WO2018154949A1 - Program updating system, control device, program updating method and computer program - Google Patents

Abstract

The present disclosure relates to a program updating system which includes a control device mounted on a vehicle, a relay device connected to the control device in a manner that enables communication within the vehicle, and a management server that wirelessly communicates with the relay device. The relay device or the control device executes transmission and receiving processing in which the transmission and receiving processes defined below are repeated, until a plurality of update programs required for updating a control program of the control device to a new version that is at least two generations newer are acquired. Transmission process: a process for transmitting, to the management server, a control message requesting an update program for updating, one generation at a time, the version of the control program of the control device. Receiving process: a process for receiving, from the management server, the update program transmitted by the management server in response to the control message.

Description

Program update system, control device, program update method, and computer program

The present invention relates to a program update system, a control device, a program update method, and a computer program.
This application claims priority based on Japanese Patent Application No. 2017-031758 filed on Feb. 23, 2017, and incorporates all the content described in the above Japanese application.

In recent years, in the technical field of automobiles, functions of vehicles have been advanced, and a wide variety of in-vehicle devices are mounted on vehicles. Therefore, a large number of so-called ECUs (Electronic Control Units), which are control devices for controlling each in-vehicle device, are mounted on the vehicle.
The ECU includes, for example, an engine, a brake, an EPS (Electric Power Steering) control for the operation of an accelerator, a brake, and a steering wheel, and a headlight is turned on / off according to a switch operation by an occupant Some of them operate the meters arranged near the driver's seat, such as wiper ON / OFF and door lock / unlock.

In general, the ECU is configured by an arithmetic processing device such as a microcomputer, and the control of the in-vehicle device is realized by reading and executing a control program stored in a ROM (Read Only Memory).
The control program of the ECU needs to rewrite the old version of the control program with the new version of the control program in response to the upgrade of the control program.

For example, in Patent Documents 1 and 2, a gateway such as an in-vehicle communication device receives an update program from a management server, and an ECU rewrites a control program from an old version to a new version using the received update program. A technique for remotely executing program update for each ECU by wireless communication is disclosed.

JP 2007-65856 A JP 2010-1981155 A

(1) A system according to an aspect of the present disclosure includes a control device mounted on a vehicle, a relay device connected to the control device so as to enable in-vehicle communication, and a management server that performs wireless communication with the relay device. In the program update system, the relay device or the control device transmits a transmission defined as follows until obtaining a plurality of update programs necessary for updating the control program of the control device to a new version of two or more generations. A transmission / reception process for repeating the process and the reception process is executed.

Transmission process: Process for transmitting a control message requesting an update program for upgrading the control program of the control device one generation at a time to the management server Reception process: Managing an update program transmitted by the management server in response to the control message Processing received from the server

(13) An apparatus according to an aspect of the present disclosure is a control device mounted on a vehicle, and includes a volatile memory, a storage unit having a rewritable nonvolatile memory that stores a control program, and the control program A control unit that controls a control target in the vehicle, and an acquisition unit that acquires an update program of the control program, and the control unit, when the acquisition unit acquires a plurality of the update programs, The control program is read from the non-volatile memory to the volatile memory, a plurality of the update programs are sequentially applied to the control program on the volatile memory, and the control program is updated to a new version of two or more generations. Then, the updated new version of the control program is written into the nonvolatile memory.

(14) A method according to an aspect of the present disclosure includes a control device mounted on a vehicle, a relay device connected to the control device so as to enable in-vehicle communication, and a management server that performs wireless communication with the relay device. A method for updating a program executed in a communication system, wherein the relay device or the control device acquires a plurality of update programs necessary for updating the control program of the control device to a new new version for two generations or more. , Including the step of repeating the transmission process and the reception process defined above.

(15) A computer program according to an aspect of the present disclosure includes a control device mounted on a vehicle, a relay device connected to the control device so as to be able to perform in-vehicle communication, and a management server that performs wireless communication with the relay device. A computer program for causing a computer to function as the relay device or the control device of a communication system including the plurality of computers necessary for updating the control program of the control device to a new version more than two generations in the computer Until the update program is acquired, the steps of repeating the transmission process and the reception process defined above are executed.

1 is an overall configuration diagram of a program update system according to an embodiment of the present invention. It is a block diagram which shows the internal structure of a gateway. It is a block diagram which shows the internal structure of ECU. It is a block diagram which shows the internal structure of a management server. It is a sequence diagram which shows the prior art example of the update procedure of a control program. It is a sequence diagram which shows the update procedure of the control program of 1st Embodiment. It is a sequence diagram which shows the update procedure of the control program of 2nd Embodiment. It is a sequence diagram which shows the update procedure of the control program of 3rd Embodiment. It is a sequence diagram which shows the update procedure of the control program of 4th Embodiment. It is a sequence diagram which shows the update procedure of the control program of 5th Embodiment.

<Problems to be solved by the present disclosure>
Since the update timing of the control program is different for each vehicle, the management server manages the version history of the control program of the ECU for each vehicle, and in the operation method in which an update program suitable for each vehicle is generated and provided to the vehicle, The server processing load becomes excessive.
In particular, when the vehicle receives the update program by wireless communication, the above-mentioned tendency becomes remarkable because the update timing is diversified as compared with the case of wired communication.
Therefore, on the management server side, when there are a plurality of version upgrades for a predetermined ECU, it is a reality that each differential program is prepared, and the ECU of the vehicle that is not the new version sequentially updates the differential program and the control program. Operation.

However, if the update program is a differential program, the old version of the control program is expanded in the RAM, and the new version of the control program to which the update program is applied is written in the ROM. Done.
Therefore, when the difference between the current version and the new version is two generations or more with respect to the same ECU control program, at least the update process from the current version to the mid version and the update process from the mid version to the new version are at least Since two update processes are required, there is a problem that it takes time to reach the new version.

Thus, when the update program is a differential program, it is necessary to perform writing / ROM check of the control program, which is the main cause of lengthening the update time, at least twice. Depending on the data capacity of the control program, It takes a lot of time to update from version to new version.
The present disclosure has been made in view of such conventional problems, and an object thereof is to shorten the update time of a control program necessary for upgrading two or more generations.

<Effects of the present disclosure>
According to the present disclosure, it is possible to shorten the update time of a control program necessary for upgrading two or more generations.

<Outline of Embodiment of the Present Invention>
Hereinafter, an outline of embodiments of the present invention will be listed and described.
(1) A program update system according to the present embodiment includes a control device mounted on a vehicle, a relay device connected to the control device so that in-vehicle communication is possible, and a management server that wirelessly communicates with the relay device. In the update system, the relay apparatus or the control apparatus transmits a plurality of update programs necessary for updating the control program of the control apparatus to a new new version for two generations or more until the transmission process defined below The transmission / reception process is repeated to repeat the reception process.

Transmission process: Process for transmitting a control message requesting an update program for upgrading the control program of the control device one generation at a time to the management server Reception process: Managing an update program transmitted by the management server in response to the control message Processing received from the server

According to the program update system of the present embodiment, since the relay device or the control device executes the transmission / reception process described above, the control device can update a plurality of update programs or new versions required for generating a new version of the control program. A control program can be acquired.

(2) Therefore, for example, when the control device includes a volatile memory and a storage unit having a rewritable nonvolatile memory for storing the control program, and the control device acquires a plurality of the update programs, the control The apparatus reads the control program from the non-volatile memory to the volatile memory, sequentially applies the plurality of update programs to the control program on the volatile memory, and updates the control program to the new version. The updated new version of the control program may be written into the nonvolatile memory.

In this way, the control device only needs to write and check a new version of the control program (skip program) generated by itself once, and shorten the update time required for two or more generations of version upgrades. Can do.

(3) However, in order to realize the above processing, the control device does not update the control program until a plurality of the update programs are acquired, and after the plurality of the update programs are acquired, It is necessary to update the control program.

(4) In the program update system of the present embodiment, the control device may transmit a write completion notification when the updated control program is written to the nonvolatile memory after a plurality of the update programs are acquired. preferable.
In this way, by sending the above write completion notification to the relay device or management server, it is possible to notify the relay device or management server that the control program has been updated to a new version of two or more generations. it can.

(5) In the program update system of the present embodiment, more specifically, the relay device or the control device applies the plurality of acquired update programs to the volatile memory of its own device a plurality of times to generate two generations. As described above, the generation process of the skip program which is the new version of the control program is executed, and the control apparatus executes the writing process of writing the generated skip program in the nonvolatile memory of the own apparatus.
For this reason, the control device only needs to write and check a new version of the control program (skip program) that has been generated by itself or provided from the relay device once, and it can be upgraded to two or more generations. The required update time can be shortened.

(6) In the program update system of the present embodiment, when the execution subject of the transmission / reception process is the relay device, the relay device transfers the acquired plurality of update programs to the control device, and the control The apparatus uses the plurality of transferred update programs to generate a skip program that is a version of the control program that is two or more generations newer than the current version of the apparatus, and stores the generated skip program in the storage unit of the apparatus. Just write it.
In this case, if the writing and checking of the skip program are completed successfully, the update to the new version, which is a new version of two generations or more, is completed, so the update time required for the version upgrade of two generations or more can be shortened. .

(7) In the program update system of the present embodiment, when the execution subject of the transmission / reception process is the relay device, the relay device uses the plurality of acquired update programs to obtain the current version of the control device. A skip program that is a version of the control program that is newer than two generations is generated, the generated skip program is transferred to the control device, and the control device writes the transferred skip program in the storage unit of the own device. You may do it.
In this case as well, if the writing and checking of the skip program is completed successfully, the update to the new version, which is a new version of 2 generations or more, is completed, so the update time required for the upgrade of 2 generations or more can be shortened. it can.

(8) In the program update system of the present embodiment, when the execution subject of the transmission / reception process is the control device, the control device uses the plurality of acquired update programs to determine the current version of the device itself. A skip program that is a new version of the control program of two or more generations may be generated, and the generated skip program may be written in the storage unit of the own device.
In this case as well, if the writing and checking of the skip program is completed successfully, the update to the new version, which is a new version of 2 generations or more, is completed, so the update time required for the upgrade of 2 generations or more can be shortened. it can.

(9) In the program update system of the present embodiment, the control device generates a next-generation control program from the update program when the write of the skip program fails, and the generated control program It is preferable to perform writing to the storage unit of the own device step by step for each generation.
In this way, even if the skip program writing fails, the control program of the control device can be reliably updated to the new version.

(10) In the program update system of the present embodiment, the control message may include a provisional completion notification requesting the management server to transmit the next update program in response to reception of the update program. preferable.
In this way, since the management server further transmits the next update program in response to the provisional completion notification, a plurality of update programs necessary for updating to a new version that is a new version of two or more generations are transferred to the relay device or The control device can receive appropriately.

(11) In the program update system of the present embodiment, the control message includes a write completion notification for notifying the management server of completion of writing of the next generation control program generated from the update program. Also good.
In this way, since the management server further transmits the next update program in response to the rewriting completion notification, a plurality of update programs necessary for updating to a new version that is a new version of two or more generations are transferred to the relay device or The control device can receive appropriately.

(12) In the program update system of the present embodiment, whether or not the relay device or the control device executes the transmission / reception process based on at least one of a data size and a transmission time of a plurality of the update programs. It is preferable to determine whether or not.
In this case, only when the data size and transmission time of a plurality of update programs are equal to or greater than a predetermined threshold, the program update system of the present embodiment can be flexibly operated, for example, by causing the relay device or the control device to execute the transmission / reception process described above become able to.

(13) The control device of the present embodiment is a control device mounted on a vehicle, and includes a volatile memory, a storage unit having a rewritable nonvolatile memory for storing a control program, and the vehicle according to the control program. A control unit that controls a control target of the control unit, and an acquisition unit that acquires an update program of the control program, and the control unit is configured such that when the acquisition unit acquires a plurality of the update programs, the nonvolatile unit The control program is read from the volatile memory to the volatile memory, a plurality of the update programs are sequentially applied to the control program on the volatile memory, and the control program is updated to a new new version for two generations or more. The new version of the control program is written into the nonvolatile memory.

According to the control device of the present embodiment, the control unit reads the control program from the nonvolatile memory to the volatile memory, sequentially applies a plurality of update programs to the control program on the volatile memory, and generates the control program for two generations. Since the new new version is updated and the updated new version of the control program is written to the non-volatile memory, it is only necessary to write and check the generated new version of the control program (skip program) once and for two or more generations. The update time required for version upgrade can be shortened.

(14) The program update method of the present embodiment relates to a program update method executed by a relay device included in the program update system described in any of (1) to (12) above.
Therefore, the program update method of the present embodiment has the same effects as the program update system described in any of the above (1) to (12).

(15) The computer program of the present embodiment relates to a computer program for causing a computer to function as a relay device included in the program update system described in any one of (1) to (12) above.
Therefore, the computer program of the present embodiment has the same operational effects as the program update system described in any of the above (1) to (12).

<Details of Embodiment of the Present Invention>
Hereinafter, details of embodiments of the present invention will be described with reference to the drawings. In addition, you may combine arbitrarily at least one part of embodiment described below.

[Overall system configuration]
FIG. 1 is an overall configuration diagram of a program update system according to an embodiment of the present invention.
As shown in FIG. 1, the program update system of this embodiment includes a vehicle 1 and a management server 5 that can communicate via a wide area communication network 2.
The management server 5 is operated, for example, by a car manufacturer of the vehicle 1 and can communicate with a large number of vehicles 1 owned by a user who is registered as a member in advance.

The vehicle 1 is equipped with a gateway 10, a wireless communication device 15, a plurality of ECUs 30, and various in-vehicle devices (not shown) controlled by the ECUs 30.
In the vehicle 1, there is a communication group including a plurality of ECUs 30 that are bus-connected to a common in-vehicle communication line, and the gateway 10 relays communication between the communication groups. Therefore, a plurality of in-vehicle communication lines are connected to the gateway 10.

The gateway 10 is connected to the wireless communication device 15 by an in-vehicle communication line. The wireless communication device 15 wirelessly communicates with the management server 5 through the wide area communication network 2 such as a mobile phone network, and transfers information received from an external device such as the management server 5 to the gateway 10. The gateway 10 transmits information received from the wireless communication device 15 to the ECU 30.
The gateway 10 transfers the information acquired from the ECU 30 to the wireless communication device 15, and the wireless communication device 15 transmits the received information to an external device such as the management server 5.

The wireless communication device 15 includes a communication device such as a mobile phone, a smartphone, a tablet terminal, or a notebook PC (Personal Computer) owned by the user. The wireless communication device 15 may be a navigation device that is constantly mounted on the vehicle 1.
In the vehicle 1 of FIG. 1, a case where the gateway 10 communicates with an external device via the wireless communication device 15 is illustrated. However, when the gateway 10 itself has a wireless communication function, the gateway 10 includes the management server 5. You may decide to perform radio | wireless communication with external apparatuses, such as.

In the program update system of FIG. 1, the management server 5 is configured by one server device, but may be configured by two or more server devices.
For example, the management server 5 is configured by a server device that plays a different role, such as an information management server that manages user registration information and control program version information, and a download server that stores control program update programs. Can do.

[Internal configuration of gateway]
FIG. 2 is a block diagram showing the internal configuration of the gateway 10.
As shown in FIG. 2, the gateway 10 includes a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a storage unit 13, an in-vehicle communication unit 14, and the like. The gateway 10 is connected to the wireless communication device 15 via the in-vehicle communication line, but may include the wireless communication device 15.

The CPU 11 causes the gateway 10 to function as a relay device for various information by reading one or more programs stored in the storage unit 13 into the RAM 12 and executing them.
The CPU 11 can execute a plurality of programs in parallel, for example, by switching and executing a plurality of programs in a time division manner. The CPU 11 may represent a plurality of CPU groups. In this case, the functions realized by the CPU 11 are realized by the cooperation of a plurality of CPU groups.

The RAM 12 is composed of a volatile memory element such as SRAM (Static RAM) or DRAM (Dynamic RAM).
The RAM 12 temporarily stores computer programs executed by the CPU 11 and data necessary for execution.

The computer program executed by the CPU 11 can be transferred while being recorded on a known recording medium such as a CD-ROM or DVD-ROM, or can be transferred by information transmission (downloading) from a computer device such as a server computer. You can also.
The same applies to a computer program executed by a CPU 31 (see FIG. 3) of an ECU 30 described later and a computer program executed by a CPU 51 (see FIG. 4) of a management server 5 described later.

The storage unit 13 includes a nonvolatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory).
The storage unit 13 has a storage area for storing a computer program executed by the CPU 11 and data necessary for execution. The storage unit 13 also stores an update program for each ECU 30 received from the management server 5.

A plurality of ECUs 30 are connected to the in-vehicle communication unit 14 via an in-vehicle communication line disposed in the vehicle 1.
The in-vehicle communication unit 14 is, for example, CAN (Controller Area Network), CANFD (CAN with Flexible Data Rate), LIN (Local Interconnect Network), Ethernet (registered trademark), or MOST (Media Oriented Systems Transport: MOST is a registered trademark). Communication with the ECU 30 is performed according to the standard.

The in-vehicle communication unit 14 transmits the information given from the CPU 11 to the target ECU 30 and gives the information received from the ECU 30 to the CPU 11.
The in-vehicle communication unit 14 may communicate according to other communication standards used for the in-vehicle network as well as the above communication standards.

The wireless communication device 15 includes a wireless communication device including an antenna and a communication circuit that executes transmission / reception of a wireless signal from the antenna. The wireless communication device 15 can communicate with an external device by being connected to a wide area communication network 2 such as a mobile phone network.
The wireless communication device 15 transmits information given from the CPU 11 to an external device such as the management server 5 through the wide area communication network 2 formed by a base station (not shown), and receives information received from the external device to the CPU 11. give.

[Internal configuration of ECU]
FIG. 3 is a block diagram showing the internal configuration of the ECU 30.
As shown in FIG. 3, the ECU 30 includes a CPU 31, a RAM 32, a storage unit 33, a communication unit 34, and the like. The ECU 30 is a control device that individually controls a plurality of in-vehicle devices mounted on the vehicle 1. Examples of the ECU 30 include an engine control ECU, a steering control ECU, and a door lock control ECU.

The CPU 31 controls the operation of the in-vehicle device that it is in charge of by reading one or more programs stored in advance in the storage unit 33 into the RAM 32 and executing them. The CPU 31 may also represent a plurality of CPU groups, and the control by the CPU 31 may be control by cooperation of a plurality of CPU groups.

The RAM 32 is composed of a volatile memory element such as SRAM or DRAM.
The RAM 32 temporarily stores computer programs executed by the CPU 31 and data necessary for execution.

The storage unit 33 is configured by a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The information stored in the storage unit 33 includes, for example, a computer program (hereinafter referred to as “control program”) for causing the CPU 31 to execute processing for controlling the in-vehicle device that is the control target.

The communication unit 34 is connected to the gateway 10 via an in-vehicle communication line disposed in the vehicle 1. The communication unit 34 communicates with the gateway 10 according to a standard such as CAN, Ethernet, or MOST.
The communication unit 34 transmits the information given from the CPU 31 to the gateway 10 and gives the information received from the gateway 10 to the CPU 31. The communication unit 34 may communicate according to other communication standards used for the in-vehicle network as well as the above communication standards.

The communication unit 34 may be connected to another ECU 30 via an in-vehicle communication line disposed in the vehicle 1. In this case, the communication unit 34 communicates with the gateway 10 via another ECU 30.
The CPU 31 of the ECU 30 includes an activation unit 35 that switches the control mode by the CPU 31 to either “normal mode” or “reprogramming mode” (hereinafter also referred to as “repro mode”).

The normal mode is a control mode in which the CPU 31 of the ECU 30 executes original control contents (for example, engine control, steering control, etc.) by a control program.
The reprogramming mode is a mode in which the CPU 31 of the ECU 30 is given the authority to erase and rewrite the control program in the ROM area of the control program. The CPU 31 can update the control program to the new version only in this mode.

When the activation unit 35 writes the new version control program in the storage unit 33 in the repro mode, the activation unit 35 restarts (resets) the ECU 30 once, and executes the verification process on the storage area in which the new version control program is written.
The activation unit 35 causes the CPU 31 to operate according to the updated control program after the above-described verification processing is completed.

[Management Server internal configuration]
FIG. 4 is a block diagram showing the internal configuration of the management server 5.
As shown in FIG. 4, the management server 5 includes a CPU 51, a ROM 52, a RAM 53, a storage unit 54, a communication unit 55, and the like.

The CPU 51 reads out one or more computer programs stored in advance in the ROM 52 to the RAM 53 and executes them, thereby controlling the operation of each hardware and causing the management server 5 to function as an external device that can communicate with the gateway 10. The CPU 51 may also represent a plurality of CPU groups, and the functions realized by the CPU 51 may be realized by the cooperation of a plurality of CPU groups.

The RAM 53 is composed of a volatile memory element such as SRAM or DRAM.
The RAM 53 temporarily stores computer programs executed by the CPU 51 and data necessary for execution.

The storage unit 54 includes a nonvolatile memory element such as a flash memory or an EEPROM, or a magnetic storage device such as a hard disk.
The communication unit 55 includes a communication device that executes communication processing in accordance with a predetermined communication standard, and is connected to a wide-area communication network 2 such as a mobile phone network. The communication unit 55 transmits the information given from the CPU 51 to the external device via the wide area communication network 2 and gives the information received via the wide area communication network 2 to the CPU 51.

As shown in FIG. 4, the information stored in the storage unit 54 includes an update management table RT for managing for each vehicle 1 whether or not the control program of the ECU 30 has been updated to the latest version. In the update management table RT of FIG. 4, “EI” is an identification number of the ECU 30.
The update management table RT includes the identification number of the ECU 30 (“EI = 1” in FIG. 4), the latest version of the control program of the identification number (“3.0” in FIG. 4), and the vehicle identification number of the registered member ( It consists of a table that summarizes the updated state of the ECU 30 for each (VIN).

In the update management table RT of FIG. 4, since the update state is “complete” in the vehicle 1 with VIN = 3, the update to the latest version (= 3.0) of the control program of the ECU 30 with EI = 1 has already been completed. is doing.
Therefore, for the vehicle 1 with VIN = 3, it is not necessary to update the control program of the ECU 30 with EI = 1 unless the latest version of the control program is updated to, for example, “4.0”.

In the vehicle 1 with VIN = 1 and 2, since the update state is “incomplete”, the control program of the ECU 30 with EI = 1 has not yet been updated to the latest version (= 3.0) of the control program. Absent.
Therefore, for the vehicle 1 with VIN = 1 and 2, it is necessary to provide an update program necessary for the ECU 30 with EI = 1 to update its own control program to the latest version (= 3.0).

Therefore, the CPU 51 of the management server 5 transmits an update notification to the vehicle 1 (the vehicle 1 with VIN = 1 and 2) whose update state is not completed at predetermined time intervals, and the control program of the ECU 30 with EI = 1. Encourage updates. The vehicle 1 that has received the update notification transmits a version notification including the current version (for example, 1.0) of the control program of the ECU 30 to the management server 5.
The CPU 51 determines an update program necessary for the vehicle 1 from the current version included in the received version notification, and transmits the determined update program to the vehicle 1.

[Conventional example of control program update procedure]
FIG. 5 is a sequence diagram showing a conventional example of a control program update procedure in the program update system of the present embodiment. Here, it is assumed that the communication partner of the management server 5 is the vehicle 1 with VIN = 1 in the update management table RT of FIG.
Further, the version history of the control program of the ECU 30 with EI = 1 is “1.0” → “2.0” → “3.0 (latest)”. In the ECU 30 of the vehicle 1 with VIN = 1, Assume that the current version of the control program is 1.0 (two generations before the latest version).

In the present embodiment, it is assumed that the update program is a “difference program Δ” from an old version one generation before. In this case, if Δ including the difference information of the file between the old version and the new version is in the same storage area, the new version can be generated by applying Δ to the old version.
In the following description, an update program from version 1.0 to version 2.0 of the control program is “Δ1”, and an update program from version 2.0 to version 3.0 of the control program is “Δ2”. "

As shown in FIG. 5, the management server 5 transmits an update notification that prompts an update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 (step S1).
The gateway 10 of the vehicle 1 that has received the update notification transmits a control program version confirmation to the ECU 30 with EI = 1 (step S2). The ECU 30 that has received the version confirmation returns a version notification including the current version (= 1.0) of the control program to the gateway 10 (step S3).

The gateway 10 that has received the version notification transmits a version notification including the current version (= 1.0) of the ECU 30 to the management server 5 (step S4).
The CPU 51 of the management server 5 that has received the version notification transmits to the vehicle 1 with VIN = 1 the update program Δ1 necessary for updating the version of the control program from 1.0 to 2.0 (step S5). The gateway 10 of the vehicle 1 transfers the received update program Δ1 to the ECU 30 with EI = 1 (step S6).

Next, the CPU 31 of the ECU 30 copies the current version of the control program (hereinafter also referred to as “current software”) from the ROM of the storage unit 33 to the RAM 32 (step S7), and develops the current software ( Ver = 1.0), the update program Δ1 is applied (step S8). As a result, a version 2.0 control program, which is the next generation from the current version 1.0, is generated.

When the version 2.0 control program is generated, the starting unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and stores the version 2.0 control program in the storage unit 33. Then, the data content is checked (step S9).

The above check includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 2.0 control program is written.
When the above check is completed, the activation unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated new control program (Ver = 2.0).

Next, the CPU 31 of the ECU 30 transmits a write completion notification to the gateway 10 (step S10). The gateway 10 transfers the received write completion notification to the management server 5 (step S11).
The write completion notification includes the version information of the control program after writing (in this case, Ver = 2.0).

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), even if the control program for the ECU 30 is updated to version 2.0, the control program for the ECU 30 is not yet the latest.
Therefore, the management server 5 that has received the write completion notification transmits an update notification for urging the update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 after the lapse of a predetermined period (step S12).

The gateway 10 of the vehicle 1 that has received the update notification transmits a software version confirmation to the ECU 30 with EI = 1 (step S13). The ECU 30 that has received the version confirmation returns a version notification including the current version (= 2.0) of the control program to the gateway 10 (step S14).

The gateway 10 that has received the version notification transmits a version notification including the current version (= 2.0) of the ECU 30 to the management server 5 (step S15).
The management server 5 that has received the version notification transmits to the vehicle 1 with VIN = 1 the update program Δ2 required to update the version of the control program from 2.0 to 3.0 (step S16). The gateway 10 of the vehicle 1 transfers the received update program Δ2 to the ECU 30 with EI = 1 (step S17).

Next, the CPU 31 of the ECU 30 copies the current software (in this case, the control program of version 2.0) from the ROM of the storage unit 33 to the RAM 32 (step S18), and develops the current software (Ver = 2. 0), the update program Δ2 is applied (step S19). As a result, a version 3.0 control program that is the next generation from the current version 2.0 is generated.

When the version 3.0 control program is generated, the activation unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and stores the version 3.0 control program in the storage unit 33. After the data is written into the ROM, the data content is checked (step S20).

The above check also includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 3.0 control program is written.
When the above check is completed, the activation unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated new control program (Ver = 3.0).

Next, the CPU 31 of the ECU 30 transmits a write completion notification to the gateway 10 (step S21). The gateway 10 transfers the received write completion notification to the management server 5 (step S22).
The write completion notification includes version information of the control program after writing (in this case, Ver = 3.0).

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), when the control program for the ECU 30 is updated to version 3.0, the control program for the ECU 30 becomes the latest.
Therefore, the management server 5 that has received the write completion notification transmits the latest notification that the control program of the ECU 30 with EI = 1 is the latest to the vehicle 1 with VIN = 1 (step S23).

[Problems and solutions of conventional update procedures]
In a FOTA (Firmware On-The-Air) that downloads an update program necessary for updating the control program of the ECU 30 from the management server 5 by wireless communication, for example, in the case of a user with a low update frequency, a predetermined ECU 30 Regarding the control program, the difference between the current version and the latest version may be two generations or more.

For example, when the current version is 1.0 and the latest version is 3.0 after two generations, as shown in FIG. 5, an update process from version 1.0 to version 2.0 (FIG. 5). Steps S7 to S9) and update processing from version 2.0 to latest version 3.0 (steps S18 to S20 in FIG. 5) are required, and the current version 1.0 is reached to the latest version 3.0. There is a problem that it takes time.

In particular, when the update program is the difference program Δ, the control program on the ROM in the storage unit 33 is once expanded in the RAM 32, the file after the application of the difference program Δ is written back on the ROM, and the ROM check ( (Verify processing) is performed (steps S9 and S20 in FIG. 5).
For this reason, it is necessary to perform rewriting / ROM check of the control program based on the update programs Δ1 and Δ2 twice, and depending on the data capacity of the control program, it is very large to update the current version 1.0 to the latest version 3.0 Takes a lot of time.

Therefore, in the present embodiment, when two or more generations of the control program of the same ECU 30 are required, the control program of the latest version 3.0 is generated step by step using a plurality of update programs Δ1, Δ2. It was made possible to write and check in the ROM of the storage unit 33 in one time.
In this case, since the control program needs to be written and checked only once, the update time required for upgrading two or more generations can be shortened.

[Update Procedure of First Embodiment]
FIG. 6 is a sequence diagram showing the update procedure of the control program of the first embodiment in the program update system of the present embodiment.
Here, it is assumed that the communication partner of the management server 5 is the vehicle 1 with VIN = 1 in the update management table RT of FIG. This is the same in the update procedure (FIGS. 7 to 10) of the second to fifth embodiments described later.

The version history of the control program of the ECU 30 with EI = 1 follows “1.0” → “2.0” → “3.0 (latest)”. In the ECU 30 of the vehicle 1 with VIN = 1, Assume that the current version of the program is 1.0 (two generations before the latest version). This also applies to the update procedure (FIGS. 7 to 10) of the second to fifth embodiments described later.

In the program update system of the present embodiment, “provisional completion notification” is defined as a type of control message for controlling the download process between the management server 5 and the vehicle 1 (the gateway 10 in the first embodiment). Yes.
Specifically, the provisional completion notification is a control message defined in advance so that the management server 5 and the gateway 10 of the vehicle 1 execute the following processes (1) to (4). The provisional completion notification is issued without receiving a writing completion notification from the ECU 30.

(1) Upon receipt of the update program Δi (i = 1, 2,...), The gateway 10 of the vehicle 1 transmits a provisional completion notification to the management server 5 before providing the received update program Δi to the ECU 30.
(2) When the management server 5 receives the temporary completion notification from the vehicle 1, the management server 5 updates the ECU 30 with EI = 1 of the vehicle 1 that is the transmission source of the temporary completion notification (the vehicle 1 with VIN = 1 in the illustrated example). It is determined whether or not the next update program Δi + 1 of the program Δi is necessary.

(3) When the determination result of (2) is affirmative, the management server 5 transmits an update program Δi + 1 that is necessary next to the update program Δi to the vehicle 1 (gateway 10).
(4) When the determination result of (2) is negative, the management server 5 transmits a final notification that the update program Δi is final to the vehicle 1 (gateway 10).

As shown in FIG. 6, the management server 5 transmits an update notification for urging the update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 (step S101).
The gateway 10 of the vehicle 1 that has received the update notification transmits a software version confirmation to the ECU 30 with EI = 1 (step S102). The ECU 30 that has received the version confirmation returns a version notification including the current version (= 1.0) of the control program to the gateway 10 (step S103).

The gateway 10 that has received the version notification transmits a version notification including the current version (= 1.0) of the ECU 30 to the management server 5 (step S104).
Receiving the version notification, the CPU 51 of the management server 5 transmits an update program Δ1 necessary for updating the version of the control program from 1.0 to 2.0 to the vehicle 1 with VIN = 1 (step S105).

The gateway 10 that has received the update program Δ1 transmits a provisional completion notification to the management server 5 (step S106).
Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), even if the control program for the ECU 30 is updated to version 2.0 by the update program Δ1, the control program for the ECU 30 is not yet the latest.

Therefore, the management server 5 that has received the provisional completion notification in step S106, the update program Δ2 next to the update program Δ1, that is, the update program Δ2 necessary for updating the version of the control program from 2.0 to 3.0. Is transmitted to the vehicle 1 with VIN = 1 (step S107).
The gateway 10 that has received the update program Δ2 transmits a provisional completion notification to the management server 5 (step S108).

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), when the control program for the ECU 30 is updated to version 3.0 by the update program Δ2, the control program for the ECU 30 becomes the latest.
Therefore, the management server 5 that has received the temporary completion notification in step S108 transmits a final notification that the update program Δ2 is final to the vehicle 1 with VIN = 1 (step S109). The final notification includes version information (Ver = 3.0) of the final version.

Receiving the final notification, the gateway 10 transfers the update programs Δ1, Δ2 temporarily stored in the storage unit 33 of the own device to the ECU 30 with EI = 1 (step S110).
Further, the gateway 10 notifies the ECU 30 with EI = 1 of the final version (= 3.0) of the control program generated when the two update programs Δ1, Δ2 are applied (step S111).

Next, the CPU 31 of the ECU 30 copies the current software from the ROM of the storage unit 33 to the RAM 32 (step S112), and sequentially applies the two update programs Δ1 and Δ2 to the current software (Ver = 1.0) developed in the RAM 32. (Step S113).
As a result, a control program (hereinafter referred to as “skip program”) of the new version 3.0 from the current version 1.0 is generated.

The CPU 31 of the ECU 30 confirms whether the generated skip program is the final version (= 3.0) notified from the gateway 10, and then permits writing of the skip program (step S114).
When writing of the skip program is permitted, the activation unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and writes the version 3.0 control program in the ROM of the storage unit 33. After that, the data content is checked (step S115).

The above check includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 3.0 control program is written.
When the above check is completed, the starting unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated control program (= 3.0).

Next, the CPU 31 of the ECU 30 transmits a write completion notification to the gateway 10 (step S116). The gateway 10 transfers the received write completion notification to the management server 5 (step S117).
The write completion notification includes version information of the control program after writing (in this case, Ver = 3.0).

[Update Procedure of Second Embodiment]
FIG. 7 is a sequence diagram showing a control program update procedure according to the second embodiment in the program update system of the present embodiment.
The update procedure (FIG. 7) of the second embodiment is different from the update procedure (FIG. 6) of the first embodiment in that the latest version of the skip program write permission (step S114 in FIG. There is a point to execute.

As shown in FIG. 7, the management server 5 transmits an update notification for urging the update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 (step S201).
The gateway 10 of the vehicle 1 that has received the update notification transmits a software version confirmation to the ECU 30 with EI = 1 (step S202). The ECU 30 that has received the version confirmation returns a version notification including the current version (= 1.0) of the control program to the gateway 10 (step S203).

The gateway 10 that has received the version notification transmits a version notification including the current version (= 1.0) of the ECU 30 to the management server 5 (step S204).
The CPU 51 of the management server 5 that has received the version notification transmits to the vehicle 1 with VIN = 1 the update program Δ1 necessary for updating the version of the control program from 1.0 to 2.0 (step S205).

The gateway 10 that has received the update program Δ1 transmits a provisional completion notification to the management server 5 (step S206).
Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), even if the control program for the ECU 30 is updated to version 2.0 by the update program Δ1, the control program for the ECU 30 is not yet the latest.

Therefore, the management server 5 that has received the temporary completion notification in step S206 updates the update program Δ2 next to the update program Δ1, that is, the update program Δ2 necessary to update the version of the control program from 2.0 to 3.0. Is transmitted to the vehicle 1 with VIN = 1 (step S207).
The gateway 10 that has received the update program Δ2 transmits a provisional completion notification to the management server 5 (step S208).

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), when the control program for the ECU 30 is updated to version 3.0 by the update program Δ2, the control program for the ECU 30 becomes the latest.
Accordingly, the management server 5 that has received the temporary completion notification in step S108 transmits a final notification that the update program Δ2 is final to the vehicle 1 with VIN = 1 (step S209).

Receiving the final notification, the gateway 10 transfers the update programs Δ1, Δ2 temporarily stored in the storage unit 33 of the own device to the ECU 30 with EI = 1 (step S210).
Further, the gateway 10 temporarily stores the final version (= 3.0) of the control program generated when the two update programs Δ1 and Δ2 are applied in the storage unit 13 of the own device.

Next, the CPU 31 of the ECU 30 copies the current software from the ROM of the storage unit 33 to the RAM 32 (step S211), and sequentially applies the two update programs Δ1 and Δ2 to the current software (Ver = 1.0) expanded in the RAM 32. (Step S212).
As a result, a skip program of version 3.0 that is two generations new from the current version 1.0 is generated.

The CPU 31 of the ECU 30 reads version information from the generated skip program, and sends a version notification including the read version information to the gateway 10 (step S213).
Upon receiving the version notification, the gateway 10 confirms whether the notified version information is the last version (= 3.0) being stored, generates a skip program write permission (step S214), and generates the generated write The permission is transmitted to the ECU 30 (step S215).

When receiving the permission to write the skip program, the activation unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and writes the version 3.0 control program in the ROM of the storage unit 33. Then, the data content is checked (step S216).

The above check includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 3.0 control program is written.
When the above check is completed, the starting unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated control program (= 3.0).

Next, the CPU 31 of the ECU 30 transmits a write completion notification to the gateway 10 (step S217). The gateway 10 transfers the received write completion notification to the management server 5 (step S218).
The write completion notification includes version information of the control program after writing (in this case, Ver = 3.0).

[Update Procedure of Third Embodiment]
FIG. 8 is a sequence diagram showing a control program update procedure according to the third embodiment in the program update system of the present embodiment.
The update procedure (FIG. 8) of the third embodiment is different from the update procedure (FIG. 6) of the first embodiment in that the management server 5 that cannot recognize the provisional completion notification is adopted, and the gateway 10 replaces the provisional completion notification. Thus, a normal write completion notification is transmitted to the management server 5. However, the gateway 10 transmits a write completion notification to the management server 5 without receiving a write completion notification from the ECU 30.

That is, when the gateway 10 used for the update procedure (FIG. 8) of the third embodiment receives the update program Δi (i = 1, 2,...), The gateway 10 uses the update program Δi before providing the update program Δi to the ECU 30. A notification to the effect that writing has been completed is transmitted to the management server 5.
The write completion notification includes version information (= i + 1) when the update program Δi is applied. Therefore, when the notified version of the control program is not the latest, the management server 5 transmits the next update program Δi + 1 to the vehicle 1.

As illustrated in FIG. 8, the management server 5 transmits an update notification that prompts an update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 (step S301).
The gateway 10 of the vehicle 1 that has received the update notification transmits a software version confirmation to the ECU 30 with EI = 1 (step S302). The ECU 30 that has received the version confirmation returns a version notification including the current version (= 1.0) of the control program to the gateway 10 (step S303).

The gateway 10 that has received the version notification transmits a version notification including the current version (= 1.0) of the ECU 30 to the management server 5 (step S304).
The CPU 51 of the management server 5 that has received the version notification transmits an update program Δ1 necessary for updating the version of the control program from 1.0 to 2.0 to the vehicle 1 with VIN = 1 (step S305).

The gateway 10 that has received the update program Δ1 transmits a write completion notification to the management server 5 (step S306). This write completion notification includes the version (Ver = 2.0) of the control program after applying the update program Δ1.
Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), even if the control program for the ECU 30 is updated to version 2.0 by the update program Δ1, the control program for the ECU 30 is not yet the latest.

Accordingly, the management server 5 that has received the write completion notification in step S306, the update program Δ2 next to the update program Δ1, that is, the update program Δ2 required to update the version of the control program from 2.0 to 3.0. Is transmitted to the vehicle 1 with VIN = 1 (step S307).
The gateway 10 that has received the update program Δ2 transmits a write completion notification to the management server 5 (step S308). This write completion notification includes the version of the control program (Ver = 3.0) after applying the update program Δ2.

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), when the control program for the ECU 30 is updated to version 3.0 by the update program Δ2, the control program for the ECU 30 becomes the latest.
Accordingly, the management server 5 that has received the provisional completion notification in step S308 transmits the latest notification that the notified version (= 3.0) is the latest to the vehicle 1 with VIN = 1 (step S309).

The gateway 10 that has received the latest notification transfers the update programs Δ1 and Δ2 temporarily stored in the storage unit 33 of the own device to the ECU 30 with EI = 1 (step S110).
Further, the gateway 10 notifies the ECU 30 with EI = 1 of the final version (= 3.0) of the control program generated when the two update programs Δ1, Δ2 are applied (step S311).

Next, the CPU 31 of the ECU 30 copies the current software from the ROM of the storage unit 33 to the RAM 32 (step S312), and sequentially applies the two update programs Δ1 and Δ2 to the current software (Ver = 1.0) expanded in the RAM 32. (Step S313).
The CPU 31 of the ECU 30 confirms whether or not the control program generated by applying the update programs Δ1 and Δ2 is the final version (= 3.0) notified from the gateway 10, and then permits writing of the control program ( Step S314).

When writing of the control program is permitted, the activation unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and writes the version 3.0 control program in the ROM of the storage unit 33. After that, the data content is checked (step S315).

The above check includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 3.0 control program is written.
When the above check is completed, the starting unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated control program (= 3.0).

In the update procedure (FIG. 8) of the third embodiment, the gateway 10 has already transmitted the writing completion notification of the latest version (= 3.0) before transferring the update programs Δ 1 and Δ 2 to the ECU 30. ing.
Therefore, the CPU 31 of the ECU 30 does not need to send the write completion notification after the process of step S315 to the gateway 10.

[Update procedure of the fourth embodiment]
FIG. 9 is a sequence diagram showing a control program update procedure according to the fourth embodiment in the program update system of the present embodiment.
The update procedure (FIG. 9) of the fourth embodiment is different from the update procedure (FIG. 6) of the first embodiment in that the communication entity that exchanges the control message and the update program Δi with the management server 5 is the ECU 30 itself, and the gateway 10 is that it functions as a mere repeater.

In the update system of the present embodiment, “temporary completion notification” is defined as a type of control message for controlling the download process between the management server 5 and the vehicle 1 (ECU 30 in the fourth embodiment).
Specifically, the provisional completion notification is a control message defined in advance so that the management server 5 and the ECU 30 of the vehicle 1 execute the following processes (1) to (4). The temporary completion notification is issued without the ECU 30 notifying the completion of writing.

(1) Upon receiving the update program Δi (i = 1, 2,...), The ECU 30 of the vehicle 1 manages the provisional completion notification without generating a next-generation control program using the received update program Δi. Send to server 5.
(2) When the management server 5 receives the temporary completion notification from the vehicle 1, the management server 5 updates the ECU 30 with EI = 1 of the vehicle 1 that is the transmission source of the temporary completion notification (the vehicle 1 with VIN = 1 in the illustrated example). It is determined whether or not the next update program Δi + 1 of the program Δi is necessary.

(3) When the determination result of (2) is affirmative, the management server 5 transmits an update program Δi + 1 that is necessary next to the update program Δi to the vehicle 1 (ECU 30).
(4) When the determination result of (2) is negative, the management server 5 transmits a final notification that the update program Δi is final to the vehicle 1 (gateway 10).
(5) Upon receiving the final notification, the ECU 30 of the vehicle 1 generates a new version of the control program using the acquired one or more update programs Δi, Δi + 1.

As illustrated in FIG. 9, the management server 5 transmits an update notification that prompts an update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 (step S401).
Upon receiving the update notification, the ECU 30 of the vehicle 1 (ECU 30 with EI = 1) returns a version notification including the current version (= 1.0) of the control program of the own device to the management server 5 (step S402).

The CPU 51 of the management server 5 that has received the version notification transmits an update program Δ1 necessary for updating the version of the control program from 1.0 to 2.0 to the vehicle 1 with VIN = 1 (step S403).
The ECU 30 that has received the update program Δ1 transmits a provisional completion notification to the management server 5 (step S404).

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), even if the control program for the ECU 30 is updated to version 2.0 by the update program Δ1, the control program for the ECU 30 is not yet the latest.

Therefore, the management server 5 that has received the provisional completion notification in step S404 updates the update program Δ2 next to the update program Δ1, that is, the update program Δ2 required to update the version of the control program from 2.0 to 3.0. Is transmitted to the vehicle 1 with VIN = 1 (step S405).
The ECU 30 that has received the update program Δ2 transmits a provisional completion notification to the management server 5 (step S406).

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), when the control program for the ECU 30 is updated to version 3.0 by the update program Δ2, the control program for the ECU 30 becomes the latest.
Accordingly, the management server 5 that has received the provisional completion notification in step S406 transmits a final notification that the update program Δ2 is final to the vehicle 1 with VIN = 1 (step S407). The final notification includes version information (Ver = 3.0) of the final version.

Next, the CPU 31 of the ECU 30 copies the current software from the ROM of the storage unit 33 to the RAM 32 (step S408), and sequentially applies the two update programs Δ1 and Δ2 to the current software (Ver = 1.0) expanded in the RAM 32. (Step S409).
As a result, a skip program of version 3.0 that is two generations new from the current version 1.0 is generated.

The CPU 31 of the ECU 30 confirms whether or not the skip program generated by applying the update programs Δ1 and Δ2 is the final version (= 3.0) notified from the management server 5, and then allows the skip program to be written. (Step S410).
When writing of the skip program is permitted, the activation unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and writes the version 3.0 control program in the ROM of the storage unit 33. After that, the data content is checked (step S411).

The above check includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 3.0 control program is written.
When the above check is completed, the starting unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated control program (= 3.0).

Next, the CPU 31 of the ECU 30 transmits a write completion notification to the management server 5 (step S412). This writing completion notification includes version information of the control program after writing (in this case, Ver = 3.0).

[Update Procedure of Fifth Embodiment]
FIG. 10 is a sequence diagram showing a control program update procedure according to the fifth embodiment in the program update system of the present embodiment.
The update procedure (FIG. 10) of the fifth embodiment is different from the update procedure (FIG. 6) of the first embodiment in that the communication entity that exchanges the control message and the update program Δi with the management server 5 is the ECU 30 itself, and the gateway 10 is that it functions as a mere repeater.

Further, the update procedure (FIG. 10) of the fifth embodiment is different from the update procedure (FIG. 9) of the fourth embodiment in that the management server 5 that cannot recognize the provisional completion notification is adopted, and the ECU 30 receives the provisional completion notification. Instead, a normal write completion notification is transmitted to the management server 5.
The ECU 30 transmits a write completion notification to the management server 5 even if the writing of the new version of the control program has not been completed.

That is, when receiving the update program Δi (i = 1, 2,...), The ECU 30 used for the update procedure (FIG. 10) of the fifth embodiment writes the update program Δi before applying the received update program Δi. Is sent to the management server 5.
The write completion notification includes version information (= i + 1) when the update program Δi is applied. Therefore, when the notified version of the control program is not the latest, the management server 5 transmits the next update program Δi + 1 to the vehicle 1.

As illustrated in FIG. 10, the management server 5 transmits an update notification that prompts an update of the control program of the ECU 30 with EI = 1 to the vehicle 1 with VIN = 1 (step S501).
The ECU 30 of the vehicle 1 that has received the update notification (the ECU 30 with EI = 1) returns a version notification including the current version (= 1.0) of the control program of its own device to the management server 5 (step S502).

The CPU 51 of the management server 5 that has received the version notification transmits the update program Δ1 necessary for updating the version of the control program from 1.0 to 2.0 to the vehicle 1 with VIN = 1 (step S503).

The ECU 30 that has received the update program Δ1 transmits a write completion notification to the management server 5 (step S504). This write completion notification includes the version (Ver = 2.0) of the control program after applying the update program Δ1.
Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), even if the control program for the ECU 30 is updated to version 2.0 by the update program Δ1, the control program for the ECU 30 is not yet the latest.

Therefore, the management server 5 that has received the write completion notification in step S504 updates the update program Δ2 next to the update program Δ1, that is, the update program Δ2 required to update the version of the control program from 2.0 to 3.0. Is transmitted to the vehicle 1 with VIN = 1 (step S505).
The ECU 30 that has received the update program Δ2 transmits a write completion notification to the management server 5 (step S506). This write completion notification includes the version of the control program (Ver = 3.0) after applying the update program Δ2.

Since the latest version of the ECU 30 with EI = 1 is 3.0 (see FIG. 4), when the control program for the ECU 30 is updated to version 3.0 by the update program Δ2, the control program for the ECU 30 becomes the latest.
Therefore, the management server 5 that has received the provisional completion notification in step S506 transmits the latest notification that the notified version (= 3.0) is the latest to the vehicle 1 with VIN = 1 (step S507). The final notification includes version information (Ver = 3.0) of the final version.

Next, the CPU 31 of the ECU 30 copies the current software from the ROM of the storage unit 33 to the RAM 32 (step S508), and sequentially applies the two update programs Δ1 and Δ2 to the current software (Ver = 1.0) expanded in the RAM 32. (Step S509).
As a result, a skip program of version 3.0 that is two generations new from the current version 1.0 is generated.

The CPU 31 of the ECU 30 confirms whether or not the skip program generated by applying the update programs Δ1 and Δ2 is the final version (= 3.0) notified from the management server 5, and then permits writing of the control program. (Step S510).
When writing of the skip program is permitted, the activation unit 35 (see FIG. 3) of the ECU 30 switches the control mode of the CPU 31 from the normal mode to the repro mode, and writes the version 3.0 control program in the ROM of the storage unit 33. After that, the data content is checked (step S511).

The above check includes, for example, a verify process performed on the storage area in which the ECU 30 is once restarted and the version 3.0 control program is written.
When the above check is completed, the starting unit 35 of the ECU 30 switches the control mode of the CPU 31 to the normal mode, and causes the CPU 31 to operate according to the updated control program (= 3.0).

In the update procedure (FIG. 10) of the fifth embodiment, the ECU 30 has already transmitted the latest version (= 3.0) write completion notification before generating the skip program from the update programs Δ1 and Δ2. ing.
Therefore, it is not necessary for the CPU 31 of the ECU 30 to transmit the write completion notification after the processing in step S511 to the management server 5.

[First Modification]
In the update procedure (FIGS. 6 to 10) of each of the above-described embodiments, the ECU 30 fails to write the generated skip program (by the ROM check in step S115, step S216, step S315, step 411, and step 511). If the writing is determined to be unsuccessful), the version of the control program may be upgraded step by step for each generation.

Specifically, a version upgrade from version 1.0 using update program Δ1 to version 2.0 and a version upgrade from version 2.0 using update program Δ2 to the latest version 3.0 are sequentially performed. You just have to do it.
In this way, even if the writing of the skip program fails, the control program of the ECU 30 can be reliably updated to the latest version 3.0.

[Second Modification]
In the program update system of the present embodiment, the gateway 10 or the ECU 30 does not unconditionally execute the update procedures (FIGS. 6 to 10) of the above-described embodiments, but the data sizes of the plurality of update programs Δ1 and Δ2. And transmission processing of a control message such as a provisional completion notification to the management server 5 based on at least one of the transmission time and reception of update programs Δ1 and Δ2 transmitted by the management server 5 in response to the control message, respectively. You may decide whether to perform a process.

Specifically, the gateway 10 or the ECU 30 transmits and updates the control message only when the data size of the plurality of update programs Δ1, Δ2 is equal to or larger than a predetermined threshold or when the transmission time is equal to or larger than the predetermined threshold. The update procedure of the present embodiment in which the reception of the program Δi is repeated is executed. In other cases, the control program is upgraded one by one using the update programs Δ1 and Δ2 according to the conventional update procedure (FIG. 5). That's fine.
In this way, when the update time is relatively long, the update procedure of this embodiment can be adopted, and the program update system of this embodiment can be operated more flexibly.

[Third Modification]
In the update procedure (FIGS. 6 to 10) of the above-described embodiments, the gateway 10 or the ECU 30 receives three or more update programs Δ1, Δ2, Δ3... From the management server 5, and receives the received update programs Δ1, A skip program may be generated from Δ2, Δ3.
In this case, the ECU 30 generates a skip program from three or more update programs Δ1, Δ2, Δ3..., And writes the generated skip program and performs a ROM check, thereby rapidly raising the version of the control program to the latest version. .

However, the skip program is not necessarily the latest version of the control program. For example, when four update programs Δ1 to Δ4 are necessary to generate the latest version of the skip program, it is assumed that only three update programs Δ1 to Δ3 could be received due to deterioration of the communication situation. .
In this case, the gateway 10 may transfer the three update programs Δ1 to Δ3 that can be received to the ECU 30.

In this way, the ECU 30 uses the three update programs Δ1 to Δ3 transferred from the gateway 10 to generate a skip program of a version one generation before the latest version, and writes the generated skip program and ROM check As a result, the version of the control program is moved up to one generation before the latest version.

Thereafter, if the gateway 10 can receive the fourth update program Δ4, it may transfer the program Δ4 to the ECU 30.
In this case, the ECU 30 uses the fourth update program Δ4 transferred from the gateway 10 to generate the latest version of the control program, writes the generated control program, and checks the ROM, thereby controlling the version of the control program. To the latest version.

[Fourth Modification]
In the update procedure (FIGS. 6 to 8) of the first to third embodiments described above, a skip program generation process using a plurality of update programs Δi (i = 1, 2,...) (Step S112 in FIG. 6). To S113, steps S211 to S212 in FIG. 7, and steps S312 to S313 in FIG. 8 may be executed by the gateway 10.

That is, the gateway 10 may generate a skip program using a plurality of update programs Δi received from the management server 5 and transfer the generated skip program to the ECU 30.
In this case, since the ECU 30 does not execute the skip program generation process by itself, the ECU 30 writes the skip program transferred from the gateway 10 in the storage unit 33 of its own device.

[Other variations]
The embodiments disclosed herein are illustrative and non-restrictive in every respect. The scope of rights of the present invention is not limited to the above-described embodiments, but includes all modifications within the scope equivalent to the configurations described in the claims.
For example, the wireless communication device 15 may execute the processing of the gateway 10 in the above-described embodiment (including modifications). That is, the “relay device” of the present embodiment may be either the gateway 10 or the wireless communication device 15 shown in the figure.

1 Vehicle 2 Wide Area Communication Network 5 Management Server 10 Gateway (Relay Device)
11 CPU
12 RAM
13 Storage Unit 14 In-Vehicle Communication Unit 15 Wireless Communication Device (Relay Device)
30 ECU (control device)
31 CPU
32 RAM
33 Storage Unit 34 Communication Unit 35 Start-up Unit 51 CPU
52 ROM
53 RAM
54 storage unit 55 communication unit RT update management table

Claims (15)

1. A program update system comprising: a control device mounted on a vehicle; a relay device connected to the control device so as to enable in-vehicle communication; and a management server wirelessly communicating with the relay device,
   The relay device or the control device is
   A program update system that executes transmission / reception processing that repeats transmission processing and reception processing defined below until a plurality of update programs necessary for updating a control program of the control device to a new version that is two generations or more is acquired.
   Transmission process: Process for transmitting a control message requesting an update program for upgrading the control program of the control device one generation at a time to the management server Reception process: Managing an update program transmitted by the management server in response to the control message Processing received from the server
2. The control device includes a volatile memory, and a storage unit having a rewritable nonvolatile memory that stores the control program,
   When the control device acquires a plurality of the update programs, the control device reads the control program from the nonvolatile memory to the volatile memory, and sequentially applies the plurality of update programs to the control program on the volatile memory. The program update system according to claim 1, wherein the control program is updated to the new version, and the updated new version of the control program is written to the nonvolatile memory.
3. The program update according to claim 2, wherein the control device does not update the control program until a plurality of the update programs are acquired, and updates the control program after the plurality of the update programs are acquired. system.
4. 4. The program update system according to claim 2, wherein the control device transmits a write completion notification when the updated control program is written in the nonvolatile memory after a plurality of the update programs are acquired.
5. The relay device or the control device is
   Applying the acquired plurality of update programs to the volatile memory of its own device a plurality of times, and executing a generation process of a skip program that is a new version of the control program of two or more generations,
   The program update system according to claim 1, wherein the control device executes a writing process for writing the generated skip program in a nonvolatile memory of the control device.
6. When the execution subject of the transmission / reception processing is the relay device,
   The relay device is
   Transferring the obtained plurality of update programs to the control device;
   The control device includes:
   A skip program that is a version of the control program that is two or more generations newer than the current version of the own device is generated using the plurality of transferred update programs, and the generated skip program is written in a storage unit of the own device. The program update system according to claim 1 or 5.
7. When the execution subject of the transmission / reception processing is the relay device,
   The relay device is
   Using the obtained plurality of update programs, generate a skip program that is a version of the control program that is two or more generations newer than the current version of the control device, and transfer the generated skip program to the control device,
   The control device includes:
   6. The program update system according to claim 1, wherein the transferred skip program is written in a storage unit of the device itself.
8. When the execution subject of the transmission / reception processing is the control device,
   The control device includes:
   2. A skip program that is a version of the control program that is two or more generations newer than the current version of the own device is generated using the plurality of acquired update programs, and the generated skip program is written in a storage unit of the own device. Or the program update system of Claim 5.
9. The control device includes:
   When writing the skip program fails,
   The process of generating the next-generation control program from the update program and writing the generated control program to the storage unit of the own device is performed step by step for each generation. The program update system according to claim 1.
10. The control message includes
    10. The program update system according to claim 1, further comprising a provisional completion notification requesting the management server to transmit the next update program in response to reception of the update program. 11.
11. The control message includes
    10. The program update system according to claim 1, further comprising: a write completion notification for notifying the management server of completion of writing of the next generation control program generated from the update program. 11.
12. The relay device or the control device is
    The program update according to any one of claims 1 to 11, wherein it is determined whether or not to execute the transmission / reception processing based on at least one of a data size and a transmission time of the plurality of update programs. system.
13. A control device mounted on a vehicle,
    Volatile memory,
    A storage unit having a rewritable nonvolatile memory for storing a control program;
    A control unit for controlling a control target in the vehicle according to the control program;
    An acquisition unit for acquiring an update program of the control program,
    The control unit reads the control program from the nonvolatile memory to the volatile memory when the acquisition unit acquires the plurality of update programs, and controls the plurality of update programs on the volatile memory. A control apparatus that sequentially applies to a program, updates the control program to a new version of two or more generations, and writes the updated new version of the control program to the nonvolatile memory.
14. A program update method executed in a communication system including a control device mounted on a vehicle, a relay device connected to the control device so as to enable in-vehicle communication, and a management server wirelessly communicating with the relay device,
    The relay device or the control device repeats the transmission processing and the reception processing defined below until a plurality of update programs necessary for updating the control program of the control device to a new new version for two generations or more are acquired. Program update method including:
    Transmission process: Process for transmitting a control message requesting an update program for upgrading the control program of the control device one generation at a time to the management server Reception process: Managing an update program transmitted by the management server in response to the control message Processing received from the server
15. A computer as the relay device or the control device of a communication system including a control device mounted on a vehicle, a relay device connected to the control device so as to enable in-vehicle communication, and a management server that communicates wirelessly with the relay device A computer program for functioning,
    In the computer,
    A computer program for executing a step of repeating a transmission process and a reception process defined below until a plurality of update programs necessary for updating the control program of the control device to a new new version for two generations or more is acquired.
    Transmission process: Process for transmitting a control message requesting an update program for upgrading the control program of the control device one generation at a time to the management server Reception process: Managing an update program transmitted by the management server in response to the control message Processing received from the server

Images