Relay device, electronic control unit, and vehicle-mounted system

• US 10,489,141 B2
• Filed: 07/14/2016
• Issued: 11/26/2019
• Est. Priority Date: 07/23/2015
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Nakamura, Sho, Harata, Yuzo, Natsume, Mitsuyoshi, Doi, Masakazu, Kaneko, Naoji
• Primary Examiner(s): Kang, Insun
• Application Number:
  US15/743,777
• Publication Number:
  US 20180203685A1
• Time in Patent Office: 1,230 Days
• Field of Search: None
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 12/40 Bus networks
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A relay device is provided. The relay device includes: an acquisition unit acquiring data necessary for an upgrade processing from an upgrading tool, which performs the upgrading processing to an ECU connected to a vehicle-mounted network; a relay unit providing the data, via the vehicle-mounted network, to a target ECU which is subject to the upgrade processing; a suspend instructing unit transmitting, via the vehicle-mounted network, a suspend command which instructs the non-target ECU to shift to a suspend state in which a transmission of other data to the non-target ECU via the vehicle-mounted network is suspended in response to a start of the upgrade processing; and a cancel instructing unit instructing, via the vehicle-mounted network, the non-target ECU to cancel the suspend state when the upgrade processing is completed.

Claims

1. A relay device comprising:

a memory storing a program;

a processor that, when executing the program, is configured to;

acquire data necessary to perform an upgrade processing from an upgrading tool, wherein the upgrading tool performs the upgrade processing to upgrade Electronic Control Units (ECUs) connected to a vehicle-mounted network, and the ECUs include a target Electronic Control Unit (ECU) which is subject to the upgrade processing and a non-target ECU which is not subject to the upgrade processing;

provide, via the vehicle-mounted network, the acquired data to the target ECU;

transmit, via the vehicle-mounted network, a suspend command which instructs the non-target ECU to shift to a suspend state in response to a start of the upgrade processing, the suspend state being a state in which a transmission of other data to the non-target ECU via the vehicle-mounted network is suspended;

instruct, via the vehicle-mounted network, the non-target ECU to cancel the suspend state when the upgrade processing is completed; and

instruct the non-target ECU to cancel the suspend state via the vehicle-mounted network when the processor fails to acquire, from the upgrading tool, the data necessary to perform the upgrade processing over a period longer than a predetermined abnormality detection duration during an execution of the upgrade processing.

2. The relay device according to claim 1, wherein the processor, when executing the program, is further configured to:

periodically transmit, via the vehicle-mounted network, a suspend extending command which instructs the non-target ECU to extend the suspend state by a predetermined period during an execution of the upgrade processing, and

instruct a cancel of the suspend state of the non-target ECU by canceling a transmission of the suspend extending command.

3. The relay device according to claim 1, wherein the processor, when executing the program, is further configured to:

periodically transmit, via the vehicle-mounted network, a suspend extending command which instructs the non-target ECU to extend the suspend state by a predetermined period during an execution of the upgrade processing, and

instruct, when the upgrade processing is completed, a cancel of the suspend state of the non-target ECU by transmitting, via the vehicle-mounted network, a suspend canceling command which instructs the non-target ECU to cancel the suspend state.

4. The relay device according to claim 1, wherein the ECUs include one or more target ECUs, and the processor, when executing the program, is further configured to:

determine whether the upgrade processing for upgrading one of the one or more target ECUs is started according to the data acquired from the upgrading tool;

determine whether the upgrade processing for upgrading the one of the one or more target ECUs is completed according to the data acquired from the upgrading tool; and

count a total number of the one or more target ECUs to which the upgrade processing is presently performed according to a determination result of whether the upgrade processing for upgrading one of the one or more target ECUs is started and a determination result of whether the upgrade processing for upgrading one of the one or more target ECUs is completed; and

instruct a cancel of the suspend state of the non-target ECU via the vehicle-mounted network when the total number of the one or more target ECUs counted by decreases to zero.

5. The relay device according to claim 1, wherein the processor, when executing the program, is further configured to:

determine whether the upgrade processing for the target ECU is started according to the data acquired from the upgrading tool,

wherein

a time when the processor determines that the upgrade processing is started is defined as a start time, and

wherein the processor, when executing the program, is further configured to instruct a cancel of the suspend state of the non-target ECU via the vehicle-mounted network when a predetermined end duration elapses from the start time.

6. The relay device according to claim 1, wherein

the non-target ECU in the suspend state does not treat a failure in a data acquiring via the vehicle-mounted network as an abnormality.

7. An Electronic Control Unit (ECU) comprising:

a memory storing a program;

a processor that, when executing the program, is configured to;

acquire, via a vehicle-mounted network, data necessary to perform an upgrade processing of the ECU from an upgrading tool through a relay device;

perform a processing associated with the upgrade processing according to the acquired data;

shift the ECU to a suspend state in which a data transmission via the vehicle-mounted network is suspended upon receipt of a suspend command from the relay device via the vehicle-mounted network when the upgrade processing is started; and

cancel the suspend state upon receipt of a command from the relay device via the vehicle-mounted network when the upgrade processing is completed;

wherein the relay device instructs the ECU to cancel the suspend state via the vehicle-mounted network when the relay device fails to acquire, from the upgrading tool, the data necessary to perform the upgrade processing over a period longer than a predetermined abnormality detection duration during an execution of the upgrade processing.

8. The ECU according to claim 7, wherein the processor, when executing the program, is further configured to:

extend the suspend state by a predetermined suspend period upon receipt of a suspend extending command from the relay device via the vehicle-mounted network during an execution of the upgrade processing, the suspend extending command instructing an extension of the suspend state by the predetermined suspend period,

wherein, when processor receives the command for canceling the suspend state from the relay device, the processor cancels the suspend state under a condition that the predetermined suspend period is elapsed after receiving the suspend extending command from the relay device.

9. A vehicle-mounted system comprising:

a plurality of Electronic Control Units (ECUs) connected to a vehicle-mounted network; and

a relay device connected to a vehicle-mounted network,

wherein

the relay device includes a first memory storing a first program and a first processor that, when executing the first program, is configured to;

acquire data necessary to perform an upgrade processing from an upgrading tool, wherein the upgrading tool performs the upgrade processing to upgrade the plurality of ECUs, and the plurality of ECUs include a target Electronic Control Unit (ECU) which is subject to the upgrade processing and a non-target ECU which is not subject to the upgrade processing;

provide, via the vehicle-mounted network, the data acquired by the first processor to the target ECU;

transmit, via the vehicle-mounted network, a suspend command which instructs the non-target ECU to shift to a suspend state in response to a start of the upgrade processing, the suspend state being a state in which a transmission of other data to the non-target ECU via the vehicle-mounted network is suspended; and

instruct, via the vehicle-mounted network, the non-target ECU to cancel the suspend state when the upgrade processing is completed, and

each of the plurality of ECUs includes a second memory storing a second program and a second processor that, when executing the second program, is configured to;

acquire, from the relay device via the vehicle-mounted network, data that is necessary to perform the upgrade processing of an own ECU and transmitted from the upgrading tool through the relay device;

perform a processing associated with the upgrade processing according to the data acquired by the second processor;

shift the own ECU to the suspend state upon receipt of the suspend command from the relay device via the vehicle-mounted network when the upgrade processing is started;

cancel the suspend state upon receipt of a command from the relay device when the upgrade processing is completed;

and

the first processor, when executing the first program, is further configured to instruct the non-target ECU to cancel the suspend state via the vehicle-mounted network when the first processor fails to acquire, from the upgrading tool, the data necessary to perform the upgrade processing over a period longer than a predetermined abnormality detection duration during an execution of the upgrade processing.

10. The vehicle-mounted system according to claim 9, wherein

the first processor, when executing the first program, is further configured to:

periodically transmit, via the vehicle-mounted network, a suspend extending command which instructs the non-target ECU to extend the suspend state by a predetermined suspend period during an execution of the upgrade processing,

instruct the non-target ECU to cancel the suspend state by canceling a transmission of the suspend extending command;

the second processor, when executing the second program, is further configured to;

extend the suspend state by the predetermined suspend period upon receipt of the suspend extending command from the relay device via the vehicle-mounted network during the execution of the upgrade processing, and

cancel, when the the command that instructs cancellation of the suspend state is received from the relay device, the suspend state after the predetermined suspend period elapses after from reception time of the suspend extending command.