On-board update apparatus, update processing system, update processing method, and computer program

An on-board update apparatus includes: a communication unit configured to communicate with a first on-board apparatus including a storage unit that stores a program in a rewritable manner and a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; and a processing unit configured to obtain an update program for updating the program stored in the storage unit from outside, and execute update processing of the program stored in the storage unit using the obtained update program, wherein the processing unit executes update processing of the program stored in the storage unit using the update program, when it is determined that no person is present around the vehicle based on the detection result received through the communication unit.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is the U.S. national stage of PCT/JP2020/008683 filed on Mar. 2, 2020, which claims priority of Japanese Patent Application No. JP 2019-042788 filed on Mar. 8, 2019, the contents of which are incorporated herein.

TECHNICAL FIELD

The present disclosure relates to an on-board update apparatus, an update processing system, an update processing method, and a computer program.

BACKGROUND

Conventionally, on-board apparatuses such as a plurality of electronic control units (ECUs) are installed in a vehicle, and the plurality of ECUs are connected to each other via a communication line such as a controller area network (CAN) bus so as to transmit and receive information to and from each other. Each ECU performs various processes such as control of the vehicle by a processing device such as a central processing unit (CPU) reading and executing a program stored in a storage unit such as a flash memory or an electrically erasable programmable read only memory (EEPROM). The program stored in the storage unit of the ECU needs to be updated to a new program when, for example, a function needs to be added, a problem needs to be corrected, or a version needs to be upgraded. In this case, an update program is transmitted via the communication line to the ECU to be updated.

JP 2017-220091A proposes a vehicular apparatus capable of notifying a user of the vehicle of driving availability when updating a program in response to a request from a terminal operable by the user.

There has been a technical problem that a program update of an on-board apparatus could cause a vehicle to behave unexpectedly, which could endanger a person present around the vehicle. JP 2017-220091A does not consider an unexpected situation in which a person present around a vehicle is at risk.

An object of the present disclosure is to provide an on-board update apparatus, an update processing system, an update processing method, and a computer program capable of executing program update processing of an on-board apparatus after at least confirming that no person is present around a vehicle, and restricting the program update processing when a person is present around the vehicle.

SUMMARY

An on-board update apparatus of the present disclosure includes: a communication unit configured to communicate with a first on-board apparatus including a storage unit that stores a program in a rewritable manner and a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; and a processing unit configured to obtain an update program for updating the program stored in the storage unit from outside, and execute update processing of the program stored in the storage unit using the obtained update program, wherein the processing unit executes update processing of the program stored in the storage unit using the update program, when it is determined that no person is present around the vehicle based on the detection result received through the communication unit.

An update processing method of the present disclosure is an update processing method for executing update processing of a program stored in a storage unit included in a first on-board apparatus, the update processing method including: a step of obtaining an update program for updating the program stored in the storage unit from outside; a step of performing communication with a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; a step of determining whether or not a person is present around the vehicle based on the received detection result; and a step of executing update processing of the program stored in the storage unit using the obtained update program when it is determined that no person is present around the vehicle.

A computer program of the present disclosure is a computer program for causing a computer to execute update processing of a program stored in a storage unit included in a first on-board apparatus, the computer program causing the computer to execute: a step of performing communication with a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; a step of determining whether or not a person is present around the vehicle based on the received detection result; and a step of executing update processing of the program stored in the storage unit using an update program obtained from outside for updating the program when it is determined that no person is present around the vehicle.

Note that the present application can be realized not only as an update processing apparatus including such a characteristic processing unit, but also as an update processing method including such characteristic processing as steps, or as a program for causing a computer to execute such steps, as described above. In addition, the present application can be realized as a semiconductor integrated circuit that realizes a part or all of the update processing apparatus, or can be realized as another system including the update processing apparatus.

Effects of the Present Disclosure

According to the present disclosure, it is possible to provide an on-board update apparatus, an update processing system, an update processing method, and a computer program capable of executing program update processing of an on-board apparatus after confirming that at least no person is present around a vehicle, and restricting the program update processing when a person is present around the vehicle.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may also be freely combined.

An on-board update apparatus according to an aspect includes: a communication unit configured to communicate with a first on-board apparatus including a storage unit that stores a program in a rewritable manner and a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; and a processing unit configured to obtain an update program for updating the program stored in the storage unit from outside, and execute update processing of the program stored in the storage unit using the obtained update program, wherein the processing unit executes update processing of the program stored in the storage unit using the update program, when it is determined that no person is present around the vehicle based on the detection result received through the communication unit.

In this aspect, the processing unit obtains an update program for updating the program stored in the storage unit of the first on-board apparatus from outside. The processing unit receives, through the communication unit, the detection result transmitted from the second on-board apparatus when executing update processing of the program stored in the storage unit using the obtained update program. The detection result is information indicating presence or absence of a person around the vehicle. The processing unit determines whether or not a person is present around the vehicle based on the received detection result, and executes update processing of the program when it is determined that no person is present around the vehicle. That is to say, when a person is present around the vehicle, the processing unit does not execute update processing of the program stored in the storage unit.

Accordingly, even when the vehicle performs an unexpected operation due to a failure in the program update processing, no person is present around the vehicle. Therefore, even when an unexpected situation related to the program update occurs, harm to people can be avoided.

It is preferable that the communication unit is configured to communicate with a third on-board apparatus including a sensor that performs detection of a person present in the vehicle and configured to transmit an inside-of-vehicle detection result indicating presence or absence of a person in the vehicle, and the processing unit executes update processing of the program stored in the storage unit using the update program, when it is determined that no person is present around and in the vehicle based on the detection result and the inside-of-vehicle detection result received through the communication unit.

In this aspect, the processing unit receives, through the communication unit, the inside-of-vehicle detection result transmitted from the third on-board apparatus when executing update processing of the program stored in the storage unit. The inside-of-vehicle detection result is information indicating presence or absence of a person in the vehicle. The processing unit determines whether or not a person is present around or in the vehicle based on the received detection result and the inside-of-vehicle detection result, and executes update processing of the program when it is determined that no person is present around and in the vehicle. That is to say, when a person is present around and in the vehicle, the processing unit does not execute update processing of the program stored in the storage unit.

Accordingly, even when the vehicle performs an unexpected operation due to a failure in the program update processing, no person is present around and in the vehicle. Therefore, even when an unexpected situation related to the program update occurs, harm to people can be avoided.

It is preferable that the processing unit executes update processing of the program stored in the storage unit using the update program when a predetermined time has elapsed after it is confirmed that no person is present.

In this aspect, the processing unit executes update processing of the program stored in the storage unit after the predetermined time has elapsed since it is confirmed that no person is present around the vehicle. Therefore, it is possible to more reliably detect that no person is present around the vehicle, and to avoid harm to people due to an unexpected situation related to program update.

It is preferable that the processing unit stops update processing of the program executed by the first on-board apparatus when it is determined that a person is present around the vehicle during the update processing of the program, and resumes the update processing of the program when a predetermined time has elapsed since it is again determined that no person is present around the vehicle.

In this aspect, the processing unit temporarily stops update processing when a person is detected around the vehicle during the update processing of the program. The processing unit resumes the update processing of the program when a predetermined time has elapsed since it is again determined that no person is present. Therefore, it is possible to advance update processing in a state where no person is present around the vehicle, and to avoid harm to people due to an unexpected situation related to program update.

It is preferable that the processing unit stops update processing of the program stored in the storage unit when an unlocking operation of a door of the vehicle is performed.

In this aspect, the processing unit temporarily stops update processing when a door unlocking operation is performed during the update processing of the program. When the door is unlocked by remote control, a person may approach the vehicle. Therefore, it is also possible to stop update processing when there is a possibility that a person is present around the vehicle, and to avoid harm to people due to an unexpected situation related to program update.

It is preferable that, in a case where a predetermined time has elapsed without a person being detected around the vehicle, the communication unit is caused to transmit a locking instruction signal for instructing locking of the door of the vehicle.

In this aspect, the processing unit locks the door of the vehicle after a predetermined time has elapsed since it is confirmed that no person is present around the vehicle. Therefore, it is possible to prevent a person from entering the vehicle during program update and operating the vehicle, and to more reliably avoid harm to people due to an unexpected situation related to program update.

It is preferable that when a communication apparatus related to maintenance of a vehicle is connected to an in-vehicle network to which the on-board update apparatus and the first on-board apparatus are connected, update processing of the program stored in the storage unit is executed using the update program regardless of presence or absence of a person around the vehicle.

In this aspect, when a communication apparatus related to the maintenance of the vehicle is connected to the in-vehicle network, update processing of the program is managed by a maintenance worker who has specialized knowledge. Therefore, the processing unit can execute the update processing of the program stored in the storage unit regardless of presence or absence of a person around the vehicle. As a result, unnecessary interruption of program update processing can be prevented, and the maintenance worker can efficiently perform the maintenance work of the vehicle.

It is preferable that the detection result includes a result of performing detection of a person present around the vehicle using an on-board camera that captures an image around the vehicle, or a radar.

In this aspect, it is possible to execute update processing of the program stored in the storage unit after confirming that no person is present around the vehicle using an on-board camera or a radar.

By using an on-board camera, the system can be configured at low cost. The on-board camera includes a camera that captures an image outside visible light, such as an infrared camera.

The radar emits radio waves or ultrasonic waves, and detects reflected waves from an object to detect a person. The radar includes a millimeter-wave radar, an ultrasonic sensor, an infrared sensor, a laser scanner, and the like.

An update processing system according to this aspect includes: the on-board update apparatus according to any one of aspects (1) to (8); a first on-board apparatus including the storage unit that stores the program in a rewritable manner; and a second on-board apparatus including a sensor that performs detection of a person present around the vehicle and configured to transmit the detection result indicating presence or absence of a person around the vehicle.

In this aspect, similarly to the aspect (1), even when the vehicle performs an unexpected operation due to a failure of the program update processing of the on-board apparatus, no person is present around the vehicle. Accordingly, even if an unexpected situation related to program update occurs, harm to people can be avoided.

An update processing method according to this aspect is an update processing method for executing update processing of a program stored in a storage unit included in a first on-board apparatus, the update processing method including: a step of obtaining an update program for updating the program stored in the storage unit from outside; a step of performing communication with a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; a step of determining whether or not a person is present around the vehicle based on the detection result that is received; and a step of executing update processing of the program stored in the storage unit using the obtained update program when it is determined that no person is present around the vehicle.

In this aspect, similarly to the aspect (1), even when the vehicle performs an unexpected operation due to a failure of program update processing of the on-board apparatus, no person is present around the vehicle. Accordingly, even if an unexpected situation related to program update occurs, harm to people can be avoided.

A computer program according to this aspect is a computer program for causing a computer to execute update processing of a program stored in a storage unit included in a first on-board apparatus, the computer program causing the computer to execute: a step of performing communication with a second on-board apparatus including a sensor that performs detection of a person present around a vehicle and configured to transmit a detection result indicating presence or absence of a person around the vehicle; a step of determining whether or not a person is present around the vehicle based on the detection result that is received; and a step of executing update processing of the program stored in the storage unit using an update program obtained from outside for updating the program when it is determined that no person is present around the vehicle.

In this aspect, it is possible to cause a computer to function as the update processing apparatus according to the aspect (1), and no person is present around the vehicle even when the vehicle performs an unexpected operation due to a failure in the program update processing of the on-board apparatus. Accordingly, even if an unexpected situation related to program update occurs, harm to people can be avoided.

Specific examples of an on-board update apparatus, an update processing system, and an update processing method according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is defined by the claims, and is intended to include all modifications that come within the meaning and range of equivalency of the claims.

FIG.1is a schematic diagram illustrating a configuration of an update processing system100according to the present embodiment, andFIG.2is a schematic diagram illustrating configurations of the update processing system100and a gateway (on-board update apparatus)1according to the present embodiment. The update processing system100according to the present embodiment includes a plurality of ECUs2installed in a vehicle C, one wireless communication apparatus3, and one gateway1.

Each ECU2is connected to any one of communication lines1a,1b, and1c, and can perform communication via the communication line1a,1b, or1cto which the ECU2is connected. In the example shown inFIG.2, a drive ECU (a first on-board apparatus)21is connected to the communication line1a, a surroundings detection ECU (a second on-board apparatus)22, a vehicle-stop detection ECU23, a seating detection ECU (a third on-board apparatus)24a, and a gripping detection ECU (the third on-board apparatus)24bare connected to the communication line1b, and a locking/unlocking ECU25is connected to the communication line1c. In the present embodiment, these ECUs are correctively referred to as ECUs2as appropriate. The gateway1relays communication between the communication lines1a,1b, and1c, so that the plurality of ECUs2can communicate via the communication lines1a,1b,1c, and the gateway1.

The drive ECU21is, for example, an ECU2that controls the operation of the engine of the vehicle C. The configuration of the drive ECU21will be described later.

The surroundings detection ECU22is connected to an on-board camera22athat captures an image of the vehicle surroundings, an ultrasonic sensor22bthat performs detection of an object present around the vehicle, a millimeter-wave radar22c, and a laser radar (LIDAR: light detection and ranging)22d. Either a monocular camera or a stereo camera can be used as the on-board camera22a. The on-board camera22amay also capture an image of a person A with visible light or may also capture an image of a person A with infrared light. The surroundings detection ECU22according to the present embodiment performs detection of a person A present around the vehicle based on an image captured by the on-board camera22aand the detection data of the ultrasonic sensor22b, the millimeter-wave radar22c, the laser radar22d(LIDAR), and the like. A person A includes not only a pedestrian, but also a person A riding on a two wheeled vehicle. A person A may be identified using a trained model trained through deep learning, for example. Deep learning is a type of machine learning, and classifies images and detection results of sensors and radars into predetermined classes. The surroundings detection ECU22learns a large amount of object images of stationary obstacles other than a person A present around the vehicle, object images of the person A, object images of objects such as buildings present around the vehicle, and the vehicle C, and the like, and stores weight coefficients for associating features of the person A and the like with classes corresponding to the features as learning results. The surroundings detection ECU22specifies the class to which the detection target belongs, by inputting the obtained image data and the detection result of each sensor to the learned model. Whether or not the detection target is a person A is specified by specifying the class. The surroundings detection ECU22transmits, to the gateway1, an outside-of-vehicle detection result indicating whether or not a person A is present around the vehicle. The gateway1receives the outside-of-vehicle detection result transmitted from the surroundings detection ECU22, and can determine whether or not a person A is present around the vehicle based on the received outside-of-vehicle detection result.

The vehicle-stop detection ECU23is connected to, for example, a vehicle speed sensor, a position switch that outputs a signal corresponding to a position of a shift lever of the vehicle C, an ignition switch, or the like. The vehicle speed sensor is, for example, a wheel speed sensor, and outputs a pulse signal corresponding to the rotational speed of the wheel. The vehicle-stop detection ECU23determines whether or not the vehicle C is stopped based on a signal that is output from the vehicle speed sensor, the position switch, the ignition switch, or the like, and outputs, to the gateway1, a vehicle-stop detection result indicating whether or not the vehicle C is stopped. The gateway1receives the vehicle-stop detection result transmitted from the vehicle-stop detection ECU23, and can determine whether or not the vehicle C is stopped based on the received vehicle-stop detection result.

The seating detection ECU24aincludes a pressure-sensitive sensor, a weight sensor, and the like embedded in the seat of the vehicle C, detects whether or not an occupant is seated in the seat, and transmits an inside-of-vehicle detection result to the gateway1. The gateway1receives the inside-of-vehicle detection result transmitted from the seating detection ECU24a, and can determine whether or not a person A is present in the vehicle, based on the received inside-of-vehicle detection result.

The gripping detection ECU24bincludes a touch sensor provided on the steering wheel. The touch sensor is, for example, a capacitive sensor, and the gripping detection ECU24bdetermines whether or not the driver is gripping the steering wheel based on a signal of the touch sensor. The gripping detection ECU24btransmits, to the gateway1, the inside-of-vehicle detection result indicating whether or not the steering wheel is being gripped. The gateway1receives the inside-of-vehicle detection result transmitted from the gripping detection ECU24b, and can determine whether or not a person A is present in the vehicle, based on the received inside-of-vehicle detection result.

The locking/unlocking ECU25is connected to an actuator that drives a locking/unlocking apparatus (not shown) that locks and unlocks the doors of the vehicle. When request switches of the doors of the vehicle are operated and an authorized portable device is present near the doors, the locking/unlocking ECU25drives the locking/unlocking apparatus to lock or unlock the doors of the vehicle. Further, when a signal instructing locking/unlocking of the doors is transmitted from the authorized portable device and the locking/unlocking ECU25receives the signal, the locking/unlocking ECU25drives the locking/unlocking apparatus to lock or unlock the doors of the vehicle. The detection of the operation state of the request switches, the wireless communication process with the portable device, the position detection of the portable device, the authentication process of the portable device, and the like may also be performed by another ECU2. The locking/unlocking ECU25may receive, from the other ECU2, an operation state of the request switches, a position detection result of the portable device, an authentication result, a signal for instructing locking/unlocking wirelessly transmitted from the portable device, and the like.

The locking/unlocking ECU25can transmit information indicating locked/unlocked state of the doors to the gateway1via the communication line1c. The gateway1can recognize the locked/unlocked state of the doors by receiving the information transmitted from the locking/unlocking ECU25.

In the update processing system100according to the present embodiment, a wireless communication apparatus3is connected to the gateway1via the communication line1d. The gateway1can communicate with a server apparatus9installed outside the vehicle C via the wireless communication apparatus3.

The wireless communication apparatus3can communicate with the server apparatus9installed outside the vehicle C by performing wireless communication using, for example, a mobile phone communication network or a wireless local area network (LAN). The wireless communication apparatus3can relay communication between the gateway1and the server apparatus9, and transmits data provided from the gateway1to the server apparatus9, and provides data received from the server apparatus9to the gateway1.

The server apparatus9manages and stores programs to be executed by the ECUs2installed in the vehicle C. In response to an inquiry from the vehicle C, the server apparatus9notifies whether or not it is necessary to update a program or the like stored in each ECU2, and when it is necessary to update a program, the server apparatus9distributes an update program to the vehicle9. The gateway1can communicate with the server apparatus9, obtain an update program for updating a program21d(described later) stored in an ECU2, and transmit the obtained update program to that ECU2.

A connector4for connecting an external device by wire is provided at an appropriate position of the vehicle C. The gateway1is connected to the connector4via a communication line1e. A diagnosis tool5is detachably connected to the connector4via, for example, a communication cable. With this configuration, the gateway1can communicate with the diagnosis tool5via the communication line1e, the connector4, and the communication cable.

The diagnosis tool5is an apparatus provided in, for example, a dealer or a maintenance factory of the vehicle C, and is an apparatus for an operator to perform an inspection of a defect, a setting change, or the like of the vehicle C. The diagnosis tool5is a portable apparatus having, for example, an operation unit and a display unit. After the operator connects the communication cable of the diagnosis tool5to the connector4of the vehicle C and performs an appropriate authentication process or the like, the diagnosis tool5and the gateway1of the vehicle C can communicate with each other.

In the update processing system100according to the present embodiment, the gateway1periodically communicates with the server apparatus9via the wireless communication apparatus3to check whether or not the programs stored in the ECUs2need to be updated. When it is necessary to update a program, the gateway1obtains an update program from the server apparatus9and stores the update program in a storage unit12of the gateway1. After obtaining the update program, the gateway1transmits the update program to the ECU2to be updated via the communication line1a,1b, or1cto update that ECU2. The ECU2receives the update program transmitted from the gateway1and stores the received update program in the storage unit21bof that ECU2, and updates the program by changing the program to be executed to the stored update program after the update program has been received. Hereinafter, in the present embodiment, an example in which the program of the drive ECU21is updated will be mainly described.

As illustrated inFIG.2, the gateway1according to the present embodiment includes a processing unit (processor)11, a storage unit (storage)12, first to fifth communication units (transceivers)13ato13e, and the like. The processing unit11is constituted using an arithmetic processing device such as a central processing unit (CPU) or a micro-processing unit (MPU), and performs various kinds of arithmetic processing by reading and executing a computer program12astored in the storage unit12. In the present embodiment, the processing unit11performs processing for relaying data transmission and reception between the communication lines1ato1eof the in-vehicle network and arithmetic processing necessary for update processing of the ECUs2and the like.

The storage unit12is configured using a nonvolatile memory element such as a flash memory or an electrically erasable programmable read only memory (EEPROM). The storage unit12stores various programs executed by the processing unit11and various data necessary for processing executed by the processing unit11. In the present embodiment, the storage unit12stores a computer program12aexecuted by the processing unit11. The computer program12amay also be written to the storage unit12, for example, in the manufacturing stage of the gateway1, or may also be distributed by the remote server apparatus9or the like and obtained by the gateway1through communication, or may also be recorded on a recording medium101such as a memory card or an optical disk and then read by the gateway1and stored in the storage unit12, or may also be recorded on the recording medium101and then read by the writing apparatus and written to the storage unit12of the gateway1. The computer program12amay also be provided in the form of being distributed via a network, or may also be provided in the form of being recorded in the recording medium101.

The gateway1includes a first communication unit13a, a second communication unit13b, a third communication unit13c, a fourth communication unit13d, and a fifth communication unit13e. The first communication unit13a, the second communication unit13b, the third communication unit13c, the fourth communication unit13d, and the fifth communication unit13eare connected to the communication lines1ato1econstituting the in-vehicle network, respectively, and perform data transmission and reception with the ECUs2, the server apparatus9, and the diagnosis tool5according to a predetermined communication protocol. In the present embodiment, the first to fifth communication units13ato13eperform data transmission and reception, based on the CAN communication standard, but the communication standard may also be any standard other than CAN. The first to fifth communication units13ato13etransmit information by converting data supplied from the processing unit11into electric signals and outputting the electric signals to the communication lines1ato1e, receive data by sampling and obtaining the potentials of the communication lines1ato1e, and supply the received data to the processing unit11. The five first to fifth communication units13ato13eincluded in the gateway1may also perform communication according to different communication protocols.

FIG.3is a schematic diagram illustrating a configuration of the drive ECU21. Although the configuration of the drive ECU21among the plurality of ECUs2installed in the vehicle C is illustrated, the other ECUs2have the same configuration. The drive ECU21includes a control unit (processor)21a, a storage unit (storage)21b, an ECU communication unit (transceiver)21c, and the like. Various sensors, actuators, and the like are connected to the control unit21aaccording to the function of the ECU2. The control unit21ais configured using an arithmetic processing device such as a CPU or an MPU, for example, and performs various arithmetic processes by reading and executing a program21dstored in the storage unit21d. The program21dstored in the storage unit21bhas different contents for each ECU2.

The storage unit21bis configured using a nonvolatile memory element such as a flash memory or an EEPROM. The storage unit21bstores the program21dexecuted by the control unit21aand data required for executing the program21d. The program21din the initial state may also be written in the storage unit21b, for example, in the manufacturing stage of the drive ECU21, or may also be recorded on a recording medium such as a memory card or an optical disk and then read by the drive ECU21and stored in the storage unit21b, or may also be recorded on a recording medium and then read by the writing apparatus and written in the storage unit21bof the drive ECU21, for example. Note that, in the present embodiment, after the drive ECU21is installed in the vehicle C, the drive ECU21receives an update program transmitted from the gateway1via the communication line1a, and the drive ECU21updates the program21dstored in the storage unit21busing the received update program.

In the present embodiment, two areas for storing the program21dare provided in the storage unit21bof the drive ECU21. The two areas both have sufficient storage capacity for storing the program21d. The control unit21areads the program21dfrom one area of the storage unit21band performs processing, and the update program received from the gateway1is stored in the other area of the storage unit21b. After having received the update program from the gateway1, the drive ECU21updates the program21dby switching the area from which the control unit21areads the program21d.

The ECU communication unit21cis connected to the communication line1aconstituting the in-vehicle network, and performs data transmission and reception in accordance with, for example, the CAN communication protocol. The ECU communication unit21cconverts the data supplied from the control unit21ainto an electric signal and outputs the electric signal to the communication line1ato transmit the data, and samples and obtains the potential of the communication line1ato receive data and supply the received data to the control unit21a.

FIG.4andFIG.5are flowcharts showing the procedure of the program update processing, andFIG.6,FIG.7AandFIG.7B, andFIG.8A,FIG.8BandFIG.8Care explanatory diagrams showing the program update method.

The processing unit11of the gateway1determines whether or not an update request has been received from the server apparatus9(step S11). When it is determined that the update request has not been received (NO in step S11), the processing unit11waits until the update request is received.

When it is determined that the update request has been received (YES in step S11), the processing unit11receives the update program transmitted from the server apparatus9that is the transmission source of the update request, thereby obtaining the update program to be used for update processing (step S12).

The processing unit11determines whether or not the diagnosis tool5is connected to the fifth communication unit13eor the connector4of the gateway1(step S13). As shown inFIG.6, when it is determined that the diagnosis tool5is connected (YES in step S13), the processing unit11executes update processing of the program21dstored in the storage unit21bof the ECU2using the update program obtained in step S12, without executing processing of detecting the presence or absence of a person A present inside or outside the vehicle (step S14). When having received, from the ECU2, notification of the completion of the update processing of the program21d, the processing unit11ends the program update processing.

When it is determined that the diagnosis tool5is not connected (NO in step S13), the processing unit11receives an outside-of-vehicle detection result transmitted from the surroundings detection ECU22through the second communication unit13b(step S15). The processing unit11receives an inside-of-vehicle detection result transmitted from the seating detection ECU24aand the gripping detection ECU24bthrough the second communication unit13b(step S16). The processing unit11determines whether or not a person A is present around or in the vehicle, based on the inside-of-vehicle detection result and the outside-of-vehicle detection result received in step S15and step S16(step S17). As shown inFIG.7A, when it is determined that a person A is present around or in the vehicle (YES in step S17), the processing unit11returns the processing to step S15, and continues monitoring the surroundings and the inside of the vehicle. That is to say, the processing unit11waits, without executing program update processing.

When it is determined that no person A is present around and in the vehicle (NO in step S17), the processing unit11determines the absence time of a person A around or in the vehicle, that is to say, whether or not a predetermined time has elapsed after it is determined that no person A is present around and in the vehicle (step S18). When it is determined that the absence time of a person A is within the predetermined time (NO in step S18), the processing unit11returns the processing to step S15and continues monitoring the surroundings and the inside of the vehicle.

As shown inFIG.7B, when it is determined that the predetermined time has elapsed since it is determined that no person A is present around and in the vehicle (YES in step S18), the processing unit11transmits a locking instruction signal for the doors of the vehicle C to the locking/unlocking ECU25through the third communication unit13c(step S19). The doors of the vehicle C are locked due to the transmission of the locking instruction signal. Next, the processing unit11starts update processing of the program21dstored in the storage unit21bof the drive ECU21using the update program obtained in step S12(step S20).

After starting the update processing, the processing unit11receives the outside-of-vehicle detection result transmitted from the surroundings detection ECU22through the second communication unit13b(step S21), and receives the inside-of-vehicle detection result transmitted from the seating detection ECU24aand the gripping detection ECU24bthrough the second communication unit13b(step S22). The processing unit11determines whether or not a person A is present around or in the vehicle, based on the inside-of-vehicle detection result and the outside-of-vehicle detection result received in the step21and step S22(step S23).

When it is determined that no person A is present around and in the vehicle (NO in step S23), the processing unit11communicates with the locking/unlocking ECU25and determines whether or not the unlocking operation has been performed (step S24). When it is determined that the unlocking operation has not been performed (NO in step S24), the processing unit11communicates with an ECU2and determines whether or not the update processing of the program21dis completed (step S25). Each ECU2is configured, for example, to send a completion signal to the gateway1when the update of the program21dis completed, and the processing unit11can determine whether or not the update is completed based on whether a completion signal sent from the ECU2has been received. As shown inFIG.8A, when it is determined that no person A is present around and in the vehicle and the update of the program21dis not completed (NO in step S25), the processing unit11returns the processing to step S21and continues monitoring of a person A around and in the vehicle while continuing the program update processing. When it is determined that the update processing of the program21dis completed (YES in step S25), the processing unit11ends the processing.

As shown inFIG.8B, when it is determined that a person A is present around or in the vehicle during program update (YES in step S23), or when it is determined that the unlocking operation of the doors has been performed (YES in step S24), the processing unit11temporarily stops update processing of the program21d(step S26). Specifically, the processing unit11transmits, to the drive ECU21, a temporary stop instruction signal for instructing temporary stop of updating. The drive ECU21that has received the temporary stop instruction signal temporarily stops update processing of the program21d.

Next, the processing unit11receives the outside-of-vehicle detection result transmitted from the surroundings detection ECU22through the second communication unit13b(step S27), and receives the inside-of-vehicle detection result transmitted from the seating detection ECU24aand the gripping detection ECU24bthrough the second communication unit13b(step S28). The processing unit11determines whether or not a person A is present around or in the vehicle, based on the inside-of-vehicle detection result and the outside-of-vehicle detection result received in step27and step S28(step S29).

When it is determined that a person A is present around or in the vehicle (YES in step S29), the processing unit11returns the processing to step S27and continues monitoring the surroundings and the inside of the vehicle.

When it is determined that no person A is present around and in the vehicle (NO in step S29), the processing unit11determines the absence time of a person A present around or in the vehicle, that is to say, whether or not a predetermined time has elapsed after it is determined that no person A is present around and in the vehicle (step S30). When it is determined that the absence time of a person A is within the predetermined time (NO in step S30), the processing unit11returns the processing to step S27and continues monitoring the surroundings and the inside of the vehicle.

When it is determined that the predetermined time has elapsed since it is determined that no person A is present around and in the vehicle (YES in step S30), the processing unit11transmits a locking instruction signal of the doors of the vehicle C to the locking/unlocking ECU25through the third communication unit13c(step S31), resumes the update processing of the program21d(step S32) as shown inFIG.8C, and returns the processing to step S21. Specifically, the processing unit11transmits, to the drive ECU21, a resuming instruction signal for instructing resuming of the update processing. The drive ECU21that has received the resuming instruction signal resumes the update processing of the program21d.

According to the update processing system100, the gateway1, the update processing method, and the computer program12aaccording to the embodiment configured as described above, it is possible to execute program update processing of the on-board apparatus after it is confirmed that no person A is present around and in the vehicle, and restrict program update processing when a person A is present around or in the vehicle.

According to the present embodiment, the processing unit11executes the update processing of the program21dstored in the storage unit21bafter the predetermined time has elapsed after it is confirmed that no person A is present around the vehicle. Therefore, it is possible to more reliably detect that no person A is present around the vehicle, and to avoid harm to people due to unexpected situation related to the program update.

According to the present embodiment, when a person A present around the vehicle is detected during update processing of the program21d, the processing unit11temporarily stops the update processing, and then resumes the update processing of the program21dafter it is again confirmed that no person A is present around the vehicle. Therefore, it is possible to advance the update processing in a state where no person A is present around the vehicle, and to avoid harm to people due to unexpected situation related to the program update.

According to the present embodiment, when an unlocking operation is performed during update processing of the program21d, the processing unit11temporarily stops the update processing. When the door is unlocked by remote control, a person A may approach the vehicle. Therefore, it is also possible to stop the update processing when there is a possibility that a person A is present around the vehicle, and to avoid harm to people due to unexpected situation related to the program update.

According to the present embodiment, the processing unit11locks the doors of the vehicle after the predetermined time has elapsed since it is confirmed that no person A is present around the vehicle. Therefore, it is possible to prevent the person A from entering the vehicle during the program update and operating the vehicle, and to more reliably avoid harm to people due to an unexpected situation related to the program update.

According to the present embodiment, when the diagnosis tool5is connected to the in-vehicle network, update processing of the program21dis managed by a maintenance worker who has specialized knowledge. Accordingly, the processing unit11can execute the update processing of the program21dstored in the storage unit21bregardless of presence or absence of a person A around the vehicle. As a result, unnecessary interruption of the program update processing can be prevented, and the maintenance worker can efficiently perform the maintenance work of the vehicle.

According to the present embodiment, the processing unit11can execute the update processing of the program21dstored in the storage unit21bafter confirming that no person A is present around the vehicle using the on-board camera22a. The system can be configured at low cost by utilizing the on-board camera22a.

Further, the processing unit11confirms that no person A is present around the vehicle using the ultrasonic sensor22b, the millimeter-wave radar22c, and the laser radar22d, in addition to the on-board camera22a. Therefore, it is possible to more reliably detect whether or not a person A is present around the vehicle, and to more reliably avoid harm to people due to an unexpected situation related to the program update. In particular, by using the millimeter-wave radar22c, a person A can be detected, without being affected by weather. Also, the laser radar22dcan detect a person A more accurately than other radars.

In the present embodiment, an example, in which a reprogramming master (the update processing apparatus) that controls the program update processing of the ECUs2is configured as the gateway1has been described, but the reprogramming master may also be configured separately from the gateway1. Further, in the present embodiment, an example in which programs of the ECUs2are configured has been described. However, a configuration may also be adopted in which a program of any reprogramming slave connected to an in-vehicle network in a wired or wireless manner is configured.