Electronic control unit

Abstract

An electronic control unit connected to a vehicle network (7, 8), comprising: - a memory (1a, 2a, 2b, 3a, 3b, 4a, 5a) configured to accumulate a program or data exchanged with an external device (9 to 11) or in the vehicle network; - a writing section (12b, 14b) configured to write a program or data into the memory; - a management data storage section (12c, 14c) configured to store memory management data indicating a usage status of writing a program or data into the memory; - a management data updating section (12d, 14d) configured to update the memory management data each time a program or data is written into the memory;- a state confirmation request receiving section (14e) configured to receive a memory state confirmation request from a memory management unit (1); and - a management data transmitting section (14g) configured to transmit the memory management data to the memory management unit when the memory state confirmation request is received from the memory management unit, wherein - the management data storing section stores the memory management data in dual areas consisting of a first area and a second area, and stores flag information indicating whether the memory management data stored in the first area or the memory management data stored in the second area is valid;and- when the memory management data is updated, the management data updating section updates (i) the memory management data stored in the first area or (ii) the memory management data stored in the second area in accordance with the flag information, whichever is older;

Description

FIELD OF THE INVENTIONThe present invention relates to an electronic control unit.PRIOR ARTJP 2017-011 374 A, for example, discloses a configuration of an electronic control unit that is connected to a vehicle network and writes and accumulates a program or data exchanged with an external device or within a vehicle network.The above configuration involves a risk that writing of a program or data to a specific memory concentrates. Such a particular memory to which writing focuses experiences physical degradation earlier than other memories. This includes data corruption or data omission in the written program or data depending on the written capacity even if a vehicle guarantee time has not yet elapsed; there is a possibility that the written program or data cannot be guaranteed. Moreover, when writing concentrates on a certain memory with a high internal processing load, the execution of the internal processing may delay; there may be a risk that the internal processing may be prolonged. Accordingly, in view of the above-described problem, there is a need for a countermeasure that avoids a risk that writing of a program or data to a specific memory concentrates.US 2017 / 0 003 890 A1 also discloses a data processing system having a management device and a plurality of data processing devices. Each data processing device includes a memory that is a NAND flash memory. Each computing device communicates status data indicative of a number of data rewrites to the memory of the host device to the management device. The management device allocates data processing to the data processing device having the least number of data rewrites indicated by the received status data.It is an object of the present invention to provide an electronic control unit that can avoid a risk that writing of a program or data to a specific memory will concentrate.The object is achieved by the subject matter of the main claim. Advantageous refinements are specified in the dependent claims.According to the present invention, each time a program or data is written into a memory, the electronic control unit updates memory management data indicating a usage state of writing the program or data into the memory. When a storage state confirmation request is received from the storage management unit, the electronic control unit transmits the storage management data to the storage management unit. The storage management unit may analyze the storage management data received from the electronic control unit so as to perform overall management of the usage state of writing a program or data to a memory or memories connected to the vehicle network.This configuration enables appropriate control of an accumulation target that accumulates a program or data to compensate for writing of the program or data, while avoiding a situation in which writing of a program or data concentrates on a specific memory. This can avoid a situation in which physical deterioration of the specific memory progresses more quickly than other memories, while ensuring that a program or data is appropriately written. Moreover, a situation in which writing of a program or data concentrates on a high load of internal processing can be avoided, while a situation in which the processing time of internal processing increases can be avoided.BRIEF DESCRIPTION OF THE DRAWINGSFIG. 1 is a diagram illustrating configurations of an electronic control unit and peripherals according to an embodiment; FIG. 2 is a functional block diagram; FIG. 3 is a diagram illustrating a storage structure of a master node; FIG. 4 is a diagram illustrating storage management data of a master node; FIG. 5 is a diagram illustrating a storage structure of a slave node; FIG. 6 is a diagram illustrating storage management data of a slave node; FIG. 7 is a flowchart illustrating a writing process; FIG. 8 is a flowchart illustrating a transmission process of a storage state confirmation request; FIG. 9 is a flowchart illustrating a transmission process of an accumulation target change request; FIG. 10 is a flowchart illustrating a reception process of a storage state confirmation request; and FIG. 11 is a flowchart illustrating a reception process of an accumulation target change request.DETAILED DESCRIPTIONHereinafter, an embodiment of the present invention will be described with reference to drawings. As shown in FIG. 1, a plurality of electronic control units 1 to 5 (also referred to as ECUs 1 to 5) and an in-vehicle communication unit 6 are mounted in a vehicle. In the vehicle, the electronic control units 1 to 5 each serve as a node, and the electronic control units 1 to 5 each have a memory that stores a program or data. The electronic control unit 1 has a memory 1 a. The electronic control unit 2 includes a memory 2 aand a memory 2 b. The electronic control unit 3 includes a memory 3 aand a memory 3 b. The electronic control unit 4 has a memory 4 a. The electronic control unit 5 has a memory 5 a. The number of memories provided in each of the electronic control units 1 to 5 or the capacity of each memory in each of the electronic control units 1 to 5 may be changed as needed.The electronic control unit 1 is connected to the electronic control units 2 and 3 via a communication bus 7 (synonymous with a vehicle network) and is connected to the electronic control units 4 and 5 via a communication bus 8 (synonymous with a vehicle network). The electronic control unit 1, which may be a gateway ECU, has a relay function that relays a program or data between the electronic control units 2 to 5. The electronic control unit 1 serves as a master node (equivalent to a memory management unit) that performs overall management of the usage state of writing programs or data to a memory or memories connected to the communication buses 7 and 8.The electronic control units 2 to 5 each serve as a slave node whose usage state of writing programs or data to the memory or the memories is managed by the electronic control unit 1 serving as a master node. Each of the electronic control units 2 to 5 may be an engine ECU that controls an engine; a brake ECU that controls a brake; a steering wheel ECU that controls steering; a transmission ECU that controls an automatic transmission; a navigation ECU that controls a navigation device; an ETC ECU that controls communication with an electronic toll (ETC or electronic toll collect) system; a door ECU that controls locking / unlocking of doors; a meter ECU that controls display of a meter; an air conditioner ECU that controls an air conditioner; or a window ECU that controls opening or closing of windows.Each of the communication buses 7 and 8 may be a communication bus of a multimedia system; a communication bus of a powertrain system; or a communication bus of a body system. Each of the communication buses 7 and 8 may be configured as a CAN (Controller Area Network, registered trademark); a LIN (Local Interconnect Network); a CXPI (Clock Extension Peripheral Interface, registered trademark); a FlexRay (registered trademark); or a MOST (Media Oriented Systems Transport, registered trademark). The communication buses 7 and 8 have respective communication protocols, transmission speeds or signal formats which may be the same as or different from each other. Moreover, the number of the electronic control units or the number of the communication buses is not limited to the exemplary configurations.The electronic control unit 1 exchanges (i.e., sends and receives) a program or data with a vehicle diagnostic apparatus 9 (equivalent to an external device) when a wired connection to the vehicle diagnostic apparatus 9 is established via a distribution cable connected to a connector of the vehicle body. The vehicle diagnostic apparatus 9 is an apparatus operated by an operator to perform a diagnosis of the vehicle.Further, the electronic control unit 1 exchanges a program or data with the in-vehicle communication unit 6. The in-vehicle communication unit 6 exchanges a program or data with a cloud 10 (synonymous with an external device) when a wireless connection is established to the cloud 10 via a wide area network. The cloud 10 has a central terminal (data station) or a server. The in-vehicle communication unit 6 exchanges a program or data with a vehicle connection terminal 11 (equivalent to an external device) when a wireless connection to the vehicle connection terminal 11 is established via a short-range wireless communication network. The vehicle connection terminal 11 includes a smartphone or a tablet that a user can carry with him. Hereinafter, the vehicle diagnostic apparatus 9, the cloud 10, or the vehicle connection terminal 11 are collectively referred to as an external device 9 to 11.Configurations of the electronic control units 1 to 5 will be described below. The electronic control units 2 to 5 serving as slave nodes each have substantially an identical configuration; thus, the electronic control unit 2 is used as representative for the description. That is, the electronic control unit 1 and the electronic control unit 2 are described as an example of a relationship between a master node and a slave node. Such a relationship is similarly applied to the relationship between the electronic control unit 1 and each of the electronic control units 3 to 5. Moreover, the description of the memory 2 aof the electronic control unit 2 is applied to the memory 2 bin the same manner.As shown in FIG. 2, the electronic control unit 1 serving as a master node includes a microcomputer 12. The microcomputer 12 having a CPU, a RAM, a ROM, and an I / O port has internal functions achieved by software programs such as a transmission and reception section 12 a, a writing section 12 b, a management data storage section 12 c, a management data update section 12 d, a state confirmation request transmission section 12 e, a management data reception section 12 f, an accumulation target change section 12 g, and an accumulation target change request transmission section 12 h.As shown in FIG. 3, the memory 1 aof the electronic control unit 4 includes: a control use storage area 13 athat stores control programs, control data, or rewrite programs; an area 13 bthat is dedicated to accumulation (hereinafter, referred to as an accumulation area) and stores (i.e., accumulates) programs or data; a storage area 13 cthat stores first memory management data; a storage area 13 dthat stores second memory management data; and a storage area 13 ethat stores the flag information (also referred to as a flag state).The first storage management data stored in the storage area 13 cand the second storage management data stored in the storage area 13 dare data indicating the usage state of writing programs or data regarding all the memories of the electronic control units 1 to 5 of all the nodes connected to the communication buses 7 and 8, respectively. As shown in FIG. 4, the first storage management data and the second storage management data are data including (i) an aggregate usage total capacity that is a total capacity usable for accumulating programs or data, and (ii) a written total capacity that is a total capacity of programs or data written up to the current time (i.e., in the past). The total accumulation usage capacity is a capacity indicated by a value obtained by multiplying a capacity of the accumulation region 13 bby the number of times of rewriting possible in the entire lifetime. That is, when the total written capacity is relatively small as compared with the total accumulation usage capacity, and the frequency of usage in the memories is thus relatively small, the written program or data can be guaranteed. On the other hand, when the total written capacity is relatively high compared with the total accumulation use capacity and the frequency of use in the memories is thus relatively high, the written program or data cannot be guaranteed. The numerical values of the total accumulation usage capacity and the total written capacity shown in FIG. 4 are merely examples.The transmitting and receiving section 12 atransmits and receives a program or data via the communication buses 7 and 8, so as to transmit the data on a vehicle state or a control history from the vehicle to the external devices 9 to 11 and receive the program or data on a vehicle control from the external devices 9 to 11 to the vehicle.The writing section 12 bwrites and accumulates programs or data transmitted or received by the transmitting and receiving section 12 ain the / accumulating area 13 bof the memory 1 a. Such a program or data is also referred to as a write destination. In this case, the writing section 12 bwrites and accumulates programs or data in respective blocks of the memory 1 ato prevent the writing and accumulating of the programs or data from concentrating on a specific block of the blocks of the memory 1 a.The management data storage section 12 cis configured to have the storage areas 13 c, 13 d, 13 eof the memory 1 a, and stores the first storage management data and the second storage management data together with the flag information. That is, the management data storage section 12c stores the storage management data in dual areas consisting of a first area 13c and a second area 13d.Each time a program or data is written in the accumulation area 13 bof the memory 1 a, the management data update section 12 dupdates the storage content of the memory 1 ain the storage management data stored in the storage areas 13 cand 13 din accordance with the flag information stored in the storage area 13 e. The management data updating section 12 ddetermines the older time stamp or the newer time stamp of the update with respect to the storage management data on the basis of the flag information. The management data updating section 12 dupdates the storage management data with the older time stamp in accordance with the capacity of the written program or the written data in the accumulation area 13 bof the memory 1 a.The state confirmation request transmission section 12 etransmits a storage state confirmation request to the electronic control units 2 to 5 that are slave nodes via the communication buses 7 and 8. As a transmission destination of the storage state confirmation request, the state confirmation request transmission section 12 emay select all of the electronic control units 2 to 5 connected to the communication buses 7 and 8, or only a predetermined restricted one or some of the electronic control units 2 to 5 connected to the communication buses 7 and 8.The management data receiving section 12 freceeds the storage management data transmitted from the electronic control units 2 to 5. When the storage management data transmitted from the electronic control units 2 to 5 is received, the management data updating section 12 dupdates the storage content of the memory of the transmission source among the storage management data stored in the storage areas 13 cand 13 din accordance with the flag information stored in the storage area 13 e. For example, when receiving the storage management data regarding the memory 2 atransmitted from the electronic control unit 2, the management data updating section 12 dupdates the storage content of the memory 2 a, among the storage management data stored in the storage areas 13 cand 13 d, in accordance with the flag information stored in the storage area 13 e. In this case, likewise, the management data updating section 12 ddetermines the older time stamp or the newer time stamp of the update with respect to the storage management data on the basis of the flag information. The management data updating section 12 dupdates the storage management data of the older time stamp in accordance with the capacity of the written program or the written data in the accumulation area 13 bof the memory 1 a.When the storage management data is updated, the accumulation target changing section 12 gdetermines whether it is necessary to change a storage that is considered as an accumulation target of a program or data in accordance with the storage management data after the update (i.e., the updated storage management data). That is, the accumulation target changing section 12 gcalculates a difference between the total accumulation use capacity and the latest total written capacity; the difference is a writable capacity that is a capacity with which writing is possible from the current time point. The accumulation target changing section 12 gcalculates a ratio of the writable capacity to the total accumulation use capacity, determines or judges the distribution in the ratios for all of the memories connected to the communication buses 7 and 8, and determines whether it is necessary to change a memory serving as an accumulation target of a program or data. This memory, which serves as an accumulation target of a program or data, is also referred to as an accumulation target memory of a program or data.When the distribution is within a predetermined range, the accumulation target changing section 12 gdetermines that it is not necessary to change the storage of the accumulation target of a program or data. On the other hand, when the distribution is not within the predetermined range, the accumulation target changing section 12 gdetermines that it is necessary to change the storage of the accumulation target of a program or data. When it is determined that it is necessary to change the storage of the accumulation target of a program or data, the accumulation target changing section 12 gchanges the storage of the accumulation target to approximate the distribution within a predetermined range. That is, the accumulation target changing section 12g changes the storage of the accumulation target to approximate the distribution within a predetermined range, so as to avoid a situation in which writing of programs or data concentrates on a certain storage. In this case, the accumulation target changing section 12 gpreferably changes the storage of the accumulation target (i.e., the accumulation target storage) by selecting, as a new accumulation target storage, a new storage that can store a program or data having a data length identical to or equal to a multiple of a data length of a write target (i.e., a program or data exchanged with the external devices 9 to 11). Further, the accumulation target changing section 12 gmay determine whether it is necessary to change the storage of the accumulation target of a program or data, in a manner other than the calculation of the ratio of the writable capacity to the total accumulation use capacity.When the storage of the accumulation target of a program or data is changed, the accumulation target change request transmitting section 12 htransmits an accumulation target change request to one of the electronic control units 2 to 5 of the slave nodes via the communication buses 7 and 8, depending on which is determined to require the change of the storage of the accumulation target.The electronic control unit 2 of a slave node includes a microcomputer 14 including a CPU, a RAM, a ROM, and an I / O port. The electronic control unit 2 achieves the functions with software programs such as a transmission and reception section 14 a, a writing section 14 b, a management data storage section 14 c, a management data update section 14 d, a state confirmation request reception section 14 e, a storage resource determination section 14 f, a management data transmission section 14 g, an accumulation target change request reception section 14 h, and an accumulation target change section 14 i.As shown in FIG. 5, the memory 2 aof the electronic control unit 2 includes, like the memory 1 aof the electronic control unit 1, a control use storage area 15 athat stores control programs, control data, or rewrite programs; an accumulation area 15 bthat stores programs or data; a storage area 15 cthat stores first storage management data; a storage area 15 dthat stores second storage management data; and a storage area 15 ethat stores the flag information.As shown in FIG. 6, the first storage management data stored in the storage area 15 cand the second storage management data stored in the storage area 15 dare the data indicating a usage state of writing programs or data with respect to all the memories of the electronic control unit 2. Similarly, in this case, the first storage management data and the second storage management data are data including (i) a total accumulation usage capacity that is a total capacity that can be used to accumulate programs or data, and (ii) a total written capacity that is a total capacity of programs or data written up to the current time (i.e., in the past). The total accumulation usage capacity is a capacity indicated with a value obtained by multiplying a capacity of the accumulation area 15 bby the number of times of rewriting possible in an entire lifetime. That is, when the total written capacity is relatively small as compared with the total accumulation usage capacity, and the frequency of usage in the memories is thus relatively small, the written program or data can be guaranteed. On the other hand, when the total written capacity is relatively high compared with the total accumulation use capacity and the frequency of use in the memories is thus relatively high, the written program or data cannot be guaranteed. The numerical values of the total accumulation usage capacity and the total written capacity shown in FIG. 6 are merely examples.The transmitting and receiving section 14 achanges (i.e., transmits and receives) a program or data via the communication bus 7 so as to transmit the program or data on a vehicle state or a control history from the vehicle to the external device 9 to 11 and receive the program or data from the external device 9 to 11 to the vehicle via a vehicle controller.The writing section 14 bwrites and accumulates a program or data transmitted or received by the transmitting and receiving section 14 ain the / accumulating area 15 bof the memory 2 a. In this case, the writing section 14 bwrites and accumulates programs or data in respective / respective blocks / blocks of the memory 2 ato prevent the writing and accumulating of the programs or data from concentrating on a certain block among the blocks of the memory 2 a.The management data storage section 14 cis configured to have the storage areas 15 cto 15 eof the memory 2 a, and stores the first storage management data, the second storage management data, and the flag information. That is, the management data storage section 14c stores the storage management data in dual areas consisting of a first area 15c and a second area 15d.Each time a program or data is written in the accumulation area 15 bof the memory 2 a, the management data updating section 14 dupdates the storage content of the memory 2 awithin the storage management data stored in the storage areas 15 cand 15 din accordance with the flag information stored in the storage area 15 e. The management data updating section 14 ddetermines the older time stamp or the newer time stamp of the update with respect to the storage management data on the basis of the flag information. The management data updating section 14d updates the storage management data with the older time stamp in accordance with the capacity of the written program or the written data in the accumulating area 15b of the memory 2a.The state confirmation request receiving section 14 ereceeds the storage state confirmation request from the electronic control unit 1 of the master node via the communication bus 7. When the storage state confirmation request is received from the electronic control unit 1, the storage resource determination section 14 fdetermines whether there is a storage resource shared among the memories connected to the communication buses 7 and 8. That is, when unused storage capacity has an additional margin to the storage capacity used for the main control of the electronic control unit 2, the storage resource determination section 14 fdetermines that a shared storage resource is present. On the other hand, when unused storage capacity has no additional margin, the storage resource determination section 14 fdetermines that there is no shared storage resource.When it is determined that a shared storage resource is present, the management data transmission section 14 gtransmits the storage management data to the electronic control unit 1 together with a positive acknowledgement.The accumulation target change request receiving section 14 h receives the accumulation target change request from the electronic control unit 1 of the master node via the communication bus 7. when the accumulation target change request is received from the electronic control unit 1, the accumulation target changing section 14 ichanges the storage of the accumulation target of a program or data in accordance with the accumulation target change request.Next, operations in the above configuration will be described with reference to FIGS. 7 to 11. The description will be made in the case where the electronic control unit 1 sends a storage state confirmation request to the electronic control unit 2 and the electronic control unit 2 sends storage management data to the electronic control unit 1. More specifically, the description is made sequentially for (i) a writing process executed by both the microcomputer 12 of the electronic control unit 1 and the microcomputer 14 of the electronic control unit 2, (ii) a transmission process of a storage state confirmation request executed by the microcomputer 12, (iii) a transmission process of an accumulation target change request executed by the microcomputer 12, (iv) a reception process of a storage state confirmation request executed by the microcomputer 14, and (v) a reception process of an accumulation target change request executed by the microcomputer 14.(1) Writing ProcessAs shown in FIG. 7, when a writing process is started, in the electronic control unit 1 of a master node and the electronic control unit 2 of a slave node, the microcomputers 12 and 14 determine whether reception of a program or data as a writing destination has started (S 1). When it is determined that reception of a program or data of a write target has started (S 1: YES), the microcomputers 12 and 14 start writing a program or data of a write target in each memory (S 2), and the microcomputers 12 and 14 monitor completion of reception of the program or data of the write target (S 3). When the completion of the reception of the program or the data of the writing target is determined (S 3: YES), the microcomputers 12 and 14 stop the writing of the program or the data of the writing target into the respective memories (S 4).After the writing of the program or data is completed, the microcomputers 12 and 14 calculate the written capacity and the writing volume as a written capacity, respectively (S 5), and the microcomputers 12 and 14 determine the flag information at this time (S 6). Based on the determined flag information, the microcomputers 12 and 14 update the storage management data of the older time stamp among the first storage management data and the second storage management data in accordance with the written capacity of the written program or the written data (S 7). That is, the microcomputers 12 and 14 add the write capacity due to the writing process at this time to the total written capacity at this time to update the storage management data. Subsequently, the microcomputers 12 and 14 update the flag information (S 8) and the microcomputers 12 and 14 end the writing process.(2) Transmission Process of Storage State Confirmation RequestAs shown in FIG. 8, in the electronic control unit 1 of a master node, with the start of the transmission process of a storage state confirmation request, the microcomputer 12 transmits a storage state confirmation request to the electronic control unit 2 of a slave node (S 11), and the microcomputer 12 monitors the reception of a positive confirmation or a negative confirmation from the electronic control unit 2 (S 12, S 13). When it is determined that the storage management data is received together with the positive confirmation from the electronic control unit 2 (S 12: YES), the microcomputer 12 updates the internally stored storage management data in accordance with the received storage management data (S 14), and the microcomputer 12 terminates the transmission process of the storage state confirmation request. On the other hand, when it is determined that the negative confirmation is received from the electronic control unit 2 (S 13: YES), the microcomputer 12 terminates the transmission process of the storage state confirmation request without updating the storage management data.(3) Transmission Process of Accumulation Target Change RequestAs shown in FIG. 9, in the electronic control unit 1 of a master node, with the start of the transmission process of an accumulation target change request, the microcomputer 12 determines whether the requirement for changing the accumulation target arises from the update of the storage management data (S 21). When it is determined that the requirement for changing the accumulation target arises (S 21: YES), the microcomputer 12 sends an accumulation target change request to each electronic control unit among the electronic control units 2 to 5 of the slave nodes (S 22), and the microcomputer 12 terminates the sending process of the accumulation target change request. When it is determined that the requirement for changing the accumulation target does not arise (S 21: NO), the microcomputer 12 terminates the transmission process of the accumulation target change request without transmitting the accumulation target change request.(4) Reception Process of Storage State Confirmation RequestAs shown in FIG. 10, in the electronic control unit 2 of a slave node, with the start of the reception process of a storage state confirmation request, the microcomputer 14 determines whether the storage state confirmation request is received from the electronic control unit 1 of a master node (S 31). When it is determined that the storage state confirmation request is received from the electronic control unit 1 (S 31: YES), the microcomputer 14 determines whether there is a storage resource shared between memories connected to the communication buses 7 and 8 (S 32). When it is determined that a shared memory resource is present (S 32: YES), the microcomputer 14 sends the memory management data to the electronic control unit 1 together with a positive acknowledgement (S 33), and the microcomputer 14 terminates the reception process of the memory state acknowledgement request. When it is determined that there is no shared memory resource (S 32: NO), the microcomputer 14 sends the negative acknowledgement to the electronic control unit 1 (S 34), and the microcomputer 14 terminates the reception process of the memory state confirmation request without sending the memory management data.(5) Reception Process of Accumulation Target Change RequestAs shown in FIG. 11, in the electronic control unit 2 of a slave node, with the start of the reception process of an accumulation target change request, the microcomputer 14 determines whether the storage state confirmation request is received from the electronic control unit 1 of a master node (S 41). When it is determined that the accumulation target change request is received from the electronic control unit 1 (S 41: YES), the microcomputer 14 changes the storage of the accumulation target of a program or data in accordance with the received accumulation target change request (S 42), and the microcomputer 14 terminates the reception process of the accumulation target change request.Above, the electronic control unit 2 of a slave node is described as an example. The description of the electronic control units 3 to 5 is the same as the above description. That is, similarly to sending a storage state confirmation request to the electronic control unit 2 and receiving storage management data from the electronic control unit 2 as described above, the electronic control unit 1 of a master node sends a storage state confirmation request to each of the electronic control units 3 to 5, and the electronic control unit 1 receives storage management data from each of the electronic control units 3 to 5, so as to execute overall management of the write use state of all of the memories connected to the communication buses 7 and 8. The electronic control unit 1 can transmit a storage state confirmation request to the electronic control units 2 to 5 at all times. The electronic control unit 1 can send a storage state confirmation request to all of the electronic control units 2 to 5 at once when the bus load of the communication buses 7 and 8 is comparatively small. Alternatively, the electronic control unit 1 may transmit the storage state confirmation requests to the respective electronic control units 2 to 5 one after another when the bus load of the communication buses 7 and 8 is comparatively high.As described above, the present embodiment can achieve the following advantageous effects. In each of the electronic control units 2 to 5 of a slave node, each time a program or data is written into a memory, memory management data indicating the usage state of writing a program or data into the memory is updated. When a storage state confirmation request is received from the electronic control unit 1 of a master node, storage management data is sent to the electronic control unit 1. In the electronic control unit 1, the memory management data received from each of the electronic control units 2 to 5 is analyzed; thus, overall management of the use state of writing programs or data to the memories connected to the communication buses 7 and 8 is performed.This configuration enables appropriate control of an accumulation target to balance writing of programs or data while avoiding a situation where writing of programs or data concentrates on a specific memory. This can avoid a situation in which physical deterioration of the particular memory progresses more quickly than other memories, while the program or data being written can be suitably guaranteed. Moreover, a situation in which writing of programs or data concentrates on high internal processing load can be avoided, while a situation in which processing time of internal processing increases can be avoided.In each of the electronic control units 1 to 5, the storage management data is stored in dual areas consisting of a first area and a second area, and the storage management data is updated according to the flag information, whichever is older, when the storage management data is updated. Also, if the electric power source is blocked during writing of a program or data, the storage management data is trusted.In each of the electronic control units 1 to 5, the data on a vehicle state or a control history sent from the vehicle to the external devices 9 to 11 is written into / stored in a memory and accumulated. With reference to the data on a vehicle state or a control history sent from the vehicle to the external devices 9 to 11, overall management of the use state of writing programs or data to the memories connected to the communication buses 7 and 8 is performed.Further, in each of the electronic control units 1 to 5, a program or data on the vehicle controller sent from the external device 9 to 11 to the vehicle is written into / stored in a memory and accumulated. With reference to the program or data about vehicle control from the external device 9 to 11 to the vehicle, overall management of the use state of writing the program or data to the memories connected to the communication buses 7 and 8 is performed.Further, in each of the electronic control units 2 to 5, when a storage state confirmation request is received from the electronic control unit 1, it is determined whether there is a storage resource shared among the memories connected to the communication buses 7 and 8. When it is determined that a shared storage resource is present, storage management data is transmitted together with a positive acknowledgement. If it is determined that there is no shared memory resource, a negative acknowledgement is sent. Shared memory resources are provided from both sides; the memory resources are effectively used among the memories connected to the communication buses 7 and 8.Further, in each of the electronic control units 2 to 5, when an accumulation target change request is received from the electronic control unit 1, the memory of the accumulation target of a program or data is changed in accordance with the received accumulation target change request. Changing the memory of the accumulation destination of a program or data may enable a flexible response.Further, in each of the electronic control units 2 to 5, a memory that can accumulate the data having a data length identical to or equal to a multiple of a data length of the data exchanged with the external device 9 to 11 is selected as a memory of a new accumulation target; the memory of the accumulation target of a program or data is changed. Considering units of data that can be handled in a memory results in effective use of a storage capacity.Further, in each of the electronic control units 1 to 5, storage management data including (i) an accumulation usage total capacity that is a total capacity usable for accumulating programs or data, and (ii) a written total capacity that is a total capacity written up to the current time point (i.e., in the past) is stored. The total accumulation usage capacity is a capacity indicated by a value obtained by multiplying a capacity of the accumulation area by the possible number of times of rewriting in an entire lifetime. Comparing the total accumulation usage capacity with the total written capacity allows easy confirmation and management of the progress of the usage frequency of the memory.Further, in each of the electronic control units 1 to 5, programs or data are written and accumulated in respective / respective blocks / blocks of the memory to prevent the writing and accumulating of the programs or data from focusing on a certain block of the blocks. Writing the programs or data sequentially at different addresses within the memory allows for "smoothing" of the write frequency and an increase in memory life.Further, in the electronic control unit 1, when a storage state confirmation request is transmitted to each of the electronic control units 2 to 4 and storage management data is received from each of the electronic control units 2 to 4, the storage management data is updated according to the transmission source of the storage management data. The accumulation target may be successively controlled to compensate for writing of a program or data.Further, in the electronic control unit 1, when storage management data is updated, the storage of the accumulation target of a program or data is changed in accordance with the storage management data after the update (i.e., the updated storage management data). Changing the memory of the accumulation destination of a program or data may enable a flexible response.Further, also in the electronic control unit 1, a memory that can accumulate the data having a data length identical to or equal to a multiple of a data length of the data exchanged with the external device 9 to 11 is selected as a memory of a new accumulation target; the memory of the accumulation target of a program or data is changed in this manner. Considering units of data that can be handled in the memory results in effective utilization of the storage capacity.Although the present invention has been described above in connection with embodiments thereof, it should be understood that it is not limited to the embodiments and constructions. The present invention is to be understood to include various modifications and equivalent arrangements. Further, while the various combinations and configurations are shown, other combinations and configurations having more, less, or only a single element should also be understood as included within the scope of the present invention.Although a configuration in which a master node includes only a single electronic control unit 1 is described as an example, another configuration in which a master node includes a plurality of electronic control units sharing and managing memory management data may be provided.Although a configuration in which the electronic control unit 1 of a master node has a memory 1 ais described as an example, another configuration in which the electronic control unit 1 of a master node does not have a memory 1 amay be provided. That is, the electronic control unit 1 of a master node can manage the usage state of writing programs or data to these memories with respect to the memories of the electronic control units 2 to 5 except for the electronic control unit 1 itself.Although a configuration in which the usage state of writing programs or data to all of the memories connected to the communication buses 7 and 8 is managed is described as an example, another configuration in which the usage state of writing programs or data to a selected part of all of the memories connected to the communication buses 7 and 8 is managed may be provided. Moreover, a memory may be any memory within the electronic control units 1 to 5, and is not limited to the microcomputer.Although the configuration in which the program or data exchanged with the external device 9 to 11 serves as a write destination is described as an example, another configuration in which a program or data is transmitted and received, i.e., exchanged, in the vehicle network may be provided. That is, a program or data handled only inside the vehicle may serve as a writing destination, and overall management may be performed for the usage state of writing programs or data to the memories.

Claims

An electronic control unit connected to a vehicle network (7, 8), comprising: a memory (1a, 2a, 2b, 3a, 3b, 4a, 5a) configured to accumulate a program or data exchanged with an external device (9 to 11) or in the vehicle network; a writing section (12b, 14b) configured to write a program or data into the memory; a management data storage section (12c, 14c) configured to store memory management data indicating a usage state of writing a program or data into the memory; a management data updating section (12d, 14d) configured to update the memory management data each time a program or data is written into the memory; a state confirmation request receiving section (14e) configured to receive a storage state confirmation request from a storage management unit (1); and a management data sending section (14g) configured to send the storage management data to the storage management unit when the storage state confirmation request is received from the storage management unit, wherein the management data storage section stores the storage management data in dual areas consisting of a first area and a second area and stores flag information indicating whether the storage management data stored in the first area or the storage management data stored in the second area is valid; and when updating the storage management data, the management data updating section updates (i) the storage management data stored in the first area or (ii) the storage management data stored in the second area in accordance with the flag information, whichever is older.The electronic control unit according to claim 1, further comprising: a storage resource determination section (14f) configured to determine whether a shared storage resource exists among memories connected to the vehicle network when the storage state confirmation request is received from the storage management unit, wherein when it is determined that a shared storage resource exists, the management data transmission section transmits the storage management data to the storage management unit together with a positive confirmation; and when it is determined that no shared storage resource exists, the management data transmission section transmits a negative confirmation to the storage management unit.The electronic control unit according to claim 1 or 2, further comprising: an accumulation target change request receiving section (14h) configured to receive an accumulation target change request from the storage management unit; and an accumulation target changing section (14i) configured to change a memory serving as an accumulation target that accumulates a program or data in accordance with the accumulation target change request when the accumulation target change request is received from the storage management unit.The electronic control unit according to claim 3, wherein - the program or the data exchanged with the external device or in the vehicle network serves as a write target having a first data length to be accumulated in a first memory serving as a first accumulation target that accumulates the write target; - the accumulation target changing section newly selects a second memory having a second data length that is identical to or a multiple of the first data length as a second accumulation target; and - the accumulation target changing section changes an accumulation target for the write target from the first memory as the first accumulation target to the second memory as the second accumulation target.The electronic control unit according to any one of claims 1 to 4, wherein - the management data storage section stores, as the storage management data, data including a total accumulation usage capacity and a total written capacity; - the total accumulation usage capacity is a total capacity usable for accumulating a program or data; and - the total written capacity is a total capacity with which writing has been made in the past.The electronic control unit according to any one of claims 1 to 5, wherein the writing section is configured to write and accumulate programs or data in respective / respective blocks / blocks of the memory to prevent the writing and accumulating of the programs or data from focusing on a specific block among the blocks.The electronic control unit according to any one of claims 1 to 6, further comprising: a storage state confirmation request transmission section (12e) configured to transmit a storage state confirmation request to a transmission destination of the storage state confirmation request; and a management data reception section (12f) configured to receive storage management data from the transmission destination of the storage state confirmation request.

Images