Electronic control device

Abstract

To appropriately write back a program while avoiding increases in data communication volume and execution time, an increase in the size of a device, and high costs.SOLUTION: An electronic control device capable of rewriting programs includes a program storage unit 11a that stores a program, a program rewriting unit 11b that rewrites the program by writing a rewrite program, a write-back difference program creation unit 11c that creates a write-back difference program based on the rewrite program and the program stored in the program storage unit before the program rewriting unit writes the rewrite program to the program storage unit, a write-back difference program storage unit 11d that stores the write-back difference program, a write-back necessity determination unit 11e that determines whether the program needs to be written back based on whether the program rewriting has been successful, and a program write-back unit 11h that writes back the program using the write-back difference program when it is determined that the program needs to be written back.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an electronic control device. [Background technology]

[0002] For example, in-vehicle electronic control devices (hereinafter referred to as ECUs (Electronic Control Units)) are configured to be able to rewrite programs stored in memory in order to improve functions, eliminate defects, etc. When rewriting a program stored in a memory by writing a rewrite program to the memory, rewriting the program is not always successful, and there may be cases where rewriting the program fails due to, for example, the influence of the communication environment. If rewriting the program fails, it is necessary to return the program to the state before the rewrite program was written to the memory, that is, to rewrite the program. For example, Patent Document 1 discloses a technology in which a vehicle receives a rewrite program transmitted from an OTA (Over the Air) center and rewrites the program. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-027634 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology disclosed in Patent Document 1, the vehicle receives the program for writing back transmitted from the OTA center, which causes problems such as an increase in the amount of data communication between the OTA center and the vehicle, and a long execution time required for writing back the program. In addition, in places with poor communication environments such as underground parking lots, data communication may be hindered, and the program may not be written back properly. In this regard, there is a method in which the program writing area is configured as a two-sided configuration of an operational side and a non-operational side, and the program before and after writing back is switched. However, this method requires a large capacity memory to be secured in order to configure the two-sided configuration of the operational side and the non-operational side, which causes new problems such as an increase in the size of the device and high costs.

[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its object is to provide an electronic control device that can appropriately rewrite programs while avoiding increases in data communication volume and execution time, increases in device size, and high costs. [Means for solving the problem]

[0006] According to the invention recited in claim 1, a program storage unit (11a) stores a program. A program rewriting unit (11b) rewrites a program stored in the program storage unit by writing a rewrite program to the program storage unit. A write-back difference program creation unit (11c) creates a write-back difference program based on the rewrite program and the program stored in the program storage unit before the program rewriting unit writes the rewrite program to the program storage unit. A write-back difference program storage unit (11d) stores the write-back difference program. A write-back necessity determination unit (11e) determines whether or not a program needs to be written back based on whether or not the program stored in the program storage unit has been successfully rewritten. A program write-back unit (11h) writes back a program using the write-back difference program when the write-back necessity determination unit determines that a program needs to be written back.

[0007] Before the program rewriting unit writes the rewrite program to the program storage unit, a write-back difference program is created and stored based on the rewrite program and the program stored in the program storage unit, and when it is determined that the program needs to be written back, the write-back difference program is used to write back the program. There is no need to receive a write-back program from outside, making data communication from outside unnecessary, and it is possible to avoid an increase in data communication volume and execution time required for writing back the program. There is also no need to configure the program writing area into a two-sided configuration with an operational side and a non-operational side, and it is possible to avoid problems such as an increase in the size of the device and high costs. This makes it possible to properly write back the program while avoiding an increase in data communication volume and execution time, an increase in the size of the device, and high costs. [Brief description of the drawings]

[0008] [Figure 1] A functional block diagram showing the overall configuration of an embodiment. [Diagram 2] Control unit functional block diagram [Diagram 3] Sequence diagram showing the process [Figure 4] Sequence diagram showing the process [Diagram 5] Sequence diagram showing the process [Figure 6] Sequence diagram showing the process [Figure 7] Sequence diagram showing the process [Figure 8] Sequence diagram showing the process DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment will be described with reference to the drawings. As shown in Fig. 1, in a vehicle-side system 1 mounted on a vehicle, an OTA master 2 and ECUs 3 to 6 whose programs are to be rewritten by the OTA master 2 are connected to each other so as to be able to communicate data with each other via an in-vehicle network 7. The programs to be rewritten in each of the ECUs 3 to 6 also include libraries, data, etc. that are referenced when the programs are executed.

[0010] Each of the ECUs 3 to 6 is, for example, an ECU having a function of controlling a drive system, an ECU having a function of controlling an ADAS (Advanced Driving Assistant System), an ECU having a function of controlling a multimedia system, etc. The in-vehicle network 7 is, for example, a Controller Area Network (CAN) (registered trademark), FLEXRAY (registered trademark), Clock Extension Peripheral Interface (CXPI) (registered trademark), Ethernet (registered trademark), etc. The number of in-vehicle networks 7 connected to the OTA master 2 is not limited to one, and multiple in-vehicle networks 7 may be arranged for each control system. The number of ECUs connected to the in-vehicle network 7 is not limited to four.

[0011] A TCU (Telematics Control Unit) 8 functioning as an in-vehicle communication device is connected to the OTA master 2. The TCU 8 wirelessly connects to an OTA center 9 via a communication network 10 and performs data communication. The TCU 8 can receive a rewrite program distributed from the OTA center 9 via the communication network 10, and upon receiving the rewrite program, transfers the received rewrite program to the OTA master 2.

[0012] When the installation enabling condition for the rewrite target ECU is satisfied, the OTA master 2 notifies the rewrite target ECU of an installation instruction, distributes the rewrite program to the rewrite target ECU, and causes the rewrite target ECU to install the rewrite program. The installation enabling condition is, for example, that the user has performed an operation to approve the installation, the remaining battery charge of the in-vehicle battery is equal to or greater than a predetermined capacity, the vehicle is not in an illegal environment, the vehicle state is in a state in which the installation is possible, the rewrite program is normal data, the memory structure of the installation destination of the rewrite program is normal, the communication load of the in-vehicle network 7 is less than a predetermined level, etc.

[0013] When the installation of the rewrite program in the rewrite target ECU is completed and the activation enabling condition for the rewrite target ECU is satisfied, the OTA master 2 notifies the rewrite target ECU of an activation instruction to validate the installed rewrite program, and causes the rewrite target ECU to activate the program. The activation enabling condition is, for example, that the user has performed an operation to approve the activation, that the remaining battery charge of the in-vehicle battery is equal to or greater than a predetermined capacity, that the vehicle state is in a state in which activation is possible, that the installed rewrite program is normal data, etc.

[0014] This mode in which the rewrite program is distributed from the OTA master 9 via wireless communication to rewrite the program of the ECU to be rewritten is called wireless repro. Note that the mode is not limited to wireless repro, and may be, for example, a mode in which the diagnostic tool and the OTA master 2 are connected by a communication line by connecting the diagnostic tool to a connector on the vehicle side, and the rewrite program is distributed from the diagnostic tool via wired communication to rewrite the program of the ECU to be rewritten. This mode is called wired repro.

[0015] Each of the ECUs 3 to 6 has basically the same configuration, and includes a control unit 11, a communication interface unit 12, and an input / output interface unit 13, as shown in Fig. 2. The control unit 11 is mainly configured with a microcomputer (hereinafter referred to as a microcomputer) having a CPU, ROM, RAM, I / O, etc., and controls the operation of each of the ECUs 3 to 6 by executing software processing by running a computer program stored in a non-transient substantial storage medium on the CPU and hardware processing by a dedicated electronic circuit. The communication interface unit 12 controls data communication with the in-vehicle network 7. The input / output interface unit 13 controls data input / output with various devices, and controls, for example, the input of sensing data from a sensor and the output of drive data to an actuator.

[0016] The control unit 11 includes, for each function, a program storage unit 11a, a program rewriting unit 11b, a write-back difference program creation unit 11c, a write-back difference program storage unit 11d, a write-back necessity determination unit 11e, a combination information storage unit 11f, a combination information acquisition unit 11g, a program write-back unit 11h, a write-back difference program transmission unit 11i, and a write-back difference program acquisition unit 11j.

[0017] The program storage unit 11a stores a program distributed from the OTA master 2. When a rewrite program is distributed from the OTA master 2, the program rewriting unit 11b rewrites the program stored in the program storage unit 11a by writing the distributed rewrite program to the program storage unit 11a. Before the program rewriting unit 11b writes the rewrite program to the program storage unit 11a, the backwrite difference program creation unit 11c creates a backwrite difference program by comparing the rewrite program with the program stored in the program storage unit 11a. When the backwrite difference program is created by the backwrite difference program creation unit 11c, the backwrite difference program storage unit 11d stores the created backwrite difference program.

[0018] The write-back necessity determination unit 11e determines whether the rewriting of the program stored in the program storage unit 11a has been successful using a determination method such as a checksum, and determines whether the program needs to be written back. The write-back necessity determination unit 11e determines whether or not the program has been rewritten successfully by determining whether or not a checksum or the like is consistent, and if it determines that the program stored in the program storage unit 11a has been successfully rewritten, it determines whether or not the program needs to be written back. Not writing back the program means that writing back the program is not necessary. On the other hand, the write-back necessity determination unit 11e determines whether or not a checksum or the like is consistent, and if it determines that the rewriting of the program stored in the program storage unit 11a has failed, it determines whether or not the program needs to be written back. The program needs to be written back means that writing back the program is necessary.

[0019] The combination information storage unit 11f stores combination information. The combination information is information indicating whether or not rewriting of each program affects rewriting of other programs when there are multiple ECUs to be rewritten. For example, when the ECUs to be rewritten are ECUs 3 to 5 and ECU 4 controls in cooperation with ECU 3, combination information indicating that ECU 3 and ECU 4 cooperate with each other is stored, and when ECU 5 controls without cooperation with ECU 3, combination information indicating that ECU 3 and ECU 5 do not cooperate with each other is stored.

[0020] For example, if it is determined that rewriting the program of ECU3 has failed but rewriting the program of ECU4 has been successful, the control of ECU3 and the control of ECU4 are linked, so that in addition to ECU3, whose program rewriting has failed, ECU4, whose program rewriting has been successful, needs to be restored to the state before the program was rewritten. On the other hand, if it is determined that rewriting the program of ECU3 has failed but rewriting the program of ECU5 has been successful, the control of ECU3 and the control of ECU5 are not linked, so that ECU3, whose program rewriting has failed, needs to be restored to the state before the program was rewritten, but there is no need to restore ECU5, whose program rewriting has been successful, to the state before the program was rewritten.

[0021] The write-back necessity determination unit 11e determines whether or not the program needs to be written back based on the combination information stored in the combination information storage unit 11f when another ECU fails to rewrite the program. That is, the write-back necessity determination unit 11e determines whether or not the program needs to be written back when cooperating with the other ECU that failed to rewrite the program, and determines whether or not the program needs to be written back when not cooperating with the other ECU that failed to rewrite the program.

[0022] The combination information acquisition unit 11g acquires combination information stored in the OTA master 2 or another ECU from the OTA master 2 or another ECU.

[0023] When another ECU fails to rewrite its program, the write-back necessity determination unit 11e determines whether or not the program needs to be written back based on the combination information acquired by the combination information acquisition unit 11g from the OTA master 2 or another ECU. That is, the write-back necessity determination unit 11e determines whether or not the program needs to be written back when cooperating with the other ECU that failed to rewrite its program, and determines whether or not the program needs to be written back when not cooperating with the other ECU that failed to rewrite its program.

[0024] When the write-back necessity determining unit 11e determines whether or not the program needs to be written back, the program write-back unit 11h writes back the program using the write-back difference program stored in the write-back difference program storage unit 11d.

[0025] The write-back difference program transmission unit 11i transmits the write-back difference program stored in the write-back difference program storage unit 11e to another ECU, so that the write-back difference program is stored in the other ECU.

[0026] The write-back difference program acquisition unit 11j acquires the write-back difference program stored in another ECU.

[0027] Next, the operation of the above-mentioned configuration will be described with reference to Figs. 3 to 8. The following describes in sequence: (1) a mode in which the reprogramming target ECU creates and stores a write-back difference program, (2) a mode in which the reprogramming target ECU stores combination information, and (3) a mode in which the reprogramming target ECU creates a write-back difference program and the OTA master 2 stores the write-back difference program. Note that the first ECU, second ECU, and third ECU, which are the reprogramming target ECUs described later, are any of ECUs 3 to 6.

[0028] (1) How the target ECU creates and saves a write-back differential program (see Figures 3 and 4) The following description is based on the premise that the first ECU, the second ECU, and the third ECU cooperate to perform control. When the TCU 8 receives the rewrite program distributed from the OTA center 9 via the communication network 10 (A1, A2), the TCU 8 transfers the received rewrite program to the OTA master 2 (A3). When the OTA master 2 transfers the rewrite program from the TCU 8, the OTA master 2 transmits a write-back difference program creation request together with the transferred rewrite program to the first ECU (A4).

[0029] In the first ECU, when the control unit 11 receives the rewrite program and the write-back difference program creation request transmitted from the OTA master 2, the control unit 11 compares the received rewrite program with the program stored in the program storage unit 11a to create a write-back difference program, and stores the created write-back difference program in the write-back difference program storage unit 11d. When the control unit 11 determines that the creation and storage of the write-back difference program has been successful, it transmits a creation success notification to the OTA master 2 (A5).

[0030] When the OTA master 2 receives the creation success notification sent from the first ECU, it transmits a rewrite request to the first ECU (A6). When the control unit 11 in the first ECU receives the rewrite request sent from the OTA master 2, it writes the rewrite program received earlier into the program storage unit 11a, thereby rewriting the program stored in the program storage unit 11a. The control unit 11 determines whether the program rewrite has been successful, and when it determines that the program rewrite has been successful, it transmits a rewrite success notification to the OTA master 2 (A7). When the OTA master 2 receives the rewrite success notification sent from the first ECU, it determines whether the program rewrite in the first ECU has been successful.

[0031] Similarly, the OTA master 2 transmits a write-back difference program creation request together with the rewrite program to the second ECU (A8). In the second ECU, when the control unit 11 receives the rewrite program and the write-back difference program creation request transmitted from the OTA master 2, the control unit 11 compares the received rewrite program with the program stored in the program storage unit 11a to create a write-back difference program, and stores the created write-back difference program in the write-back difference program storage unit 11d. When the control unit 11 determines that the creation and storage of the write-back difference program has been successful, it transmits a creation success notification to the OTA master 2 (A9).

[0032] When the OTA master 2 receives the creation success notification sent from the second ECU, it transmits a rewrite request to the second ECU (A10). When the control unit 11 in the second ECU receives the rewrite request sent from the OTA master 2, it writes the rewrite program received earlier into the program storage unit 11a, thereby rewriting the program stored in the program storage unit 11a. The control unit 11 determines whether the program rewrite has been successful, and when it determines that the program rewrite has been successful, it transmits a rewrite success notification to the OTA master 2 (A11). When the OTA master 2 receives the rewrite success notification sent from the second ECU, it determines whether the program rewrite in the second ECU has been successful.

[0033] The OTA master 2 transmits a write-back difference program creation request together with the rewrite program to the third ECU (A12). In the third ECU, when the control unit 11 receives the rewrite program and the write-back difference program creation request transmitted from the OTA master 2, the control unit 11 compares the received rewrite program with the program stored in the program storage unit 11a to create a write-back difference program, and stores the created write-back difference program in the write-back difference program storage unit 11d. When the control unit 11 determines that the creation and storage of the write-back difference program has been successful, it transmits a creation success notification to the OTA master 2 (A13).

[0034] When the OTA master 2 receives the creation success notification sent from the third ECU, it transmits a rewrite request to the second ECU (A14). When the control unit 11 in the third ECU receives the rewrite request sent from the OTA master 2, it writes the rewrite program received earlier into the program storage unit 11a, thereby rewriting the program stored in the program storage unit 11a. The control unit 11 determines whether the program rewrite was successful, and when it determines that the program rewrite has failed, it transmits a rewrite failure notification to the OTA master 2 (A15). When the OTA master 2 receives the rewrite failure notification sent from the third ECU, it identifies the failure of the program rewrite in the third ECU.

[0035] When the OTA master 2 identifies a failure in rewriting the program in the third ECU, it transfers a rewrite failure notification capable of identifying the third ECU in which the rewrite failed to be performed to the TCU 8 (A16). When the rewrite failure notification is transferred from the OTA master 2, the TCU 8 transmits the transferred rewrite failure notification to the OTA center 9 via the communication network 10 (A17, A18). When the OTA center 9 receives the rewrite failure notification transmitted from the OTA master 2 via the communication network 10, it identifies a failure in rewriting the program in the third ECU.

[0036] Furthermore, when the OTA master 2 determines that the rewriting of the program in the third ECU has failed, it transmits a write-back request to the first ECU (A19). In the first ECU, when the control unit 11 receives the write-back request transmitted from the OTA master 2, it writes back the program using the write-back difference program stored in the write-back difference program storage unit 11d. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A20).

[0037] Similarly, the OTA master 2 transmits a write-back request to the second ECU (A21). In the second ECU, when the control unit 11 receives the write-back request transmitted from the OTA master 2, it writes back the program using the write-back difference program stored in the write-back difference program storage unit 11d. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A22).

[0038] The OTA master 2 transmits a write-back request to the third ECU (A23). In the third ECU, when the control unit 11 receives the write-back request transmitted from the OTA master 2, it writes back the program using the write-back difference program stored in the write-back difference program storage unit 11d. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A24).

[0039] When the OTA master 2 receives the write-back success notification transmitted from the first ECU, the second ECU, and the third ECU, the OTA master 2 transfers the write-back success notification capable of identifying the rewrite target ECU in which the program was successfully written back to the TCU 8 (A25). When the write-back success notification is transferred from the OTA master 2, the TCU 8 transmits the transferred write-back success notification to the OTA center 9 via the communication network 10 (A26, A27). When the OTA center 9 receives the write-back success notification transmitted from the OTA master 2 via the communication network 10, it identifies the success of the program write-back in the first ECU, the second ECU, and the third ECU.

[0040] The above is an example of a case where rewriting of a program in the third ECU fails, but the same applies to cases where rewriting of a program in the first ECU or the second ECU fails. Also, the same applies to cases where rewriting of a program in two ECUs, for example the second ECU and the third ECU, fails.

[0041] (2) How the reprogramming target ECU stores combination information (see Figures 5 and 6) The following description is based on the premise that the first ECU and the third ECU perform control in cooperation with each other, and the second ECU and the third ECU perform control without cooperation with each other. When the TCU 8 receives combination information distributed from the OTA center 9 via the communication network 10 (A31, A32), the TCU 8 transfers the received combination information to the OTA master 2 (A33). The OTA master 2 transmits the combination information transferred from the TCU 8 to the first ECU, the second ECU, and the third ECU (A34 to A36).

[0042] In the first ECU, the second ECU, and the third ECU, when the control unit 11 receives the combination information transmitted from the OTA master 2, the control unit 11 stores the received combination information in the combination information storage unit 11f.

[0043] After this, similarly to the process described in FIG. 3, when the TCU 8 receives the rewrite program distributed from the OTA center 9 via the communication network 10 (A1, A2), the TCU 8 transfers the received rewrite program to the OTA master 2 (A3). The OTA master 2 sequentially transmits a write-back differential program creation request together with the rewrite program to the first ECU, the second ECU, and the third ECU (A4, A8, A12). In this case as well, when the control unit 11 in the third ECU determines that the rewrite of the program has failed, it transmits a rewrite failure notification to the OTA master 2 (A15) and rewrites the program using the write-back differential program stored in the write-back differential program storage unit 11d. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A37).

[0044] When the OTA master 2 identifies the failure of the program rewrite in the third ECU, it transmits a rewrite failure notification to the first ECU, which can identify the third ECU in which the program rewrite has failed (A38). When the first ECU receives the rewrite failure notification transmitted from the OTA master 2, it identifies the failure of the program rewrite in the third ECU, and judges whether or not the program needs to be rewritten by referring to the combination information stored in the combination information storage unit 11f. When the control unit 11 determines to cooperate with the third ECU in which the program rewrite has failed, it determines whether or not the program needs to be rewritten, and rewrites the program using the rewrite difference program stored in the rewrite difference program storage unit 11d. When the control unit 11 determines that the program rewrite has been successful, it transmits a rewrite success notification to the OTA master 2 (A39).

[0045] The OTA master 2 transmits a rewrite failure notification to the second ECU, which can identify the third ECU in which the program rewrite has failed (A40). When the second ECU receives the rewrite failure notification transmitted from the OTA master 2, it identifies the failure of the program rewrite in the third ECU, and judges whether or not the program needs to be rewritten by referring to the combination information stored in the combination information storage unit 11f. When the control unit 11 judges not to cooperate with the third ECU in which the program rewrite has failed, it judges whether or not to rewrite the program, and transmits a no-rewrite notification to the OTA master 2 (A41).

[0046] When the OTA master 2 receives the write-back success notification from the third ECU and the first ECU and also receives the write-back unnecessary notification from the second ECU, the OTA master 2 transfers the write-back success notification capable of identifying the rewrite target ECU in which the program has been successfully written back to the TCU 8 (A42). When the write-back success notification is transferred from the OTA master 2, the TCU 8 transmits the transferred write-back success notification to the OTA center 9 via the communication network 10 (A43, A44). When the OTA center 9 receives the write-back success notification transmitted from the OTA master 2 via the communication network 10, it identifies the success of the program write-back in the first ECU and the third ECU.

[0047] In the above, the combination information is transmitted from the OTA center 9 to the OTA master 2, and then transmitted from the OTA master 2 to each ECU. However, each ECU may store the combination information in advance. Alternatively, the OTA master 2 may store the combination information and transmit the stored combination information to the first ECU, the second ECU, and the third ECU when a rewrite failure notification is received from any ECU. In this case, the third ECU fails to rewrite the program. However, the first ECU and the second ECU fail to rewrite the program. Alternatively, the first ECU and the second ECU fail to rewrite the program.

[0048] (3) A state in which the reprogramming target ECU creates a write-back difference program, and the OTA master 2 stores the write-back difference program (see Figs. 7 and 8). The following description is based on the premise that the first ECU, the second ECU, and the third ECU cooperate with each other to perform control. Similar to the process described in Fig. 3, when the TCU 8 receives the reprogramming program distributed from the OTA center 9 via the communication network 10 (A1, A2), the TCU 8 transfers the received reprogramming program to the OTA master 2 (A3).

[0049] When the rewrite program is transferred from the TCU 8, the OTA master 2 transmits a backwrite difference program creation request together with the transferred rewrite program to the first ECU (A4). In the first ECU, when the control unit 11 receives the rewrite program and the backwrite difference program creation request transmitted from the OTA master 2, the control unit 11 compares the received rewrite program with the program stored in the program storage unit 11a to create a backwrite difference program. The control unit 11 transmits the created backwrite difference program to the OTA master 2 (A51).

[0050] When the OTA master 2 receives the write-back difference program transmitted from the first ECU, it stores the received write-back difference program and transmits a rewrite request to the first ECU (A6). When the control unit 11 in the first ECU receives the rewrite request transmitted from the OTA master 2, it writes the rewrite program received earlier in the program storage unit 11a to rewrite the program stored in the program storage unit 11a. The control unit 11 determines whether the program rewrite has been successful, and when it determines that the program rewrite has been successful, it transmits a rewrite success notification to the OTA master 2 (A7). When the OTA master 2 receives the rewrite success notification transmitted from the first ECU, it determines whether the program rewrite in the first ECU has been successful.

[0051] Similarly, the OTA master 2 transmits a write-back difference program creation request together with the rewrite program to the second ECU (A8). In the second ECU, when the control unit 11 receives the rewrite program and the write-back difference program creation request transmitted from the OTA master 2, the control unit 11 compares the received rewrite program with the program stored in the program storage unit 11a to create a write-back difference program. The control unit 11 transmits the created write-back difference program to the OTA master 2 (A52).

[0052] When the OTA master 2 receives the write-back difference program transmitted from the second ECU, it stores the received write-back difference program and transmits a rewrite request to the second ECU (A10). When the control unit 11 in the second ECU receives the rewrite request transmitted from the OTA master 2, it writes the rewrite program received earlier in the program storage unit 11a to rewrite the program stored in the program storage unit 11a. The control unit 11 determines whether the program rewrite has been successful, and when it determines that the program rewrite has been successful, it transmits a rewrite success notification to the OTA master 2 (A11). When the OTA master 2 receives the rewrite success notification transmitted from the second ECU, it determines whether the program rewrite in the second ECU has been successful.

[0053] The OTA master 2 transmits a write-back difference program creation request together with the rewrite program to the third ECU (A12). In the third ECU, when the control unit 11 receives the rewrite program and the write-back difference program creation request transmitted from the OTA master 2, the control unit 11 compares the received rewrite program with the program stored in the program storage unit 11a to create a write-back difference program. The control unit 11 transmits the created write-back difference program to the OTA master 2 (A53).

[0054] When the OTA master 2 receives the write-back difference program transmitted from the third ECU, it stores the received write-back difference program and transmits a rewrite request to the third ECU (A14). When the control unit 11 in the third ECU receives the rewrite request transmitted from the OTA master 2, it writes the rewrite program received earlier in the program storage unit 11a, thereby rewriting the program stored in the program storage unit 11a. In this case as well, when the control unit 11 determines that the program rewrite has failed, it transmits a rewrite failure notification to the OTA master 2 (A15). When the OTA master 2 receives the rewrite failure notification transmitted from the third ECU, it identifies the failure of the program rewrite in the third ECU.

[0055] When the OTA master 2 identifies a failure in rewriting the program in the third ECU, it transfers a rewrite failure notification capable of identifying the third ECU in which the rewrite failed to be performed to the TCU 8 (A16). When the rewrite failure notification is transferred from the OTA master 2, the TCU 8 transmits the transferred rewrite failure notification to the OTA center 9 via the communication network 10 (A17, A18). When the OTA center 9 receives the rewrite failure notification transmitted from the OTA master 2 via the communication network 10, it identifies a failure in rewriting the program in the third ECU.

[0056] Furthermore, when the OTA master 2 identifies a failure in rewriting the program in the third ECU, it transmits the previously stored write-back difference program to the first ECU (A54). In the first ECU, when the control unit 11 receives the write-back difference program transmitted from the OTA master 2, it rewrites the program using the received write-back difference program. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A20).

[0057] The OTA master 2 transmits the write-back difference program to the second ECU (A55). In the second ECU, when the control unit 11 receives the write-back difference program transmitted from the OTA master 2, it writes back the program using the received write-back difference program. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A22).

[0058] The OTA master 2 transmits the write-back difference program to the third ECU (A56). In the third ECU, when the control unit 11 receives the write-back difference program transmitted from the OTA master 2, it writes back the program using the received write-back difference program. When the control unit 11 determines that the program has been successfully written back, it transmits a write-back success notification to the OTA master 2 (A24).

[0059] When the OTA master 2 receives the write-back success notification transmitted from the first ECU, the second ECU, and the third ECU, the OTA master 2 transfers the write-back success notification capable of identifying the rewrite target ECU in which the program was successfully written back to the TCU 8 (A25). When the write-back success notification is transferred from the OTA master 2, the TCU 8 transmits the transferred write-back success notification to the OTA center 9 via the communication network 10 (A26, A27). When the OTA center 9 receives the write-back success notification transmitted from the OTA master 2 via the communication network 10, it identifies the success of the program write-back in the first ECU, the second ECU, and the third ECU.

[0060] In the above, the configuration in which the write-back difference program is stored in the OTA master 2 has been exemplified, but the write-back difference program may be stored in a fourth ECU other than the first ECU, the second ECU, and the third ECU. The OTA master 2 and the fourth ECU may be used together as the storage destination of the write-back difference program, for example, the write-back difference program of the first ECU may be stored in the OTA master 2, and the write-back difference program of the second ECU may be stored in the fourth ECU. In this case, too, the case where the program rewriting fails in the third ECU has been exemplified, but the same applies when the program rewriting fails in the first ECU or the second ECU. In addition, the same applies when the program rewriting fails in two ECUs, for example, the second ECU and the third ECU.

[0061] (1) and (3) may be used together. For example, the backwrite difference program of the first ECU may be stored in the first ECU, and the backwrite difference program of the second ECU may be stored in a location other than the second ECU, for example, in the OTA master 2. The storage destination of the backwrite difference program may be fixed or variable. That is, the capacity of the backwrite difference program may be compared with the available capacity, and the OTA master 2 or an ECU having sufficient available capacity for the capacity of the backwrite difference program may be selected as the storage destination of the backwrite difference program. In this case, the OTA master 2 may collectively manage the available capacity of each ECU and allocate the storage destination of the backwrite difference program, or each ECU may individually inquire about the available capacity of other ECUs.

[0062] As described above, according to this embodiment, the following advantageous effects can be obtained: Before writing a rewrite program to the program storage unit 11a, the ECUs 3 to 6 compare the rewrite program with the program stored in the program storage unit 11a to create and store a write-back difference program, and when it is determined that the program needs to be written back, the program is written back using the write-back difference program.

[0063] There is no need to receive a write-back program from outside, and data communication from outside is unnecessary, making it possible to avoid increases in data communication volume and execution time required to write back the program. In addition, there is no need to configure the program write area into two areas, an operational side and a non-operational side, making it possible to avoid problems such as an increase in the size of the device and high costs. This makes it possible to properly write back the program while avoiding increases in data communication volume and execution time, an increase in the size of the device, and high costs.

[0064] The combination information is saved, and if another ECU fails to rewrite its program, the saved combination information is used to determine whether or not the program needs to be rewritten. By using the combination information, the number of ECUs that need to rewrite their programs can be kept to a minimum, and the execution time required for program rewriting for the entire system can be reduced.

[0065] The combination information transmitted from the OTA center 9 is stored. The combination information can be managed by the OTA center 9, and changes to the configuration information due to the addition of an ECU, etc. can be flexibly handled.

[0066] The write-back difference program is stored, for example, in the OTA master 2. Generally, the OTA master 2 has relatively abundant memory resources, so by storing the write-back difference program in the OTA master 2, which has relatively abundant memory resources, the memory resources of the entire system can be used effectively.

[0067] Although the present disclosure has been described based on the embodiment, it is understood that the present disclosure is not limited to the embodiment or structure. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

[0068] The control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more special-purpose computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. [Explanation of symbols]

[0069] In the drawing, 3 to 6 are electronic control devices, 11 is a control unit, 11a is a program storage unit, 11b is a program rewriting unit, 11c is a write-back difference program creation unit, 11d is a write-back difference program storage unit, 11e is a write-back necessity determination unit, 11f is a combination information storage unit, 11g is a combination information acquisition unit, 11h is a program write-back unit, 11i is a write-back difference program transmission unit, and 11j is a write-back difference program acquisition unit.

Claims

1. A programmable electronic control device, A program storage unit (11a) for storing the program; a program rewriting unit (11b) that rewrites a program stored in the program storage unit by writing a rewriting program into the program storage unit; a write-back difference program creation unit (11c) that creates a write-back difference program based on the rewrite program and a program stored in the program storage unit before the program rewriting unit writes the rewrite program in the program storage unit; A write-back differential program storage unit (11d) for storing the write-back differential program; a write-back necessity determination unit (11e) for determining whether or not a program needs to be written back based on whether or not the program stored in the program storage unit has been successfully rewritten; and a program rewrite unit (11h) that rewrites a program by using the rewrite difference program when the rewrite necessity determination unit determines that the program needs to be rewritten.

2. A combination information storage unit (11f) for storing combination information, 2. The electronic control device according to claim 1, wherein the rewrite necessity determination unit determines whether or not a program needs to be rewritten based on the combination information stored in the combination information storage unit when another electronic control device fails to rewrite a program.

3. A combination information acquisition unit (11g) for acquiring combination information stored in another device from the other device, The electronic control device according to claim 1, wherein the rewrite necessity determination unit determines whether or not a program needs to be rewritten based on combination information acquired from the other electronic control device by the combination information acquisition unit when the other electronic control device fails to rewrite the program.

4. An electronic control device as described in any one of claims 1 to 3, further comprising a write-back difference program transmission unit (11i) that transmits the write-back difference program stored in the write-back difference program storage unit to another device and causes the write-back difference program to be stored in the other device.

5. A write-back difference program acquisition unit (11j) for acquiring a write-back difference program stored in another device, The electronic control device according to claim 4 , wherein the program write-back unit writes back a program using the write-back difference program acquired by the write-back difference program acquisition unit.

Images