Center device and on-board electronic control device

Abstract

To provide a center device capable of preparing a distribution package for updating data corresponding to each vehicle in a relatively short processing time.SOLUTION: A configuration information DB 208 of a central device 3 stores identification information of a device for each of a plurality of ECUs 19 and information on a software architecture of the device together with a vehicle type. A specification data generation unit 201 obtains difference data, which is the difference between update data and data before the update, for each of the ECUs 19 whose data is to be updated, calculates a hash value of the difference data, and stores the calculated hash value in an ECU repro data DB 204. When generating a distribution package for the ECU 19 whose data is to be updated, a package generation unit 202 uses the corresponding hash value stored in the ECU repro data DB 204.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a center device that manages data to be written to a plurality of electronic control devices mounted on a vehicle, and to an on-vehicle electronic control device that communicates with the center device. [Background technology]

[0002] In recent years, with the diversification of vehicle control such as driving assistance functions and automatic driving functions, the scale of application programs such as vehicle control and diagnosis mounted on the vehicle's electronic control unit (hereinafter referred to as ECU (Electronic Control Unit)) is increasing. In addition, with version upgrades for function improvements and the like, there are also increasing opportunities to rewrite ECU application programs, that is, to perform so-called reprogramming. Meanwhile, with the development of communication networks, connected car technology is also becoming widespread. In light of these circumstances, for example, Patent Document 1 discloses a technology in which an ECU update program is delivered from a server to an in-vehicle device by OTA (Over The Air) and the update program is rewritten on the vehicle side. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-27624 A Summary of the Invention [Problem to be solved by the invention]

[0004] Furthermore, in order to rewrite vehicle application programs that are customized for each user, there is a demand for the center device to generate a distribution package for rewriting that corresponds to each vehicle.

[0005] However, the size of the distribution package can be several gigabytes depending on the capacity of the program to be rewritten, and the process of generating the package takes time. Therefore, if it were assumed that a distribution package would be individually prepared for each vehicle, it would take an enormous amount of time, making it impractical.

[0006] The present invention has been made in consideration of the above-mentioned circumstances, and its object is to provide a center device that can prepare a distribution package for data updates corresponding to each vehicle in a relatively short processing time, and an on-board electronic control device that can receive the distribution package and write update data. [Means for solving the problem]

[0007] According to the center device of claim 1, the vehicle information storage unit stores device identification information for each of a plurality of electronic control devices and information on the software architecture of the device together with the vehicle type. The hash value generation unit obtains difference data, which is the difference between update data and data before the update, for each electronic control device that is the target of data update, calculates a hash value of the difference data, and stores the calculated hash value in the hash value storage unit. Then, when generating a distribution package for the electronic control device that is the target of data update, the package generation unit uses the corresponding hash value stored in the hash value storage unit to generate the distribution package. and generate a vehicle identification information to be included in the distribution package. do.

[0008] With this configuration, the data size can be reduced by including a hash value of the difference data in the package distributed to each vehicle, and the processing time of the package can be shortened. Also, the vehicle that receives the distribution package can identify the difference data for updating the data corresponding to the vehicle based on the hash value.

[0009] According to the center device described in claim 2, data is managed using linking information that links differential data with a distribution package that includes a hash value corresponding to the differential data, so that the differential data corresponding to the distribution package that includes the hash value can be easily identified.

[0010] According to the center device of claim 3, the package generation unit generates a distribution package including multiple hash values ​​and linking information corresponding to the multiple hash values. This makes it possible for a vehicle receiving the distribution package to easily identify multiple difference data for updating multiple data corresponding to the vehicle based on each hash value.

[0011] Claim 5 According to the described in-vehicle electronic control device, when a distribution package received from a center device contains a hash value, the in-vehicle electronic control device requests the center device to download difference data corresponding to the hash value, thereby making it possible to reliably obtain difference data for updating data corresponding to the vehicle based on the hash value.

[0012] Claim 6 According to the described in-vehicle electronic control device, when downloading of differential data is performed, the hash value is compared with a hash value calculated for the differential data to verify the validity of the differential data, so that the validity of the differential data downloaded from the center device can be verified using the hash value included in the distribution package. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a functional block diagram showing an embodiment of a vehicle program rewriting system; [Diagram 2] Functional block diagram showing the CGW configuration [Diagram 3] Functional block diagram showing the ECU configuration [Figure 4] A functional block diagram showing the configuration of a center device. [Diagram 5]FIG. 13 is a diagram showing an example of data registered in a configuration information DB. [Figure 6] A diagram showing an example of data registered in the ECU repro data DB. [Figure 7] FIG. 13 is a diagram showing an example of data registered in a vehicle information DB; [Figure 8] A diagram showing an example of specification data [Figure 9] Flowchart showing new difference data registration processing [Figure 10] Flowchart showing distribution package generation processing [Figure 11] Flowchart showing the process of the vehicle-side system DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] An embodiment will be described below with reference to the drawings. The vehicle program rewriting system is a system capable of rewriting application programs such as vehicle control and diagnosis of an ECU mounted on a vehicle by OTA. As shown in Fig. 1, the vehicle program rewriting system 1 has a center device 3 on the communication network 2 side, a vehicle-side system 4 on the vehicle side, and a display terminal 5. The communication network 2 includes, for example, a mobile communication network using a 4G line or the like, the Internet, WiFi (Wireless Fidelity: registered trademark), and the like.

[0015] The display terminal 5 is a terminal having a function of receiving operation input from a user and a function of displaying various screens, and is, for example, a mobile terminal 6 such as a smartphone or tablet that can be carried by a user, or an in-vehicle display 7 such as a display that also serves as a navigation function or a meter display that is arranged in the vehicle cabin. The mobile terminal 6 can be connected to the communication network 2 if it is within the communication range of the mobile communication network. The in-vehicle display 7 is connected to the vehicle-side system 4.

[0016] If the user is outside the vehicle cabin and within the communication range of the mobile communication network, the user can perform procedures related to the rewriting of the application program by performing operation input while checking various screens related to the rewriting of the application program on the mobile terminal 6. If the user is inside the vehicle cabin, the user can perform procedures related to the rewriting of the application program by performing operation input while checking various screens related to the rewriting of the application program on the in-vehicle display 7. In other words, the user can perform procedures related to the rewriting of the application program by using the mobile terminal 6 and the in-vehicle display 7 separately when outside the vehicle cabin and when inside the vehicle cabin.

[0017] The center device 3 controls the OTA functions on the communication network 2 side in the vehicle program rewriting system 1, and functions as an OTA center. The center device 3 has a file server 8, a web server 9, and a management server 10, and the servers 8 to 10 are configured to be able to communicate data with each other.

[0018] The file server 8 has a function of managing application programs transmitted from the center device 3 to the vehicle-side system 4, and is a server that manages ECU programs and associated information provided by suppliers who are providers of application programs, distribution specification data provided by OEMs (Original Equipment Manufacturers), vehicle conditions acquired from the vehicle-side system 4, and the like. The file server 8 is capable of data communication with the vehicle-side system 4 via the communication network 2, and when a download request for a distribution package occurs, transmits a distribution package in which the distribution specification data is packaged and reprogram data, also called update data, to the vehicle-side system 4. The web server 9 is a server that manages web information, and provides various screens related to rewriting of application programs to the mobile terminal 6. The management server 10 manages personal information, etc. of users who are registered for the service of rewriting application programs, and manages the rewrite history of application programs for each vehicle.

[0019] The center device 3 transmits the distribution package as a compressed file, but transmits the reprogrammed data to the vehicle-side system 4 without compressing it. The reprogrammed data may or may not be compressed outside the center device 3, but the center device 3 does not compress the reprogrammed data received from outside.

[0020] The vehicle-side system 4 has a master device 11. The master device 11 has a DCM (Data Communication Module) 12 and a CGW (Central Gate Way) 13, and the DCM 12 and the CGW 13 are connected to each other via a first bus 14 so as to be able to perform data communication. The DCM 12 is an in-vehicle communication device that performs data communication with the center device 3 via a communication network 2, and when a distribution package is downloaded from the file server 8, the DCM 12 extracts write data from the distribution package and transfers it to the CGW 13. Alternatively, when the DCM 12 downloads a distribution package from the file server 8, the DCM 12 transfers the distribution package to the CGW 13. The CGW 13 extracts the write data from the distribution package.

[0021] The CGW 13 is a vehicle gateway device having a data relay function, and when it acquires write data from the DCM 12, it distributes the write data to a rewrite target ECU for rewriting an application program. The master device 11 manages the vehicle-side OTA functions in the vehicle program rewriting system 1, and functions as an OTA master. Although FIG. 1 illustrates a configuration in which the DCM 12 and the in-vehicle display 7 are connected to the same first bus 14, the DCM 12 and the in-vehicle display 7 may be connected to different buses. The CGW 13 corresponds to a relay device of the present disclosure.

[0022] In addition to the first bus 14, a second bus 15, a third bus 16, a fourth bus 17, and a fifth bus 18 are connected to the CGW 13 as buses inside the vehicle, and various ECUs 19 are connected via buses 15 to 17, and a power management ECU 20 is connected via bus 18.

[0023] The second bus 15 is, for example, a bus for a body system network. The ECUs 19 connected to the second bus 15 are ECUs that control the body system, such as a door ECU that controls the locking / unlocking of doors, a meter ECU that controls meter display, an air conditioner ECU that controls the operation of an air conditioner, and a window ECU that controls the opening and closing of windows. The third bus 16 is, for example, a bus for a driving system network. The ECUs 19 connected to the third bus 16 are ECUs that control the driving of the driving system, such as an engine ECU that controls the operation of an engine, a brake ECU that controls the operation of a brake, an ECT (Electronic Controlled Transmission) ECU that controls the operation of an automatic transmission, and a power steering ECU that controls the operation of a power steering.

[0024] The fourth bus 17 is, for example, a multimedia bus, a so-called MM-system network bus. The ECU 19 connected to the fourth bus 17 is, for example, a navigation ECU for controlling a navigation system, an ETC ECU for controlling an electronic toll collection system, i.e., an ETC (Electronic Toll Collection System: registered trademark) system, and other multimedia system control ECUs. The buses 15 to 17 may be buses of a system other than the body system network bus, the driving system network bus, and the multimedia system network bus. In addition, the number of buses and the number of ECUs 19 are not limited to the configuration illustrated. The power supply management ECU 20 is an ECU that has a function of managing the power supplies of the DCM 12, the CGW 13, the various ECUs 19, and the like.

[0025] A sixth bus 21 is connected to the CGW 13 as a bus on the outside of the vehicle. A DLC (Data Link Coupler) connector 22 to which a tool 23 is detachably connected is connected to the sixth bus 21. The inside-of-vehicle buses 14 to 18 and the outside-of-vehicle bus 21 are configured, for example, by a CAN (Controller Area Network: registered trademark) bus, and the CGW 13 performs data communication between the DCM 12, various ECUs 19, and the tool 23 in accordance with the CAN data communication standard and diagnostic communication standard (UDS: ISO14229). The DCM 12 and the CGW 13 may be connected by Ethernet, and the DLC connector 22 and the CGW 13 may be connected by Ethernet.

[0026] When the rewrite target ECU 19 receives the write data from the CGW 13, it writes the write data to a flash memory to rewrite the application program. In the above configuration, when the CGW 13 receives a request to obtain write data from the rewrite target ECU 19, it functions as a reprogramming master that distributes the write data to the rewrite target ECU 19. When the rewrite target ECU 19 receives the write data from the CGW 13, it functions as a reprogramming slave that writes the write data to a flash memory to rewrite the application program. Note that the "rewrite target ECU" may be referred to as the "target ECU."

[0027] There are two modes for rewriting an application program: a wired rewriting mode and a wireless rewriting mode. In the wired rewriting mode, when the tool 23 is connected to the DLC connector 22, the tool 23 transfers write data to the CGW 13. The CGW 13 relays or distributes the write data transferred from the tool 23 to the rewriting target ECU 19. In the wireless rewriting mode, as described above, when the DCM 12 downloads a distribution package from the file server 8, it extracts write data from the distribution package and transfers the write data to the CGW 13.

[0028] 2, the CGW 13 has, as electrical functional blocks, a microcomputer (hereinafter referred to as a microcomputer) 24, a data transfer circuit 25, a power supply circuit 26, and a power supply detection circuit 27. The microcomputer 24 has a CPU (Central Processing Unit) 24a, a ROM (Read Only Memory) 24b, a RAM (Random Access Memory) 24c, and a flash memory 24d. The microcomputer 24 executes various control programs stored in a non-transient substantial storage medium to perform various processes and control the operation of the CGW 13.

[0029] The data transfer circuit 25 controls data communication between the buses 14-18, 21 in accordance with the CAN data communication standard and the diagnostic communication standard. The power supply circuit 26 inputs a battery power supply (hereinafter referred to as +B power supply), an accessory power supply (hereinafter referred to as ACC power supply), and an ignition power supply (hereinafter referred to as IG power supply). The power supply detection circuit 27 detects the voltage values ​​of the +B power supply, the ACC power supply, and the IG power supply input by the power supply circuit 26, compares these detected voltage values ​​with predetermined voltage threshold values, and outputs the comparison result to the microcomputer 24. The microcomputer 24 judges whether the +B power supply, the ACC power supply, and the IG power supply supplied from the outside to the CGW 13 are normal or abnormal based on the comparison result input from the power supply detection circuit 27.

[0030] 3, the ECU 19 has, as electrical functional blocks, a microcomputer 28, a data transfer circuit 29, a power supply circuit 30, and a power supply detection circuit 31. The microcomputer 28 has a CPU 28a, a ROM 28b, a RAM 28c, and a flash memory 28d. The microcomputer 28 executes various control programs stored in a non-transient substantial storage medium to perform various processes and control the operation of the ECU 19.

[0031] The data transfer circuit 29 controls data communication between the buses 15 to 17 in accordance with the CAN data communication standard. The power supply circuit 30 inputs the +B power supply, the ACC power supply, and the IG power supply. The power supply detection circuit 31 detects the voltage values ​​of the +B power supply, the ACC power supply, and the IG power supply input by the power supply circuit 30, compares these detected voltage values ​​with a predetermined voltage threshold, and outputs the comparison result to the microcomputer 28. The microcomputer 28 judges whether the +B power supply, the ACC power supply, and the IG power supply supplied from the outside to the ECU 19 are normal or abnormal based on the comparison result input from the power supply detection circuit 27. The ECU 19 has a basically similar configuration, although the loads connected, such as sensors and actuators, are different. The DCM 12, the in-vehicle display 7, and the power supply management ECU also have the same basic configuration as the ECU 19 shown in FIG. 3.

[0032] 4, the center device 3 includes a package management unit 3A. The package management unit 3A includes a specification data generation unit 201, a package generation unit 202, a package distribution unit 203, an ECU repro data DB 204, an ECU metadata DB 205, and a package DB 206.

[0033] The supplier registers ECU-specific data using an input unit 218 and a display unit 219, which are user interface (UI) functions of the management server 10. The ECU-specific data includes program files such as new programs and difference data, program file-related information such as verification data and size of the program files and encryption method, and ECU attribute information such as the memory structure of the ECU 19. The program files are stored in the ECU repro data DB 204. The ECU attribute information is stored in the ECU metadata DB 205. The program file-related information may be stored in the ECU repro data DB 204 or the ECU metadata DB 205.

[0034] The OEM registers the authentic configuration information in the configuration information DB 208 for each vehicle model. Authentic configuration information is vehicle configuration information approved by a public institution. The configuration information is identification information related to the hardware and software of the ECU 19 mounted in the vehicle, and is an example of vehicle-related information. The configuration information also includes identification information of a system configuration consisting of multiple ECUs 19 and identification information of a vehicle configuration consisting of multiple systems. Vehicle constraint information related to program updates may also be registered as configuration information. For example, ECU group information, bus load table, information related to battery load, etc. described in the rewrite specification data may be registered.

[0035] The specification data generation unit 201 refers to each DB and generates rewritten specification data. The package generation unit 202 generates a distribution package including the rewritten specification data and the hash value of the difference data, and registers it in the package DB 206. The package DB 206 also registers the distribution package ID, distribution package file, data for verifying the integrity of the distribution package, and the like. The package generation unit 202 may generate a distribution package including the distribution specification data. The package distribution unit 203 distributes the registered distribution package and reprogrammed data to the vehicle-side system 4. The package distribution unit 203 corresponds to a distribution unit.

[0036] The vehicle information DB 213 stores vehicle information uploaded from each vehicle. The initial value stored before uploading may be the vehicle information at the time of vehicle production or sales. The configuration information DB 208 stores configuration information for each vehicle model.

[0037] OEM registers campaign information, which is information related to program updates and is distributed to vehicles, in the campaign DB 217. The campaign information here corresponds to the above-mentioned "distribution specification data" and is mainly information related to the update contents to be displayed on the vehicle-side system 4. In the vehicle-side system 4, for example, the user decides whether or not to download the update program based on the campaign information transmitted from the center device 3, and downloads it if necessary. Note that the parts of the package management unit 3A other than each database are functions realized by computer hardware and software. The vehicle communication unit 222 is a functional block for wirelessly communicating data between the center device 3 and the vehicle-side system 4.

[0038] The above process will be explained in more detail below, but first the contents of the data registered in each database will be explained. As shown in FIG. 5, the following data is registered in the configuration information DB 208 as an example. "Vehicle model" indicates the vehicle model. "Vehicle SW ID" is a software ID for the entire vehicle, and corresponds to the vehicle software ID. Only one "Vehicle SW ID" is assigned to each vehicle, and is updated whenever the version of the application program of one or more ECUs is updated. "Sys ID" is the ID of a system, assuming that a group of multiple ECUs 19 installed in each vehicle is a "system."

[0039] For example, in FIG. 1, the group of body system ECUs 19 is the body system, and the group of driving system ECUs 19 is the driving system. The "Sys ID" is updated when the version of the application program of one or more ECUs constituting the system is updated. The "ECU ID" is an ID for device identification indicating the type of each ECU. The "ECU SW ID" is a software ID for each ECU, and corresponds to the ECU software ID. For convenience, the "ECU ID" is shown here with the software version added. The "ECU SW ID" is updated when the version of the application program of the ECU is updated. Even if the "ECU ID" and the program version are the same, if the hardware configuration is different, a different "ECU SW ID" is used. In other words, the "ECU SW ID" is also information indicating the product number of the ECU.

[0040] FIG. 5 shows configuration information related to a vehicle with "vehicle type" = "aaa". Among the ECUs 19 mounted on the vehicle, an autonomous driving ECU (ADS), an engine ECU (ENG), a brake ECU (BRK), and an electric power steering ECU (EPS) are shown as examples. For example, the "ECU SW ID" of "Vehicle SW ID" = "0001" is "ads_001", "eng_010", "brk_001", and "eps_010", whereas the "ECU SW ID" of "Vehicle SW ID" = "0002" is "ads_002", "eng_010", "brk_005", and "eps_011", and three software versions have been updated. Accordingly, "Sys ID" = "SA01" is updated to "SA02", and "Sys ID" = "SA02" is updated to "SA03". In this way, initial values ​​are registered in the configuration information DB 208 at the time of production or sale of the vehicle, and are updated thereafter as the version of the application program of one or more ECUs is updated. In other words, the configuration information DB 208 indicates configuration information that is legitimately available on the market for each vehicle model.

[0041] As shown in FIG. 6, the following programs and data are registered in the ECU repro data DB 204 as examples. In FIG. 6, an automatic driving ECU (ADS), a brake ECU (BRK), and an electric power steering ECU (EPS) are exemplified as ECUs 19 whose application programs are updated among the ECUs 19 mounted on a certain vehicle model. For the latest "ECU SW ID" of these ECUs 19 to be updated, the old program and new program files of the ECU, the integrity verification data of the new program, the update data file which is the difference data between the new program and the old program, the integrity verification data of the update data, the rollback data file which is also the difference data, the integrity verification data of the rollback data, the hash value obtained by applying a hash function to the update data file, and the hash value obtained by applying a hash function to the rollback data file are registered. Hereinafter, the hash value may be referred to as a "Hash value".

[0042] In this embodiment, the description is based on the assumption that the rewriting from the old program to the new program is performed using differential data, but all data equivalent to the entire new application program may be used as the update data instead of the differential data. Rollback refers to the process of rewriting from the new program to the old program when an error or cancellation occurs during the program update.

[0043] 6 shows the data structure for the latest "ECU SW ID", but when data for an old "ECU SW ID" is stored, the old program file may be configured to refer to the new program file for the "ECU SW ID" that is one step older. Also, each integrity verification data and hash value may be calculated by the supplier and registered, or may be calculated and registered by the center device 3.

[0044] The ECU metadata DB 205 registers the following ECU-specific specification data as examples: For the latest "ECU SW ID", the size of the update data file, the size of the rollback data file, if the flash memory 28d in the ECU 19 has two or more sides, side information indicating which side (side A, side B, side C, etc.) the program is for, the transfer size, the read address of the program file, etc. These are examples of update data related information. More detailed content of the specification data will be described later.

[0045] Furthermore, attribute information indicating attributes of the ECU 19 is also registered in the ECU metadata DB 205. The attribute information is information indicating hardware attributes and software attributes related to the ECU. The "transfer size" is the transfer size when rewrite data is divided and transferred from the CGW 13 to the ECU 19, and the "key" is the key used by the CGW 13 to securely access the ECU 19. These are examples of software attribute information. In addition, the "vehicle model" and "ECU ID" also include the memory configuration of the flash memory 28d provided in the ECU 19, the type of bus to which the ECU 19 is connected, the type of power source connected to the ECU 19, and the like. These are examples of hardware attribute information.

[0046] For example, the memory configuration "1 side" is a single-side memory having one flash side, "2 sides" is a dual-side memory having two flash sides, and "suspend" is a single-side suspend memory having pseudo-two flash sides. The hardware attribute information and software attribute information are information used in the vehicle-side system 4 to control the rewrite of each ECU 19. Moreover, the software attribute information is data that directly specifies the rewrite operation of each ECU 19.

[0047] As shown in FIG. 7, the individual vehicle information DB 213 registers data for each individual vehicle, as shown below as an example. Mainly, configuration information for each individual vehicle and status information for each individual vehicle with respect to program updates are registered. Specifically, for the "VIN (Vehicle Identification Number)" which is the vehicle identification number and the ID of each vehicle, configuration information such as "Vehicle SW ID", "Sys ID", "ECU ID", and "ECU SW ID" are registered. A "Digest" value which is a hash value for these pieces of configuration information is also calculated and stored by the center device 3. The "operation side" is the side where the program currently being operated by the ECU 19 is written when the memory configuration is two sides, and values ​​uploaded together with the configuration information are registered.

[0048] "Access log" is the date and time when the vehicle uploaded the individual vehicle information to the center device 3. "Reprogram status" indicates the status of the reprogram in the vehicle, such as "campaign issued," "activation completed," "download completed," etc. In other words, this progress status indicates to what phase the reprogram in the vehicle has progressed and in what phase it is stagnating. When configuration information, etc. is uploaded from the vehicle-side system 4 to the center device 3, the "VIN" of each vehicle is added to the information, etc.

[0049] The following data is registered in the campaign DB217: campaign information ID, distribution package ID, message information such as text indicating specific update contents as the campaign contents, a list of "VIN" which is the ID of the vehicles that are the target of the campaign, "Vehicle SW ID" before and after the update, a list of "ECU SW ID" before and after the update, etc. The "target VIN" list can be registered by checking the individual vehicle information DB213 and the campaign DB217. It should be noted that this campaign information may also be registered together with the package DB206.

[0050] The specification data generation unit 201 accesses the ECU metadata DB 205 to acquire update data related information, hardware attribute information, software attribute information, and individual vehicle information as specification data related to the ECU 19 to be updated. For example, as shown in Fig. 8, the update data related information is "update program version", "update program acquisition address", "update program size", "rollback program version", "rollback program acquisition address", "rollback program size", "write data type", "write side", "update data", and "Hash value".

[0051] The hardware attribute information is "connection bus," "connection power source," and "memory type." The software attribute information is "rewrite surface information," "security access key information," "rewrite method," and "transfer size." "Rewrite method" is data that indicates whether rewrite is performed with the power self-holding circuit enabled when the IG is switched from on to off (power self-holding), or whether rewrite is performed according to IG on and IG off (power control). "Security access key information" may include information other than the key.

[0052] The individual vehicle information is the "VIN" mentioned above. The "VIN" is unique information for identifying the vehicle to which the distribution package is to be distributed, that is, an example of vehicle identification information. In addition to the "VIN", other vehicle identification information such as the chassis number or vehicle registration number may be used. The individual vehicle information may also include vehicle owner information.

[0053] Each piece of information will be explained below. "Write data type" is a type that indicates whether the program is differential data or all data. The write data type for the update program and the write data type for the rollback program may be described separately. The "write side" is information that indicates to which side of the ECU 19's two-sided memory the program is to be written. "Connection bus" is information for identifying the bus to which the ECU 19 is connected. "Connected power source" is information indicating the power source state to which the ECU 19 is connected, and a value indicating one of the battery power source (+B power source), the accessory power source (ACC power source), and the ignition power source (IG power source) is recorded.

[0054] "Memory type" is information for identifying the memory configuration of the ECU 19, and a value indicating a two-plane memory, a one-plane suspend type memory (pseudo two-plane memory), a one-plane memory, etc. is recorded. The "reprogramming surface information" is information indicating which surface of the ECU 19 is the startup surface (operational surface) and which surface is the reprogramming surface (non-operational surface). "Security access key information" is information for authenticating access to the ECU 19 using a key, and includes information on a key derivation key, a key pattern, and a decryption operation pattern. "Transfer size" is the data size when the program is divided and transferred to the ECU 19. "Update data" is the file name of the update data file, which is the differential data. "Hash value" is the file name of the data file of the hash value of the update data file. Here, the "hash value" is linked to the difference data. In other words, the difference data and the hash value are linked by including the file name of the update data file and the data file name of the hash value in the specification data. The vehicle-side system 4 that receives the specification data refers to the specification data to determine which hash value corresponds to which difference data.

[0055] These pieces of information are stored in the above-mentioned specific ECU order with "ECU ID" as a key, as shown in FIG. 8, for example. After acquiring information for all ECUs, the specification data generating unit 201 specifies "rewrite environment information" for the vehicle to be updated. The "rewrite environment information" is information used for rewrite control in the vehicle-side system 4 for a group of ECUs or the entire vehicle, and is data that directly specifies the rewrite operation. For example, examples of rewrite environment information for the entire vehicle include "vehicle state" indicating whether the program update in the vehicle-side system 4 is performed while the vehicle is running (IG switch is on) or while the vehicle is parked (IG switch is off), "battery load (remaining battery capacity)" indicating the constraints on the remaining battery capacity that allows the program update in the vehicle-side system 4 to be executed, and bus load table information indicating the constraints on the bus load that allows the write data to be transferred in the vehicle-side system 4.

[0056] The rewrite environment information for a group includes the ECUs 19 belonging to the group and the ECU order within the group. The vehicle-side system 4 controls program updates to be synchronized on a group basis, and writes to the ECUs 19 in a specified ECU order. The specification data generating unit 201 starts a screen for registering rewrite environment information, and receives input from an OEM worker. Alternatively, Excel (registered trademark) into which the rewrite environment information has been entered may be imported. Alternatively, the constraint information registered in the configuration information DB 208 may be extracted.

[0057] The bus load table is a table showing the correspondence between the power supply state and the transmission capacity of the bus. The transmission capacity is the sum of the transmission capacity of the vehicle control data and the write data that can be transmitted with respect to the maximum transmission capacity. For example, if the transmission capacity of the first bus is "80%" with respect to the maximum transmission capacity, the CGW 13 allows "50%" with respect to the maximum transmission capacity as the transmission capacity of the vehicle control data, and allows "30%" with respect to the maximum transmission capacity as the transmission capacity of the write data, in the IG power supply state. Also, the CGW 13 allows "30%" with respect to the maximum transmission capacity as the transmission capacity of the vehicle control data, and allows "50%" with respect to the maximum transmission capacity as the transmission capacity of the write data, in the ACC power supply state. Also, the CGW 13 allows "20%" with respect to the maximum transmission capacity as the transmission capacity of the vehicle control data, and allows "60%" with respect to the maximum transmission capacity as the transmission capacity of the write data, in the +B power supply state. The same applies to the second bus and the third bus.

[0058] Finally, the specification data generation unit 201 arranges each of the generated or acquired data in accordance with a predetermined data structure, and generates rewritten specification data as shown in FIG. 8. That is, the specification data generation unit 201 generates the rewritten specification data in a data structure that can be interpreted by the vehicle-side system 4. It is advisable to write each ECU information in the rewritten specification data in order of the youngest group and in the order of ECUs within the group. For example, if group 1 is "ADS", and group 2 is first "BRK" and second "EPS", the ECU information column of the specification data will list the ECU information for "ADS" first, then the ECU information for "BRK", and finally the ECU information for "EPS".

[0059] In the specification data shown in FIG. 8, the ECU information "ECU ID" to "Transfer size" are an example of target device related information including the type of the target ECU 19, and correspond to the hardware attribute information and software attribute information described above. Additionally, "Update program version" to "Hash value" are an example of update data related information. Additionally, the "rewrite environment" for a group of ECUs or the entire vehicle is an example of update process information that specifies the update process in the vehicle.

[0060] Next, the operation according to the gist of the present embodiment will be described. As shown in Fig. 9, when registering new differential data, the specification data generating unit 201 calculates a hash value of the differential data (S1), and registers the differential data and the hash value in the ECU repro data DB 204 (S2). The DB 204 corresponds to a hash value storage unit.

[0061] As shown in FIG. 10, the package generation unit 202 obtains and prepares hash values ​​corresponding to all the difference data of the data to be updated from the ECU repro data DB 204 (S11). If there is a plurality of difference data to be updated, a hash value is generated for each difference data, so that a plurality of hash values ​​are generated. Next, the configuration information DB 208 is compared with the individual vehicle DB 213 to determine whether there is an update by a new program, that is, whether there is campaign information. The package generation unit 202 also determines whether the individual vehicle package generation conditions are met (S12). If it is determined that the individual vehicle package generation conditions are met (YES), the process proceeds to step S13. If it is determined that the individual vehicle package generation conditions are not met (NO), the process proceeds to step S14.

[0062] The individual vehicle package generation condition is, for example, whether or not the update data is for a fee, in other words, whether or not the update data is a billable package. If the update data is for a fee, the individual vehicle package generation condition is determined to be positive. By configuring in this way, it is possible to limit the application of the update package to vehicles of users who have subscribed to the paid service. Alternatively, the individual vehicle package generation condition may be a flag indicating whether or not an individual vehicle package is required. For example, an operator sets a flag according to the type of ECU to be updated and the type of update data. Furthermore, S12 may be omitted, and individual vehicle identification information may always be stored in the specification data of the distribution package.

[0063] A package including specification data that stores vehicle identification information is called a personal vehicle package, and a package including specification data that does not store vehicle identification information is called a generic package. A personal vehicle package is used only by a vehicle specified by the specification data of the personal vehicle package, so that it is possible to prevent the package from being used to update programs of other vehicles and to accommodate customized ECU settings. In contrast, a generic package is a package that is widely applicable to vehicles of a specific model, and one generic package can be applied to multiple vehicles, so that the processing load required to generate a distribution package in the center device 3 can be reduced.

[0064] If it is a personal vehicle package, the vehicle identification information "VIN" is stored in the specification data (S13), and further information linking the hash value and the differential data, that is, the hash value and the file name of the differential data, is stored (S14). If it is not a personal vehicle package (S12; NO), step S13 is skipped and step S14 is executed. Then, other necessary information is stored to generate a distribution package (S15), and finally a signature is added to authenticate the data of the package (S16).

[0065] In this embodiment, the personal vehicle package or the general-purpose package does not include update data and rollback data. The update data and rollback data may have a file size of several gigabytes. By not including this data in the personal vehicle package or the general-purpose package, the file size of the package can be significantly reduced. Since the personal vehicle package or the general-purpose package is generated as a compressed file during package generation, a small file size can reduce the processing load of the center device 3. In other words, the center device 3 can generate the package in a shorter time than when generating a package including update data and rollback data.

[0066] Next, the processing of the vehicle-side system 4, which is an on-board electronic control device, will be described. As shown in Fig. 11, the vehicle-side system 4 downloads a distribution package addressed to the vehicle, and then downloads the difference data (S21). The "update software" in the figure corresponds to the difference data. Alternatively, the vehicle-side system 4 may download the distribution package addressed to the vehicle and complete verification of the package, and then download the difference data of the file name stored in the distribution package.

[0067] Next, a hash value is calculated for the downloaded differential data (S22), and it is determined whether it matches the hash value stored in the distribution package (S23). If the two hash values ​​match (YES), the OTA is performed, that is, the downloaded differential data is installed and activated (S24), and if the hash values ​​do not match (NO), the OTA is canceled (S25).

[0068] As described above, according to this embodiment, the configuration information DB 208 of the center device 3 stores device identification information for each of the multiple ECUs 19 and information on the software architecture of the device together with the vehicle type. The specification data generation unit 201 obtains difference data, which is the difference between update data and data before the update, for each ECU 19 whose data is to be updated, calculates a hash value of the difference data, and stores the calculated hash value in the ECU repro data DB 204. Then, when generating a distribution package for the ECU 19 whose data is to be updated, the package generation unit 202 generates the package using the corresponding hash value stored in the ECU repro data DB 204.

[0069] In other words, when generating a distribution package for the ECU 19 that is the target of data update, the package generation unit 202 generates a distribution package that includes the corresponding hash value stored in the ECU repro data DB 204. The package generation unit 202 generates a distribution package that does not include an update data file or rollback data.

[0070] With this configuration, the data size can be reduced by including a hash value of the difference data in the package distributed to each vehicle, and the processing time of the package can be shortened. Also, the vehicle that receives the distribution package can determine whether the difference data for updating the data corresponding to the vehicle is genuine or not, based on the hash value included in the specification data and the hash value calculated by the vehicle from the update data file.

[0071] In addition, the center device 3 manages data using linking information that links differential data with a distribution package that includes a hash value corresponding to the differential data, so that it is possible to easily identify differential data that corresponds to a distribution package that includes that hash value.

[0072] In addition, the package generation unit 202 generates a distribution package including multiple hash values ​​corresponding to multiple "ECU IDs" and linking information corresponding to the multiple hash values. This makes it possible for the vehicle receiving the distribution package to easily determine whether the multiple differential data for updating the multiple data corresponding to the vehicle are genuine or not, based on the hash values ​​and the hash values ​​calculated from the differential data.

[0073] Furthermore, since the package generation unit 202 generates the distribution package including the vehicle identification information "VIN", the package distribution destination, i.e., the vehicle that should receive the package, can be identified based on the "VIN". In addition, the package generation unit 202 generates the distribution package including a signature used to authenticate the data of the distribution package, thereby improving security.

[0074] When the vehicle-side system 4 receives a distribution package from the center device 3 and finds that the package contains a hash value, the vehicle-side system 4 requests the center device 3 to download difference data corresponding to the hash value. This makes it possible to reliably obtain difference data for updating data corresponding to the vehicle based on the hash value.

[0075] In addition, when the vehicle-side system 4 downloads the differential data, it compares the hash value with the hash value calculated for the differential data to verify the validity of the differential data, so that the validity of the differential data downloaded from the center device 3 can be verified using the hash value included in the distribution package.

[0076] (Other embodiments) The vehicle identification information "VIN" may be included in the distribution package and the distribution package may be signed, if necessary. When the OTA is stopped in step S25, a request for downloading may be made to the center device 3 again. Although the present disclosure has been described based on the embodiment, it is understood that the present disclosure is not limited to the embodiment or structure. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and forms, and other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

[0077] The control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more special-purpose computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. [Explanation of symbols]

[0078] In the drawing, 1 is a vehicle program rewriting system, 3 is a center device, 4 is a vehicle-side system, 11 is a master device, 12 is a DCM, 13 is a CGW, 19 is an ECU, 201 is a specification data generation unit, 202 is a package generation unit, 204 is an ECU repro data DB, 205 is an ECU metadata DB, 206 is a package DB, and 208 is a configuration information DB.

Claims

1. A center device that manages data to be written to a plurality of electronic control devices (19) mounted on a vehicle, a vehicle information storage unit (208) in which device identification information for each of the plurality of electronic control units and information regarding the software architecture of the device are stored together with the vehicle type; a hash value generating unit (201) for determining, for each electronic control device to be updated, difference data which is a difference between update data and data before the update, calculating a hash value of the difference data, and storing the calculated hash value in a hash value storage unit (204); a package generation unit (202) that generates a distribution package for an electronic control device that is a target for updating the data by using the corresponding hash value stored in the hash value storage unit, The package generation unit is a center device that generates the distribution package by including vehicle identification information in the distribution package.

2. 2. The center device according to claim 1, wherein data is managed using linking information linking the difference data with a distribution package including a hash value corresponding to the difference data.

3. 3. The center device according to claim 2, wherein the package generation unit generates a distribution package including a plurality of hash values ​​and linking information corresponding to the plurality of hash values.

4. 4. The center device according to claim 1, wherein the package generation unit generates the distribution package so as to include a signature used for authenticating data of the distribution package in the distribution package.

5. A central device that manages data to be written to a plurality of electronic control devices (19) mounted on a vehicle, comprising: a vehicle information storage unit (208) in which device identification information for each of the plurality of electronic control units and information regarding the software architecture of the device are stored together with the vehicle type; a hash value generating unit (201) for determining, for each electronic control device to be updated, difference data which is a difference between update data and data before the update, calculating a hash value of the difference data, and storing the calculated hash value in a hash value storage unit (204); a package generation unit (202) that generates a distribution package for an electronic control device that is a target for updating the data by using a corresponding hash value stored in the hash value storage unit; a distribution unit (203) that distributes the distribution package to a vehicle equipped with the plurality of electronic control units, the package generation unit generates a distribution package that does not include the difference data and that includes a hash value; The distribution unit is a center device that distributes the package and the difference data separately.

6. 6. The center device according to claim 5, wherein the distribution unit distributes the package as a compressed file and the difference data as a non-compressed file.

7. 7. An electronic control device (4) mounted on a vehicle and communicating with a center device described in any one of claims 1 to 6, wherein when a received distribution package contains the hash value, the in-vehicle electronic control device requests the center device to download difference data corresponding to the hash value.

8. 8. The in-vehicle electronic control device according to claim 7, wherein, when the difference data is downloaded, the hash value is compared with a hash value calculated for the difference data to verify the validity of the difference data.

9. A central device that manages data to be written to a plurality of electronic control devices (19) mounted on a vehicle, comprising: a vehicle information storage unit (208) in which device identification information for each of the plurality of electronic control units and information regarding the software architecture of the device are stored together with the vehicle type; a hash value generating unit (201) for determining, for each electronic control device to be updated, difference data which is a difference between update data and data before the update, calculating a hash value of the difference data, and storing the calculated hash value in a hash value storage unit (204); a package generation unit (202) that generates a distribution package for an electronic control device that is a target for updating the data by using the corresponding hash value stored in the hash value storage unit, The package generation unit is a center device that generates a distribution package that does not include the difference data and includes the hash value.

10. A center device that distributes data to be written to a plurality of electronic control devices (19) mounted in a vehicle to the vehicle, a vehicle information storage unit (208) in which device identification information for each of the plurality of electronic control units and information regarding the software architecture of the device are stored together with the vehicle type; a package acquisition unit (202) for acquiring a distribution package including a hash value of difference data, which is a difference between update data and data before the update, for each electronic control device to be updated; a distribution unit (203) that distributes the distribution package to a vehicle equipped with the plurality of electronic control units, the package acquisition unit acquires a distribution package that does not include the difference data and that includes the hash value; The distribution unit is a center device that distributes the package and the difference data separately.

Images