway device 10 determines the LED 38 in step V7, for example, the blinking cycle may be lengthened when the progress status X1 is close to 0%, and gradually shortened when the progress status X1 is close to 100%. .. Further, the color of the LED 38 may be changed. Therefore, even if the driver is not on the vehicle, the vehicle user or the like can immediately confirm the information by checking the lighting/blinking state of the display 5a or the LED 38 of the portable terminal 5.

For example, when the gateway device 10 decides to display on the mobile terminal 5, the gateway device 10 instructs the mobile terminal 5 to display the content shown in FIG. Here, as in the first embodiment, as shown in FIG. 17A, the mobile terminal 5 displays the progress status X1, the travel availability information X2, and the cancel button B3 on the display device 5a. In the initial state, the progress status X1 indicates 0%, the traveling propriety information X2 indicates that traveling is possible, and the cancel button B3 is displayed so as to accept the update interruption.

After the gateway device 10 determines the notification medium, the process returns to the process of FIG. 15 and it is determined in step U2 whether the reprogram is in progress or completed. When the gateway device 10 performs the series of processes illustrated in FIGS. 15 and 16, the processes illustrated in the first embodiment are performed in parallel. However, when the gateway device 10 is in the middle of reprogramming, In step U3, the progress status is calculated.

As a whole sequence, the gateway device 10 can grasp the transmission end update file by transmitting the update file to the replog slave RS and receiving the response signal from the replog slave RS.

A method based on the in-vehicle diagnostic communication specification will be described. The gateway device 10 divides the update file at the time of reprogram into messages according to the standard such as UDS (Unified Diagnostic Services) defined by ISO14229 which is a diagnostic communication specification of ECU of a passenger car, and sends it to the replog slave RS. To do. At this time, the gateway device 10 transmits the service ID (SID34) indicating the start of data transfer to the replog slave RS, and then transmits the data a plurality of times together with the service ID (SID36) indicating the actual data transfer, and ends the data transfer. The service ID (SID37) indicating the is transmitted.

Therefore, the microcomputer 36 of the gateway device 10 can determine the progress status according to the amount of transmission data transmitted to the replog slave RS. As a specific example, it is preferable that the microcomputer 36 of the gateway device 10 divides the entire rewrite data amount of the update file by the transmission data amount transmitted to the replog slave RS to calculate the progress ratio as the progress status.

At this time, the progress status may be determined depending on the percentage of the number of repetitions of the SID 36 indicating the actual data transfer with respect to the total number of times, and a series of these service IDs (SID34, SID36, It is also possible to count the number of times transmission is repeated for the SID 37) and judge the progress status according to the number of times transmission is repeated. In such a case, the gateway device 10 transmits the update file separately for each unit block (=sector) such as 256 bytes, 1 kbytes to the storage area of 1 Mbyte of the update file storage memory of each ECU 22 to 31, for example. However, with respect to this transmission data amount, the progress status may be determined based on how many blocks have been transmitted with respect to the entire block in units of blocks. That is, the progress may be determined in units of blocks (=sectors).

Further, the progress may be determined based on what percentage of the total number of update files is transmitted to the replog slave RS, that is, the number of update files as a unit. Further, for example, when the replog slave RS is targeted for some of a plurality of ECUs of the entire ECUs 22 to 31, the gateway device 10 transmits the update file for which number of ECUs. It is also possible to judge whether or not there is progress status. That is, the progress status may be determined according to the number of transmissions to the ECU.

Further, although the ECUs 22 to 31 serving as the replog slaves RS are mainly configured by the microcomputer 41 shown in FIG. 3, the microcomputer 41 includes a main main microcomputer and sub-microcomputers, and a plurality of them are configured as a whole. In some cases. In such a case, the update file may be reprogrammed for each of the main microcomputer and sub-microcomputer. In such a case, the main microcomputer and the sub-microcomputer are regarded as one microcomputer, and the entire update is performed. The progress status may be determined according to what percentage of the number of target main microcomputers and sub-microcomputers the update file stored in the microcomputer is transmitted.

Further, the estimated completion time of rewriting may be calculated according to the data amount of the update file, and the progress status may be determined using the time from the start of rewriting with respect to the calculated estimated completion time of rewriting. These methods of judging the progress can be used in combination. As a result, the detailed progress status X1 can be obtained, and the progress can be displayed by finely displaying the percentage display granularity on the display devices 5a, 46 and the like.

Then, after determining the progress status in this way, the gateway device 10 determines whether or not the vehicle can travel in step U4. In step U4, the gateway device 10 collates the related information such as the CANID, the connection bus, and the name of the replog slave RS with the traveling propriety determination table TA1 to read and determine the traveling propriety, and after the determination processing, issues a display command to the mobile terminal 5. Then, as shown in FIG. 17B, in step U5, the progress status X1 and the traveling propriety information X2 are displayed on the display 5a of the mobile terminal 5.

When it is determined that traveling is not permitted in step U4, the gateway device 10 calculates the time until traveling is permitted based on the progress status described above in step U7, and the traveling is permitted in step U8. Display the remaining time until. This remaining time is based on the remaining processing amount obtained by subtracting the processing amount (for example, the transmission data amount, the reception data amount, the number of update files, the number of blocks, the ratio of the number of ECUs, etc.) from the overall processing amount. It is calculated.

At this time, for example, when it becomes impossible to travel, as shown in the screen display image in FIG. 17B, the gateway device 10 indicates the remaining time until the travel becomes possible together with the progress status X1 and the travel availability information X2 described above. The information X3b is displayed on the display 5a. After that, when the reprogramming is completed, the reprog slave RS notifies the gateway device 10 of this fact, so the gateway device 10 notifies the mobile terminal 5 of this fact. As a result, the mobile terminal 5 displays the fact that the reprogramming is completed on the display 5a and ends the processing.

Further, as shown in FIGS. 17A and 17B, it is preferable to display a cancel button B3 for forced interruption by the user on the display screen of the display device 5a. When the user presses the cancel button B3, the microcomputer 50 of the mobile terminal 5 accepts this request. Then, the mobile terminal 5 transmits this request to the gateway device 10. As a result, the gateway device 10 suspends the process of transmitting the reprogram update file.

For example, when the gateway device 10 is reprogramming the ECUs 26 to 29 connected to the traveling bus 13, for example, when it is determined that the reprogramming cannot be interrupted, the gateway device 10 sets the cancel button B3 in the unenable state to enable the interruption. At this time, the cancel button B3 should be enabled.

FIG. 18 shows a flow of processing contents of the gateway device 10 and the mobile terminal 5 at the time of interruption. When the mobile terminal 5 accepts the cancel button B3, the push information of the cancel button B3 is notified from the mobile terminal 5 to the gateway device 10 through the DCM 21. The gateway device 10 cancels the rewriting in a state where the traveling is not affected in step W2. That is, the replog slave RS transmits the traveling propriety information as described in the above embodiment, but the gateway device 10 receives the traveling propriety information, and the gateway device 10 until the traveling propriety information at this time becomes the traveling propriety. The process waits, and the rewriting process is stopped when the vehicle is ready to run.

The CPU 32 of the gateway device 10 stores the rewrite stop information in a storage medium such as the flash memory 35. In this case, the gateway device 10 waits until the timing at which safe running is possible even if the rewriting process of the update file is stopped midway, or the timing at which the reprogram process is stopped and the program before rewriting is restored. It is calculated as a time that does not affect running, and the mobile terminal 5 is notified of this time. Then, as shown in FIG. 17C, the mobile terminal 5 displays the notified time information X3c on the display 5a together with the acceptance message X3d of the cancel button B3 such as "Cancelled."

The mobile terminal 5 counts the calculated time information X3c using a timer or the like, and when this time has elapsed, the travel permission/prohibition information X2 is changed from “prohibited” to “permitted” and displayed in step W3. The travel-enabled message X3e such as "" is displayed on the display 5a.

Note that the timing at which the mobile terminal 5 displays the runnable message X3e on the display screen of the display device 5a is the runnability signal indicating that the gateway device 10 is ready to run, which is connected to the replog slave RS or another ECU (for example, the running bus 13). It is preferable that the data is received from the ECUs 26 to 29) that are operated. That is, the gateway device 10 determines the traveling propriety based on the traveling propriety information received from the replog slave RS after notifying the portable terminal 5 of the time information X3c, and the portable terminal at the timing when the traveling propriety information becomes the traveling propriety. It is desirable that the portable terminal 5 displays the travel-enabled message X3e on the display device 5a after that. Then, the user can understand that the user can drive, and the user can safely start driving the vehicle.

After that, after the user drives the vehicle and stops the engine as usual, the gateway device 10 mainly takes charge of starting the reprogram processing. For example, when the gateway device 10 restarts the engine and refers to the flash memory 35 to confirm that the rewrite stop information is stored, the gateway device 10 starts the reprogram processing.

Similarly to the above, the gateway device 10 calculates the time until the vehicle becomes runnable, and notifies the mobile terminal 5 of the remaining time information X3b until the vehicle becomes runnable through the DCM 21. Then, as shown in FIG. 17E, the mobile terminal 5 switches the travel propriety information X2 from “possible” to “prohibited” and displays it on the display 5a, and also displays the remaining time information X3b on the display 5a. ..

When the gateway device 10 receives the completion of the reprogram from the reprog slave RS, the gateway device 10 clears the rewrite stop information stored in the flash memory 35, notifies the mobile terminal 5 of the completion information, and notifies the mobile terminal 5 of the completion information. Displays the progress status X1 as 100%, and informs the user that the vehicle can be traveled by setting the travel permission/prohibition information X2 from “NO” to “OK”. This allows the user to recognize that the reprogramming has been completed, understand that the vehicle can travel safely, and start driving.

According to the present embodiment, the mobile terminal 5 causes the display device 5a to display the travel permission/prohibition information X2 in response to the display instruction from the gateway device 10, and thus the vehicle user can be appropriately notified of the travel permission/prohibition. The user can determine whether or not the vehicle can be driven, and thus safety can be ensured.

Further, since the mobile terminal 5 displays the progress status X1 on the display device 5a in response to the display command from the gateway device 10, it is possible to appropriately notify the vehicle user of the progress status X1. The vehicle user can roughly understand the time until the end of the program update when the progress status is notified through the notification medium. Therefore, the vehicle user can determine whether or not the program is being updated, and it is possible to prevent accidental start of driving. This ensures safety.

For example, even if the vehicle user can grasp the progress status X1, if the display granularity is rough, such as in two stages of reprogramming or end of reprogramming, the vehicle user can only grasp whether or not reprogramming is completed. In such a case, if the reprogramming time is long, it may be determined that the reprogramming has failed.

In the present embodiment, the gateway device 10 determines the progress status according to the amount of transmission data transmitted to the replog slave RS, determines the progress status according to the number of transmission ends of the ECU, and updates the transmission processing. The progress status is determined according to the number of files, the rewrite completion prediction time is calculated, and the progress status is determined using the time from the start of rewriting with respect to the rewrite completion prediction time. Therefore, in response to the display command from the gateway device 10, the mobile terminal 5 can notify that the progress is normally made by making the progress display granularity as small as possible. Therefore, the vehicle user can wait for the end of the reprogramming without anxiety.

In addition, since the mobile terminal 5 causes the display device 5a to display the remaining time information X3b in response to the display command from the gateway device 10, the user can accurately determine how long the vehicle can be driven before waiting. .. The user can effectively use the waiting time.

Further, since the mobile terminal 5 is configured to display the cancel button B3 on the display 5a and to accept the pressing of the cancel button B3, the user can give an interruption command at a timing at which he/she wants to interrupt.

Further, even if the user presses and accepts the cancel button B3, the gateway device 10 and the replog slave RS continue to reprogram without stopping until it is determined that the vehicle is not affected and the vehicle can travel. The user can drive in a program rewriting state that does not affect the running of the vehicle and can drive safely.

FIG. 19 is a flowchart collectively showing the processing contents of the gateway device 10 which is the replog master RM according to the present embodiment. When the gateway device 10 receives a reprogram instruction from the outside, the gateway device 10 executes the reprogram in step Y1, but thereafter calculates and determines the progress situation X1 in step Y2.

Then, the gateway device 10 determines whether or not the vehicle can travel in step Y3, and instructs the display device (for example, the display device 5a and the LED 38) to display the travel availability information X2 and the progress status X1 in step Y4. By presenting the progress status X1 to the user, the user can grasp the detailed progress status X1 and prevent accidental operation during rewriting, and safe rewriting is possible even if a remote rewriting command is issued.

Then, the gateway device 10 repeats the processing from step Y1 until the reprogramming is completed. It is desirable to judge the reprogram completion by accepting the reprogram completion information from the relog slave RS and judging that the reprogram is completed at the timing considered as complete, but at the time when the update file is completely transmitted to the relog slave RS. It may be determined that the reprogramming is completed at a timing when a predetermined time has elapsed from the above. In the present embodiment, the gateway device 10 mainly determines the progress status and the traveling propriety in this way, and issues a display command to the display device (for example, 5a). According to such a form, the gateway device 10 can integrally control the information.

(Third Embodiment)
20 and 21 show additional explanatory views of the third embodiment. 20 and 21 are flowcharts showing the processing contents of the gateway device 10 and the replog slave RS that are the replog master RM according to the present embodiment. As shown in FIGS. 20 and 21, the processing content of the gateway device 10 which is the replog master RM shown in FIG. 19 may be shared by the replog slave RS.

As shown in FIG. 20, the replog slave RS is mainly responsible for calculating and determining the progress status in step T1, determining whether or not the vehicle can travel in step T2, and transmitting the progress status and travel availability information to the replog master RM in step T3. To do. In this step T2, the replog slave RS may determine the progress status according to the received data amount of the update file received from the gateway device 10. As a specific example, the replog slave RS may divide the received data amount received by the total data amount of the update file received from the gateway device 10 in advance to calculate the progress ratio and determine the progress status. At this time, the progress status may be determined depending on the percentage of the number of times the SID 36 indicating the actual data transfer is repeated with respect to the total number of times.

These series of processes are repeated until reprogramming is completed. In addition, the gateway device 10 serving as the replog master RM acquires the progress status and the travel availability information from the replog slave RS in step Y15, and instructs the display device (for example, 5a) to display in step Y16. At this time, the gateway device 10 serving as the replog master RM can periodically acquire the progress information from the replog slave RS by outputting the service ID (SID22).

According to this mode, the processing load can be shared between the gateway device 10 and the replog slave RS. Since the reprogramming completion timing is determined based on the completion information of the reprog slave RS, the reprogramming completion timing can be accurately determined.
As shown in the above-mentioned embodiment and this embodiment, either of the replog master RM and the replog slave RS may perform the traveling propriety determination processing and the progress status determination processing.

(Other embodiments)
The present invention is not limited to the above-described embodiments, can be variously modified and implemented, and can be applied to various embodiments without departing from the scope of the invention. For example, the following modifications or extensions are possible.

In the above-mentioned form, the description has been given of the form in which the replog master RM or the replog slave RS acquires the progress status and displays it on the display unit 46, but the present invention is not limited to this, and the progress is made on the web server 3 side of the center device 4. The progress status X1 may be confirmed by transmitting the status and allowing the user to access the web server 3 by operating the operation unit 5b of the mobile terminal 5. In this case, the web server 3 is configured as a notification medium. The same applies to the travelability information X2 described above.

The relationship between the CANID and the name of the ECU set in the table TA1 of the above-described embodiment and the traveling propriety is merely an example, and the present invention is not limited to this.
In the above embodiment, the ECUs 22 to 31 of each system are connected to the buses 12 to 14 such as the body system bus 12, the traveling system bus 13 and the multimedia system bus 14, but the types of ECUs are different. The invention is not limited to the one described in the above embodiment.

In the above-described embodiment, the ECUs 22 to 31 of the respective systems are shown connected to the buses 12 to 14 such as the body system bus 12, the traveling system bus 13 and the multimedia system bus 14, but the present invention is not limited to this. Not something. For example, some or all of these ECUs 22 to 31 may be connected to one bus. In particular, in the above-described embodiment, the ECUs 22 to 25 connected to the body bus 12 and the ECUs 30 and 31 connected to the multimedia bus 14 may be connected to the same bus. Further, the system of the connection bus of the ECUs 22 to 31 may be changed. Further, at least two or more functions of each of the ECUs 22 to 31 may be integrated into one ECU.

In the vehicle system 1 according to the above-described embodiment, the gateway device 10 is used as the replog master RM, but the present invention is not limited to this. For example, any one of the ECUs other than the ECU that functions as the replog slave RS, the mobile terminal 5, and the monitor tool 48 may function as the replog master RM.

In the vehicle system 1 of the above-described embodiment, the gateway device 10 is shown to include the travelability determination table TA1, but the present invention is not limited to this. For example, the traveling propriety determination table TA1 may be stored in any of the ECUs 22 to 31 or the mobile terminal 5 and the traveling propriety determination table TA1 may be shared in the system 1.

Although the LED 38 is shown connected to the gateway device 10, it may be connected to the other ECUs 22 to 31. Although the display 46 is shown connected to the navigation ECU 30, it may be connected to the other ECUs 22 to 29 and 31.

The various sensors described above (for example, the parking brake on/off state detection sensor, the shift lever position sensor, the gasoline remaining amount sensor) may not be connected to the target ECU described above. These various sensors (for example, a parking brake on/off state detection sensor, a shift lever position sensor, a gasoline remaining amount sensor) are connected to other ECUs than those described above, and communicate with each other through buses 11 to 15. The gateway device 10 and other ECUs may acquire the sensor information.

Although the mode in which various messages are displayed by selecting the indicators 5a and 46 as the notification medium has been shown, the notification medium is not limited to the above-described embodiment, and may be, for example, a navigation ECU 30 or an audio ECU (not shown). It may be applied to a mode in which sound is notified through a speaker mounted on the vehicle.

Although the form in which the flash memories 35 and 45 are configured as storage units is shown, the present invention is not limited to this. For example, a volatile memory such as RAM or a non-volatile memory such as EEPROM may be applied as the storage unit. It may be configured by combining the plurality of embodiments described above.

Although the embodiment in which the entry/exit state of the vehicle user is specified has been described on the assumption that the mobile terminal 5 is present in the vicinity of the vehicle in step V2 of FIG. 16, the present invention is not limited to this. That is, step V2 may be provided as needed.

(Explanation of Correspondence between the Present Invention and the Embodiments)
The correspondence between the present invention and the above-described embodiment will be described. Any of the portable terminal 5, the gateway device 10, the ECU other than the replog slave RS, and the monitor tool 48 constitutes a replog master RM. Any one or more of the ECUs 22 to 31 constitutes a replog slave RS. The microcomputer 36 or 41 of the replog master RM is configured as an acquisition unit that acquires the propriety of traveling. Further, the microcomputer 36 or 41 of the replog master RM is configured as a boarding/alighting state determination unit that judges a boarding/alighting state of a vehicle occupant. Further, the microcomputer 36 or 41 of the replog master RM is configured as a vehicle state determination unit that determines the operating/non-operating state of the engine. Further, the microcomputer 36 or 41 of the replog master RM transmits an interrupt command to the replog slave RS when it receives an interrupt request from the terminals 5 and 46 operated by the vehicle user, and interrupts the update file rewriting process. Composed as a part. Further, the microcomputer 36 or 41 of the replog master RM is configured as a reprogram execution instruction unit that issues a reprogram execution instruction to the replog slave RS. Further, when the reprogram execution command unit transmits the reprogram execution command to the reprog slave RS, the microcomputer 36 or 41 of the reprog master RM determines whether or not reprogramming is possible and whether or not the vehicle is traveling, to all the ECUs including the reprog slave RS. It is configured as a stable state maintenance requesting unit that requests maintenance of the state.

In addition, the microcomputer 36 or 41 of the replog master RM is configured as a notification command unit that issues a notification command to the notification medium (the mobile terminal 5, the LED 38, the display 46) regarding the information regarding the travel enable/disable signal. The microcomputer 36 or 41 of the replog master RM is configured as a distance specifying unit that specifies the distance of the terminal 5 operated by the vehicle user from the vehicle. At this time, the microcomputer 36 or 41 of the replog master RM is configured as a presence/absence determining unit that determines whether or not the terminal exists around the vehicle according to the distance specified by the distance specifying unit. The microcomputer 36 or 41 of the replog master RM is configured as a boarding/alighting state specifying unit. The web server 3, the display device 5a, the LED 38, and the display device 46 are configured as a notification medium that notifies whether or not the vehicle can travel or the progress. In particular, the display 46 is configured as an in-vehicle display device. The flash memories 35, 45, etc. are configured as a storage unit.

(Explanation from other perspectives)
Further, in each embodiment, the replog master RM includes a progress determination unit that determines the progress status, a progress notification command unit that issues a notification command of the progress status, a progress notification control unit that notifies and controls the progress status, and a progress display control of the progress status. It is configured to realize at least a part of the functions of the display control unit, the progress status acquisition unit that acquires the progress status, and the travel availability determination unit that determines the travel availability of the vehicle. The replog slave RS may have the functions of the progress determination unit and the travel availability determination unit.
According to one aspect, when the vehicle user operates the terminal and requests updating of the program, the replog master controls updating of the program stored in the replog slave in response to the request. When the acquisition unit of the replog master acquires the traveling propriety determined by the determination unit, the notification command unit issues a notification of traveling propriety information to the notification medium. Therefore, when requested by the terminal operated by the vehicle user, it is possible to notify the notification medium of the traveling propriety to the notification medium, and it is possible to appropriately inform the vehicle user of the traveling propriety. When the vehicle user is informed that the vehicle is capable of traveling through the notification medium, the vehicle user determines that the vehicle is capable of traveling, and thus can safely drive the vehicle. Further, when the vehicle user is informed that the vehicle cannot be driven through the notification medium, the vehicle user determines that the vehicle cannot be driven and stops driving. This ensures safety.

For example, the function of one component may be distributed to a plurality of components, or the functions of a plurality of components may be integrated into one component. Further, at least a part of the configuration of the above-described embodiment may be replaced with a known configuration having the same function. Further, some or all of the configurations of the above-described two or more embodiments may be combined with each other and added or replaced. The reference numerals in parentheses in the claims indicate the correspondence with the specific means described in the above embodiments as one aspect of the present invention, and the technical scope of the present invention. Is not limited.

In the drawing, 1 is a vehicle system, 3 is a web server (notification medium), RM is a relog master (vehicle device), RS is a relog slave, 36 is a microcomputer (determination unit, acquisition unit, notification command unit, reprogram execution) Command unit, getting-on/off state determination unit, vehicle state determination unit, distance specifying unit, presence/absence determination unit, 41 is a microcomputer (determination unit, acquisition unit, notification instruction unit, reprogram execution instruction unit, getting-on/off state determination unit, vehicle State determination unit) 5, mobile terminal (notification medium, terminal), 35 flash memory (storage unit), 38 LED (notification medium), 45 flash memory (storage unit), 46 display (vehicle-mounted display device) , Terminal, notification medium), and TA1 indicates a traveling propriety determination table.

Claims (9)

A reprog slave (RS), which is one of electronic control devices connected to an in-vehicle network, for updating a stored program,
A replog master (RM), which is one of the electronic control devices, performs control for downloading a program update file based on a request from the outside, and updating the program stored in the replog slave,
A notification medium for notifying the user of the vehicle of information regarding the update,
A relog system having:
A traveling propriety determination unit that determines whether the vehicle is capable of traveling or not traveling during traveling of the program stored in the replog slave to determine whether the vehicle is capable of traveling,
Before the program update file is downloaded, the travel availability information determined by the travel availability determination unit is notified from the notification medium, and the user is selected whether or not to download the program update file. An instructing command unit for issuing a command to
Replog system with. One of electronic control devices connected to an in-vehicle network, and a reprog slave (RS) for updating a stored program,
A replog master (RM), which is one of the electronic control devices, performs control for downloading a program update file based on a request from the outside, and updating the program stored in the replog slave,
A notification medium for notifying the user of the vehicle of information regarding the update,
A relog system having:
A traveling propriety determination unit that determines whether the vehicle is capable of traveling or not traveling during traveling of the program stored in the replog slave to determine whether the vehicle is capable of traveling,
Before the update of the program stored by the replog slave is started, the travel availability information determined by the travel availability determination unit is notified from the notification medium, and the user is informed whether or not to perform the update. A notification command unit that gives a command to select,
Replog system with. The notification instruction unit issues an instruction to notify from the notification medium, together with the travel availability information, a remaining time during which the travel-disabled state of the vehicle continues after the program update is started. The replog system described in 2. The electronic device that downloads a program update file based on a request from the outside and performs control for updating a program stored in a replog slave (RS) that is one of electronic control devices connected to an in-vehicle network A Replog Master (RM), which is one of the control devices,
A traveling propriety determination unit that determines whether the vehicle is capable of traveling or not traveling during traveling of the program stored in the replog slave to determine whether the vehicle is capable of traveling,
Before the program update file is downloaded, the travel availability information determined by the travel availability determination unit is notified to the user of the vehicle, and the user is informed whether to download the program update file. A notification command unit that gives a command to select,
Replog master with. Control for transmitting a program update file to a replog slave (RS) which is one of the electronic control devices connected to the in-vehicle network based on a request from the outside, and updating the program stored in the replog slave A Replog Master (RM), which is one of the electronic control devices that
A traveling propriety determination unit that determines whether the vehicle is capable of traveling or not capable of traveling during updating of the program stored in the replog slave to determine the traveling propriety information,
Before the update of the program stored by the replog slave is started, the user is informed of the travel availability information determined by the travel availability determination unit, and the user determines whether or not the update is performed. An instructing command unit that gives a command to select
Replog master with. 5. The notification instruction unit issues an instruction to notify the user of the vehicle of the remaining time, in which the vehicle is in the travel-disabled state after the start of the program update, together with the travel availability information. The Replogmaster according to Item 5. One of the electronic control devices connected to the in-vehicle network, and a reprog slave (RS) for updating a stored program,
A replog master (RM), which is one of the electronic control devices, performs control for downloading a program update file based on a request from the outside, and updating the program stored in the replog slave,
A notification medium for notifying the user of the vehicle of information regarding the update,
A method of notifying a relog system having:
During the updating of the program stored in the replog slave, whether the vehicle is allowed to run or not, as a travel availability information by the travel availability determination unit determining,
Before the program update file is downloaded, the notification command unit notifies the determined travelability information from the notification medium and selects the user whether or not to download the program update file. Command to
Notification method of the Replog system. A reprog slave (RS), which is one of electronic control devices connected to an in-vehicle network, for updating a stored program,
A replog master (RM), which is one of the electronic control devices, performs control for downloading a program update file based on a request from the outside, and updating the program stored in the replog slave,
A notification medium for notifying the user of the vehicle of information regarding the update,
A method of notifying a relog system having:
While the program stored in the replog slave is being updated, whether or not the vehicle is allowed to travel or not, is determined by the travel availability determination unit as travel availability information,
Before the update of the program stored by the replog slave is started, the notification command unit notifies the user of the determined travelability information from the notification medium, and informs the user whether or not to perform the update. Command to select,
Notification method of the Replog system. 8. The notification command unit, together with the travel propriety information, issues a command to notify from the notification medium of the remaining time during which the travel-disabled state of the vehicle continues after the program update is started. 8. The notification method of the relog system according to item 8.

Images