JP7633215B2 - PROGRAM MANAGEMENT DEVICE, PROGRAM MANAGEMENT METHOD, AND RECORDING MEDIUM - Google Patents

Description

The present invention relates to a program management device, a program management method, and a recording medium.

In recent years, the functions of software that controls vehicles have been enhanced with the aim of improving traffic safety and reducing _CO2 emissions. A technology has been proposed for updating a program executed by an ECU (Electronic Control Unit) mounted on a vehicle. For example, Patent Document 1 discloses a configuration in which a storage unit that stores a program includes a vehicle control program storage area that stores a control program, and a second program storage area that stores an update program that is an update version of the control program. With this configuration, it is possible to store the update program in the storage unit even while the control program is being executed, and it is said that this reduces constraints on the timing of program updates.

JP 2019-144669 A

As described in Patent Document 1, a configuration in which multiple memory areas are provided for storing programs and one of the memory areas can be selected for use has the problem that it requires a large memory capacity compared to the size of the programs.
The present invention has been made in view of the above background, and has an object to reduce constraints on the timing of updating programs used in vehicles, using a method that is unlikely to result in an excessive increase in the capacity of memory areas.

According to one aspect for achieving the above object, there is provided a first storage unit having a communication unit that communicates with an external device present outside the vehicle, a program storage first area and a program storage second area that store a vehicle control program for controlling the vehicle, and a non -involved program storage area that stores a non-involved program that is not involved in the control of the vehicle, a vehicle control program execution unit that executes the vehicle control program that is set as an active program among the vehicle control programs stored in the program storage first area or the program storage second area, a non-involved program execution unit that executes the non-involved program stored in the non-involved program storage area , a second storage unit that is provided independently of the first storage unit and has an update program storage first area that stores a vehicle control update program used for updating the vehicle control program received by the communication unit, and an update program storage second area that stores a non-involved update program used for updating the non-involved program received by the communication unit, and an update process of the vehicle control program based on the vehicle control update program, and an update processing unit that executes an update process of the non-involved program based on a new program , wherein when an update program is received by the communication unit, the update processing unit determines whether the update program is the vehicle control update program or the non-involved update program, and, when the update program is the vehicle control update program, executes a process to update the vehicle control program stored in the program storage first area or the program storage second area of the first storage unit based on the vehicle control update program stored in the update program storage first area of the second storage unit, and, when the update program is the non-involved update program, stores a copy of the non-involved program stored in the non-involved program storage area of the first storage unit in a program storage area provided in the second storage unit, and then executes a process to update the non-involved program stored in the non-involved program storage area of the first storage unit based on the non-involved update program stored in the update program storage second area of the second storage unit.

The above configuration reduces constraints on the timing of updating non-involved programs.

FIG. 1 is a schematic diagram of a vehicle control system. FIG. 1 is a diagram showing a schematic configuration of a program management system. FIG. 2 is a block diagram showing a configuration of a main part of a control system. FIG. 4 is a schematic diagram showing a configuration example of a data storage unit. 4 is a flowchart showing the operation of the control system. FIG. 4 is a sequence diagram showing the operation of the program management system. 4 is a flowchart showing the operation of the control system.

FIG. 1 is a diagram showing a control system 1 for a vehicle.
The control system 1 includes a central ECU 2 that performs overall control and information processing of the vehicle. Hereinafter, the vehicle equipped with the control system 1 is referred to as the vehicle itself. Specifically, the vehicle itself is a vehicle V, which will be described later. The central ECU 2 is connected to communication lines including communication lines 4a, 4b, and 4c. The central ECU 2 realizes a gateway function that manages the transmission and reception of communication data between these communication lines. In addition, a TCU (Telematics Control Unit) 12, which is a wireless device that complies with the communication standard of a mobile communication system, is connected to the central ECU 2. The central ECU 2 executes OTA (Over The Air) management using the TCU 12. The OTA management includes control related to a process of downloading an update program for an in-vehicle device provided in the vehicle from a server outside the vehicle, and a process of applying the downloaded update program to the in-vehicle device.

The first zone ECU 20a, the second zone ECU 20b, and the third zone ECU 20c are connected to the communication lines 4a, 4b, and 4c, respectively. The first zone ECU 20a is connected to ECUs 30a, 30b, and 30c, and the second zone ECU 20b is connected to ECUs 30d, 30e, and 30f. The third zone ECU 20c is connected to ECUs 30g, 30h, and 30i.

Hereinafter, the first zone ECU 20a, the second zone ECU 20b, and the third zone ECU 20c will be collectively referred to as zone ECU 20, and the ECUs 30a, 30b, 30c, 30d, 30e, 30f, 30g, 30h, and 30i will be collectively referred to as ECU 30.

The ECU 30 may include, for example, an MPU (Map Positioning Unit), an MVC-ECU (MVC; Multi View Camera), a PKS-ECU (PKS; Parking Support), and/or an ADAS-ECU (ADAS; Advanced Driver-Assistance System), as well as other ECUs that control the operation of various devices and sensors equipped in the vehicle. Such devices and sensors may include a driving motor that drives the vehicle, a steering device such as an accelerator and brake, a VSA device (VSA; Vehicle Stability Assist), a battery, lighting devices such as headlamps, a window motor that drives the door windows, an actuator that drives the door lock mechanism, a door lock sensor, a door opening/closing sensor, a temperature sensor, an exterior camera, an interior camera, and the like.

Each zone ECU 20 is connected to multiple ECUs 30 arranged in the same compartment of the vehicle's body space, or multiple ECUs 30 that control the operation of devices and sensors arranged in the same compartment.

In addition to the zone ECU 20, other control devices and equipment may be connected to the central ECU 2. Such control devices and equipment may include an ICB (Infotainment Control Box), a speaker, a microphone, a meter panel, a steering switch, a GNSS (Global Navigation Satellite System) sensor, a touch panel, etc.

In this embodiment, the communication lines 4a, 4b, and 4c are configured, for example, by a CAN bus that performs communication in accordance with the CAN communication standard. Hereinafter, the communication lines 4a, 4b, and 4c are collectively referred to as the communication lines 4. Hereinafter, the communication lines 4 correspond to the in-vehicle network in this disclosure. In addition, the zone ECUs 20 connected to the communication lines 4 correspond to the multiple electronic control devices in this disclosure.

The zone ECU 20 connected to the communication line 4 sends data to be transmitted in one frame or as a sequence of multiple frames according to the CAN communication standard, according to conventional technology, to the communication line 4. According to the CAN communication standard, each frame sent out includes an identification code (ID), and each zone ECU 20 that receives a frame determines whether the frame was sent to it based on the ID included in the frame.

FIG. 2 is a diagram showing a schematic configuration of the program management system 100. As shown in FIG.
The program management system 100 is a system that enables updating of programs executed by various ECUs that constitute the control system 1. The program management system 100 includes a server 110 and a vehicle diagnosis device 120.

The server 110 is connected to the control system 1 via a communication network N.
The communication network N includes, for example, a cellular communication network, a Wi-Fi (registered trademark) network, Bluetooth (registered trademark), the Internet, a Wide Area Network (WAN), a Local Area Network (LAN), a public line, a provider device, a dedicated line, a base station, etc., and a base station B is illustrated in Fig. 2. The TCU 12 included in the control system 1 executes cellular communication with the base station B, thereby executing data communication with an external device through the communication network N.

The control system 1 can download update data for updating programs executed by various ECUs of the control system 1 from the server 110 by communicating with the server 110 via the TCU 12. The means by which the control system 1 downloads update data from the server 110 and updates the programs corresponds to the OTA described above. The server 110 corresponds to an example of an external device of the control system 1. The TCU 12 corresponds to an example of a communication unit.

The vehicle diagnosis device 120 is a device installed in a dealership or repair shop that handles the vehicle V on which the control system 1 is installed. The vehicle diagnosis device 120 is connected by a cable to a DLC (Data Link Connector) (not shown) of the control system 1. The control system 1 can perform updates of the programs executed by the control system 1 by communicating with the vehicle diagnosis device 120.

Here, updating an ECU program refers to rewriting the program executed by the ECU with a different version of the program. Updating an ECU program may include rewriting data referenced when the ECU executes the program and/or data generated or changed by the execution of the program along with the program. Updating an ECU program may include rewriting the program executed by the ECU with the same version of the program.

Figure 3 is a block diagram showing the main configuration of control system 1. Figure 3 shows part of the configuration related to program updates in control system 1, and does not prevent control system 1 from having configurations not shown in Figure 3.

In the control system 1, each ECU including the central ECU 2, the zone ECU 20, and the ECU 30 includes a processor and a storage unit. The processor is, for example, configured with a CPU (Central Processing Unit), an MCU (Micro Controller Unit), and an MPU (Micro Processor Unit). The storage unit stores the programs executed by the processor and the data processed by the processor in a non-volatile manner. The storage unit is, for example, a ROM (Read Only Memory). The ECU may also include a RAM (Random Access Memory) that forms a work area for temporarily storing programs and data. The ECU may be configured as an integrated circuit that includes a processor, a ROM, and a RAM. The ECU may also be configured to include the processor, the ROM, and the RAM as independent hardware.

The central ECU2 includes an update control unit 201 and a processing unit 211 as functional units related to updating the program. The update control unit 201 and the processing unit 211 may be hardware included in the central ECU2. The update control unit 201 and the processing unit 211 may also be functional units that are realized by the cooperation of software and hardware when the processor of the central ECU2 executes a program.

The update control unit 201 includes an update data receiving unit 202 and an update data control unit 203. The update data receiving unit 202 controls the TCU 12 to receive update data for updating programs from the server 110. The update data control unit 203 uses the update data received by the update data receiving unit 202 to control the process by which various ECUs, including the central ECU 2, update programs.

Figure 3 illustrates the central ECU 2, the first zone ECU 20a, the second zone ECU 20b, and ECU 30d as targets of control by the update control unit 201, but this is just one example. There is no limit to the number of ECUs that are targets of control by the update control unit 201. The update control unit 201 controls the updates of programs executed by at least some of the ECUs provided in the control system 1. The update control unit 201 may control the updates of programs by all or almost all of the ECUs provided in the control system 1.

The processing unit 211 includes a data storage unit 212, a program execution unit 213, and an update processing unit 214. The data storage unit 212 corresponds to the storage unit described above. The data storage unit 212 stores the programs executed by the central ECU 2 and data related to these programs. The program execution unit 213 executes the programs stored in the data storage unit 212. It can also be said that the program execution unit 213 represents the function of the processor itself equipped in the central ECU 2. The program execution unit 213 corresponds to an example of a vehicle control program execution unit, and corresponds to an example of a non-involved program execution unit. The update processing unit 214 updates the programs stored in the data storage unit 212.

The first zone ECU 20a includes a data storage unit 51a, a program execution unit 52a, and an update processing unit 53a. The data storage unit 51a stores programs and data related to these programs. The program execution unit 52a realizes the functions of the first zone ECU 20a by executing the programs stored in the data storage unit 51a. The update processing unit 53a updates the programs stored in the data storage unit 51a.

The second zone ECU 20b includes a data storage unit 51b, a program execution unit 52b, and an update processing unit 53b. The data storage unit 51b stores programs and data related to these programs. The program execution unit 52b executes the programs stored in the data storage unit 51b to realize the functions of the second zone ECU 20b. The update processing unit 53b updates the programs stored in the data storage unit 51b.

A specific example of ECU 30d is an entry ECU. The entry ECU is connected to an LF/RF antenna (not shown) that performs wireless communication with the vehicle's electronic key. The electronic key is an electronic device with wireless communication capabilities, and is also called a smart key or FOB key. The entry ECU works in conjunction with other vehicle ECUs to process user access to the control system 1 from outside the vehicle, achieving the so-called smart entry operation.

ECU 30d includes a data storage unit 51c, a program execution unit 52c, and an update processing unit 53c. Data storage unit 51c stores programs and data related to these programs. Program execution unit 52c realizes the functions of ECU 30d by executing the programs stored in data storage unit 51c. Update processing unit 53c updates the programs stored in data storage unit 51c.

Here, when the data storage units 51a, 51b, and 51c are not differentiated, they are referred to as data storage unit 51. In addition to data storage units 51a, 51b, and 51c, the data storage unit 51 may include a data storage unit provided in an ECU not shown in FIG. 3. Similarly, when the program execution units 52a, 52b, and 52c are not differentiated, they are referred to as program execution unit 52. In addition to program execution units 52a, 52b, and 52c, the program execution unit 52 may include a program execution unit provided in an ECU not shown in FIG. 3. In addition, when the update processing units 53a, 53b, and 53c are not differentiated, they are referred to as update processing unit 53. In addition to update processing units 53a, 53b, and 53c, the update processing unit 53 may include an update processing unit 53 provided in an ECU not shown in FIG. 3. The program execution unit 52 corresponds to an example of a vehicle control program execution unit and corresponds to an example of a non-involved program execution unit.

Figure 4 is a schematic diagram showing an example configuration of the data storage unit 212. The data storage unit 51 can have a similar configuration to the data storage unit 212.

The data storage unit 212 includes a plurality of semiconductor storage elements or semiconductor memory devices. The data storage unit 212 includes a first storage unit 61, a second storage unit 62, and a memory 63. The storage areas of the first storage unit 61, the second storage unit 62, and the memory 63 are independent of each other.

The first memory unit 61 is a memory element that stores programs and data in a non-volatile manner. The first memory unit 61 is, for example, a NOR type flash memory element. The second memory unit 62 is a memory element that stores programs and data in a non-volatile manner. The second memory unit 62 is, for example, a NAND type flash memory element. The memory 63 is a volatile memory element that stores programs and data. The memory 63 forms a work area when the program execution unit 213 executes a program. The program executed by the program execution unit 213 and the data processed, generated, or updated by the program are deployed in the work area. The memory 63 is, for example, composed of a DRAM (Dynamic Random Access Memory) or an SDRAM (Synchronous DRAM).

FIG. 4 illustrates an example in which the first storage unit 61, the second storage unit 62, and the memory 63 are each composed of one semiconductor storage element. This is just one example, and for example, one or more of the first storage unit 61, the second storage unit 62, and the memory 63 may be composed of multiple semiconductor storage elements.

In the following description, the programs and data stored in the data storage unit 212 and the data storage unit 51 are referred to as programs. In other words, the programs referred to in the following description include data that is referenced, generated, or processed when the processor executes the programs. These programs and data as a whole can be referred to as software. In other words, the program management system 100 has the function of managing and updating the software of the control system 1 installed in the vehicle V.

As described above, the data storage unit 51 is configured similarly to the data storage unit 212. That is, the data storage unit 51 includes a first storage unit 61, a second storage unit 62, and a memory 63.
In the present embodiment, as an example, the central ECU 2 will be described as using the data storage unit 212. The use of the data storage unit 51a by the first zone ECU 20a, the use of the data storage unit 51b by the second zone ECU 20b, and the use of the data storage unit 51c by the ECU 30d are executed in the same manner as the use of the data storage unit 212. The use of the data storage unit 51 by the other ECUs is also executed in the same manner.

The memory area of the first memory unit 61 is divided into multiple areas. Specifically, the first memory unit 61 has a boot sector 71, an A-side boot image memory area 72, a B-side boot image memory area 73, a first program memory area 74, a second program memory area 75, and a non-involved program memory area 76.

The memory area of the first memory unit 61 is classified into an A side and a B side. The A side memory area includes an A side boot image memory area 72 and a first program memory area 74. The B side memory area includes a B side boot image memory area 73 and a second program memory area 75. The boot sector 71 and the non-involved program memory area 76 belong to neither the A side nor the B side.

The memory area on side A and the memory area on side B store programs independently of each other. The program execution unit 213 of the central ECU 2 can execute various operations required of the central ECU 2 by using the programs stored in either the memory area on side A or side B. In other words, the central ECU 2 can execute operations as the central ECU 2 as long as a program is properly stored in either the A side or the B side of the data storage unit 212.

When updating a program stored in the data storage unit 212, the update processing unit 214 selects either the A side or the B side.
As an example, a case where the update processing unit 214 selects the A side and updates the program will be described. In this example, the update processing unit 214 executes a process of storing a new program in the program storage first area 74, and then executes a process of confirming that the program has been written normally. Here, if writing the program to the program storage first area 74 fails, the update processing unit 214 needs to redo the program update. The central ECU 2 cannot execute the program written in the program storage first area 74 to control the vehicle V until the program update in the program storage first area 74 is completed normally. However, the central ECU 2 can control the vehicle V by executing the program stored in the program storage second area 75. The same is true when the update processing unit 214 selects the B side. In this way, when the data storage unit 212 updates the program on either the A side or the B side, an executable program is stored in the other side, so the success or failure of the program update does not have a significant effect on the control of the vehicle V. Therefore, the constraints on the timing of updating the program are relaxed, and it is not impossible to update the program while the vehicle V is running, for example.

The boot sector 71 stores a boot loader. The boot loader is a program that is executed first by the program execution unit 213 when the central ECU 2 is started. The program execution unit 213 executes the boot loader to execute processes required for basic operations of the central ECU 2. The boot sector 71 stores active program designation data 71a. The active program designation data 71a is included in the boot loader or is stored in an area referenced by the boot loader. The active program designation data 71a is data that designates a program to be executed by the program execution unit 213 following the boot loader, and specifically, designates whether the program is an A-side program or a B-side program. For example, the active program designation data 71a is an address of a boot image stored in the A-side boot image storage area 72, or an address of a boot image stored in the B-side boot image storage area 73 .

The boot image is a basic control program that the processor of the central ECU 2 executes following the boot loader. The A-side boot image storage area 72 stores a boot image used when executing a program stored in the first program storage area 70. The A-side boot image storage area 72 stores a start address 72a. The start address 72a is, for example, the start address of a program stored in the first program storage area 70. The B-side boot image storage area 73 stores a boot image used when executing a program stored in the second program storage area 75. The B-side boot image storage area 73 stores a start address 73a. The start address 73a is, for example, the start address of a program stored in the second program storage area 75.

The first program storage area 74 is an area for storing a program for the ECU to control the vehicle V. The second program storage area 75 is an area for storing a program for the ECU to control the vehicle V. The types of programs stored in the first program storage area 74 and the second program storage area 75 are the same. The programs stored in the first program storage area 74 and the second program storage area 75 are programs for controlling the vehicle V. These are called vehicle control programs. The vehicle control programs are involved in control related to the running of the vehicle V and control essential for the running of the vehicle V. The subjects that execute the vehicle control programs are the central ECU 2, the first zone ECU 20a, the second zone ECU 20b, the ECU 30d, and other ECUs. For example, the program for the central ECU 2 to execute the operations described with reference to Figures 5 to 7 is included in the vehicle control program. Therefore, the data storage unit 212 corresponds to an example of a recording medium of the present invention. Among the programs that the control system 1 downloads from the server 110, the programs and data for updating the vehicle control program are called vehicle control update programs. The control system 1 configured to store these programs corresponds to an example of a program management device.

The non-involved program memory area 76 is a memory area for storing programs that are not involved in the control of the vehicle V. The programs stored in the non-involved program memory area 76 are called non-involved programs. Among the processes executed by the control system 1, the non-involved programs are not involved in the control related to the running of the vehicle V and the control essential for the running of the vehicle V. Among the programs downloaded by the control system 1 from the server 110, the programs and data for updating the non-involved programs are called non-involved update programs.

Here, control related to the traveling of the vehicle V includes control related to the acceleration, deceleration, stopping, and steering of the vehicle V. For example, control related to the traveling of the vehicle V includes controlling the vehicle V based on an operation performed by a user to steer or drive the vehicle V. In addition, control related to the traveling of the vehicle V includes control executed by the ADAS function and the PKS function without being based on an operation by the user. In addition, control essential for the traveling of the vehicle V includes control for operating the auxiliary equipment necessary for the traveling of the vehicle V. Examples of the auxiliary equipment include the meter panel, the vehicle V's lights, wipers, window washers, air conditioning equipment, etc. In addition, control essential for the traveling of the vehicle V includes controlling the camera and radar device to execute the ADAS function and the PKS function.

The non-participant programs stored in the non-participant program storage area 76 include, for example, programs related to the infotainment function provided by the control system 1. Programs related to the infotainment function refer to, for example, application programs related to entertainment. Specifically, the infotainment functions include music playback, receiving and listening to radio broadcasts, sending and receiving e-mail, receiving and watching television broadcasts, information search using a network such as the Internet, playing video games, and other entertainment functions. In addition, for example, the non-participant programs include programs related to a function of placing an order or making a reservation with an external service provider by communicating with a server outside the vehicle V based on the operation of a touch panel mounted on the vehicle V. The external service provider is, for example, a provider that provides sales of goods including food and beverages, delivery of goods including food and beverages, car wash services, cleaning services, ticket sales or ticket reservation services, and other services.

The non-involved program stores, for example, a program specified by the manufacturer of the vehicle V or the distributor of the vehicle V. The non-involved program may also be a program that is not specified by the manufacturer of the vehicle V or the distributor of the vehicle V. For example, the non-involved program may be a so-called third-party program.

The memory 63 forms a work area when the program execution unit 213 executes the program stored in the first storage unit 61 .
In order to execute the program stored in the first storage unit 61, the program execution unit 213 stores and expands the program stored in the first storage unit 61 in the memory 63 as indicated by the arrow A in the figure. As a result, the work area of the memory 63 stores the boot loader stored in the boot sector 71 and the boot image stored in the A-side boot image storage area 72 or the B-side boot image storage area 73. The work area of the memory 63 also stores the vehicle control program stored in the first program storage area 74 or the second program storage area 75, and the non-involved program stored in the non-involved program storage area 76.

Figure 4 shows an example of a program stored in memory 63 when program execution unit 213 executes a program stored on side B of first storage unit 61. In this example, a boot loader 81, side B boot image 82, vehicle control program 83 read from second program storage area 75, and non-involved program 84 are stored in the work area of memory 63. These programs are expanded in the work area of memory 63 in a state that can be executed by program execution unit 213.

The program execution unit 213 expands, from among the programs stored on side A of the first storage unit 61 and the programs stored on side B of the first storage unit 61, the program specified by the active program designation data 71a into the memory 63. The program specified by the active program designation data 71a is called the active program.

The memory area of the second memory unit 62 is divided into multiple areas. Specifically, the second memory unit 62 has a program memory area 77, a first update program memory area 78, and a second update program memory area 79.

The first update program storage area 78 and the second update program storage area 79 are storage areas that store update programs downloaded by the control system 1 from the server 110. The first update program storage area 78 stores a vehicle control update program for updating the vehicle control program. The second update program storage area 79 stores a non-involved update program for updating the non-involved program. The update processing unit 214 stores the vehicle control update program downloaded from the server 110 in the first update program storage area 78 as shown by arrow B, and stores the non-involved update program in the second update program storage area 79 as shown by arrow C.

The program memory area 77 stores the non-involved program stored in the non-involved program memory area 76. More specifically, when the update processing unit 214 updates the non-involved program stored in the non-involved program memory area 76, the non-involved program before the update is copied and stored in the program memory area 77. As a result, the non-involved program before the update is saved in the program memory area 77. The program execution unit 213 can write the non-involved update program stored in the program memory area 77 back to the non-involved program memory area 76 of the first storage unit 61. For example, when the update of the non-involved program stored in the non-involved program memory area 76 is not completed normally, the program execution unit 213 writes the non-involved program stored in the program memory area 77 back to the non-involved program memory area 76. As a result, regardless of whether the update of the non-involved program is successful or not, the non-involved program memory area 76 can hold a non-involved program that can be executed normally.

Figure 5 is a flowchart showing the operation of the control system 1, and shows the operation of the program execution unit 213 executing the program stored in the data storage units 51, 212. The operation in Figure 5 is executed when the ECU is started. As an example, a case where the central ECU 2 executes the program stored in the data storage unit 212 will be described.

When the central ECU 2 starts up from a stopped state, the program execution unit 213 of the central ECU 2 reads the boot loader 81 stored in the boot sector 71 of the first storage unit 61 and expands it in the work area of the memory 63 (step SA1). The program execution unit 213 executes the boot loader 81 expanded in the memory 63 (step SA2). In step SA2, the program execution unit 213 determines whether the active program is side A or side B by referring to the active program designation data 71a held by the boot loader 81.

The program execution unit 213 reads the active program specified by the active program designation data 71a from the first storage unit 61 and expands it in the work area of the memory 63 (step SA3). For example, if the active program is a B-side program, the program execution unit 213 expands the B-side boot image 82 stored in the B-side boot image storage area 73 and the vehicle control program 83 stored in the second program storage area 75 in the memory 63.

Furthermore, the program execution unit 213 loads the non-involved program 84 stored in the non-involved program storage area 76 in the work area of the memory 63 (step SA4).
The program execution unit 213 executes the program deployed in the first storage unit 61 to realize the functions of the central ECU 2 .

In the operation example of FIG. 5, the timing for loading the non-involved program 84 into the first storage unit 61 is not limited to when the ECU is started. For example, when a user operates a touch panel mounted on the vehicle V to instruct execution of a non-involved program, the program execution unit 213 may read the non-involved program 84 from the non-involved program storage area 76 and load it into the first storage unit 61.

FIG. 6 is a sequence diagram showing the operation of the program management system 100. As shown in FIG.
Steps SA11 to SA20 show the operation of the control system 1, and steps SB11 to SB14 show the operation of the server 110. Fig. 7 is a flowchart showing in detail the operation of the control system 1 in step SA20 of Fig. 6.
6 and 7 show processes related to the operation of updating the program of the control system 1. In FIG.

In FIG. 6, steps SA11 to SA19 are executed by the update data receiving unit 202. The control system 1 acquires vehicle information of the vehicle V (step SA11). The vehicle information is information that enables the server 110 to identify the type of program and the version of the program that are compatible with the control system 1. The vehicle information includes, for example, the vehicle identification number of the vehicle V, the type of ECU possessed by the control system 1, and the version of the program installed in the ECU. The control system 1 acquires information possessed by the control system 1 and information possessed by the ECU connected to the control system 1, and compiles the information into a single set of vehicle information.

The control system 1 requests program update information from the server 110 (step SA12). The program update information is information about programs already stored in the control system 1. In detail, the program update information includes the names and versions of programs that can be updated among the programs already stored in the control system 1. The program update information may also include information about programs that can be used by the control system 1 but are not stored in the control system 1. In this case, the program update information includes the names of programs that can be used by the control system 1 and information indicating an overview of the programs. In step SA12, when requesting the program update information, the control system 1 transmits the vehicle information acquired in step SA11 to the server 110. The request for program update information and the vehicle information of the vehicle V are received by the server 110.

Based on the request sent by the control system 1 and the vehicle information of the vehicle V, the server 110 searches a database (not shown) for a program corresponding to the vehicle V (step SB11). In this database, the server 110 stores programs corresponding to a plurality of vehicles including the vehicle V. This database may be provided in the server 110, or may be a database server connected to the server 110 via the communication network N.

Based on the results of searching the database, the server 110 generates program update information (step SB11) and transmits the program update information to the control system 1 (step SB12). This program update information is received by the control system 1.

The control system 1 updates the receivable list based on the program update information received from the server 110 (step SA13). The receivable list is a list of programs that the control system 1 can download from the server 110. The receivable list is a list that includes updatable programs that are already stored in the control system 1, and programs that the control system 1 can use but that are not stored in the control system 1. The receivable list includes the name of the program and the type or overview of the program.

The control system 1 and the server 110 repeatedly execute the operations of steps SA11 to SA13 and steps SB11 to SB13 at a preset cycle. This allows the control system 1 to maintain a state in which it holds the latest receivable list for the programs corresponding to the vehicle V.

Program updating in the control system 1 is started, for example, by the user operating a touch panel or the like mounted on the vehicle V. When the user performs an operation related to the program update, the control system 1 accepts the user's operation (step SA14). In response to the user's operation, the control system 1 displays a receivable list, for example, on a display mounted on the vehicle V (step SA15). Here, the control system 1 determines whether or not the user has instructed to download a program (step SA16). The user selects a program to be downloaded, for example, by operating a touch panel mounted on the vehicle V, and instructs to download the selected program. While a program download is not instructed (step SA16; NO), the control system 1 waits in step SA16.

If a command to download a program is issued (step SA16; YES), the control system 1 identifies the program to download based on the user's command (step SA17). The control system 1 requests the server 110 to download the identified program (step SA18). The download request from the control system 1 is received by the server 110.

The server 110 transmits the program requested by the control system 1 to the control system 1 (step SB14). The program transmitted by the server 110 includes at least one of a vehicle control update program for updating or newly installing a vehicle control program, and a non-control update program for updating or newly installing a non-involved program. The control system 1 downloads the program transmitted by the server 110 (step SA19). Then, the control system 1 executes an installation process (step SA20). The installation process includes storing the program downloaded in step SA19 in the data storage unit 51 or the data storage unit 212. The installation process also includes a process of making the vehicle control program and/or the non-involved program executable by the ECU by executing the vehicle control update program and/or the non-control update program. After the installation, the program is stored in the data storage unit 51 or the data storage unit 212 in a state executable by the ECU.

Figure 7 shows the details of the installation process. In Figure 7, steps SA31, SA32, and SA39 are executed by the update data control unit 203, and the other operations are executed by the update processing unit 214 or the update processing unit 53. In the following explanation, an example is given in which the update processing unit 214 executes the first process and the second process, but the update processing unit 53 can also execute similar operations.

The update data control unit 203 determines whether the program to be installed is a non-involved update program (step SA31). If the program to be installed is not a non-involved update program (step SA31; NO), the update data control unit 203 identifies the ECU on which the program is to be installed (step SA32). In step SA32, the update data control unit 203 selects an ECU on which the program is to be installed from among the central ECU 2, the first zone ECU 20a, the second zone ECU 20b, the ECU 30d, and other ECUs. Next, the vehicle control update program downloaded by the TCU 12 is stored in the update program storage first area 78 of the second storage unit 62 by the update processing unit 214 of the ECU identified by the update data control unit 203 (step SA33).

The update processing unit 214 selects either the A side or the B side of the first storage unit 61 as an area for installing the vehicle control program (step SA34). Specifically, the update processing unit 214 selects either the program storage first area 74 or the program storage second area 75 as an area for installing the vehicle control program. If the type and version of the program stored in the program storage first area 74 and the program storage second area 75 are the same, the update processing unit 214 selects either the A side or the B side according to a pre-set. If there is a problem with the program stored in either the program storage first area 74 or the program storage second area 75, the update processing unit 214 selects the area storing the problematic program in step SA34. If the version of the program stored in the program storage first area 74 and the program storage second area 75 are different, the update processing unit 214 selects the area storing the older version of the program in step SA34.

The update processing unit 214 writes the vehicle control update program stored in the first update program storage area 78 to the area selected in step SA34 (step SA35). Next, the update processing unit 214 installs the vehicle control update program by having the program execution unit 213 execute the vehicle control update program written in step SA35 (step SA36).

The update processing unit 214 performs a process to confirm that the installation has been completed normally (step SA37). In step SA37, the update processing unit 214 confirms that the installed program can be executed normally by the program execution unit 213. For example, the update processing unit 214 verifies the normality of the program and data written to the first storage unit 61 by calculating and comparing a hash value or calculating and comparing a checksum.

The update processing unit 214 activates the installed program (step SA38). Activation is a process for setting up the control system 1 to execute the installed program. For example, the update processing unit 214 rewrites the active program designation data 71a to the address of the area selected in step SA34.

On the other hand, if the program to be installed is a non-involved update program (step SA31; YES), the update data control unit 203 identifies the ECU on which the program is to be installed (step SA39). The operation of step SA39 is the same as that of step SA32.

Next, the update processing unit 214 of the ECU identified by the update data control unit 203 stores the non-involved update program downloaded by the TCU 12 in the update program storage second area 79 of the second storage unit 62 (step SA40).

The update processing unit 214 copies the non-involved program stored in the non-involved program storage area 76 to the program storage area 77 of the second storage unit 62 (step SA41). After that, the update processing unit 214 writes the non-involved update program stored in the update program storage second area 79 to the non-involved program storage area 76 (step SA42).
The update processing unit 214 installs the non-involved program in the non-involved program storage area 76 by having the program execution unit 213 execute the non-involved update program written in step SA42 (step SA43).

The update processing unit 214 performs a process to confirm that the installation has been completed normally (step SA44). In step SA44, the update processing unit 214 performs a process similar to that of step SA37. The update processing unit 214 executes activation of the installed program (step SA45).

The update processing unit 214 deletes the non-involved programs stored in the program memory area 77 of the second memory unit 62 (step SA46).

The above embodiment shows a specific example to which the present invention is applied, and does not limit the form to which the invention is applied.
For example, in the above embodiment, a configuration has been described in which a vehicle control update program or a non-involved update program is downloaded from the server 110 to the control system 1 by a user operating a touch panel or the like. This is just one example, and, for example, a configuration may be adopted in which the control system 1 downloads the vehicle control update program from the server 110 without the need for a user operation. Also, a configuration may be adopted in which the control system 1 downloads the non-involved update program from the server 110 without the need for a user operation. In these cases, the control system 1 may be configured to install the downloaded vehicle control update program and/or the non-involved update program based on a user operation. Also, the control system 1 may install the vehicle control update program without a user operation.

In the above embodiment, an example has been described in which the control system 1 operates as a program management device. In detail, the control system 1 includes data storage units 51, 213 that store the vehicle control program and the non-involved program, and manages updates to the vehicle control program and the non-involved program. This is one example, and for example, the program management device may be configured as a part of the control system 1, or an external device connected to the control system 1 may function as the program management device.

The configuration of the control system 1 shown in the above embodiment is just one example, and the type of ECUs included in the control system 1, the number of ECUs, and the configuration of the devices controlled by the ECUs can be changed in various ways.

Figures 1 and 3 are diagrams showing the schematic configuration of the functional configuration of each device in the program management system 100, divided according to the main processing content, in order to facilitate understanding of the present invention, and are not intended to limit the configuration of the devices. Each process shown in Figures 5 to 7 may be executed by one program or multiple programs.

The above embodiment supports the following configurations:

(Configuration 1) A program management device comprising: a communication unit that communicates with an external device outside the vehicle; a first memory unit having a non-involved program memory area that stores a non-involved program that is not involved in the control of the vehicle; a second memory unit that is provided independently of the first memory unit; and an update processing unit that stores a non-involved update program received by the communication unit and used to update the non-involved program in the second memory unit, wherein the update processing unit executes a process of storing the non-involved program stored in the non-involved program memory area in the second memory unit, and then executes a process of storing the non-involved program in the non-involved program memory area based on the non-involved update program.
According to the program management device of configuration 1, before updating the non-involved program stored in the first storage unit, the non-involved program is stored in the second storage unit. This allows the non-involved program before the update to be held in the second storage unit. Therefore, even if the update of the non-involved program cannot be completed normally, the non-involved program in the first storage unit can be rolled back using the non-involved program stored in the second storage unit. Therefore, since the reliability of the program is not impaired even if the execution timing of the process of updating the non-involved program is not restricted, the constraints on the timing of updating the non-involved program can be reduced.

(Configuration 2) The first memory unit has a program storage first area that stores a vehicle control program for controlling the vehicle, and a program storage second area that stores the vehicle control program, and the update processing unit stores a vehicle control update program used to update the vehicle control program received by the communication unit in the second memory unit, and the update processing unit updates either the vehicle control program stored in the program storage first area or the vehicle control program stored in the program storage second area based on the vehicle control update program stored in the second memory unit. This is the program management device described in configuration 1.
According to the program management device of configuration 2, a vehicle control program for controlling a vehicle is stored in a first program storage area and a second program storage area. This allows the vehicle control program to be held in an area that is not affected by updates while the vehicle control program is being updated. Therefore, the reliability of the vehicle control program is not compromised even if there are no restrictions on the timing of updating the vehicle control program. This makes it possible to reduce restrictions on the timing of updating the vehicle control program.

(Configuration 3) The update processing unit includes a vehicle control program execution unit that executes the vehicle control program stored in the program storage first area and the vehicle control program stored in the program storage second area, which is set as an active program, and when the update processing unit updates the vehicle control program stored in the program storage first area or the vehicle control program stored in the program storage second area, the update processing unit sets the updated vehicle control update program as the active program. This is the program management device described in Configuration 2.
According to the program management device of configuration 3, it is possible to set a vehicle control program to be executed from among the vehicle control programs stored in the first program storage area and the second program storage area, thereby making it possible to efficiently use the vehicle control programs stored in the duplicated storage areas.

(Configuration 4) A program management device described in any one of configurations 1 to 3, comprising a non-involved program execution unit that executes the non-involved program, and the update processing unit executes a process of storing the non-involved program in the non-involved program memory area based on the non-involved update program, regardless of whether the non-involved program execution unit is executing the non-involved program.
According to the program management device of configuration 4, since the non-involved program is stored in the second storage unit before the process of updating the non-involved program is performed, the non-involved program before the update is not lost due to the process of updating the non-involved program. Therefore, by making it possible to update the non-involved program regardless of whether the non-involved program is being executed or not, it is possible to perform program updates efficiently.

(Configuration 5) A program management device described in any one of configurations 1 to 4, wherein the update processing unit deletes the non-involved program stored in the second memory unit after executing a process to store the non-involved program in the non-involved program memory area based on the non-involved update program.
According to the program management device of configuration 5, when updating a non-involved program, the non-involved program stored in the second storage unit is deleted when it becomes unnecessary, thereby making it possible to efficiently use the storage area of the second storage unit.

(Configuration 6) A program management device described in any one of configurations 1 to 5, wherein the update processing unit writes the non-involved program stored in the second memory unit to the non-involved program memory area when the process of storing the non-involved program in the non-involved program memory area based on the non-involved update program is not completed successfully.
According to the program management device of configuration 6, if the update of the non-involved program in the first storage unit is not completed normally, the non-involved program can be rolled back using the non-involved program before the update. This ensures the reliability of the update of the non-involved program.

(Configuration 7) The program management device according to any one of configurations 1 to 6, wherein the first memory unit is configured with a NOR type flash memory element, and the second memory unit is configured with a NAND type flash memory element.
According to the program management device of configuration 7, the reliability of the programs used in the vehicle can be improved by storing the vehicle control program and the non-involved program using a NOR type flash memory element with high data retention performance. NOR type flash memory is suitable for storing programs because of its high speed random read. Furthermore, by storing the vehicle control program in a duplicated manner in the first storage unit, which is a NOR type flash memory element, high reliability of the vehicle control program can be ensured. Furthermore, when updating the non-involved program, a low-cost NAND type flash memory element is used as the second storage unit used to store the non-involved program before the update, so that reliability regarding the update of the non-involved program can be ensured at a small cost.

(Configuration 8) A program management method that utilizes a program management device having a communication unit that communicates with an external device outside the vehicle, a first memory unit, and a second memory unit, the program management method comprising: providing a non-involved program memory area in the first memory unit for storing a non-involved program that is not involved in the control of the vehicle; storing a non-involved update program received by the communication unit and used to update the non-involved program in the second memory unit; executing a process to store the non-involved program stored in the non-involved program memory area in the second memory unit; and then executing a process to store the non-involved program in the non-involved program memory area based on the non-involved update program.
According to the program management method of configuration 8, before updating the non-involved program stored in the first storage unit, the non-involved program is stored in the second storage unit. This allows the non-involved program before the update to be held in the second storage unit. Therefore, even if the update of the non-involved program cannot be completed normally, the non-involved program in the first storage unit can be rolled back using the non-involved program stored in the second storage unit. Therefore, since the reliability of the program is not compromised even if the execution timing of the process of updating the non-involved program is not restricted, the constraints on the timing of updating the non-involved program can be reduced.

(Configuration 9) A program executed by a computer that controls a program management device having a communication unit that communicates with an external device outside the vehicle, a first memory unit, and a second memory unit, wherein the first memory unit is provided with a non-involved program memory area that stores a non-involved program that is not involved in the control of the vehicle, and a recording medium storing a program that causes the computer to execute a process of storing in the second memory unit a non-involved update program used to update the non-involved program received by the communication unit, a process of storing the non-involved program stored in the non-involved program memory area in the second memory unit, and then a process of storing the non-involved program in the non-involved program memory area based on the non-involved update program.
According to the program stored in the recording medium of configuration 9, before updating the non-involved program stored in the first storage unit, the non-involved program is stored in the second storage unit. This allows the non-involved program before the update to be held in the second storage unit. Therefore, even if the update of the non-involved program cannot be completed normally, the non-involved program in the first storage unit can be rolled back using the non-involved program stored in the second storage unit. Therefore, since the reliability of the program is not compromised even if the execution timing of the process of updating the non-involved program is not restricted, the constraints on the timing of updating the non-involved program can be reduced.

1...Control system (program management device), 2...Central ECU, 12...TCU (communication unit), 20...Zone ECU (control unit), 20a...First zone ECU (control unit), 20b...Second zone ECU (control unit), 20c...Third zone ECU (control unit), 30, 30a, 30b, 30c, 30d, 30e, 30f, 30g, 30h, 30i...ECU, 51, 51a, 51b, 51c, 212...Data storage unit, 52, 52a, 52b, 52c, 213...Program execution unit (vehicle control program execution unit, non-involved program execution unit) line section), 53, 53a, 53b, 53c, 214...update processing section, 61...first storage section, 62...second storage section, 63...memory, 74...first program storage area, 75...second program storage area, 76...non-involved program storage area, 77...program storage area, 78...first update program storage area, 79...second update program storage area, 100...program management system, 110...server, 120...vehicle diagnostic device, 201...update control section, 202...update data receiving section, 203...update data control section, 211...processing section, V...vehicle.

Claims (8)

A communication unit that communicates with an external device located outside the vehicle;
A first storage unit including a program storage first area and a program storage second area for storing a vehicle control program for controlling the vehicle, and a non-involved program storage area for storing a non-involved program that is not involved in the control of the vehicle;
a vehicle control program execution unit that executes one of the vehicle control programs stored in the first program storage area or the second program storage area as an active program;
A non-involved program execution unit that executes the non-involved program stored in the non-involved program storage area;
a second storage unit provided independently of the first storage unit, the second storage unit having a first update program storage area for storing a vehicle control update program used to update the vehicle control program received by the communication unit, and a second update program storage area for storing a non-involved update program used to update the non-involved program received by the communication unit;
an update processing unit that executes an update process of the vehicle control program based on the vehicle control update program and an update process of the non-involved program based on the non-involved update program;
Equipped with
The update processing unit:
When the update program is received by the communication unit, it is determined whether the update program is the vehicle control update program or the non-participation update program;
When the update program is the vehicle control update program, a process of updating the vehicle control program stored in the program storage first area or the program storage second area of the first storage unit is executed based on the vehicle control update program stored in the update program storage first area of the second storage unit,
When the update program is the non-involved update program, a program management device stores a copy of the non-involved program stored in the non-involved program memory area of the first memory unit in a program memory area provided in the second memory unit, and then executes a process of updating the non-involved program stored in the non-involved program memory area of the first memory unit based on the non-involved update program stored in the update program memory second area of the second memory unit. The program management device according to claim 1, wherein the update processing unit sets the updated vehicle control update program as an active program when the vehicle control program stored in the first program storage area or the vehicle control program stored in the second program storage area is updated. The program management device according to claim 1, wherein the update processing unit executes a process of updating the non-involved program stored in the non-involved program storage area of the first storage unit based on the non-involved update program, regardless of whether the non-involved program execution unit is executing the non-involved program. The program management device according to claim 1, wherein the update processing unit deletes the non-involved program stored in the program storage area of the second storage unit after executing a process of updating the non-involved program stored in the non-involved program storage area of the first storage unit based on the non-involved update program. The program management device according to claim 1, wherein the update processing unit writes the non-involved program stored in the program storage area of the second storage unit to the non-involved program storage area of the first storage unit when the process of updating the non-involved program stored in the non-involved program storage area of the first storage unit based on the non-involved update program is not completed normally. The program management device according to any one of claims 1 to 5, wherein the first storage unit is configured from a NOR type flash memory element, and the second storage unit is configured from a NAND type flash memory element. A communication unit that communicates with an external device located outside the vehicle;
A first storage unit including a program storage first area and a program storage second area for storing a vehicle control program for controlling the vehicle, and a non-involved program storage area for storing a non-involved program that is not involved in the control of the vehicle;
a second storage unit provided independently of the first storage unit, the second storage unit having a first update program storage area for storing a vehicle control update program used to update the vehicle control program received by the communication unit, and a second update program storage area for storing a non-involved update program used to update the non-involved program received by the communication unit;
A program management method executed by a program management device comprising:
a vehicle control program execution step of executing a vehicle control program set as an active program among the vehicle control programs stored in the first program storage area or the second program storage area;
A non-involved program execution step of executing the non-involved program stored in the non-involved program storage area;
an update processing step of executing an update process of the vehicle control program based on the vehicle control update program and an update process of the non-involved program based on the non-involved update program;
Including,
The update processing step includes:
When the update program is received by the communication unit, it is determined whether the update program is the vehicle control update program or the non-involved update program;
When the update program is the vehicle control update program, a process of updating the vehicle control program stored in the program storage first area or the program storage second area of the first storage unit is executed based on the vehicle control update program stored in the update program storage first area of the second storage unit,
A program management method, when the update program is the non-involved update program, which stores a copy of the non-involved program stored in the non-involved program memory area of the first memory unit in a program memory area provided in the second memory unit, and then performs a process of updating the non-involved program stored in the non-involved program memory area of the first memory unit based on the non-involved update program stored in the update program memory second area of the second memory unit. A communication unit that communicates with an external device located outside the vehicle;
A first storage unit including a program storage first area and a program storage second area for storing a vehicle control program for controlling the vehicle, and a non-involved program storage area for storing a non-involved program that is not involved in the control of the vehicle;
a second storage unit provided independently of the first storage unit, the second storage unit having a first update program storage area for storing a vehicle control update program used to update the vehicle control program received by the communication unit, and a second update program storage area for storing a non-involved update program used to update the non-involved program received by the communication unit;
A computer that controls a program management device comprising:
a vehicle control program execution unit that executes one of the vehicle control programs stored in the first program storage area or the second program storage area as an active program;
A non-involved program execution unit that executes the non-involved program stored in the non-involved program storage area;
an update processing unit that executes an update process of the vehicle control program based on the vehicle control update program and an update process of the non-involved program based on the non-involved update program;
and make it work.
The update processing unit:
When the update program is received by the communication unit, it is determined whether the update program is the vehicle control update program or the non-involved update program;
When the update program is the vehicle control update program, a process of updating the vehicle control program stored in the program storage first area or the program storage second area of the first storage unit is executed based on the vehicle control update program stored in the update program storage first area of the second storage unit,
A recording medium that stores a program that, when the update program is the non-involved update program, executes a process of updating the non-involved program stored in the non-involved program memory area of the first memory unit based on the non-involved update program stored in the update program memory second area of the second memory unit, after storing a copy of the non-involved program stored in the non-involved program memory area of the first memory unit in a program memory area provided in the second memory unit.

Images