JP7058629B2 - Software updater, software update method, and program - Google Patents

Description

The present invention relates to a software update device, a software update method, and a program.

Conventionally, a software update system is known in which an update program is downloaded from a server and the downloaded update program is applied to software incorporated in a control unit that controls an in-vehicle device to update the software (for example, a patent document). 1). In the update system of Patent Document 1, when the update of the device to be updated is incomplete, the cause of the incomplete update is detected, and when the update can be restarted, the process of restarting the update is performed. conduct.

Japanese Unexamined Patent Publication No. 2018-97764

However, the above-mentioned technique takes measures after a defect occurs, and does not perform update control in consideration of a disturbance factor that may cause the defect in advance. Therefore, appropriate software updates may not be performed.

One aspect of the present invention has been made in consideration of such circumstances, and an object of the present invention is to provide a software update device, a software update method, and a program capable of more appropriately executing software update processing. I will do it.

The software update device, the software update method, and the program according to the present invention have adopted the following configurations.
(1): The software update device according to one aspect of the present invention controls a plurality of devices that control devices mounted on a vehicle by communicating with a communication unit that communicates with an external device and the external device by the communication unit. The update control unit includes an update control unit that updates at least one of the software incorporated in the unit, and the update control unit is a device control unit of at least one of the plurality of device control units when the vehicle is stopped. Of the communication in the device control unit that does not update the software, or the process that the device control unit that updates the software executes when the vehicle is stopped, or one of the processes when updating the software. It is a software update device characterized by suppressing both.

(2): In the embodiment of (1) above, the plurality of device control units include a first device control unit that controls an internal combustion engine that outputs a running drive force for the vehicle to travel to a drive wheel, and the vehicle. The update control unit includes a second device control unit that controls a transmission mounted on the vehicle, and the update control unit is used when there is an update of the software for one or both of the first device control unit and the second device control unit. The first device control unit and the second device control unit are characterized in that the processing executed when the vehicle is stopped is stopped.

(3): In the embodiment of the above (1) or (2), the storage unit for storing the driving information of the vehicle is further provided, and in the update control unit, the device control unit for updating the software stops the vehicle. Along with this, when the process of storing the operation information in the storage unit is executed, the process is postponed and the process is executed after the software is updated.

(4): In any one of the above (1) to (3), the update control unit updates the software when the state in which the update of the software cannot be normally completed continues for a predetermined number of times or more. It is characterized in that a device control unit that updates the software executes a process to be executed when the vehicle is stopped before the software is stopped.

(5): In any one of the above (1) to (4), the energy acquisition unit for acquiring the energy amount of the battery mounted on the vehicle is further provided, and the update control unit is the energy acquisition unit. Based on the amount of energy acquired by the unit, the device control unit that updates the software controls the execution of the process executed when the vehicle is stopped.

(6): In any one of the above (1) to (5), the plurality of device control units control one or both of the steering and speed of the vehicle to perform operation control. The update control unit includes the device control unit, and is characterized in that when the software is updated to the third device control unit, the processing in the device controlled by the third device control unit is suppressed. Is.

(7): In the software update method according to one aspect of the present invention, a plurality of software update devices mounted on a vehicle communicate with an external device and control the devices mounted on the vehicle by communicating with the external device. When updating at least one of the software incorporated in the device control unit of the above and updating the software for at least one of the plurality of device control units when the vehicle is stopped. Software characterized by suppressing one or both of communication in a device control unit that does not update the software or processing that is executed by the device control unit that updates the software when the vehicle is stopped. This is the update method.

(8): The program according to one aspect of the present invention causes a software update device mounted on a vehicle to communicate with an external device, and a plurality of devices for controlling the device mounted on the vehicle by communicating with the external device. When at least one of the software incorporated in the control unit is updated and the software is updated for at least one device control unit among the plurality of device control units when the vehicle is stopped, the software is used. It is a program characterized in that one or both of the communication in the device control unit that does not update the software or the process executed by the device control unit that updates the software when the vehicle is stopped is suppressed. ..

According to the above aspects (1) to (8), the software update process can be executed more appropriately.

It is a block diagram of the software update system 1 including the software update apparatus 100 of embodiment. It is a block diagram of the vehicle system 2 including the software update device 100 of an embodiment. It is a figure which shows an example of the contents of the device management information 152. It is a flowchart which shows an example of the process which the update control unit 120 executes in the 1st update control pattern. It is a flowchart which shows an example of the process which the update control unit 120 executes in the 2nd update control pattern. It is a figure for demonstrating 1st Embodiment of software update in an ECU. It is a figure for demonstrating the 2nd Embodiment of software update in an ECU.

Hereinafter, the software update device, the software update method, and the embodiment of the program of the present invention will be described with reference to the drawings. In the following, an example in which the software update device is mounted on the vehicle as a part of the vehicle system will be described. The vehicle is, for example, a vehicle such as a two-wheeled vehicle, a three-wheeled vehicle, or a four-wheeled vehicle. Further, the drive source of the vehicle is, for example, an internal combustion engine such as a diesel engine or a gasoline engine, an electric motor, or a combination thereof. The electric motor operates by using the electric power generated by the generator connected to the internal combustion engine or the electric power generated by the secondary battery or the fuel cell. The software update device may be mounted on a moving body other than a vehicle (for example, a ship or a flying body).

[Software update system]
FIG. 1 is a configuration diagram of a software update system 1 including the software update device 100 of the embodiment. The software update system 1 includes, for example, software update devices 100-1 to 100-n mounted on one or more vehicles M-1 to Mn (n is a natural number of 1 or more), and a server device 200. .. The number below the hyphen at the end of the code of the vehicle M shall be an identifier for distinguishing the vehicle. When it is not distinguished which vehicle it is, it may be simply referred to as vehicle M. Further, in the following, it is assumed that the components included in the vehicle M are the same. The software update device 100 and the server device 200 can communicate with each other via the network NW. Network NW includes, for example, cellular network, Wi-Fi network, Bluetooth (registered trademark), Internet, WAN (Wide Area Network), LAN (Local Area Network), public line, provider device, leased line, wireless base station, etc. including. Further, each of these components may directly perform wireless communication without going through the network NW. The server device 200 is an example of an “external device”.

The software update device 100 controls the update of software installed in the device mounted on the vehicle M. For example, the software update device 100 downloads update software from the server device 200, and updates software that controls at least a part of the devices mounted on the vehicle M based on the downloaded software.

When the software information (version information, etc.) managed by the software update device 100 is not the latest software managed on the server side, the server device 200 is connected to the software update device 100 based on the inquiry information from the software update device 100. Download the update software and update the software. Further, when the software is updated, the server device 200 extracts a vehicle in which the target software is installed, and instructs the software update device 100 mounted on the extracted vehicle to execute the update software. good.

[Software updater]
FIG. 2 is a configuration diagram of a vehicle system 2 including the software update device 100 of the embodiment. The vehicle system 2 includes, for example, an in-vehicle device 10, an operation unit 90, a display unit 92, an ignition device 94, and a software update device 100. The in-vehicle device 10 includes, for example, an engine ECU (Electronic Control Unit) 20, a transmission ECU 30, a steering ECU 40, a brake ECU 50, an operation control ECU 60, a battery ECU 70, and a navigation ECU 80. Further, the in-vehicle device 10 may include, for example, various ECUs for controlling an audio device, a keyless entry system, a suspension system, an airbag device, and the like. Each of the plurality of ECUs included in the in-vehicle device 10 is an example of a "device control unit". The engine ECU 20 is an example of the “first device control unit”. The transmission ECU 30 is an example of a “second device control unit”. The operation control ECU 60 is an example of the “third device control unit”.

For each of the plurality of ECUs included in the in-vehicle device 10, for example, a processor, a storage unit, an external communication interface, and the like are connected by a bus or the like. Further, software is built in the ECU, and by executing the software, control of at least a part of the corresponding device is executed. The software includes at least one program module. A program module includes, for example, one or more programs and executes a partial function among the functions that can be realized by software. The software can be updated in module units under the control of the update control unit 120, for example. In the following, a series of processes for receiving update software from an external device (for example, a server device 200) by communication such as OTA (Over The Air) and updating at least one of the software incorporated in a plurality of ECUs. Is referred to as "update processing by OTA".

The storage unit (storage unit 20A, 30A, 40A, 40A, 50A, 60A, 70A, and 80A in the example of FIG. 2) in each ECU may be, for example, an EEPROM (Electrically Erasable Programmable Read Only Memory), a flash memory, or the like. It is a non-volatile memory (Non Volatile Memory). The storage units 20A to 80A store software incorporated in each ECU and configuration information related to the ECU. The configuration information includes, for example, device identification information (hereinafter referred to as hardware identification information), software identification information, and the like. The hardware identification information includes, for example, a device part number (hardware part number), a unique ID (serial number), and the like. The software identification information includes identification information (software part number) for each software module, version information, and the like. The hardware part number and the software part number may include, for example, a function type, a configuration type, a component type, variation information, and other supplementary information (for example, a manufacturer-specific number).

Further, each of the ECUs of the in-vehicle device 10 communicates with other ECUs, the software update device 100, and the like via a predetermined network. The predetermined network is, for example, a network compliant with CAN (Controller Area Network), CAN-FD (CAN with Flexible Data rate), Ethernet (registered trademark), and the like.

The engine ECU 20 controls an engine (an example of an internal combustion engine) 22 that outputs a traveling driving force for traveling the vehicle M to the drive wheels. For example, the engine ECU 20 acquires information such as the rotation speed of the engine 22 according to the information input from the operation control ECU 60 or the information input by the accelerator pedal included in the operation unit 90, and the engine is based on the acquired information. The operating state of the engine 22 is controlled by adjusting the throttle valve opening degree, the fuel supply amount, and the like so that the 22 generates the target engine torque.

The transmission ECU 30 controls the transmission (transmission) 32 mounted on the vehicle M. For example, the transmission ECU 30 switches the shift according to the information input from the operation control ECU 60 or the information input by the operation of the clutch or the shift lever included in the operation unit 90, so that the transmission becomes the designated shift stage. 32 is controlled.

The steering ECU 40 controls the steering of the vehicle M by the steering device 42. The steering device 42 includes, for example, an electric motor. The electric motor, for example, exerts a force on the rack and pinion mechanism to change the direction of the steering wheel. The steering ECU 40 drives the electric motor of the steering device 42 according to the information input from the operation control ECU 60 or the information input from the steering wheel included in the operation unit 90, and changes the direction of the steering wheel.

The brake ECU 50 controls the braking of the vehicle M by the brake device 52. The brake device 52 includes, for example, a brake caliper, a cylinder that transmits hydraulic pressure to the brake caliper, and an electric motor that generates hydraulic pressure in the cylinder. The brake ECU 50 controls the electric motor according to the information input from the operation control ECU 60 or the information input from the brake pedal included in the operation unit 90 so that the brake torque corresponding to the braking operation is output to each wheel. To. The brake device 52 may include a mechanism for transmitting the hydraulic pressure generated by the operation of the brake pedal to the cylinder via the master cylinder as a backup. The brake device 52 is not limited to the configuration described above, and may be an electronically controlled hydraulic brake device that controls the actuator according to the information input from the operation control ECU 60 to transmit the hydraulic pressure of the master cylinder to the cylinder. ..

The operation control ECU 60 controls the operation of the vehicle M based on, for example, the recognition result of the periphery of the vehicle M by the object recognition device 62. The driving control is, for example, to support the driving of the occupant of the vehicle M by controlling one or both of the steering and the speed of the vehicle M. For operation control, for example, ACC (Adaptive Cruise Control System), LKAS (Lane Keeping Assistance System), TJP (Traffic Jam Pilot), ALC (Auto Lane Changing), CMBS (Collision Mitigation Brake System), VSA (Vehicle Stability Assist) ) Etc. are included. Each operation control is executed as an event, for example, and the executed event and the content of the operation control by the event execution are stored in the storage unit 60A as operation information.

The object recognition device 62 acquires information from the camera 64, which is an in-vehicle device 10, the radar device 66, and the finder 68, and recognizes an object around the vehicle M. The camera 64 captures the periphery of the vehicle M and generates an captured image. The camera 64 is, for example, a digital camera using a solid-state image sensor such as a CCD (Charge Coupled Device) or a CMOS (Complementary Metal Oxide Semiconductor). The camera 64 is attached to an arbitrary position on the vehicle M on which the vehicle system 2 is mounted. The periphery of the vehicle M includes the front of the vehicle M, and may include the side or the rear of the vehicle M. For example, when photographing the front of the vehicle M, the camera 64 is attached to the upper part of the front windshield, the back surface of the rear-view mirror, and the like. The camera 64 may be a stereo camera.

The radar device 66 radiates radio waves such as millimeter waves in a predetermined irradiation direction around the vehicle M, and detects radio waves (reflected waves) reflected by the object to at least position (distance and orientation) of the object. Is detected. The object is, for example, another vehicle, an obstacle, a structure, or the like existing around the vehicle M. One or a plurality of radar devices 66 may be attached to any position of the vehicle M. The radar device 66 may detect the position and velocity of the object by the FMCW (Frequency Modulated Continuous Wave) method.

The finder 68 is a lidar (Light Detection and Ranging or Laser Imaging Detection and Ranging) that measures the scattered light for the irradiation light irradiated in a predetermined irradiation direction around the vehicle M and detects the distance to the object. be. One or more finder 68s may be attached to any part of the vehicle M.

The object recognition device 62 performs sensor fusion processing on the detection results of a part or all of the camera 64, the radar device 66, and the finder 68, and performs sensor fusion processing on the position, type, speed, and the like of the objects existing around the vehicle M. Recognize. Further, the object recognition device 62 may recognize the road shape, the sign, the lane, etc. around the vehicle M by the sensor fusion process. The object recognition device 62 outputs the recognition result to the operation control ECU 60.

The operation control ECU 60 acquires control information from the engine ECU 20, the transmission ECU 30, the steering ECU 40, and the brake ECU 50 so that a predetermined operation control is executed based on the recognition result from the object recognition device 62 and the like. The predetermined driving control is, for example, driving control based on the driving state of the vehicle M or the driving state by the occupant, and more specifically, the driving control for avoiding the contact between the vehicle M and the object, or the driving lane. It includes driving control that suppresses deviation from the above, driving control that follows the vehicle in front, and the like.

The battery ECU 70 controls energy such as the amount of energy and charge / discharge of the battery 72 mounted on the vehicle M. The battery ECU 70 supplies electric power of the battery 72 to, for example, an in-vehicle device 10, an operation unit 90, a display unit 92, a software update device 100, and other electric devices in the vehicle M. Further, the battery ECU 70 may supply electric power from the battery 72 to a predetermined device based on the operation content for the ignition device 94. The energy used when executing the update process of software or the like is mainly supplied from the battery 72 to the ECU to be updated.

Further, the battery ECU 70 may control to charge the battery 72 by using, for example, the regenerative current generated by the operation of the brake device 52. Further, the battery ECU 70 may control to store the energy supplied from the external charging equipment in the battery 72 via, for example, a charging connector or the like. Further, the battery ECU 70 measures the terminal voltage of the battery 72 and acquires the remaining energy amount based on the magnitude of the measured terminal voltage. Further, the battery ECU 70 may acquire the remaining energy by accumulating the amount of current stored at the time of charging using a current detection resistor and obtaining the amount of current output at the time of discharging. A database of discharge characteristics, temperature characteristics, etc. may be stored in the storage unit 70A or the like in advance, and the remaining energy may be acquired based on the measured voltage value or current value and the database. The battery management ECU 70 may acquire a charge rate (SOC; State Of Charge) instead of the above-mentioned remaining energy.

The navigation ECU 80 controls the navigation device 82 mounted on the vehicle M. The navigation device 82 includes, for example, a GNSS (Global Navigation Satellite System) receiver, a navigation HMI (Human Machine Interface), and a routing unit. The GNSS receiver identifies the position of the vehicle M based on the signal received from the GNSS satellite. The navigation HMI includes a display, a speaker, a touch panel, a key, and the like. The navigation HMI allows the occupant to set a destination, etc. using images, sounds, etc., and guides the occupant on the traveling route to the destination. The route determination unit is, for example, a route from the position of the vehicle M specified by the GNSS receiver (or an arbitrary position input) to the destination input by the occupant using the navigation HMI (hereinafter, the route on the map). ) Is determined with reference to map information and the like. Based on the route on the map, the navigation ECU performs route guidance and the like by displaying a map image by the navigation HMI and the display unit 92 and outputting voice by a speaker (not shown).

The operation unit 90 receives an input operation by the occupant of the vehicle M. For example, the operation unit 90 includes a touch panel, switches, keys, and the like. The touch panel of the operation unit 90 may be integrally configured with the display unit 92. Further, the operation unit 90 may include a driving operator for the occupant to manually drive the vehicle M. The driving controller includes, for example, an accelerator pedal, a clutch, a shift lever, a steering wheel, a brake pedal and the like.

The display unit 92 is, for example, a display device such as an LCD (Liquid Crystal Display) or an organic EL (Electro Luminescence) display. The display unit 92 displays, for example, an image generated by the display control unit 140. The display unit 92 may have, for example, as a touch panel device, a function of receiving an operation content from an occupant. Further, the display unit 92 may be integrally configured with the navigation HMI.

The ignition device 94 is a switch device that starts or stops the engine 22 or the like by the operation of the occupant of the vehicle M or the like. The start and stop of the engine 22 is controlled by turning the switch on and off. Specifically, when the switch is in the on state (hereinafter referred to as the ignition on state), the engine 22 is activated by the engine ECU 20 and the switch is in the off state (hereinafter referred to as the ignition off state). , The engine EUC 20 puts the engine 22 in a stopped state. In addition to starting and stopping the engine 22, the ignition device 94 may include a switch (accessory switch) that controls whether or not to start or stop another in-vehicle device or supply electric power by the battery 72.

The software update device 100 includes, for example, a communication unit 110, an update control unit 120, an energy acquisition unit 130, a display control unit 140, and a storage unit 150. The update control unit 120, the energy acquisition unit 130, and the display control unit 140 are realized by, for example, a hardware processor such as a CPU (Central Processing Unit) executing a program (software). In addition, some or all of these components are hardware (circuits) such as LSI (Large Scale Integration), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), GPU (Graphics Processing Unit), etc. It may be realized by the part; including circuitry), or it may be realized by the cooperation of software and hardware. The program may be stored in advance in a storage device (a storage device including a non-transient storage medium) such as an HDD (Hard Disk Drive) or a flash memory of the software update device 100, or a DVD, a CD-ROM, or the like. It is stored in a removable storage medium, and may be installed in the HDD or flash memory of the software update device 100 by mounting the storage medium (non-transient storage medium) in the drive device.

The storage unit 150 is realized by the above-mentioned various storage devices, EEPROM, ROM (Read Only Memory), RAM (Random Access Memory), or the like. The storage unit 150 stores, for example, device management information 152, a program read and executed by a processor, and various other information.

FIG. 3 is a diagram showing an example of the contents of the device management information 152. In the device management information 152, for example, software identification information, version information, execution processing contents, execution conditions, and execution history are associated with ECU-ID as identification information for identifying the ECU included in the in-vehicle device 10 of the vehicle M. This is the information that was given. The software identification information is identification information that identifies the software incorporated in the ECU-ID. The software identification information includes, for example, information such as a software type, version information, and update date. The execution process content is the content of the process (hereinafter referred to as standby process) executed when the ECU identified by the ECU-ID satisfies a predetermined execution condition. The contents of the processing include, for example, learning processing based on driving results, driving results, etc., recording processing of traveling history, correction processing, and the like. Execution conditions are various conditions for executing the standby process included in the execution process contents. The execution condition includes, for example, information on the state of the vehicle M (for example, when the vehicle M is stopped such as ignition off) and the time zone (for example, at night). The execution process contents and execution conditions may be registered or changed by an operator or the like at predetermined timings such as manufacturing, shipping, and maintenance of the vehicle M, and may be controlled by an external device such as the server device 200. It may be registered or changed. The execution history includes, for example, the execution history of the standby process. In the execution history, information on whether or not the standby process has been executed, information on whether or not the execution was suppressed, the number of times the execution was suppressed, the reason why the execution was suppressed, and information on the next execution (for example, execution). Conditions and execution contents) may be included. Further, the execution history may include history information regarding the execution of the update process.

The communication unit 110 communicates with an external device by a predetermined communication means (communication method). The communication unit 110 communicates with an external device such as the server device 200 by using, for example, a cellular network, a Wi-Fi network, Bluetooth (registered trademark), DSRC (Dedicated Short Range Communication), or the like. The communication unit 110 may be, for example, a TCU (Telematics control unit). The communication unit 110 communicates with the server device 200 by wireless communication such as OTA, and receives update software for updating the software incorporated in the ECU of the target device (performing the update by OTA). do.

The update control unit 120 controls the update of software for the ECU included in the in-vehicle device 10. For example, the update control unit 120 refers to the device management information 152 stored in the storage unit 150, and acquires software identification information for each ECU. Further, the update control unit 120 uses the acquired software identification information to generate inquiry information for inquiring whether or not the software has been updated, and transmits the generated assortment information to the server device 200 via the communication unit 110. Further, the update control unit 120 updates the software incorporated in the target ECU based on the inquiry result from the server device 200 received by the communication unit 110. Further, the update control unit 120 updates the device management information 152 based on the result of the update process.

Further, the update control unit 120 acquires control information and the like of each device from the storage units of the engine ECU 20, the transmission ECU 30, the steering ECU 40, the brake ECU 50, the operation control ECU 60, the battery ECU 70, and the navigation ECU 80 included in the in-vehicle device 10. , Software updates may be controlled based on the acquired state.

Further, when the update control unit 120 is about to execute a process (standby process) other than the update process executed when the update target ECU satisfies a predetermined execution condition at the timing of updating the software, the update control unit 120 is about to execute the process. , The execution timing of the standby process and the execution timing of the update process may be controlled. Further, the update control unit 120 may control whether or not to execute the standby process based on the amount of energy of the battery 72 acquired by the energy acquisition unit 130. The details of the function of the update control unit 120 will be described later.

The energy acquisition unit 130 acquires the amount of energy of the battery 72 from the battery ECU 70 at a predetermined timing. The predetermined timing may be, for example, a predetermined cycle, or may be a timing at which software update processing or standby processing is executed.

The display control unit 140 generates an image or the like to be displayed on the display unit 92, and displays the generated image on the display unit 92. For example, when the display control unit 140 acquires information related to software update (for example, update result, abnormality information at the time of update, etc.) by the update control unit 120, the display control unit 140 is for notifying the occupant of the vehicle M of the acquired information. An image is generated and displayed on the display unit 92 at a predetermined timing. The predetermined timing is, for example, the timing when the ignition is turned on, the timing when the software update is normally completed, or the timing when an abnormality occurs in the update. Further, the display control unit 140 may generate an image for receiving an update instruction from the occupant. Further, when the update information is an update that can be updated by OTA, the display control unit 140 may generate an image for confirming whether or not to perform the update.

[Update control unit]
Next, the details of the processing of the update control unit 120 will be described. Hereinafter, each aspect of the update control executed by the update control unit 120 will be described by dividing it into some patterns.

<First update control pattern>
In the first update control pattern, the update control unit 120 does not update the software when updating the software for at least one of the plurality of ECUs when the vehicle M is stopped (update target). One or both of the standby processes scheduled to be executed by the device controlled by the communication in the external ECU) or the ECU (update target ECU) that updates the software when the vehicle M is stopped are suppressed.

FIG. 4 is a flowchart showing an example of the process executed by the update control unit 120 in the first update control pattern. In the first update control pattern, the update control unit 120 determines whether or not the vehicle M has stopped only (step S100). Specifically, the update control unit 120 is the vehicle M when the control of the engine 22 acquired from the engine ECU 20 is changed from the started state to the stopped state, or when the ignition device 94 is changed from the ignition on state to the off state. Judges that has stopped. Further, in the process of step S100, if the update control unit 120 is set to inquire in advance whether or not the software is updated at a predetermined time, whether or not the vehicle is stopped at the predetermined time. May be determined.

When it is determined that the vehicle M has stopped, the update control unit 120 refers to the device management information 152 and generates inquiry information including the ECU-ID and software identification information associated with each ECU of the in-vehicle device 10. (Step S102). When it is determined that the vehicle M has stopped, the update control unit 120 may transmit a continuation control signal for continuing the activation of each ECU to each ECU before executing the process of step S102. Next, the update control unit 120 causes the server device 200 to transmit the generated inquiry information by the communication unit 110, and inquires about whether or not the software has been updated (step S104).

Here, the server device 200 receives the inquiry information from the software update device 100, and stores the software identification information (for example, version information) of the ECU-ID included in the received information and the storage unit of the server device 200. It is collated with the latest software identification information (version information) associated with the ECU-ID. Then, when the software identification information included in the inquiry information and the latest software identification information managed by the server device 200 match, the server device 200 uses the ECU of the in-vehicle device 10 associated with the ECU-ID. Determines that the latest software is installed, and determines that the software is not updated (no update). Further, when the software identification information included in the inquiry information and the latest software identification information managed by the server device 200 do not match, the server device 200 updates the software of the ECU associated with the ECU-ID. (Updated) is determined. Then, the server device 200 determines whether or not all the ECU-IDs included in the inquiry information are updated, and transmits the result as the inquiry result to the software update device 100 of the vehicle M inquired. The inquiry result may include data of software (program) to be updated.

The communication unit 110 of the software update device 100 receives the inquiry result from the server device 200 (step S106). Next, the update control unit 120 determines whether or not the ECU to be updated exists based on the inquiry result (step S108). When it is determined that the update target ECU exists, the update control unit 120 transmits a control signal for suppressing communication to the update target ECU (step S110). Suppressing communication means stopping communication in an ECU that is not subject to update. Further, suppressing communication may mean reducing the amount of data that can be communicated in a predetermined time to be smaller than in a normal time (during communication in a state where software is not updated), instead of the above contents.

Next, the update control unit 120 refers to the execution process content and the execution condition of the device management information 152 based on the ECU-ID of the ECU to be updated (step S112), and executes the software at the same timing as the software update. It is determined whether or not the process to be performed (standby process) exists (step S114). The same timing includes not only the processing that is executed at the same time, but also the timing that the processing is executed from the start to the end of the update, and the processing that is executed a predetermined time before the time when the update is started. Is done.

When there is a stambha process executed at the same timing, the update control unit 120 suppresses the execution of the standby process for the update target ECU to execute the software update (step S116). Suppressing the execution of a process means not executing (stopping) the process, postponing the process, or suspending the process in the middle of the process. Further, suppressing the execution of the process may mean, instead of the above-mentioned contents, the amount of the process in the predetermined time is smaller than that in the normal time (when the process is executed without updating).

Further, in the process of step S114, if there is no process executed at the same timing, the update target ECU is made to execute the software update (step S118). After the processing of step S116 and step S118, the update control unit 120 updates the device management information 152 (step S120). Specifically, the update control unit 120 updates the software identification information and updates the execution history when the update is completed normally. Further, the update control unit 120 registers the control contents related to the standby process in the execution history. For example, when the standby processing is suppressed, the update control unit 120 determines the processing content after suppression based on the urgency and priority of the standby processing, and registers the determined processing content in the execution history. For example, when the priority of the Steinby process is lower than the reference, the update control unit 120 registers information indicating that the process is collectively executed at the next execution of the standby process in the execution history. Further, when the priority of the Steinby process is higher than the reference, the update control unit 120 registers information indicating that the standby process is executed after the update process is completed in the execution history. As a result, the processing of this flowchart ends. Further, when it is determined in the process of step S100 that the vehicle M is not stopped, or when it is determined in the process of step S108 that the ECU to be updated does not exist in the inquiry result, the process of this flowchart ends. do.

Further, in the above-mentioned example of FIG. 4, both the communication in the non-update target ECU and the process scheduled to be executed by the device controlled by the update target ECU when the vehicle M is stopped are suppressed, but either one of them is suppressed. Control to suppress only may be performed. Further, in the processing of FIG. 4, the update control unit 120 may perform the processing of steps S102 to S106 at a predetermined timing (for example, a predetermined cycle) before the processing of step S100.

According to the first update control pattern described above, the communication load and the update are performed by suppressing the processing (standby processing) executed other than the communication of the ECU not to be updated and the update processing of the ECU to be updated when the software is updated. It is possible to suppress the processing load and the like due to the execution of processing other than processing. As a result, it is possible to suppress disturbance factors at the time of updating, and it is possible to execute the updating process quickly. Further, by suppressing communication and processing, it is possible to secure the power of the battery 72 in the update process. Therefore, according to the first update control pattern, the software update process can be executed more appropriately.

<Second update control pattern>
In the second update control pattern, the update control unit 120 updates the software by suppressing at least the standby process in the communication in the non-update target ECU or the standby process of the update target ECU, and the software update is normal. If the state that cannot be completed continues for a predetermined number of times or more, the standby process is executed before the software is updated.

FIG. 5 is a flowchart showing an example of the process executed by the update control unit 120 in the second update control pattern. The process shown in FIG. 5 is different from the process of steps S100 to S120 in the first update control pattern shown in FIG. 5 in that the process of steps S130 to S136 is further added. Therefore, in the following, the processing of steps S130 to S136 will be mainly described, and the description of other processing will be omitted.

In the second update control pattern, the update control unit 120 determines whether or not the software update is normally completed after the processing of step S116 (step S130). If it is determined that the process has been completed normally, the process of step S120 is performed. Further, when it is determined that the update has not been completed normally (for example, an error such as an error has occurred at the time of updating), the update control unit 120 has the number of times that the update process could not be completed normally (hereinafter referred to as the number of abnormal terminations). It is determined whether or not the number of times (referred to as) is equal to or greater than a predetermined number of times (step S132). The number of abnormal terminations is initialized every time the flowchart shown in FIG. 5 is started (more specifically, for each ECU in which the update process is executed).

If it is determined that the number of abnormal terminations is not equal to or greater than the predetermined number, the update control unit 120 increments the number of abnormal terminations by 1 and returns to the process of step S116. When it is determined that the number of abnormal terminations is equal to or greater than the predetermined number of times, the update control unit 120 causes the standby process suppressed in the process of step step S116 to be executed before updating the software (step S134), and then executes the standby process. Software update is executed (step S136). Further, the update control unit 120 performs the process of step S120 after the process of step S136. If the software update is not completed normally in the process of step S136, the update control unit 120 may generate an image including an error message by the display control unit 140 and display it on the display unit 92. good.

According to the second update control pattern described above, in addition to having the same effect as the first update control pattern, when the state in which the update cannot be completed continues for a predetermined number of times or more, the processing suppressed is performed. By executing it before the update, it is possible to improve the problem of the update process due to the influence of the standby process. Further, by executing the standby process, it is possible to increase the possibility that the update process can be completed normally.

[Specific example of software update in ECU]
Here, a specific example of updating software in the ECU will be described. FIG. 6 is a diagram for explaining a first embodiment of software update in the ECU. In the example of FIG. 6, the horizontal axis indicates time T, and it is assumed that the relationship of "T1 <T2 <T3 <T4" is established at times T1 to T4. Further, in the example of FIG. 6, as an example of the ECU included in the in-vehicle device 10, the state of software update in the engine ECU 20 is shown, but other ECUs also perform the same processing. Further, in the example of FIG. 6, it is assumed that the first period from time T1 to T2 and the third period from time T3 to T4 are in the ignition on state, and the second period from time T2 to T3 is the ignition. -It is assumed to be in the off state (downtime).

In the first period in the example of FIG. 6, the pre-update software is stored in the storage unit 20A, and the engine ECU 20 executes engine control using the pre-update software. Further, in the second period, the engine ECU 20 deletes the pre-update software stored in the storage unit 20A as the software update process, stores the updated software in the deleted storage area, and performs the update process. If there is a standby process scheduled to be executed in the second period, the engine ECU 20 suppresses the standby process and executes the update process based on the control of the update control unit 120.

Further, the engine ECU 20 may perform the software activation process after the update within the second period. The activation process is, for example, an authentication process for confirming that the user has a legitimate license for using the updated software. If the authentication is successful, the engine ECU 20 executes engine control using the updated software in the third period.

FIG. 7 is a diagram for explaining a second embodiment of software update in the ECU. In the second embodiment, as compared with the first embodiment, the storage unit 20A includes a first storage area A1 for storing the software before the update and a second storage area A2 for storing the software after the update. It differs in that. In this case, the engine ECU 20 executes engine control using the pre-update software stored in the first storage area A1 in the first period. Further, the engine ECU 20 performs an update process for storing the updated software in the second storage area A2 when the software is updated in the first period. If there is a standby process scheduled to be executed in the first period, the engine ECU 20 suppresses the standby process and executes the update process based on the control of the update control unit 120.

Further, the engine ECU 20 activates the updated software in the second period, and executes engine control using the updated software in the third period. The first embodiment can reduce the cost as compared with the second embodiment. Further, in the second embodiment, since the ignition off state period (downtime time) is shorter than that in the first embodiment, it is easy to secure the amount of energy in the battery 72 by the regenerative current or the like. Further, in the second embodiment, recovery (recovery) is easy when an abnormality occurs in the update process. The engine ECU 20 may update the software by another method.

[Specific example of update control according to the type of update target ECU]
Next, a specific example of update control in the update control unit 120 according to the type of the update target ECU will be described.

[When the ECU to be updated is the engine ECU 20 or the transmission ECU 30]
For example, when the update target ECU is the engine ECU 20 or the transmission ECU 30, the update control unit 120 stops the zero point (0 point) learning process of the clutch under the control of the engine ECU 20 and the transmission ECU 30, which is an example of the standby process. The clutch transmits the rotation of the engine 22 to the drive wheels and the like when the vehicle M is running, and transmits the rotation so as not to transmit the rotation of the engine 22 to the drive wheels and the like when the vehicle M starts, shifts, and operates the shift lever. It is a device that turns on and off. The clutch has a different reference point (zero point) for switching on / off of rotation transmission due to wear due to use and the like. Therefore, the engine ECU 20 interlocks with the transmission ECU 30 to send and receive history information related to each other's clutch control during traveling up to that point as zero point learning, learn a more accurate position of the zero point from the history information, and learn the learning result. The zero point is corrected to an appropriate position based on.

When the update control unit 120 executes software update of the engine ECU 20 or the transmission ECU 30, by stopping the above-mentioned zero point learning, the transmission / reception of history information in the zero point learning that becomes noise for the update process is not performed. Therefore, it is possible to reduce the communication load (occupancy of communication, etc.) in the communication network (for example, CAN communication). Further, the update control unit 120 can further reduce the communication load by suppressing communication in an ECU other than the engine ECU 20 or the transmission ECU 30 at the time of software update.

Further, since the engine ECU 20 and the transmission ECU 30 do not execute the zero point learning process, the software update process can be performed quickly and the electric power from the battery 72 can be secured. Since the clutch wear is not large in one run, the priority of the zero point learning process is low. Therefore, when the zero point learning process is suppressed, the update control unit 120 controls so that the zero point learning process is collectively executed at the next learning.

Further, the engine ECU 20 may suppress other standby processes when updating software. The other standby process is, for example, a DBW (Drive By Wire) learning process based on the operation of the accelerator pedal. The DBW learning process is, for example, in the throttle control (electronically controlled throttle) of the engine 22, since it is necessary to control the opening degree of the throttle valve to a minute opening degree when the vehicle M is idling or the like, an appropriate value of the opening degree. Is a process of learning by opening history and forced execution in the ignition off state.

[When the update target ECU is the operation control ECU 60]
Next, a case where the update target ECU is the operation control ECU 60 will be described. The operation control ECU 60 performs a process (operation information storage process) of writing control data at the time of operation control to the storage unit 150 as a standby process. For example, the operation control ECU 60 writes information obtained from the object recognition device 62, information on the state of operation control to the vehicle M (for example, each event information of operation control) as operation information in the storage unit 60A, and executes the information. When the condition is satisfied, the operation information storage process for storing the operation information from the storage unit 60A of the operation control ECU 60 to the storage unit 150 of the software updater 100 is executed.

When the software update of the operation control ECU 60 is executed, the update control unit 120 temporarily postpones the above-mentioned travel history recording process and restarts it after the software update is completed. As a result, it is possible to suppress the occurrence of a communication load (occupancy of communication, etc.) due to the communication of a large amount of travel history information. Further, the update control unit 120 can further reduce the communication load by suppressing communication in ECUs other than the operation control ECU 60 at the time of software update. Further, since the operation control ECU 60 does not execute the operation information storage process, the software update process can be performed more quickly.

The update control unit 120 acquires the energy amount of the battery 72 acquired by the energy acquisition unit 130 when executing the operation information storage process after updating the software, and the acquired energy amount is a predetermined amount or more. In some cases, the operation information storage process is executed. Further, the update control unit 120 registers in the execution history of the device management information 152 so that when the energy amount of the battery 72 is less than a predetermined amount, the processing is collectively performed next time. In this way, by determining whether or not to execute the postponed standby process based on the remaining energy, it is possible to prevent the standby process from ending in the middle of the process due to a power shortage caused by performing the update process or the like. can do.

Further, when the standby process executed by the operation control ECU 60 includes a travel aiming learning process that learns the travel history of the vehicle M and adjusts the content of the operation control based on the learning result, the update control unit 120 is software. Suppresses driving aiming learning processing at the time of update. Further, the update control unit 120 may suppress not only the update executed by the operation control ECU 60 but also the process executed by the device controlled by the operation control ECU 60 (for example, the object recognition device 62). For example, the object recognition device 62 performs object recognition learning processing using information obtained from the camera 64, the radar device 66, and the finder 68 in order to improve the recognition accuracy of objects around the vehicle. In this case, the operation control ECU 60 controls the object recognition device 62 to suppress the recognition learning process when the control information for suppressing the standby process is acquired from the update control unit 120. By suppressing the operation of the device controlled by the operation control ECU 60 in this way, the processing load of the operation control ECU 60 can be further reduced, and the software update process can be performed more appropriately. If the travel aiming learning process or the recognition learning process is postponed, the update control unit 120 causes the update control unit 120 to execute the above process after the update process is normally completed.

[Modification example]
In the above-described embodiment, the server device 200 is used as an example of the external device, but instead (or in addition), a terminal device used by a dealer worker (maintenance worker) or the like may be used. The communication unit 110 receives update software for updating by reprogramming from a specific terminal device by communicating with the terminal device by, for example, a wired connection using a USB (Universal Serial Bus) cable or the like. In addition, the communication unit 110 may perform authentication by the terminal device, the identification information of the worker, or the like so as to communicate only with a specific terminal or a worker. Instead of the terminal device described above, the software update device 100 may be directly connected to a device such as a USB memory to acquire data such as update software stored in the memory.

Further, when the amount of energy acquired by the energy acquisition unit 130 is less than a predetermined amount, the update control unit 120 cancels the execution of the suppressed (for example, postponed) standby process, and also updates the software. You may stop the execution of. As a result, it is possible to prevent the processing from being terminated due to a power shortage during the software update processing. In this case, the update control unit 120 causes the display control unit 140 to generate an image including information indicating that the update process could not be executed due to insufficient power and information for adjusting the update timing, and the ignition is turned on. When it becomes, it is displayed on the display unit 92.

Further, the update control unit 120 may not suppress the software even when the software is updated, depending on the type of standby processing. For example, the update control unit 120 can be completed in the VSA of the operation control, such as zero point correction of the G sensor mounted on the vehicle M, the amount of processing is small, and the standby processing that does not become a disturbance factor in the update processing is performed. , Even if the software of the operation control ECU is updated, the process is executed. As a result, software update processing and standby processing can be efficiently executed.

Further, in the present embodiment, the software update device 100 makes an inquiry about software update to the server device 200, but instead of making an inquiry, information about the update software from an external device such as the server device 200 (for example,). When the update instruction) is acquired, the above-mentioned update control process may be executed. In this case, the update control unit 120 downloads the update software of the update target ECU based on the update instruction of the server device 200, suppresses the execution of the standby process as described above, and executes the software update process.

As described above, according to the embodiment, the software update device 100 is connected to the vehicle M by communication between the communication unit 110 that communicates with the server device (an example of an external device) 200 and the server device 200 by the communication unit 110. The update control unit 120 includes an update control unit 120 that updates software incorporated in a plurality of device control units (ECUs) that control the mounted devices, and the update control unit 120 controls a plurality of devices when the vehicle M is stopped. When updating software for at least one device control unit, communication in the device control unit that does not update the software, or the device control unit that updates the software executes when the vehicle M stops. By suppressing one or both of the processes, the software update process can be executed more appropriately.

Further, according to the present embodiment, for example, by suppressing the execution of the standby process of a predetermined ECU, it is possible to secure the electric power in the software update process, and by suppressing the communication in another ECU, the communication path. Can be reduced. As a result, in the past, when installing or activating software after the ignition was turned off, OTA was executed accurately and early, whereas it was executed after waiting for the preparation of the ECU to be updated. Can be executed.

Although the embodiments for carrying out the present invention have been described above using the embodiments, the present invention is not limited to these embodiments, and various modifications and substitutions are made without departing from the gist of the present invention. Can be added.

1 ... software update system, 2 ... vehicle system, 10 ... in-vehicle equipment, 20 ... engine ECU, 30 ... transmission ECU, 40 ... steering ECU, 50 ... brake ECU, 60 ... operation control ECU, 70 ... battery ECU, 80 ... navigation ECU, 90 ... operation unit, 92 ... display unit, 94 ... ignition device 94, 100 ... software update device, 110 ... communication unit, 120 ... update control unit, 130 ... energy acquisition unit, 140 ... display control unit, 150, 20A ~ 80A ... Storage unit, 200 ... Server device, M ... Vehicle

Claims (9)

A communication unit that communicates with external devices,
The communication unit includes an update control unit that updates at least one of software incorporated in a plurality of device control units that control devices mounted on the vehicle by communicating with the external device.
When the update control unit updates the software to at least one device control unit among the plurality of device control units when the vehicle is stopped, the communication in the device control unit that does not update the software. Or, one or both of the processes executed by the device control unit that updates the software when the vehicle is stopped can be suppressed.
Further equipped with a storage unit for storing the driving information of the vehicle,
When the device control unit that updates the software executes a process of storing the driving information in the storage unit when the vehicle is stopped, the update control unit postpones the process and of the software. A software update device characterized in that the process is executed after the update. A communication unit that communicates with external devices,
The communication unit includes an update control unit that updates at least one of software incorporated in a plurality of device control units that control devices mounted on the vehicle by communicating with the external device.
When the update control unit updates the software to at least one device control unit among the plurality of device control units when the vehicle is stopped, the communication in the device control unit that does not update the software. Or, one or both of the processes executed by the device control unit that updates the software when the vehicle is stopped can be suppressed.
The plurality of device control units include a first device control unit that controls an internal combustion engine that outputs a traveling driving force for the vehicle to travel to a drive wheel, and a second device that controls a transmission mounted on the vehicle. Including the control unit
When the software is updated to one or both of the first device control unit and the second device control unit, the update control unit may use the first device control unit and the second device control unit to update the software of the vehicle. A software update device characterized by stopping a process to be executed when the machine is stopped. A communication unit that communicates with external devices,
The communication unit includes an update control unit that updates at least one of software incorporated in a plurality of device control units that control devices mounted on the vehicle by communicating with the external device.
When the update control unit updates the software to at least one device control unit among the plurality of device control units when the vehicle is stopped, the communication in the device control unit that does not update the software. Or, one or both of the processes executed by the device control unit that updates the software when the vehicle is stopped can be suppressed .
The update control unit executes the device control unit that updates the software before the software is updated when the vehicle is stopped when the state in which the software update cannot be normally completed continues for a predetermined number of times or more. A software updater characterized by executing a process to be performed. A communication unit that communicates with external devices,
The communication unit includes an update control unit that updates at least one of software incorporated in a plurality of device control units that control devices mounted on the vehicle by communicating with the external device.
When the update control unit updates the software to at least one device control unit among the plurality of device control units when the vehicle is stopped, the communication in the device control unit that does not update the software. Or, one or both of the processes executed by the device control unit that updates the software when the vehicle is stopped can be suppressed .
Further equipped with an energy acquisition unit for acquiring the amount of energy of the battery mounted on the vehicle,
The update control unit is characterized in that, based on the amount of energy acquired by the energy acquisition unit, the device control unit that updates the software controls the execution of processing executed when the vehicle is stopped. Software updater. The update control unit executes the device control unit that updates the software before the software is updated when the vehicle is stopped when the state in which the software update cannot be normally completed continues for a predetermined number of times or more. The software update device according to claim 1 , wherein the software is executed. Further equipped with an energy acquisition unit for acquiring the amount of energy of the battery mounted on the vehicle,
The update control unit is characterized in that, based on the amount of energy acquired by the energy acquisition unit, the device control unit that updates the software controls the execution of processing executed when the vehicle is stopped. The software update device according to claim 1 or 3 . The plurality of device control units include a third device control unit that controls driving by controlling one or both of the steering and speed of the vehicle.
Of claims 1 to 6 , the update control unit suppresses processing in a device controlled by the third device control unit when the software is updated to the third device control unit. The software update device according to any one of the following items. The software updater installed in the vehicle
Communicate with external devices
By communicating with the external device, at least one of the software embedded in the plurality of device control units that control the devices mounted on the vehicle is updated.
When the software is updated to at least one device control unit among the plurality of device control units when the vehicle is stopped, communication in the device control unit that does not update the software, or communication of the software. Suppressing one or both of the processes executed by the device control unit that performs the update when the vehicle is stopped ,
When the device control unit that updates the software executes a process of storing the driving information in a storage unit that stores the driving information of the vehicle when the vehicle is stopped, the processing is postponed and the software is stored. A software update method, characterized in that the process is executed after the update of the software. For software update devices installed in vehicles
Communicate with external devices
By communicating with the external device, at least one of the software embedded in the plurality of device control units that control the devices mounted on the vehicle is updated.
When the software is updated to at least one device control unit among the plurality of device control units when the vehicle is stopped, communication in the device control unit that does not update the software, or communication of the software. One or both of the processes executed by the device control unit to be updated when the vehicle is stopped are suppressed .
When the device control unit that updates the software executes a process of storing the driving information in a storage unit that stores the driving information of the vehicle when the vehicle is stopped, the processing is postponed and the software is stored. A program characterized by executing the above-mentioned processing after updating .

Images