Electronic control device and storage medium

Abstract

The electronic control device (19-21) has an application execution unit (34), which has a first default session, a wired diagnostic session for diagnosing the electronic control device from outside the vehicle via wire, and a wired rewrite session for rewriting the electronic control device using a program obtained from outside the vehicle via wire as a first state, and performs state transition to the wired diagnostic session based on a request for diagnosis via wire, and performs state transition to the wired rewrite session based on a request for rewriting via wire, and has a second default session, a wireless rewrite session for rewriting the electronic control device using a program obtained from outside the vehicle via wireless as a second state, and performs state transition to the wireless rewrite session based on a request for rewriting via wireless. The application execution unit independently manages the first state and the second state, and non-exclusively establishes the wireless rewrite session and the first default session or the wired diagnostic session.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on Japanese application No. 2018-093867 filed on May 15, 2018 and Japanese application No. 2019-090618 filed on May 13, 2019, and the contents thereof are cited herein. Technical Field

[0003] The present disclosure relates to an electronic control device and a storage medium. Background Art

[0004] It is known to connect a service tool to a vehicle network by wire to perform diagnosis on the vehicle's electronic control unit (hereinafter referred to as ECU (Electronic Control Unit)). In addition, with the development of communication networks, etc., the technology of connected cars has also become popular, and it is also known to perform diagnosis by remote operation via wireless communication. In the case where a request for wired diagnosis and wireless diagnosis is generated like this, for example, patent document 1 discloses a technology for performing mediation so that wired diagnosis based on a service tool is performed preferentially. In addition, diagnosis is also called detection (Diag).

[0005] Patent Document 1: Japanese Patent Application Publication No. 2014-78800

[0006] The requests from outside via wired or wireless include not only diagnosis but also program rewriting. In addition, there are cases where the ECU that is the object of diagnosis or program rewriting is executing a program related to vehicle control. In such a case, the ECU needs to appropriately mediate various requests from the outside. Summary of the invention

[0007] The present disclosure has been made in view of the above-mentioned circumstances, and an object of the present disclosure is to provide an electronic control device and a storage medium capable of appropriately performing mediation with respect to various requests from the outside.

[0008] According to one embodiment of the present disclosure, an application execution unit has a first default session, a wired diagnostic session for diagnosing an electronic control device from outside the vehicle via wire, and a wired rewrite session for rewriting the electronic control device using a program acquired from outside the vehicle via wire as a first state, performs state transition to the wired diagnostic session based on a request for diagnosis via wire, and performs state transition to the wired rewrite session based on a request for rewriting via wire, has a second default session and a wireless rewrite session for rewriting the electronic control device using a program acquired from outside the vehicle via wireless as a second state, and performs state transition to the wireless rewrite session based on a request for rewriting via wireless. The application execution unit independently manages the first state and the second state, and non-exclusively establishes the wireless rewrite session and the first default session or the wired diagnostic session.

[0009] By non-exclusively establishing a wireless rewrite session and a default session of the first state or a wired diagnostic session, it is possible to non-exclusively execute requests for diagnosis of vehicle control or wired electronic control devices and rewrite of wireless programs, and to appropriately mediate various requests from the outside.

[0010] According to one embodiment of the present disclosure, an application execution unit has a default session, a diagnostic session for diagnosing an electronic control device from outside the vehicle via wired or wireless, a wired rewrite session for rewriting the electronic control device using a program acquired from outside the vehicle via wired, and a wireless rewrite session for rewriting the electronic control device using a program acquired from outside the vehicle via wireless as states, and performs state transition to the diagnostic session based on a request for diagnosis via wired or wireless, performs state transition to the wired rewrite session based on a request for rewriting via wired, and performs state transition to the wireless rewrite session based on a request for rewriting via wireless. The application execution unit exclusively establishes the wired rewrite session and the wireless rewrite session.

[0011] By exclusively establishing the wired rewrite session and the wireless rewrite session, requests for wired program rewrite and wireless program rewrite can be exclusively executed, and various requests from the outside can be appropriately mediated. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above-mentioned objects and other objects, features and advantages of the present disclosure will become more apparent through the following detailed description with reference to the accompanying drawings. In the accompanying drawings:

[0013] Figure 1 It is a functional block diagram showing the overall structure of one embodiment.

[0014] Figure 2This is a functional block diagram showing the electrical structure of CGW.

[0015] Figure 3 This is a functional block diagram showing the electrical structure of the ECU.

[0016] Figure 4 This is a diagram showing a state of normal operation in a double-sided memory of a rewritable firmware built-in type.

[0017] Figure 5 This is a diagram showing a state during a rewrite operation in a double-sided memory of a rewrite firmware built-in type.

[0018] Figure 6 This is a diagram showing a state of normal operation in a rewrite firmware download type double-sided memory.

[0019] Figure 7 This is a diagram showing a state during a rewrite operation in a double-sided memory of a rewrite firmware download type.

[0020] Figure 8 This is a functional block diagram showing the configuration of each process of the microcomputer.

[0021] Fig. 9 This is a diagram showing the structure of a program (part 1).

[0022] Fig.10 This is a diagram showing state transition (part 1).

[0023] Fig.11 This is a diagram showing state transition (part 2).

[0024] Fig.12 This is a diagram showing state transition (part 3).

[0025] Fig.13 This is a diagram showing the mediation of a conversation (part 1).

[0026] Fig.14 This is a diagram showing the mediation of a conversation (part 2).

[0027] Fig.15 This is a flowchart (part 1) showing the state transition management process of the first state.

[0028] Fig.16 This is a flowchart showing the state transition management process of the first state (part 2).

[0029] Fig.17 This is a flowchart showing the state transition management process of the first state (part 3).

[0030] Fig.18 This is a flowchart (part 1) showing the state transition management process of the second state.

[0031] Fig.19 This is a flowchart showing the state transition management process of the second state (part 2).

[0032] Fig. 20 This is a diagram showing the structure of a program (part 2).

[0033] Fig.21 This is a diagram showing state transition (part 4). DETAILED DESCRIPTION

[0034] Hereinafter, an embodiment will be described with reference to the accompanying drawings. A vehicle program rewriting system (equivalent to a vehicle electronic control system) is a system capable of rewriting applications such as vehicle control and diagnosis mounted on an ECU via OTA. In addition, in the present embodiment, the case of rewriting an application by wire or wireless is described, but it can also be applied to the case of rewriting data used in various applications such as map data used in map applications and control parameters used in ECU by wire or wireless. That is, the rewriting of the program by wire includes not only rewriting the ECU using the program obtained from outside the vehicle via wire, but also obtaining and rewriting various data used when executing the program via wire. The rewriting of the program by wireless includes not only rewriting the ECU using the program obtained from outside the vehicle via wireless, but also obtaining and rewriting various data used when executing the program via wireless.

[0035] like Figure 1 As shown, the vehicle program rewriting system 1 includes a central device 3 on the communication network 2 side, a vehicle-side system 4 on the vehicle side, and a user terminal 5. The communication network 2 is configured to include, for example, a mobile communication network based on 4G lines, the Internet, WiFi (Wireless Fidelity) (registered trademark), etc.

[0036] The center device 3 has a file server 6, a web server 7, and a management server 8, and each server 6 to 8 is configured to be able to communicate data with each other. The center device 3 integrates the OTA (Over the Air) function on the communication network 2 side in the vehicle program rewriting system 1, and acts as an OTA center. The file server 6 is a server that has a management function of the application distributed to the vehicle, and manages the rewrite data provided by the supplier as the provider of the application and the status of the vehicle. The file server 6 can communicate data with the vehicle-side system 4 via the communication network 2 and distribute the rewrite data to the vehicle-side system 4. The web server 7 is a server that manages web page information. The web server 7 can communicate data with the user terminal 5 via the communication network 2 and send web page information to the user terminal 5. The management server 8 manages personal information, vehicle information, etc.

[0037] The user terminal 5 is a portable mobile terminal 9 that can be carried by the user and an on-board display 10 that is arranged in the vehicle. The portable terminal 9 is, for example, a smart phone or a tablet. The on-board display 10 is, for example, a display that also serves as a navigation function or an instrument display. When the user is outside the vehicle, the user can use the portable terminal 9 to perform various settings and various confirmations related to the rewriting of the application, and when inside the vehicle, the user can use the on-board display 10 to perform various settings and various confirmations related to the rewriting of the application.

[0038] The vehicle-side system 4 has a master device 11 (equivalent to a vehicle master device). The master device 11 has a DCM 12 and a CGW 13, and the DCM 12 and the CGW 13 are connected via a first bus 14 in a manner capable of data communication. The DCM 12 is an on-vehicle communication device that performs data communication with the center device 3 via the communication network 2, downloads rewrite data from the file server 6, and transmits the downloaded rewrite data to the CGW 13. The CGW 13 is a vehicle gateway device that distributes the rewrite data transmitted from the DCM 12 to the rewrite target ECU for rewriting the application program. The master device 11 coordinates the OTA function on the vehicle side in the vehicle program rewriting system 1 and acts as an OTA master device.

[0039] In addition to the first bus 14, the CGW 13 is also connected with a second bus 15, a third bus 16, a fourth bus 17, and a fifth bus 18 as buses on the vehicle interior side. The second bus 15 is, for example, a bus of a body system network, and multiple body system ECUs 19 are connected thereto. The multiple body system ECUs 19 are, for example, a door ECU that controls the locking / unlocking of a door, an instrument ECU that controls the instrument display, an air conditioning ECU that controls the driving of an air conditioner, a window ECU that controls the opening and closing of a window, and the like. The third bus 16 is, for example, a bus of a travel system network, and multiple travel system ECUs 20 are connected thereto. The multiple travel system ECUs 20 are, for example, an engine ECU that controls the driving of an engine, a brake ECU that controls the driving of a brake, an ECTECU that controls the driving of an automatic transmission, a power steering ECU that controls the driving of a power steering, and the like. The fourth bus 17 is, for example, a bus of a multimedia system network, and multiple multimedia system ECUs 21 are connected thereto. The multiple multimedia system ECUs 21 are, for example, a navigation ECU for controlling a navigation system, an ETC ECU that controls an electronic toll collection system (ETC (Electronic Toll Collection System, registered trademark)), and the like. A power management ECU 22 that manages power of the vehicle-side system 4 is connected to the fifth bus 18 .

[0040] The sixth bus 23 is connected to the CGW 13 as a bus outside the vehicle. The sixth bus 23 is connected to a DLC (Data Link Coupler) connector 24. A tool 25 (equivalent to a service tool) is detachably connected to the DLC connector 24. The buses 14 to 18 and 23 are composed of, for example, a CAN (Controller Area Network, a registered trademark) bus, and the CGW 13 performs data communication with the DCM 12, ECUs 19 to 22, and the tool 25 in accordance with the CAN data communication standard or the diagnostic communication standard (UDS: ISO14229). In addition, the buses 15 to 17 may also be buses of systems other than the bus of the body system network, the bus of the driving system network, and the bus of the multimedia system network. In addition, the DCM 12 and the CGW 13 may be connected via Ethernet, and the DLC connector 24 and the CGW 13 may also be connected via Ethernet.

[0041] If the rewrite target ECU receives the rewrite data from CGW13, it writes the received rewrite data into the flash memory to rewrite the application. In the above structure, CGW13 acts as a rewrite master device that distributes the rewrite data to the rewrite target ECU, and the rewrite target ECU acts as a rewrite slave device that writes the rewrite data received from CGW13 to rewrite the application.

[0042] As forms of rewriting an application, there are a form of rewriting via wire and a form of rewriting via wireless. The form of rewriting an application via wire refers to a form of rewriting the rewrite target ECU using an application obtained from outside the vehicle via wire. Specifically, if the tool 25 is connected to the DLC connector 24, the tool 25 transmits the rewrite data to the CGW13. As a gateway, the CGW13 sends a wired rewrite request to the rewrite target ECU and distributes the rewrite data transmitted from the tool 25 to the rewrite target ECU. Distributing the rewrite data transmitted from the tool 25 to the rewrite target ECU in the CGW13 means relaying the rewrite data. The rewrite target ECU writes the rewrite data received from the CGW13 to rewrite the application.

[0043] The form of wirelessly rewriting an application is a form of rewriting the rewriting target ECU using an application obtained from the outside of the vehicle via wireless. Specifically, if rewriting data is downloaded from the center device 3 to the DCM12, the DCM12 transmits the rewriting data downloaded from the center device 3 to the CGW13. The CGW13, as a gateway, sends a wireless rewriting request to the rewriting target ECU and distributes the rewriting data transmitted from the DCM12 to the rewriting target ECU. The rewriting target ECU writes the rewriting data received from the CGW13 to rewrite the application.

[0044] As the form of the diagnostic ECU 19, there are a form of diagnosis by wire and a form of diagnosis by wireless. The form of diagnosis by wire refers to a form of diagnosing the ECU 19 from the outside of the vehicle via a wire. Specifically, if the tool 25 is connected to the DLC connector 24, the tool 25 transmits a diagnostic request to the CGW 13. The CGW 13, as a gateway, sends the diagnostic request to the diagnostic object ECU and distributes the diagnostic instruction transmitted from the tool 25 to the diagnostic object ECU. The diagnostic object ECU performs a diagnostic process corresponding to the diagnostic instruction received from the CGW 13.

[0045] The form of wireless diagnosis refers to the form of wireless diagnosis of ECU19 from outside the vehicle. Specifically, if a diagnostic command is sent from the center device 3 to DCM12 as a diagnostic request, DCM12 transmits the diagnostic command to CGW13. CGW13, as a gateway, distributes the diagnostic command as a diagnostic request to the diagnostic target ECU. The diagnostic target ECU performs diagnostic processing corresponding to the diagnostic command received from CGW13.

[0046] like Figure 2 As shown, the CGW 13 includes a microcomputer (hereinafter referred to as a microcomputer) 26, a data transmission circuit 27, a power supply circuit 28, and a power supply detection circuit 29. The microcomputer 26 includes a CPU (Central Processing Unit) 26a, a ROM (Read Only Memory) 26b, a RAM (Random Access Memory) 26c, and a flash memory 26d (equivalent to a storage unit), and controls the operation of the CGW 13 by executing a control program stored in a non-transitory physical storage medium to perform processing corresponding to the control program.

[0047] The data transmission circuit 27 controls data communication with the buses 14 to 18 and 23 in accordance with the CAN data communication standard. The power circuit 28 receives inputs of a battery power supply (hereinafter referred to as +B power supply), an accessory power supply (hereinafter referred to as ACC power supply), and an ignition power supply (hereinafter referred to as IG power supply). The power detection circuit 29 detects the voltage value of the +B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply, compares these detected voltage values ​​with a predetermined voltage threshold value, and outputs the comparison result to the microcomputer 26. The microcomputer 26 receives the comparison result of the +B power supply, the ACC power supply, and the IG power supply from the power detection circuit 29, and determines whether the +B power supply, the ACC power supply, and the IG power supply are normal or abnormal.

[0048] like Figure 3As shown, ECU 19-21 has a microcomputer 30, a data transmission circuit 31, a power supply circuit 32, and a power supply detection circuit 33. The microcomputer 30 has a CPU 30a, a ROM 30b, a RAM 30c, and a flash memory 30d (equivalent to a storage unit), etc., and controls the operation of ECU 19-21 by executing a control program stored in a non-transitory physical storage medium to perform processing corresponding to the control program.

[0049] The data transmission circuit 31 controls data communication with the buses 15 to 17 in accordance with the CAN data communication standard. The +B power supply, ACC power supply, and IG power supply are input to the power supply circuit 32. The power supply detection circuit 33 detects the voltage value of the +B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply, compares these detected voltage values ​​with a specified voltage threshold, and outputs the comparison result to the microcomputer 30. The microcomputer 30 inputs the comparison result of the +B power supply, the ACC power supply, and the IG power supply from the power supply detection circuit 33, and determines whether the +B power supply, the ACC power supply, and the IG power supply are normal or abnormal. In addition, for ECUs 19 to 21, the loads such as sensors and actuators are different, but the structure is basically the same.

[0050] DCM12 has Figure 3 The DCM 12 has the same structure as the ECU 19 shown in the figure. In addition, the DCM 12 has a communication device for communicating with the center device 3 and a GPS (Global Positioning System) that can detect the position of the vehicle. Here, the flash memory 28d of the DCM 12 has sufficient capacity to store the distribution package. The vehicle-mounted display 10 has Figure 3 The vehicle-mounted display 10 is connected to a display (not shown) in such a way that data can be transmitted and received. The power management ECU 22 has Figure 3 The ECU 19 shown has the same structure.

[0051] As types of flash memory 30d mounted on ECUs 19 to 21, there are single-sided single-type memory having an application area configured with application programs on one side, single-sided suspended-type memory having application areas on pseudo-two sides, and double-sided memory having application areas on actual two sides. Hereinafter, an ECU equipped with a single-sided single-type memory is referred to as a single-sided single-type memory ECU, an ECU equipped with a single-sided suspended-type memory is referred to as a single-sided suspended-type memory ECU, and an ECU equipped with a double-sided memory is referred to as a double-sided memory ECU. In the present embodiment, a structure in which a CPU 30a and a ROM 30b are provided inside a microcomputer 30 is exemplified, but a structure in which a CPU 30a is provided inside a microcomputer 30 and a ROM 30b is provided outside the microcomputer 30 may also be a structure of a so-called external memory type.

[0052] Since the single-sided separate memory ECU has a program storage area on one side, there is no concept of an operating side and a non-operating side, and the application program rewrite process cannot be performed while the application process is being executed. Therefore, the single-sided separate memory ECU executes the rewrite program and performs the application program rewrite process in a state where the application program is stopped and the application process or the diagnostic process is stopped.

[0053] On the other hand, since the single-sided suspended memory ECU or the double-sided memory ECU has a program storage area on both sides, there are concepts of an operating side and a non-operating side. By making improvements to the memory structure, it is possible to rewrite the program and perform rewriting processing of the application on the non-operating side while executing the application and performing application processing or diagnostic processing. In this embodiment, by using a double-sided memory as the flash memory 30d and making improvements to the memory structure, it is possible to perform rewriting processing of the application on the non-operating side while the application on the operating side is being executed.

[0054] The structure of the double-sided memory is described below. Figures 4 to 7 As shown, the double-sided memory has a boot area and an application area, and the application area is provided on both sides A and B. Double-sided memories include a rewritable firmware built-in type in which rewritable firmware is pre-built-in, and a rewritable firmware download type in which rewritable firmware is downloaded from the outside. Each structure is described below.

[0055] (1) Rewrite firmware built-in type

[0056] Figure 4 The double-sided memory with built-in rewritable firmware is shown, and the firmware for rewriting is pre-stored in the flash memory. Figure 4 As shown, the boot program is configured in the boot area in a non-rewritable manner. The boot program includes a boot exchange function and a boot-time vector table. In each application area, a differential engine working area, an application, and a rewrite program for rewriting the application are pre-configured. The application includes version information, parameter data, software (application), firmware, and a normal vector table. The rewrite program includes rewrite progress management information 2, rewrite progress management information 1, startup surface determination information, wireless rewrite firmware, wired rewrite firmware, and a boot-time vector table. Wireless rewrite firmware refers to firmware that uses an application obtained from outside the vehicle via wireless to rewrite the ECU. Wired rewrite firmware refers to firmware that uses an application obtained from outside the vehicle via wired to rewrite the ECU. The rewrite firmware includes basic components such as programs for erasing and writing memory, and differential engines.

[0057] If the application areas of the two surfaces are referred to as surface A and surface B, when the microcomputer 30 performs normal operations of application processing such as vehicle control processing and diagnostic processing, it executes the boot program, determines the new and old based on the startup surface determination information of surface A and surface B through the boot exchange function, and determines which surface of surface A and surface B is the operating surface. If the microcomputer 30 determines that surface A is set as the operating surface, it searches for the front address with reference to the boot-time vector table of surface A and the normal-time vector table of surface A, and executes the application program of surface A. Similarly, if the microcomputer 30 determines that surface B is set as the operating surface, it searches for the front address with reference to the boot-time vector table of surface B and the normal-time vector table of surface B, and executes the application program of surface B.

[0058] When the microcomputer 30 performs a rewrite operation of rewriting the application program on the non-operational side, Figure 5 As shown, the application program on the non-operating surface is temporarily saved as old data in the differential engine working area. The microcomputer 30 reads out the old data temporarily saved in the differential engine working area, and restores the new data based on the read old data and the differential rewrite data stored in the RAM 30c by the built-in rewrite firmware. If the microcomputer 30 generates new data based on the old data and the differential rewrite data, the generated new data is written to the non-operating surface to rewrite the application program on the non-operating surface. In addition, the old data temporarily saved in the differential engine working area can be the application program on the operating surface as an object, or the application program on the non-operating surface as an object. In the case of taking the application program on the operating surface as an object, the data on the non-operating surface is erased before writing the new data. Here, in the case where the rewrite data acquired from the outside of the vehicle is not differential data but full data (full data), the acquired rewrite data is written as new data to the non-operating surface.

[0059] (2) Firmware rewrite download type

[0060] like Figure 6 As shown, in the rewrite firmware download type, the rewrite firmware is received from outside the vehicle and stored in the RAM, and executed on the RAM. Compared with the above-mentioned rewrite firmware built-in type, the wireless rewrite firmware or wired rewrite firmware is downloaded from the outside, and after rewriting the application, the wireless rewrite firmware or wired rewrite firmware is erased.

[0061] When the microcomputer 30 performs normal operations such as vehicle control processing and diagnostic processing, it executes the boot program in the same way as the built-in firmware rewrite type, determines the information based on the startup surfaces of surface A and surface B and determines the new and old through the boot exchange function, determines which surface of surface A and surface B is the application surface, and executes the application program of the application surface to perform application processing.

[0062] When the microcomputer 30 performs the rewriting operation of the application program rewriting process, Figure 7As shown, the application program on the non-operating surface is temporarily saved as old data in the differential engine working area. The microcomputer 30 reads out the old data temporarily saved in the differential engine working area, and restores the new data based on the read old data and the differential rewrite data stored in the RAM 30c by the rewrite firmware downloaded from the outside. If the microcomputer 30 generates new data based on the old data and the differential rewrite data, the generated new data is written to the non-operating surface to rewrite the application program on the non-operating surface. Moreover, if the microcomputer 30 completes the rewrite, the downloaded rewrite firmware is erased from the RAM. In addition, the old data temporarily saved in the differential engine working area can be the application program on the operating surface as the object, or the application program on the non-operating surface as the object. In the case of taking the application program on the operating surface as the object, the data on the non-operating surface is erased before writing the new data. Here, in the case where the rewrite data acquired from the outside of the vehicle is not differential data but full data (complete data), the acquired rewrite data is written as new data to the non-operating surface.

[0063] As described above, in either the rewrite firmware built-in type or the rewrite firmware download type, an application program and a rewrite program for rewriting the application program are arranged in each application area. Figure 4 as well as Figure 6 In the example, the application program is shown as the rewrite target, but the rewrite program may be the rewrite target. In addition, if the rewrite program is not to be rewritten, it may be arranged in the boot area. A program for wired rewrite may also be arranged in the boot area so that, for example, a dealer or the like can reliably perform wired rewrite via a tool.

[0064] like Figure 8 As shown, the microcomputer 30 has an application execution unit 34, a wireless rewrite request determination unit 35, and a wired rewrite request determination unit 36 ​​as functional modules for each process. The application execution unit 34 has a function of mediating the execution of each program. The wireless rewrite request determination unit 35 has a function of determining a program rewrite request via wireless. The wired rewrite request determination unit 35 has a function of determining a program rewrite request via wire.

[0065] Fig. 9: is a diagram showing the structure of each program stored in the flash memory. The vehicle control program is a program for realizing the vehicle control function (e.g., steering control function) mounted on the ECU 19 to 21 itself. The wired diagnostic program is a program for performing the diagnosis of the ECU 19 to 21 itself from the outside of the vehicle via wire. The wireless diagnostic program is a program for performing the diagnosis of the ECU 19 to 21 itself from the outside of the vehicle via wireless. The wireless rewrite program is a program for rewriting the program acquired from the outside of the vehicle via wireless. The wired rewrite program is a program for rewriting the program acquired from the outside of the vehicle via wire. The vehicle control program is configured in the application area as a first program. The wired diagnostic program and the wired rewrite program are configured in the application area as a second program. The wireless diagnostic program and the wireless rewrite program are configured in the application area as a third program. In other words, the second program is a program for performing special processing via wire other than vehicle control, and the third program is a program for performing special processing via wireless other than vehicle control. In addition, the wired rewrite program may be configured in the boot area as a fourth program instead of in the application area.

[0066] The application execution unit 34 performs control so that the first program, the second program, and the third program can be executed simultaneously (performing non-exclusive control). The application execution unit 34 can, for example, simultaneously execute a vehicle control program, a wired diagnostic program, and a wireless diagnostic program. That is, the application execution unit 34 can simultaneously execute vehicle control, wired diagnosis of ECU19 to 21, and wireless diagnosis of ECU19 to 21. Similarly, the application execution unit 34 performs control so that the vehicle control program, the wired diagnostic program, and the wireless rewriting program can be executed simultaneously, the vehicle control program, the wired rewriting program, and the wireless diagnostic program can be executed simultaneously, and the vehicle control program, the wired rewriting program, and the wireless rewriting program can be executed simultaneously.

[0067] On the other hand, the application execution unit 34 performs exclusive control so that each program in the second program cannot be executed at the same time. Similarly, the application execution unit 34 performs exclusive control so that each program in the third program cannot be executed at the same time. For example, the application execution unit 34 performs exclusive control on the wired diagnosis program and the wired rewriting program, and performs exclusive control on the wireless diagnosis program and the wireless rewriting program. That is, the application execution unit 34 executes only one program in the special processing via wire. Similarly, the application execution unit 34 executes only one program in the special processing via wireless.

[0068] In other words, the wireless rewrite program is configured inside the wireless diagnostic program, and can be said to be built into a part of the wireless diagnostic program. That is, the application execution unit 34 controls the vehicle control program and the wired diagnostic program to continue to be executed and the wireless rewrite program to be executed, if the state transition is made from the default session or the wireless diagnostic session to the wireless rewrite session as described later while the vehicle control program and the wired diagnostic program are being executed, based on the structure in which the wireless rewrite program is configured inside the wireless diagnostic program. By continuing the execution of the vehicle control program and the wired diagnostic program and starting the execution of the wireless rewrite program, the vehicle control program, the wired diagnostic program, and the wireless rewrite program can be executed simultaneously. That is, the application execution unit 34 controls the vehicle control, the wired diagnosis of the ECUs 19 to 21, and the rewriting of the wireless application program to be executed simultaneously.

[0069] Here, depending on the specific content of the diagnostic processing or the rewriting processing, a situation occurs in which wired diagnosis and wireless diagnosis, as well as wired rewriting and wireless rewriting cannot be performed simultaneously. For example, when the wired rewriting and the wireless rewriting rewrite rewrite the same area, the processing of the two conflicts. Therefore, the application execution unit 34 performs exclusive control over the wired diagnostic program and the wireless diagnostic program according to the specific content of the processing and request, and also performs exclusive control over the wired rewriting program and the wireless rewriting program. In addition, depending on the content of the diagnostic processing, a situation may occur in which normal vehicle control cannot be continued. For example, in the case of a diagnostic processing that causes the ECU to operate to read its results, it cannot be executed simultaneously with normal vehicle control. In this case, the application execution unit 34 performs such mediation control as putting the vehicle control program on standby and executing the wired or wireless diagnostic program.

[0070] On the other hand, when the wired rewriting program is not arranged in the application area but arranged in the boot area as the fourth program, the application execution unit 34 performs a part of the mediation control different from the above. Fig. 9As shown by the dotted line in the middle, it is configured as the fourth program outside the wired diagnostic program and is not built into the wired diagnostic program as a part of the wired diagnostic program. In this case, the application execution unit 34 performs exclusive control when executing the fourth program to terminate the first to third programs. That is, the application execution unit 34 switches from the mode of executing the first to third programs to the dedicated mode of executing the fourth program. In other words, the wired rewriting program is configured outside the wired diagnostic program. If the state is migrated from the wired diagnostic session to the wired rewriting session as described later while the vehicle control program and the wireless diagnostic program are being executed, the wired rewriting program is controlled so that the execution of the vehicle control program and the wireless diagnostic program is stopped and the execution of the wired rewriting program is started. The application execution unit 34 starts the execution of the wired rewriting program by stopping the execution of the vehicle control program and the wireless diagnostic program, so that the vehicle control program, the wireless diagnostic program and the wired rewriting program cannot be executed at the same time, and only the wired rewriting program can be executed. That is, the application execution unit 34 performs control so that vehicle control, wireless diagnosis of the ECUs 19 to 21, and wired application rewriting cannot be executed simultaneously and only wired application rewriting can be executed.

[0071] like Fig.10 As shown, the application execution unit 34 manages the default state (default session), the state of wired diagnosis (wired diagnosis session), and the state of wired rewrite (wired rewrite session) as the first state related to the special processing of the wired method. In addition, the default state (default session) and the state of wireless rewrite (wireless rewrite session) are managed as the second state related to the special processing of the wireless method, and the internal state of the action is managed.

[0072] The application execution unit 34 causes the default session that enables vehicle control, the wired diagnostic session that enables diagnosis of ECUs 19 to 21 from outside the vehicle via wires, and the wired rewrite session that enables rewriting of an application program acquired from outside the vehicle via wires to exclusively perform state transitions as state transitions of the first state in accordance with the diagnostic communication standard. Exclusively performing state transitions of the sessions means that the sessions cannot be established at the same time, and non-exclusively performing state transitions of the sessions means that the sessions can be established at the same time.

[0073] The default session in the first state is a mode indicating a state in which special processing in a wired manner is not performed, and is a state in which vehicle control can be performed. The default session can be said to be a process that does not affect vehicle control at all, for example, it is a mode in which diagnostic programs unrelated to vehicle control can also be executed. Diagnostic programs unrelated to vehicle control are programs for reading information such as fault codes, etc. The wired diagnostic session is a mode for executing diagnostic programs related to the diagnosis of ECU19~21. At least in the case of a state in which the vehicle control will be affected by executing the diagnostic program, the default session is transferred to the wired diagnostic session. The diagnostic program related to the diagnosis of ECU19~21 is a program for stopping communication, diagnostic masking, actuator driving, etc. The wired rewrite session is a mode in which the application program obtained from the outside of the vehicle via wire is rewritten.

[0074] The application execution unit 34 performs session state migration in the first state as follows. If a wired diagnostic request is generated in the state of the first default session, the application execution unit 34 transfers from the first default session to the wired diagnostic session through a diagnostic session transfer request and performs wired diagnostic processing. If a session recovery request is generated in the state of the wired diagnostic session, a timeout occurs, the power is disconnected, or a regulatory service is received, the application execution unit 34 transfers from the wired diagnostic session to the first default session. If a wired rewrite request is generated in the state of the first default session, the application execution unit 34 transfers from the wired diagnostic session to the wired rewrite session through a rewrite session transfer request after transferring from the first default session to the wired diagnostic session through a diagnostic session transfer request, and performs wired rewrite processing. If a session recovery request is generated in the state of the wired rewrite session, a timeout occurs, the power is disconnected, or a regulatory service is received, the application execution unit 34 transfers from the wired rewrite session to the first default session. In addition, the application execution unit 34 maintains the current session without transferring through a session maintenance request.

[0075] The application execution unit 34 exclusively performs state transitions to the default session that enables vehicle control and the wireless rewrite session related to rewriting of the application program acquired from outside the vehicle via wireless according to the diagnostic communication standard as the state transition to the second state. The wireless rewrite session is a mode for rewriting the application program acquired from outside the vehicle via wireless.

[0076] The application execution unit 34 performs session state transition in the second state as follows. If a wireless rewrite request is generated in the state of the second default session, the application execution unit 34 transfers from the second default session to the wireless rewrite session by rewriting the session transfer request, and performs the wireless rewrite process. If a session recovery request is generated in the state of the wireless rewrite session, a timeout occurs, or the power is disconnected, the application execution unit 34 transfers from the wireless rewrite session to the second default session. In addition, the application execution unit 34 maintains the current session without transferring it by requesting to maintain the session.

[0077] The application execution unit 34 manages the first state related to the special processing of the wired mode and the second state related to the special processing of the wireless mode while executing the vehicle control program as the first program. For example, if a wired diagnosis request is generated in the default session in both the first state and the second state, the application execution unit 34 continues the vehicle control program, transfers the first state to the wired diagnosis session, and starts the execution of the wired diagnosis program. If a wireless rewrite request is generated in this state, the application execution unit 34 continues the execution of the vehicle control program and the wired diagnosis program, transfers the second state to the wireless rewrite session, and starts the execution of the wireless rewrite program. If a wired rewrite request is generated in this state, the application execution unit 34, for example, ends the execution of the wireless rewrite program, transfers the second state to the default session, and ends the execution of the wired diagnosis program, transfers the first state to the wired rewrite session, and starts the execution of the wired rewrite program. In order to prevent conflicts in the write processing to the same memory area, the application execution unit 34 exclusively performs state transition so that the wired rewrite session in the first state and the wireless rewrite session in the second state are not established at the same time (exclusively controlled).

[0078] The wireless rewrite request determination unit 35 determines the identification information of the rewrite request received from the outside and determines the wireless rewrite request. That is, if the rewrite data is downloaded from the center device 3 to the DCM 12, and the CGW 13 distributes the rewrite data transmitted from the DCM 12 to the rewrite target ECU, the wireless rewrite request determination unit 35 receives the identification information indicating the wireless rewrite request together with the rewrite data from the CGW 13, thereby determining the wireless rewrite request.

[0079] The wired rewrite request determination unit 36 ​​determines the identification information of the rewrite request received from the outside and determines the wired rewrite request. That is, when the tool 25 is connected to the DLC connector 24, the CGW 13 distributes the rewrite data transmitted from the tool 25 to the rewrite target ECU, and the wired rewrite request determination unit 36 ​​receives the identification information indicating the wired rewrite request from the CGW 13 together with the rewrite data, thereby determining the wired rewrite request.

[0080] The identification information may be, for example, information corresponding to identification IDs that are different in the wired rewrite request and the wireless rewrite request, or information corresponding to the same identification ID but different data in the wired rewrite request and the wireless rewrite request. In other words, any information may be used as long as it can identify the wired rewrite request and the wireless rewrite request.

[0081] exist Fig.10 In the description, the configuration of managing the two states of the default session and the wireless rewrite session in the application execution unit 34 as the second state related to the special processing of the wireless method is described, but it may also be as follows Fig.11 as well as Fig.12 As shown, the configuration is to manage the three states of the default session, the wireless diagnostic session, and the wireless rewrite session as the second state. The wireless diagnostic session is a mode for executing a wireless diagnostic program for diagnosing ECUs 19 to 21 from outside the vehicle via wireless. At least when executing a wireless diagnostic program that affects vehicle control, the system shifts to the wireless diagnostic session.

[0082] exist Fig.11 In the case of the structure shown, the application execution unit 34 performs the state transition of the second state as follows. If a wireless diagnostic request is generated in the state of the second default session, the application execution unit 34 transfers from the second default session to the wireless diagnostic session through a diagnostic session transfer request and performs wireless diagnostic processing. If a session recovery request is generated in the state of the wireless diagnostic session, a timeout occurs, or the power is disconnected, the application execution unit 34 transfers from the wireless diagnostic session to the second default session. If a wireless rewrite request is generated in the state of the second default session, the application execution unit 34 transfers from the wireless diagnostic session to the wireless rewrite session through a rewrite session transfer request after transferring from the second default session to the wireless diagnostic session through a diagnostic session transfer request, and performs wireless rewrite processing. If a session recovery request is generated in the state of the wireless rewrite session, a timeout occurs, or the power is disconnected, the application execution unit 34 transfers from the wireless rewrite session to the second default session.

[0083] exist Fig.12In the case of the structure shown, the application execution unit 34 performs the state transition of the second state as follows. If a wireless diagnostic request is generated in the state of the second default session, the application execution unit 34 transfers from the second default session to the wireless diagnostic session through a diagnostic session transfer request and performs wireless diagnostic processing. If a session recovery request is generated in the state of the wireless diagnostic session, a timeout occurs, or the power is disconnected, the application execution unit 34 transfers from the wireless diagnostic session to the second default session. If a wireless rewrite request is generated in the state of the second default session, the application execution unit 34 transfers from the wireless diagnostic session to the wireless rewrite session through a rewrite session transfer request after transferring from the second default session to the wireless diagnostic session through a diagnostic session transfer request, or transfers from the second default session to the wireless rewrite session through a rewrite session transfer request, and performs wireless rewrite processing. If a session recovery request is generated in the state of the wireless rewrite session, a timeout occurs, or the power is disconnected, the application execution unit 34 transfers from the wireless rewrite session to the second default session.

[0084] In addition, the wired diagnostic session in the first state and the wireless diagnostic session in the second state may execute the same diagnostic program or different diagnostic programs. The wired rewrite session in the first state and the wireless rewrite session in the second state may execute the same rewrite program or different rewrite programs. For example, a common rewrite program such as erasing and writing of a memory may also be executed.

[0085] exist Fig.11 as well as Fig.12 In the structure shown, the mediation of each session in the first state and each session in the second state is described. Fig. 9 As described in , the wired diagnostic program is configured as the second program in the application area, the wireless diagnostic program and the wireless rewriting program are configured as the third program in the application area, and the wired diagnostic program is configured as the fourth program in the boot area. In other words, this is a description of a structure in which the wireless rewriting program is built into a part of the wireless diagnostic program, but the wired rewriting program is not built into a part of the wired diagnostic program. In this case, the mediation of program execution in each session of the first state and the second state is as follows Fig.13 As shown.

[0086] When the second state is the wireless rewrite session and the first state is the default session, the application execution unit 34 executes the wireless rewrite program while executing the vehicle control program. When the second state is the wireless rewrite session and the first state is the wired diagnostic session, the application execution unit 34 executes the wireless rewrite program and the wired diagnostic program simultaneously while executing the vehicle control program.

[0087] On the other hand, when the first state is the wired rewrite session and the second state is the default session, the application execution unit 34 terminates the vehicle control program and executes only the wired rewrite program. When the first state is the wired rewrite session and the second state is the wireless diagnostic session, the application execution unit 34 terminates the wireless diagnostic program and the vehicle control program and executes only the wired rewrite program. That is, the application execution unit 34 performs exclusive control over the first to third programs as a dedicated mode for executing only the wired rewrite program as the fourth program.

[0088] In addition, in the configuration in which the wired diagnostic program and the wired rewriting program are arranged as the second program in the application area, a part of the mediation of each program is Fig.13 That is, in a structure where the wireless rewriting program is built into a part of the wireless diagnostic program and the wired rewriting program is built into a part of the wired diagnostic program, the mediation of program execution in each session of the first state and the second state is as follows: Fig.14 In this case, when the first state is the wired rewrite session and the second state is the default session, the application execution unit 34 executes the wired rewrite program while executing the vehicle control program. When the first state is the wired rewrite session and the second state is the wireless diagnostic session, the application execution unit 34 executes the wired rewrite program and the wireless diagnostic program simultaneously while executing the vehicle control program.

[0089] Next, refer to Figures 15 to 19 , the role of the above-mentioned structure is explained.

[0090] When the microcomputer 30 detects that the power supply is turned on and starts, it executes the session establishment program to perform state transition management processing, and performs state transition management processing to manage the state transition of the first state and state transition management processing to manage the state transition of the second state. The following describes each state transition management processing. Fig.10 The following describes a case where the second state is managed by the structure shown, that is, by a structure without a wireless diagnostic session.

[0091] (1) State Transition Management Processing of the First State

[0092] When the microcomputer 30 detects that the power supply is turned on and starts, and starts the state transition management process of the first state, the rewrite completion flag is determined to determine whether the rewrite of the previous application is completed normally (S1). When the microcomputer 30 determines that the rewrite completion flag is positive and the rewrite of the previous application is completed normally (S1: "Yes"), the first state is transferred to the default session (S2). That is, the microcomputer 30 starts the vehicle control process by transferring the first state to the default session.

[0093] When the microcomputer 30 starts the vehicle control process by executing the vehicle control program, it determines whether a wired diagnostic request is generated (S3), determines whether a wired rewrite request is generated (S4), and determines whether the completion condition of the state transition management is satisfied (S5). When the microcomputer 30 determines that a wired diagnostic request is generated while the vehicle control process is being executed (S3: "Yes"), it transfers the first state from the default session to the wired diagnostic session (S6), and starts the wired diagnostic process by executing the wired diagnostic program (S7). The microcomputer 30 determines whether the completion condition of the wired diagnostic process is satisfied (S8), and if it is determined that the completion condition of the wired diagnostic process is satisfied (S8: "Yes"), it terminates the wired diagnostic program to terminate the wired diagnostic process (S9), and transfers the first state from the wired diagnostic session to the default session (S10).

[0094] When the microcomputer 30 determines that a wired rewrite request has been generated while the vehicle control process is being executed (S4: "Yes"), the rewrite exclusive process when the wired rewrite request has been generated is started (S11). That is, it is a process for performing exclusive control so that the wired rewrite process and the wireless rewrite process do not conflict. When the microcomputer 30 starts the rewrite exclusive process when the wired rewrite request has been generated, it is determined whether the second state is transitioning to the wireless rewrite session, that is, it is determined whether the second state is a wireless rewrite session (S21). If the microcomputer 30 determines that the second state is not transitioning to the wireless rewrite session (S21: "No"), it is determined that the first state can be transitioned to the wired rewrite session (S22). The microcomputer 30 ends the rewrite exclusive process when the wired rewrite request has been generated, and resumes the state transition management process of the first state.

[0095] If the microcomputer 30 determines that the wireless rewrite session is being transferred in the second state (S21: "Yes"), it determines which of the wired rewrite session and the wireless rewrite session is given priority and performs exclusive control. Specifically, the microcomputer 30 determines which of the wired rewrite session priority condition, the wireless rewrite session priority condition, and the rewrite session priority condition in transfer is established (S23-S25). The wired rewrite session priority condition is a condition that gives priority to the wired rewrite session over the wireless rewrite session. The wireless rewrite session priority condition is a condition that gives priority to the wireless rewrite session over the wired rewrite session. The rewrite session priority condition in transfer is a condition that gives priority to the rewrite session in transfer, that is, gives priority to the session that is transferred first. Which of these priority conditions is adopted is pre-set, for example, a priority condition flag can be set for the vehicle, or a priority condition flag can be set for each rewrite ECU.

[0096] If the microcomputer 30 determines that the wired rewrite session priority condition is satisfied (S23: Yes), the microcomputer 30 transfers the wireless rewrite session to the default session and interrupts the wireless rewrite in the second state through the session recovery request (S26), and determines that the first state can be transferred to the wired rewrite session (S22). The microcomputer 30 terminates the wireless rewrite program along with the default session transfer. The microcomputer 30 terminates the rewrite exclusive processing when the wired rewrite request is generated, and returns to the state transition management processing of the first state.

[0097] If the microcomputer 30 determines that the wireless rewrite session priority condition is satisfied (S24: Yes), the microcomputer 30 discards the wired rewrite request and continues the wireless rewrite (S27). That is, the microcomputer 30 maintains the second state with the wireless rewrite session, continues the execution of the wireless rewrite program, and determines that the first state cannot be transferred to the wired rewrite session (S28). The microcomputer 30 ends the rewrite exclusive processing when the wired rewrite request is generated, and returns to the state transition management processing of the first state.

[0098] If the microcomputer 30 determines that the rewrite session priority condition during the transfer is satisfied (S25: "Yes"), then in this case, the wired rewrite request is also discarded and the wireless rewrite is continued (S27). That is, the microcomputer 30 maintains the second state with the wireless rewrite session, continues the execution of the wireless rewrite program, and determines that the first state cannot be transferred to the wired rewrite session (S28). The microcomputer 30 ends the rewrite exclusive processing when the wired rewrite request is generated, and returns to the state transition management processing of the first state. By executing the rewrite exclusive processing when the wired rewrite request is generated in this way, the microcomputer 30 exclusively controls the wired rewrite session and the wireless rewrite session, and does not establish the sessions at the same time.

[0099] When the microcomputer 30 returns to the state transition management process of the first state, it determines whether the transfer to the wired rewrite session is possible as a result of the rewrite exclusive process when the wired rewrite request is generated (S12). When the microcomputer 30 determines that the transfer to the wired rewrite session is possible by determining that the transfer to the wired rewrite session is possible according to the rewrite exclusive process when the wired rewrite request is generated (S12: "Yes"), the first state is transferred from the default session to the wired rewrite session via the wired diagnostic session (S13), the vehicle control process is interrupted, and the wired rewrite process is started (S14). The microcomputer 30 ends the vehicle control program along with the transfer of the wired rewrite session.

[0100] The microcomputer 30 determines whether the completion condition of the wired rewrite process is satisfied (S15). If it is determined that the completion condition of the wired rewrite process is satisfied (S15: Yes), the wired rewrite process is completed (S16), and the first state is transferred from the wired rewrite session to the default session (S17). Here, the completion condition of the wired rewrite process is, for example, that the writing of the application program is completely completed and the integrity verification is performed.

[0101] If the microcomputer 30 determines that the state transition cannot be made to the wired rewrite session by determining that the state transition cannot be made to the wired rewrite session according to the rewrite exclusive processing when the wired rewrite request is generated (S12: "No"), the first state is not transitioned from the default session to the wired rewrite session via the wired diagnostic session. That is, the microcomputer 30 maintains the first state in the default session. If the microcomputer 30 determines that the completion condition of the state transition management is satisfied (S5: "Yes"), the state transition management processing of the first state is completed.

[0102] In addition, the above describes a situation in which the microcomputer 30 interrupts the wireless rewriting in the second state if it is determined that the microcomputer 30 is in the process of transferring to a wireless rewriting session in the second state and it is determined that the wired rewriting session priority condition is met during the rewrite exclusive processing when a wired rewriting request is generated. However, it is also possible to determine whether to interrupt the wireless rewriting session based on the unrewritten remaining amount of the wireless rewrite.

[0103] like Fig.17 As shown, if the microcomputer 30 determines that the wireless rewrite session is being transferred in the second state (S21: "Yes"), and determines that the wired rewrite session priority condition is satisfied (S23: "Yes"), it determines whether the remaining amount of wireless rewrite that has not been rewritten in the wireless rewrite session being transferred is greater than a prescribed amount (for example, greater than 20%) (S31). If the microcomputer 30 determines that the remaining amount of wireless rewrite that has not been rewritten is greater than the prescribed amount (S31: "Yes"), the second state is transferred from the wireless rewrite session to the default session, and the wireless rewrite is interrupted (S26). The microcomputer 30 ends the wireless rewrite program along with the transfer to the default session. If the microcomputer 30 determines that the remaining amount of wireless rewrite that has not been rewritten is not greater than the prescribed amount (S31: "No"), the wired rewrite request is discarded and the wireless rewrite is continued (S27). That is, if the remaining time until the wireless rewriting is completed is relatively long, the microcomputer 30 interrupts the wireless rewriting session, but if the remaining time until the wireless rewriting is completed is relatively short, the microcomputer 30 continues the wireless rewriting session without interruption.

[0104] (2) State Transition Management Processing of the Second State

[0105] When the microcomputer 30 detects that the power supply is turned on and starts, and starts the state transition management process of the second state, it determines the rewrite completion flag to determine whether the rewrite of the previous application program has been completed normally (S41). When the microcomputer 30 determines that the rewrite completion flag is positive and the rewrite of the previous application program has been completed normally (S41: "Yes"), it makes the second state transition to the default session (S42). That is, the microcomputer 30 executes the vehicle control program and starts the vehicle control process by making the second state transition to the default session.

[0106] When the microcomputer 30 starts the vehicle control process, it determines whether a wireless rewrite request is generated (S43), and determines whether the completion condition of the state transition management is satisfied (S44). When the microcomputer 30 determines that a wireless rewrite request is generated while the vehicle control process is being executed (S43: "Yes"), it starts the rewrite exclusive process when the wireless rewrite request is generated (S44). When the microcomputer 30 starts the rewrite exclusive process when the wireless rewrite request is generated, it determines whether the first state is a wired rewrite session or not in the first state. In other words, it determines whether the first state is a wired rewrite session (S61). When the microcomputer 30 determines that the first state is not in the process of transitioning to the wired rewrite session (S61: "No"), it determines that the transition to the wireless rewrite session is possible (S62). The microcomputer 30 ends the rewrite exclusive process when the wireless rewrite request is generated, and returns to the state transition management process of the second state.

[0107] If the microcomputer 30 determines that the transition to the wired rewriting session is in progress in the first state (S61: Yes), it determines which of the wired rewriting session and the wireless rewriting session is to be given priority for exclusive control. Specifically, the microcomputer 30 determines which of the wireless rewriting session priority condition, the wired rewriting session priority condition, and the rewriting session priority condition in transition is satisfied (S63 to S65).

[0108] If the microcomputer 30 determines that the wireless rewrite session priority condition is satisfied (S63: Yes), the microcomputer 30 transfers the wired rewrite session to the default session and interrupts the wired rewrite in the first state through the session recovery request (S66), and determines that the second state can be transferred to the wireless rewrite session (S62). The microcomputer 30 terminates the wired rewrite program along with the transfer to the default session. The microcomputer 30 terminates the rewrite exclusive processing when the wireless rewrite request is generated, and returns to the state transition management processing of the second state.

[0109] If the microcomputer 30 determines that the wired rewrite session priority condition is satisfied (S64: Yes), the microcomputer 30 discards the wireless rewrite request and continues the wired rewrite (S67). That is, the microcomputer 30 maintains the first state with the wired rewrite session, continues the execution of the wired rewrite program, and determines that the second state cannot be transferred to the wireless rewrite session (S68). The microcomputer 30 ends the rewrite exclusive processing when the wireless rewrite request is generated, and returns to the state transition management processing of the second state.

[0110] If the microcomputer 30 determines that the rewrite session priority condition during the transfer is satisfied (S65: "Yes"), then in this case, the wireless rewrite request is also discarded and the wired rewrite is continued (S67). That is, the microcomputer 30 maintains the first state with the wired rewrite session, continues the execution of the wired rewrite program, and determines that the second state cannot be transferred to the wireless rewrite session (S68). The microcomputer 30 ends the rewrite exclusive processing when the wireless rewrite request is generated, and returns to the state transition management processing of the second state. By executing the rewrite exclusive processing when the wireless rewrite request is generated in this way, the microcomputer 30 exclusively controls the wired rewrite session and the wireless rewrite session, and does not establish the sessions at the same time.

[0111] When the microcomputer 30 returns to the state transition management process of the second state, it determines whether the result of the rewrite exclusive process when the wireless rewrite request is generated is that the wireless rewrite session can be transferred (S45). When the microcomputer 30 determines that the wireless rewrite session can be transferred according to the rewrite exclusive process when the wireless rewrite request is generated, and determines that the transfer is possible (S45: "Yes"), the second state is transferred from the default session to the wireless rewrite session (S46), and the wireless rewrite program is executed to start the wireless rewrite process (S47). The microcomputer 30 determines whether the completion condition of the wireless rewrite process is satisfied (S48), and if it is determined that the completion condition of the wireless rewrite process is satisfied (S48: "Yes"), the wireless rewrite process is terminated (S49), and the second state is transferred from the wireless rewrite session to the default session (S50). The microcomputer 30 terminates the wireless rewrite program along with the transfer to the default session. Here, the completion condition of the wireless rewrite process is, for example, that the writing of the application program is completed and the integrity verification is performed.

[0112] If the microcomputer 30 determines that the state cannot be transferred to the wireless rewrite session by the rewrite exclusive processing when the wireless rewrite request is generated (S45: "No"), the second state is not transferred from the default session to the wireless rewrite session. In other words, the microcomputer 30 maintains the second state in the default session. If the microcomputer 30 determines that the completion condition of the state transition management is satisfied (S51: "Yes"), the state transition management processing of the second state is terminated.

[0113] In the above, the case where the program related to the special processing of the wired method and the program related to the special processing of the wireless method can be independently (simultaneously) executed in the application execution unit 34 is described. Fig. 20As shown, it is also possible to have a structure that shares a wired diagnostic program and a wireless diagnostic program. It is a structure in which the vehicle control program is configured as the first program in the application area, and the diagnostic program (wired diagnostic program and wireless diagnostic program) and the wireless rewriting program are configured as the second program in the application area. The wired rewriting program can also be configured as the second program in the application area, and can also be configured as the third program in the boot area. The application execution unit 34 enables the first program and the second program to be executed simultaneously. That is, the application execution unit 34 controls so that the vehicle control program and the shared diagnostic program can be executed simultaneously. On the other hand, the application execution unit 34 exclusively controls the execution of each program that constitutes the second program. That is, control is performed so that only any one of the wired diagnostic program, the wireless diagnostic program, the wireless rewriting program, and the wired rewriting program is operated.

[0114] The application execution unit 34 is as follows Fig.21 As shown, the default state (default session), the diagnostic state (diagnostic session), the wired override state (wired override session), and the wireless override state (wireless override session) are managed as states to manage the internal state of the action. The state managed here is not managed independently by wired and wireless, but is managed as a mixed state.

[0115] In this structure, the application execution unit 34 also starts the execution of the diagnostic program while executing the vehicle control program. In addition, the application execution unit 34 starts the execution of the wireless rewriting program or the wired rewriting program while executing the vehicle control program. On the other hand, the application execution unit 34 exclusively controls the execution of the wireless diagnostic program and the wired diagnostic program. In addition, the application execution unit 34 also exclusively controls the execution of the wired / wireless diagnostic program and the wired / wireless rewriting program. That is, the application execution unit 34 exclusively controls the execution of each program constituting the second program.

[0116] Here, when the wired rewrite program is placed in the boot area as the third program, the application execution unit 34 exclusively controls the execution of the third program and the first and second programs. That is, when the wired rewrite program is executed, the first and second programs are terminated and the operation is performed in the dedicated mode.

[0117] like Fig.21 As shown, if a diagnostic request is generated, the application execution unit 34 transfers to the diagnostic session while continuing the execution of the vehicle control program and starts the execution of the diagnostic program. In this state, if a wireless rewrite request is generated, the application execution unit 34 ends the diagnostic program, transfers to the wireless rewrite session, and starts the execution of the wireless rewrite program. The execution of the vehicle control program continues. On the other hand, in the case of a wired rewrite request, the application execution unit 34 ends the diagnostic program and the vehicle control program, transfers to the wired rewrite session, and starts the execution of the wired rewrite program.

[0118] Even if the wireless rewriting program is configured inside the diagnostic program, when the vehicle control program and the diagnostic program are being executed, the application execution unit 34 starts the execution of the wireless rewriting program after interrupting the execution of the vehicle control program and the diagnostic program. In addition, the processing can be continued without accompanying the session.

[0119] If the wired rewrite program is configured outside the diagnostic program, when the diagnostic session state is transferred to the wired rewrite session state while the vehicle control program and the diagnostic program are being executed, the application execution unit 34 stops the execution of the vehicle control program and the wireless diagnostic program and starts the execution of the wired rewrite program. That is, the application execution unit 34 cannot simultaneously execute vehicle control, wired or wireless diagnosis of the ECUs 19 to 21, and wired application rewrite, but can only execute wired application rewrite.

[0120] As described above, according to this embodiment, the following effects can be obtained.

[0121] In ECU19-21, the state transition management process of the first state and the state transition management process of the second state are executed to manage the state transition of each session in the first state and the second state, and the default session or wired diagnostic session of the first state and the wireless rewrite session of the second state are established non-exclusively (session establishment step is performed). Control can be performed so that the vehicle control program or the diagnostic program and the wireless rewrite program of ECU19-21 are non-exclusively executed in response to the request for rewriting of the vehicle control or ECU19-21 and the wireless program, and mediation can be appropriately performed in response to various requests from the outside.

[0122] In addition, the wired rewrite session and the wireless rewrite session are exclusively established in the ECUs 19 to 21. Control can be performed so that the wired rewrite program and the wireless rewrite program are exclusively executed, and the wired rewrite and the wireless rewrite can be appropriately mediated.

[0123] In addition, in ECUs 19 to 21, if the wired rewrite session priority condition is satisfied, the wired rewrite session is prioritized over the wireless rewrite session. By setting the wired rewrite session priority condition in advance, the wired program rewrite can be prioritized over the wireless program rewrite. For example, the wired program rewrite instructed by a maintenance worker such as a dealer can be prioritized over the wireless program rewrite instructed by the user of the vehicle.

[0124] In addition, in ECUs 19 to 21, if the wireless rewrite session priority condition is satisfied, the wireless rewrite session is prioritized over the wired rewrite session. By setting the wireless rewrite session priority condition in advance, the wireless program rewrite can be prioritized over the wired program rewrite. For example, the wireless program rewrite instructed by the user of the vehicle can be prioritized over the wired program rewrite instructed by a maintenance worker such as a dealer.

[0125] In addition, in ECUs 19 to 21, if the rewriting session priority condition during transfer is satisfied, the rewriting session during transfer is prioritized. By setting the rewriting session priority condition during transfer in advance, the rewriting during transfer can be performed preferentially. That is, the wired rewriting and the wireless rewriting, whichever started first, can be continued without interruption.

[0126] In the structure with application areas on both sides, the vehicle control program, the diagnostic program, and the wireless rewrite program are arranged in each application area, and the vehicle control program or the diagnostic program and the wireless rewrite program are executed in parallel (simultaneously). By making an effort on the memory structure of the flash memory 30d, the vehicle control program or the diagnostic program and the wireless rewrite program can be executed in parallel.

[0127] If a wireless rewrite request is determined while the vehicle control program or the wired diagnostic program is being executed, the vehicle control program or the wired diagnostic program is continued to be executed and the wireless rewrite program is executed. When a wireless rewrite request is generated while the vehicle control program or the wired diagnostic program is being executed, the vehicle control program or the wired diagnostic program and the wireless rewrite program can be executed in parallel (simultaneously).

[0128] If a vehicle control request or a wired diagnostic request is determined while the wireless rewrite program is being executed, the execution of the wireless rewrite program is continued and the vehicle control program or the wired diagnostic program is executed. When a vehicle control request or a wired diagnostic request is generated while the wireless rewrite program is being executed, the wireless rewrite program and the vehicle control program or the wired diagnostic program can be executed in parallel (simultaneously).

[0129] If a wired rewrite request is determined while the vehicle control program or the wireless diagnostic program is being executed, the execution of the vehicle control program or the wireless diagnostic program is stopped and the wired rewrite program is executed. When a wired rewrite request is generated while the vehicle control program or the wireless diagnostic program is being executed, only the wired rewrite program can be executed exclusively.

[0130] In the case of a rewrite firmware built-in type having rewrite firmware built-in, the rewrite program is executed using the firmware arranged in the application area, and the rewrite process of the application program not on the operation side can be executed without downloading the rewrite firmware from the outside.

[0131] In the case of a rewrite firmware download type in which the rewrite firmware is downloaded from the outside, the rewrite program is executed using the firmware downloaded from the outside. The capacity of the rewrite program in the application area can be reduced, and the rewrite process of the application program not on the operation side can be executed.

[0132] The present disclosure is described according to the embodiments, but it should be understood that it is not limited to the embodiments and structures. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations or methods, further making them include only one element, other combinations or methods above or below them also fall within the scope and thought range of the present disclosure.

[0133] The control unit and its methods described in the present disclosure may also be implemented by a special-purpose computer, which is provided by constituting a processor and a memory programmed to execute one or more functions concretized by a computer program. Alternatively, the control unit and its methods described in the present disclosure may also be implemented by a special-purpose computer, which is provided by constituting a processor using one or more special-purpose hardware logic circuits. Alternatively, the control unit and its methods described in the present disclosure may also be implemented by one or more special-purpose computers, which are constituted by a combination of a processor and a memory programmed to execute one or more functions, and a processor including one or more hardware logic circuits. In addition, the computer program may also be stored in a computer-readable non-transitional tangible recording medium as instructions executed by a computer.

[0134] Although the double-sided memory having application areas on both actual sides has been described, the present invention can also be applied to a single-sided suspend type memory or an external memory having application areas on both pseudo sides.

[0135] Although the description has been given of a case of differential rewriting in which new data is generated from old data and differential rewrite data, the invention can also be applied to a case of full rewriting in which old data is deleted and new data is written.

[0136] The case of rewriting the application programs of ECU 19 to 21 has been described, but the application can also be applied to the case of rewriting the application programs of CGW 13. That is, the flash memory 26d of CGW 13 can also be made into a double-sided structure and have the same structure as the flash memory 30d of ECU 19 to 21, so that the microcomputer 26 has the same function as the microcomputer 30 of ECU 19 to 21.

Claims

1. An electronic control device, wherein: The electronic control device comprises an application execution unit. The application execution unit has a first default session, a wired diagnostic session, and a wired rewrite session as a first state, the wired diagnostic session being used to diagnose an electronic control device from outside the vehicle via wire, the wired rewrite session being used to rewrite the electronic control device using a program acquired from outside the vehicle via wire, the application execution unit making a state transition to the wired diagnostic session based on a request indicating a diagnosis via wire, and making a state transition to the wired rewrite session based on a request indicating a rewrite via wire, The application execution unit has a second default session and a wireless rewrite session as a second state, the wireless rewrite session being used to rewrite the electronic control device using a program acquired from outside the vehicle via wireless, and the application execution unit transitions to the wireless rewrite session based on a request indicating rewriting via wireless. The application execution unit independently manages the first state and the second state, and non-exclusively establishes the wireless rewrite session and the first default session or the wired diagnostic session.

2. The electronic control device according to claim 1, wherein: The application execution unit has a wireless diagnostic session as the second state, the wireless diagnostic session being used to diagnose the electronic control device wirelessly from outside the vehicle, and the application execution unit transitions to the wireless diagnostic session based on a request for wireless diagnosis.

3. The electronic control device according to claim 1 or 2, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session.

4. The electronic control device according to claim 3, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session so that the wired rewriting session takes priority over the wireless rewriting session.

5. The electronic control device according to claim 3, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session so that the wireless rewriting session takes precedence over the wired rewriting session.

6. The electronic control device according to claim 3, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session so that the rewriting session in transition is prioritized between the wired rewriting session and the wireless rewriting session.

7. An electronic control device mounted on a vehicle capable of communicating with a tool outside the vehicle by wire and with a server outside the vehicle by wireless, and updating a program stored in a memory of the device itself, wherein: The electronic control device comprises an application execution unit. The application execution unit has a default session, a diagnostic session, a wired rewrite session, and a wireless rewrite session as states, the diagnostic session being used to diagnose the electronic control device from outside the vehicle via wire or wireless, the wired rewrite session being used to rewrite the electronic control device using a program acquired from outside the vehicle via wire, and the wireless rewrite session being used to rewrite the electronic control device using a program acquired from outside the vehicle via wireless, The application execution unit performs a state transition to the diagnostic session based on a request for diagnosis via wired or wireless communication, maintains the diagnostic session and executes the request for diagnosis, and terminates the execution of the request for diagnosis along with a state transition to a session other than the diagnostic session. The application execution unit performs a state transition to the wired rewrite session based on the request for rewriting via wire, executes the request for rewriting via wire while maintaining the wired rewrite session, and terminates the execution of the request for rewriting via wire along with a state transition to a session other than the wired rewrite session. the application execution unit performs a state transition to the wireless rewrite session based on the request for rewriting via wireless, executes the request for rewriting via wireless while maintaining the wireless rewrite session, and terminates the execution of the request for rewriting via wireless along with the state transition to a session other than the wireless rewrite session. The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session.

8. The electronic control device according to claim 7, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session so that the wired rewriting session takes priority over the wireless rewriting session.

9. The electronic control device according to claim 7, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session so that the wireless rewriting session takes precedence over the wired rewriting session.

10. The electronic control device according to claim 7, wherein: The application execution unit exclusively establishes the wired rewriting session and the wireless rewriting session so that the rewriting session in transition is prioritized between the wired rewriting session and the wireless rewriting session.

11. An electronic control device comprising: A non-transitional physical storage medium having application areas on a plurality of surfaces, wherein a first program, a second program, and a third program are stored in each application area, wherein the first program includes a vehicle control program for controlling a vehicle, the second program includes a wired diagnostic program for diagnosing an electronic control device from outside the vehicle via wire, and the third program includes a wireless diagnostic program for diagnosing an electronic control device from outside the vehicle via wireless and a wireless rewrite program for rewriting the electronic control device using a program acquired from outside the vehicle via wireless; and an application execution unit, controlling the execution of the first program, the second program, and the third program, The application execution unit performs control so that the wireless diagnostic program and the wireless rewriting program are exclusively executed, and performs control so that the first program, the second program, and the third program are non-exclusively executed.

12. The electronic control device according to claim 11, wherein: The non-transitional physical storage medium stores a fourth program, the fourth program including a wired rewriting program for rewriting the electronic control device using a program acquired from outside the vehicle via a wire. The application execution unit performs control so that the third program and the fourth program are exclusively executed.

13. The electronic control device according to claim 12, wherein: The electronic control device includes a wired rewrite request determination unit that determines a wired rewrite request for rewriting the electronic control device using a program acquired from outside the vehicle via a wire. When the wired rewrite request determination unit determines the wired rewrite request, the application execution unit stops execution of the first program, the second program, and the third program, and executes the fourth program.

14. The electronic control device according to claim 12 or 13, wherein: The first program, the second program, and the third program are stored in respective application areas of the non-transitional physical storage medium in a rewritable manner, and the fourth program is stored in the non-transitional physical storage medium in a non-rewritable manner.

15. An electronic control device comprising: A non-transitional physical storage medium having application areas on a plurality of surfaces, wherein each application area stores a first program and a second program, wherein the first program includes a vehicle control program for controlling a vehicle, and the second program includes a wired diagnostic program for diagnosing an electronic control device from outside the vehicle via wire, a wireless diagnostic program for diagnosing an electronic control device from outside the vehicle via wireless, and a wireless rewrite program for rewriting the electronic control device using a program obtained from outside the vehicle via wireless; and an application execution unit, controlling the execution of the first program and the second program, The application execution unit performs control so that the wired diagnostic program, the wireless diagnostic program, and the wireless rewriting program are exclusively executed, and performs control so that the first program and the second program are non-exclusively executed.

16. The electronic control device according to claim 15, wherein: The non-transitional physical storage medium stores a third program, the third program including a wired rewriting program for rewriting the electronic control device using a program acquired from outside the vehicle via a wire. The application execution unit performs control so that the second program and the third program are exclusively executed.

17. The electronic control device according to claim 16, wherein: The electronic control device includes a wired rewrite request determination unit that determines a wired rewrite request for rewriting the electronic control device using a program acquired from outside the vehicle via a wire. When the wired rewrite request determination unit determines the wired rewrite request, the application execution unit performs control so as to stop execution of the first program and the second program and execute the third program.

18. The electronic control device according to claim 16 or 17, wherein: The first program and the second program are stored in the application areas of the non-transitional physical storage medium in a rewritable manner, and the third program is stored in the non-transitional physical storage medium in a non-rewritable manner.

19. A storage medium storing a session establishment program, The above-mentioned session establishment program causes the electronic control device to execute a session establishment step, wherein: The electronic control device has a first default session, a wired diagnostic session, and a wired rewrite session as a first state, the wired diagnostic session is used to diagnose the electronic control device from outside the vehicle via wire, the wired rewrite session is used to rewrite the electronic control device using a program obtained from outside the vehicle via wire, the electronic control device performs state transition to the wired diagnostic session based on a request indicating diagnosis via wire, and performs state transition to the wired rewrite session based on a request indicating rewrite via wire, The electronic control device has a second default session and a wireless rewrite session as a second state, the wireless rewrite session is used to rewrite the electronic control device using a program acquired from outside the vehicle via wireless, and the electronic control device performs state transition to the wireless rewrite session based on a request indicating rewriting via wireless. In the session establishing step, the electronic control device independently manages the first state and the second state, and non-exclusively establishes the wireless rewrite session and the first default session or the wired diagnostic session.

20. A storage medium storing a session establishment program, The session establishment program causes an electronic control device mounted on a vehicle capable of communicating with a tool outside the vehicle by wire and with a server outside the vehicle by wireless to execute a session establishment step, and updates a program stored in a memory of the device itself, wherein: The electronic control device has a default session, a diagnostic session, a wired rewrite session, and a wireless rewrite session as states, the diagnostic session being used to diagnose the electronic control device from outside the vehicle via wire or wireless, the wired rewrite session being used to rewrite the electronic control device using a program acquired from outside the vehicle via wire, and the wireless rewrite session being used to rewrite the electronic control device using a program acquired from outside the vehicle via wireless. The electronic control device performs a state transition to the diagnostic session based on a request for diagnosis via wired or wireless communication, maintains the diagnostic session and executes the request for diagnosis, and terminates the execution of the request for diagnosis along with a state transition to a session other than the diagnostic session. The electronic control device performs a state transition to the wired rewrite session based on a request for rewriting via wire, executes the request for rewriting via wire while maintaining the wired rewrite session, and terminates execution of the request for rewriting via wire along with a state transition to a session other than the wired rewrite session. The electronic control device performs a state transition to the wireless rewrite session based on the request for rewriting via wireless, executes the request for rewriting via wireless while maintaining the wireless rewrite session, and terminates the execution of the request for rewriting via wireless along with a state transition to a session other than the wireless rewrite session. In the session establishing step, the electronic control device exclusively establishes the wired rewrite session and the wireless rewrite session.

Images