Electronic Control Unit

Abstract

To avoid an increase in a communication load of an entire system.SOLUTION: An electronic control device 3 comprises: a first management table receiving section 11a that receives, from a specific electronic control device 2, a management table capable of identifying electronic control devices 4 to 6 which may be backup destinations of storage data stored in the electronic control device; a rewritable capacity recording section 11b that records a rewritable capacity of the storage data in the management table; a first management table transmission section 11c that transmits the management table in which the rewritable capacity of the storage data is recorded to the backup destination electronic control device; a rewriting-time backup data transmission section 11e that transmits at least a part of the storage data as backup data to the backup destination electronic control device; and a second management table receiving section 11f that receives, from the backup destination electronic control device, the management table in which recording information indicating that the backup data is stored in the backup destination electronic control device is recorded.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an electronic control device. [Background technology]

[0002] For example, in an on-board electronic control unit (hereinafter referred to as ECU (Electronic Control Unit)), software (hereinafter referred to as "software") is configured to be rewritable for the purpose of improving functions, eliminating defects, etc. When rewriting software, for example, in an unstable communication environment, it is necessary to back up the saved data stored in the rewrite target ECU before writing update data to the rewrite target ECU. That is, by securing a backup destination ECU other than the rewrite target ECU and saving the saved data as backup data in the backup destination ECU before writing update data to the rewrite target ECU, if the rewrite of the software in the rewrite target ECU is not completed normally, it becomes possible to restore the software to the state before the rewrite using the backup data saved in the backup destination ECU.

[0003] To back up stored data, it is necessary to identify which ECU is to be reserved as the backup destination ECU, and it is necessary to manage the backup destination ECU. For example, Patent Document 1 discloses a configuration in which a specific ECU holds a management table, and the management table is used to manage the free space of multiple ECUs that can be backup destination ECUs. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-79768 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, in a configuration in which a specific ECU holds the management table, multiple ECUs that can be backup destination ECUs must each access the specific ECU to refer to the free space of the other ECUs, which results in concentrated access to the specific ECU. As a result, the amount of data communication between the multiple ECUs that can be backup destination ECUs and the specific ECU increases, which increases the communication load of the entire system.

[0006] The present invention has been made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device that can prevent an increase in the communication load of the entire system in advance by storing saved data stored in the electronic control device to be rewritten as backup data in a backup electronic control device before writing update data to the electronic control device to be rewritten. [Means for solving the problem]

[0007] According to the invention described in claim 1, software can be rewritten by writing update data. The first management table receiving unit (11a) receives from a specific electronic control unit (2) a management table capable of identifying electronic control units (4-6) that can be backup destinations for data stored in the electronic control unit. The rewrite capacity recording unit (11b) records the rewrite capacity of the stored data in the management table. When the rewrite capacity recording unit records the rewrite capacity of the stored data, the first management table transmitting unit (11c) transmits the management table in which the rewrite capacity of the stored data is recorded to the backup destination electronic control unit. The rewrite backup data transmitting unit (11e) transmits at least a part of the stored data as backup data to the backup destination electronic control unit. The second management table receiving unit (11f) receives from the backup destination electronic control unit a management table in which record information indicating that the backup data has been stored in the backup destination electronic control unit is recorded.

[0008] In a configuration in which the data stored in the electronic control device to be rewritten is stored as backup data in the electronic control device to be backed up before writing update data to the electronic control device to be rewritten, unlike the conventional configuration in which a specific electronic control device holds a management table, the electronic control device to be rewritten and the electronic control device to be the backup hold the management table by transmitting and receiving the management table between the electronic control device to be rewritten and the electronic control device to be the backup. This makes it possible to prevent concentration of access to the specific electronic control device and to prevent an increase in the amount of data communication between multiple electronic control devices that can be the electronic control device to be the backup destination and the specific electronic control device. This makes it possible to prevent an increase in the communication load of the entire system. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a configuration diagram of a vehicle-side system according to an embodiment of the present invention; [Diagram 2] A diagram showing the management table [Diagram 3] Functional block diagram of electronic control unit [Figure 4] Control Unit Functional Block Diagram [Diagram 5] A flowchart showing a process for determining whether a rewrite request has occurred among processes to be rewritten during rewrite. [Figure 6] A flowchart showing a back data transmission process among the processes to be rewritten during rewriting. [Figure 7] Flowchart showing backup destination processing during rewriting [Figure 8] Diagram showing the arrangement of stored data [Figure 9] A diagram showing the management table [Figure 10] A diagram showing the management table [Figure 11] A diagram showing the management table [Figure 12] Diagram showing movement of stored data [Figure 13] Diagram showing the movement of the management table [Figure 14]Flowchart showing the process of rewriting during recovery [Figure 15] Flowchart showing the process of rewriting during recovery [Figure 16] Flowchart showing backup destination processing during recovery [Figure 17] Diagram showing movement of stored data [Figure 18] Flowchart showing the rewrite target processing at the time of deletion [Figure 19] Flowchart showing backup destination processing at the time of deletion [Figure 20] A diagram showing the management table [Figure 21] A diagram showing the management table [Figure 22] A diagram showing the management table [Diagram 23] Diagram showing the movement of the management table DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] An embodiment will be described below with reference to the drawings. As shown in FIG. 1, a vehicle-side system 1 mounted on a vehicle includes a central ECU 2 functioning as a central gateway and ECUs 3 to 6 that are targets of software rewriting controlled by the central ECU 2, which are connected to each other via an in-vehicle network 7 so as to be capable of data communication. The software includes an application for realizing a specific function, and can also be called a program. The central ECU 2 corresponds to a specific ECU. Each of the ECUs 3 to 6 corresponds to either an ECU to be rewritten, whose software is rewritten by writing update data, or an ECU to be a backup destination for backing up stored data. The central ECU 2 and each of the ECUs 3 to 6 can store a management table, which will be described later, and can transmit and receive the management table to and from other ECUs.

[0011] Each of the ECUs 3 to 6 is, for example, an ECU having a function of controlling a drive system, an ECU having a function of controlling an ADAS (Advanced Driving Assistant System), an ECU having a function of controlling a multimedia system, etc. The in-vehicle network 7 is, for example, a CAN (Controller Area Network) (registered trademark), FLEXRAY (registered trademark), CXPI (Clock Extension Peripheral Interface) (registered trademark), etc. Also, a plurality of in-vehicle networks 7 may be arranged for each different control system.

[0012] The vehicle-side system 1 is configured to be able to rewrite the software of each of the ECUs 3 to 6 for the purpose of improving functions, eliminating defects, etc. When rewriting software, for example, in preparation for rewriting software in an unstable communication environment, it is necessary to back up the saved data that has a proven track record and is saved in the ECU to be rewritten. That is, it is necessary to secure a backup destination ECU other than the ECU to be rewritten, and save the saved data as backup data in the backup destination ECU before writing update data to the ECU to be rewritten.

[0013] For example, when ECU3 is the ECU to be rewritten, at least one of ECU4-6 becomes the backup destination ECU. When the central ECU2 controls the rewriting of the software of its own device and the central ECU2 is the ECU to be rewritten, at least one of ECU3-6 becomes the backup destination ECU. When any of ECU3-6 is the ECU to be rewritten, in addition to at least one of ECU3-6 becoming the backup destination ECU, the central ECU2 may also become the backup destination ECU.

[0014] The central ECU 2 is wirelessly connected to a center device (not shown) and can receive a distribution package transmitted from the center device, and upon receiving the distribution package, extracts update data from the received distribution package. The central ECU 2 is wiredly connected to a diagnostic tool (not shown) and can receive a distribution package transmitted from the diagnostic tool, and upon receiving the distribution package, extracts update data from the received distribution package.

[0015] When the installation enabling condition for the rewrite target ECU is satisfied, the central ECU 2 delivers the update data to the rewrite target ECU and notifies the rewrite target ECU of an installation instruction, causing the rewrite target ECU to install the update data. The installation enabling condition is, for example, that the user has performed an operation to approve the installation, that the remaining battery charge of the in-vehicle battery is equal to or greater than a predetermined capacity, that the vehicle is not in an illegal environment, that the vehicle state is in a state in which installation is possible, that the update data is normal data, that the memory structure of the installation destination of the update data is normal, and that the communication load of the in-vehicle network 7 is less than a predetermined level.

[0016] When the installation of the update data in the rewrite target ECU is completed and the activation enabling condition for the rewrite target ECU is satisfied, the central ECU 2 notifies the rewrite target ECU of an activation instruction to validate the installed update data, and causes the rewrite target ECU to activate the update data. The activation enabling condition may be, for example, that the user has performed an operation to approve the activation, that the remaining battery charge of the in-vehicle battery is equal to or greater than a predetermined capacity, that the vehicle state is in a state in which activation is possible, that the installed update data is normal data, etc.

[0017] When the rewrite target ECU performs backup of stored data, the central ECU 2 and each of the ECUs 3 to 6 transmit and receive the management table shown in FIG. 2 between the other ECUs. The management table is data with a rewrite capacity, free capacity, received data address, data amount, CANID, and priority as unit records. The rewrite capacity recording area records the amount of stored data. The free capacity recording area records the amount of data that the ECU with the corresponding CANID can store. The received data address recording area records the start address and end address of the received stored data, and records the data area specified by the start address to the end address. The data amount recording area records the amount of data indicated by the data area of ​​the received data address. The CANID recording area records a unique number assigned to each of the ECUs 3 to 6. The priority recording area records the priority of the destination of the management table.

[0018] The management table is alternatively held in the central ECU 2 and each of the ECUs 3 to 6, and is held in the central ECU 2 when the central ECU 2 has not notified the ECU to be rewritten of a backup instruction for stored data. The central ECU 2 holds a management table in which information is recorded in the recording areas for free space, CAN ID, and priority, but no information is recorded in the recording areas for rewrite capacity, received data address, and data amount. When each of the ECUs 3 to 6 is installed in a vehicle, a management table in which free space, CAN ID, and priority are recorded is created, and the free space and priority are updated to the latest state every time stored data is backed up. In the example of FIG. 2, the free space of ECU3 is "20MByte", the CANID is "1", and the priority is "1", the free space of ECU4 is "4MByte", the CANID is "2", and the priority is "3", the free space of ECU5 is "3MByte", the CANID is "3", and the priority is "4", and the free space of ECU6 is "5MByte", the CANID is "4", and the priority is "2". In this embodiment, the priority order is given in descending order of free space, but the priority order may be given in consideration of the specifications such as the processing power of each of ECU3 to 6 in addition to the free space. When notifying the rewrite target ECU of the installation instruction, the central ECU 2 transmits the management table held therein to the rewrite target ECU.

[0019] Each of the ECUs 3 to 6 basically has the same configuration, and includes a control unit 8, a communication interface unit 9, and an input / output interface unit 10, as shown in Fig. 3. The control unit 8 is mainly configured with a microcomputer (hereinafter referred to as a microcomputer) having a CPU, ROM, RAM, I / O, etc., and executes a computer program stored in a non-transient substantial storage medium to execute processing corresponding to the computer program, thereby controlling the operation of each of the ECUs 3 to 6. The communication interface unit 9 controls data communication with the in-vehicle network 7. The input / output interface unit 10 controls data input / output with various devices, and controls, for example, the input of sensing data from a sensor, the output of drive data to an actuator, etc.

[0020] Since each of the ECUs 3 to 6 can be either a rewrite target ECU or a backup destination ECU as described above, the control unit 8 includes a functional unit that functions when rewriting software, a functional unit that functions when restoring software, and a functional unit that functions when deleting backup data. That is, the control unit 8 includes a rewrite target functional unit 11 that functions as a rewrite target ECU when rewriting software, a rewrite backup destination functional unit 12 that functions as a backup destination ECU when rewriting software, a rewrite target functional unit 13 that functions as a rewrite target ECU when restoring software, a restoration backup destination functional unit 14 that functions as a backup destination ECU when restoring software, a delete target functional unit 15 that functions as a rewrite target ECU when deleting backup data, and a delete backup destination functional unit 16 that functions as a backup destination ECU when deleting backup data.

[0021] As shown in FIG. 4, the rewrite target function unit 11 includes a first management table receiving unit 11a, a rewrite capacity recording unit 11b, a first management table transmitting unit 11c, a rewrite data transmission request receiving unit 11d, a rewrite backup data transmitting unit 11e, and a second management table receiving unit 11f.

[0022] The first management table receiving unit 11a receives the management table transmitted from the central ECU 2. When the first management table receiving unit 11a receives the management table transmitted from the central ECU 2, the rewrite capacity recording unit 11b records the rewrite capacity of the stored data in the received management table. When the rewrite capacity recording unit 11b records the rewrite capacity of the stored data, the first management table transmitting unit 11c identifies one of the ECUs as a backup destination ECU in accordance with the priority, and transmits the management table in which the rewrite capacity of the stored data is recorded to the identified backup destination ECU.

[0023] The rewrite-time data transmission request receiving unit 11d receives a rewrite-time data transmission request transmitted from the backup destination ECU. The rewrite-time backup data transmitting unit 11e obtains the free space of the ECU specified as the backup destination ECU by referring to the management table, and when the rewrite-time data transmission request transmitted from the backup destination ECU is received by the rewrite-time data transmission request receiving unit 11d, transmits the amount of data of the saved data that corresponds to the free space of the backup destination ECU as backup data to the backup destination ECU. The second management table receiving unit 11f receives from the backup destination ECU a management table in which record information indicating that the backup data has been saved in the backup destination ECU is recorded.

[0024] The rewrite backup destination function unit 12 includes a rewrite data transmission request transmission unit 12a and a rewrite backup data reception unit 12b. The rewrite data transmission request transmission unit 12a transmits a rewrite data transmission request to the rewrite target ECU. The rewrite backup data reception unit 12b receives the backup data transmitted from the rewrite target ECU.

[0025] The function unit 13 to be rewritten at the time of recovery includes a recovery request determination unit 13a, a recovery data transmission request transmission unit 13b, and a recovery backup data reception unit 13c. The recovery request determination unit 13a determines the occurrence of a data recovery request. When the recovery request determination unit 13a determines that a data recovery request has occurred because the software rewriting has not been completed normally, the recovery data transmission request transmission unit 13b specifies a destination of the recovery data transmission request according to the priority recorded in the management table, and transmits the recovery data transmission request to the backup destination ECU specified as the destination. The recovery backup data reception unit 13c receives the backup data stored in the backup destination ECU from the backup destination ECU.

[0026] The recovery time backup destination function unit 14 includes a recovery time data transmission request receiving unit 14a and a recovery time backup data transmitting unit 14b. The recovery time data transmission request receiving unit 14a receives a recovery time data transmission request transmitted from the rewrite target ECU. When the recovery time data transmission request receiving unit 14a receives the recovery time data transmission request, the recovery time backup data transmitting unit 14b transmits the backup data to the rewrite target ECU.

[0027] The deletion time backup destination function unit 16 includes a recorded information deleting unit 16a. The recorded information deleting unit 16a deletes recorded information recorded in a management table from the management table.

[0028] Next, the operation of the above-mentioned configuration will be described with reference to Fig. 5 to Fig. 23. In this case, when the ECUs 3 to 6 operate as rewrite target ECUs during software rewrite, they perform rewrite target processing during rewrite by the rewrite target function unit 11, and when they operate as backup target ECUs, they perform backup target processing during rewrite by the rewrite backup target function unit 12. When the ECUs 3 to 6 operate as rewrite target ECUs during software recovery, they perform rewrite target processing during recovery by the recovery rewrite target function unit 13, and when they operate as backup target ECUs, they perform backup target processing during recovery by the recovery backup target function unit 14. When the ECUs 3 to 6 operate as rewrite target ECUs during software deletion, they perform rewrite target processing during deletion by the delete rewrite target function unit 15, and when they operate as backup target ECUs, they perform backup target processing during deletion by the delete backup target function unit 16. The following describes in sequence the processes that the control unit 8 performs in each of the ECUs 3 to 6 when rewriting software, restoring software, and deleting backup data.

[0029] (1) When rewriting software First, the rewrite target process and the backup destination process during software rewrite will be described with reference to FIG. 5 to FIG. (1-1) Processing to be rewritten during rewriting (see Figures 5 and 6) The control unit 8 performs a process of determining whether a rewrite request has occurred and a process of transmitting back data as a process of rewrite target at the time of rewrite.

[0030] (1-1-1) Processing to determine whether a rewrite request has occurred (see Figure 5) When the control unit 8 starts the process of determining whether a rewrite request has occurred, it determines whether or not a rewrite request has occurred from the outside (S101). When the control unit 8 determines that a rewrite request has not occurred from the outside (S101: NO), it ends the process of determining whether a rewrite request has occurred. When the control unit 8 determines that a rewrite request has occurred from the outside (S101: YES), it receives the management table transmitted from the central ECU 2 (S102) and records the rewrite capacity of the stored data in the management table (S103).

[0031] The control unit 8 identifies the ECU with the highest priority as the first backup destination ECU (S104), transmits a management table recording the rewrite capacity of the stored data to the first backup destination ECU (S105), and terminates the process of determining whether a rewrite request has occurred.

[0032] (1-1-2) Back data transmission process (see Figure 6) When the control unit 8 starts the backup data transmission process, it repeats the data request process until it receives from the backup destination ECU a management table in which record information indicating that the backup data has been stored in the backup destination ECU is recorded (S111 to S114). When the control unit 8 receives a rewrite data transmission request transmitted from the backup destination ECU (S112), it transmits the amount of data from the stored data that corresponds to the free space of the backup destination ECU as backup data to the backup destination ECU (S113).

[0033] When the control unit 8 determines that the management table in which record information indicating that the backup data has been saved in the backup destination ECU is received from the backup destination ECU, the control unit 8 ends the back-data transmission process.

[0034] (1-2) Backup destination processing during rewriting (see Figure 7) When the control unit 8 starts the backup destination process during rewriting, it repeats the management table moving process until the total data amount reaches the rewrite capacity of the stored data (S201 to S212). When the control unit 8 receives the management table transmitted from the ECU to be rewritten (S202), it records the latest free space in the management table (S203), and repeats the data rewriting process unless the amount of backup data received from the ECU to be rewritten reaches the free space (S204 to S209).

[0035] The control unit 8 determines whether the total amount of backup data received from the rewrite target ECU exceeds the rewrite capacity of the stored data (S205). If the control unit 8 determines that the total amount of backup data received from the rewrite target ECU does not exceed the rewrite capacity of the stored data (S205: NO), it transmits a rewrite time data transmission request to the rewrite target ECU (S206). When the control unit 8 receives the backup data transmitted from the rewrite target ECU (S207), it records the amount of the received backup data in the management table (S208).

[0036] When the control unit 8 determines that the amount of backup data received from the rewrite target ECU has reached the available capacity, it specifies the ECU with the next highest priority as the next backup destination ECU (S210) and transmits the management table to the next backup destination ECU (S211).When the control unit 8 determines that the total amount of data has reached the rewrite capacity of the stored data, it transmits the management table to the rewrite target ECU (S213) and ends the rewrite backup destination process.

[0037] The movement of stored data and management tables when rewriting software will be described below with reference to Fig. 8 to Fig. 13. As shown in Fig. 8, the ECU 3 is the ECU to be rewritten, and data A (2MByte), data B (3MByte), and data C (2MByte) are stored as stored data in the ECU 3 to be rewritten. Note that data A, data B, and data C are divided into software functional block units, for example.

[0038] When ECU3 receives the management table transmitted from central ECU2, it records "7MByte", which is the total of data A, data B, and data C, in the column for the rewrite capacity of stored data, as shown in Fig. 9. ECU3 identifies ECU6, which is assigned the next highest priority, as the first backup destination ECU, and transmits the management table in which the rewrite capacity of the stored data is recorded to ECU6 identified as the first backup destination ECU.

[0039] When the ECU 6 receives the management table transmitted from the ECU 3, it transmits a rewrite data transmission request to the ECU 3. When the ECU 6 receives the backup data transmitted from the ECU 3, it records the received data address and the data amount of the received backup data in the management table, as shown in FIG. 10. When the ECU 6 determines that the data amount of the backup data received from the ECU 3 has reached the free space, it specifies the ECU 4, which is given the next highest priority, as the next backup destination ECU, and transmits the management table to the ECU 4 specified as the next backup destination ECU. That is, the ECU 6 receives the data A and data B transmitted from the ECU 3 as backup data, stores the received backup data, and then determines that the data amount of the backup data has reached the free space, specifies the ECU 4 as the next backup destination ECU, and transmits the management table to the ECU 4 specified as the next backup destination ECU.

[0040] When the ECU4 receives the management table transmitted from the ECU6, it transmits a rewrite data transmission request to the ECU3. When the ECU4 receives the backup data transmitted from the ECU3, it records the received data address and the data amount of the received backup data in the management table, as shown in FIG. 11. When the ECU4 determines that the total data amount has reached the rewrite capacity of the stored data, it transmits the management table to the ECU3. That is, when the ECU4 receives the data C transmitted from the ECU3 as backup data and stores the received backup data, it determines that the total data amount has reached the rewrite capacity of the stored data, and transmits the management table to the ECU3.

[0041] 12, data A and data B are transmitted from ECU3 to ECU6, and data A and data B are stored as backup data in ECU6, and data C is transmitted from ECU3 to ECU4, and data C is stored as backup data in ECU4. Also, as shown in Fig. 13, the management table is transferred in the following order: from central ECU2 to ECU3 which is the rewrite target ECU (see arrow A1), from ECU3 to ECU6 which is the first backup destination ECU (see arrow A2), from ECU6 to ECU4 which is the next backup destination ECU (see arrow A3), and from ECU4 to ECU3 (see arrow A4).

[0042] (2) When software is restored Next, the process of rewriting objects during recovery and the process of backup destination during recovery when software is restored will be described with reference to FIG. 14 to FIG.

[0043] (2-1) Processing to be rewritten during recovery (see Figures 14 and 15) When the control unit 8 starts the process of rewriting the target of the recovery, it judges whether the rewriting of the software is completed (S301). For example, in the case of a two-sided memory configuration, the control unit 8 judges whether the rewriting of the software is completed by judging whether the switching between the non-operational side and the operational side is completed. When the control unit 8 judges that the rewriting of the software is completed (S301: YES), it judges whether the rewritten software is operating normally (S302). When the control unit 8 judges that the rewritten software is operating normally (S302: YES), it transmits the management table to the ECU to which the highest priority is assigned (S303), and ends the process of rewriting the target of the recovery. On the other hand, when the control unit 8 judges that some kind of malfunction has occurred and that the rewritten software is not operating normally (S302: NO), it proceeds to data recovery process (S304).

[0044] When the control unit 8 starts the data recovery process, it determines whether or not a data recovery request has occurred (S311). When it determines that a data recovery request has occurred (S301: YES), the control unit 8 specifies the destination of the recovery data transmission request as the backup destination ECU to which the highest priority has been assigned (S312), and repeats the priority process up to the number of priorities (S313 to S321).

[0045] The control unit 8 refers to the management table and determines whether the data volume is empty (S314). If the control unit 8 determines that the data volume is not empty (S314: NO), it repeats the backup data request process until all backup data within the priority level is received (S315 to S319). The control unit 8 identifies a destination of the recovery data transmission request (S316), transmits the recovery data transmission request to the backup destination ECU identified as the destination (S317), and receives the backup data transmitted from the backup destination ECU (S318).

[0046] When the control unit 8 determines that all backup data within the priority level has been received, it changes the backup destination ECU to the ECU with the next highest priority level (S320). When the control unit 8 determines that the number of priorities has been reached, it ends the data recovery process and returns to the process for the target to be rewritten at the time of recovery.

[0047] (2-2) Backup destination processing during recovery (see Figure 16) When the control unit 8 starts the backup destination process at the time of recovery, it judges whether or not a request for transmitting data at the time of recovery is received from the rewrite target ECU (S401). When it judges that a request for transmitting data at the time of recovery is received from the rewrite target ECU (S401: YES), the control unit 8 transmits the backup data to the rewrite target ECU (S402) and ends the backup destination process at the time of recovery.

[0048] The transfer of backup data during software recovery will be described below with reference to Fig. 17. As shown in Fig. 17, data A and data B stored as backup data in ECU 6 are transmitted from ECU 6 to ECU 3, and data C stored as backup data in ECU 4 is transmitted from ECU 4 to ECU 3.

[0049] (3) When deleting backup data Next, the rewrite target processing at the time of deletion and the backup destination processing at the time of deletion when backup data is deleted will be described with reference to FIG. 18 to FIG.

[0050] (3-1) Processing to be rewritten when deleting (see Figure 18) When the control unit 8 starts the rewrite target process at the time of deletion, it receives the management table (S501), deletes the record of the rewrite capacity of the stored data (S502), and records the latest state in the free capacity column (S503). The control unit 8 recalculates the priority according to the latest recorded free capacity (S504), and records the recalculation result in the priority column (S505). The control unit 8 transmits the management table to the central ECU 2 (S506), and ends the rewrite target process at the time of deletion.

[0051] (3-2) Backup destination processing at the time of deletion (see Figure 19) When the control unit 8 starts the backup destination process at the time of deletion, it repeats the management table moving process until the data amount of all backup ECUs is empty (S601 to 608). The control unit 8 repeats the record deletion process until the data amount of the target backup ECU is empty (S602 to S606). The control unit 8 acquires the management table (S603), deletes the backup data (S604), and deletes the record of the data amount of the deleted backup data from the management table (S605). When the control unit 8 determines that the record of the data amount of the target backup ECU is empty, it transmits the management table to the backup destination ECU to which the next highest priority is assigned (S607). When the control unit 8 determines that the data amount of all backup ECUs is empty, it rewrites the management table and transmits it to the target ECU (S609), and ends the backup destination process at the time of deletion.

[0052] The movement of the management table when backup data is deleted will be described below with reference to Figures 20 to 23. When ECU6, which is the first backup destination ECU, receives the management table transmitted from ECU3, it deletes the record of the data volume of its own backup data from the management table, as shown in Figure 20. When ECU6 determines that all data volumes are not empty, it transmits the management table from which the record of the data volume of the backup data has been deleted to ECU4, which is the backup destination ECU with the next highest priority.

[0053] When the ECU 4 receives the management table transmitted from the ECU 6, it deletes the record of the data volume of the backup data of its own device from the management table, as shown in Fig. 21. When the ECU 6 determines that all data volumes are empty, it transmits the management table from which the records of the backup data have been deleted to the ECU 3.

[0054] When the ECU 3 receives the management table transmitted from the ECU 4, it deletes the record of the rewrite capacity of the stored data and records the latest state in the free capacity column, as shown in Fig. 22. The ECU 3 recalculates the priority according to the latest recorded free capacity, records the recalculation result in the priority column, and transmits the management table in which the recalculation result is recorded in the priority column to the central ECU 2.

[0055] In the above example, as shown in FIG. 23, the management table is transferred in the following order: from ECU3, which is the ECU to be rewritten, to ECU6, which is the first backup destination ECU (see arrow B1), from ECU6 to ECU4, which is the next backup destination ECU (see arrow B2), from ECU4 to ECU3, which is the ECU to be rewritten (see arrow B3), and from ECU3 to the central ECU2 (see arrow B4).

[0056] The above describes an example in which ECU3 is the reprogramming target ECU, but the same applies when another ECU other than ECU 3 is the reprogramming target ECU. Also, the above describes an example in which two ECUs, ECU6 and ECU4, are backup destination ECUs, but the same applies when three or more ECUs are backup destination ECUs.

[0057] As described above, according to the embodiment, the following advantageous effects can be obtained. In a configuration in which data stored in the rewrite target ECU is saved as backup data in the backup destination ECU before writing update data to the rewrite target ECU, unlike the conventional configuration in which a specific ECU holds a management table, the rewrite target ECU and the backup destination ECU hold the management table. This makes it possible to prevent concentration of access to the central ECU 2 and to prevent an increase in the amount of data communication between the central ECU 2 and multiple ECUs 3 to 6 that can be backup destination ECUs. This makes it possible to prevent an increase in the communication load of the entire system.

[0058] The destination of the management table is specified according to the priority recorded in the management table, and the management table is sent to the backup destination ECU specified as the destination. When rewriting software, if the backup destination ECU has little free space, the management table may be moved frequently. However, by setting the priority of ECUs with a lot of free space high and setting the priority of ECUs with little free space low, the ECUs with a lot of free space can be given priority as backup destination ECUs, reducing the opportunities for the management table to be moved and more appropriately avoiding an increase in the communication load of the entire system. Furthermore, by defining the priority, the next backup destination ECU can be identified immediately, and the time spent identifying the next backup destination ECU can be minimized.

[0059] The stored data is transmitted to the backup destination ECU as backup data on the condition that a rewrite data transmission request is received from the backup destination ECU. The rewrite target ECU can transmit the stored data as backup data to the backup destination ECU upon receiving the rewrite data transmission request from the backup destination ECU. Also, by specifying the destination of the rewrite data transmission request, erroneous transmission of the backup data can be avoided.

[0060] The system splits the saved data into parts and sends them to multiple backup destination ECUs as backup data. Backup data can be distributed and saved to multiple backup destination ECUs.

[0061] When it is determined that a data recovery request has occurred, a recovery data transmission request is sent to the backup destination ECU, and the backup data stored in the backup destination ECU is received from the backup destination ECU. By receiving the backup data stored in the backup destination ECU from the backup destination ECU, the software can be restored to the state before it was rewritten.

[0062] A destination of the recovery data transmission request is identified according to the priority recorded in the management table, and the recovery data transmission request is transmitted to the backup destination ECU identified as the destination. Even during software recovery, if the backup destination ECU has little free space, the management table may be moved frequently, but by setting the priority of ECUs with a lot of free space high and setting the priority of ECUs with little free space low, ECUs with a lot of free space can be given priority as backup destination ECUs, reducing the opportunities for the management table to be moved and more appropriately avoiding an increase in the communication load of the entire system.

[0063] Backup data is sent to the rewrite target ECU on the condition that a request for sending data at recovery time is received from the rewrite target ECU. The backup destination ECU can send backup data to the rewrite target ECU when the request for sending data at recovery time is received from the rewrite target ECU. Also, by specifying the destination of the request for sending data at recovery time, erroneous sending of backup data can be avoided.

[0064] Although the present disclosure has been described based on the embodiment, it is understood that the present disclosure is not limited to the embodiment or structure. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

[0065] The control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more special-purpose computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. [Explanation of symbols]

[0066] In the drawing, 2 is a central ECU (a specific electronic control unit), 3 is an ECU (an electronic control unit to be rewritten), 4 to 6 are ECUs (electronic control units to be backed up), 11 is a functional unit to be rewritten at the time of rewriting, 11a is a first management table receiving unit, 11b is a rewrite capacity recording unit, 11c is a first management table transmitting unit, 11d is a data transmission request receiving unit at the time of rewriting, 11e is a backup data transmitting unit at the time of rewriting, 11f is a second management table receiving unit, 12 is a backup destination functional unit at the time of rewriting, 1 Reference numeral 2a denotes a data transmission request sending unit at the time of rewriting, 12b denotes a backup data receiving unit at the time of rewriting, 13 denotes a function unit to be rewritten at the time of recovery, 13a denotes a recovery request judgment unit, 13b denotes a data transmission request sending unit at the time of recovery, 13c denotes a backup data receiving unit at the time of recovery, 14 denotes a backup destination function unit at the time of recovery, 14a denotes a data transmission request receiving unit at the time of recovery, 14b denotes a backup data sending unit at the time of recovery, 15 denotes a function unit to be rewritten at the time of deletion, 16 denotes a backup destination function unit at the time of deletion, and 16a denotes a recorded information deletion unit.

Claims

1. An electronic control device capable of rewriting software by writing update data, a first management table receiving unit (11a) that receives, from a specific electronic control device (2), a management table that can identify an electronic control device (4-6) that can be a backup destination of data stored in the electronic control device; a rewrite capacity recording unit (11b) for recording a rewrite capacity of the stored data in the management table; a first management table transmission unit (11c) for transmitting the management table in which the rewrite capacity of the stored data is recorded to the backup electronic control device; a rewrite backup data transmission unit (11e) for transmitting at least a part of the stored data as backup data to the backup destination electronic control device; and a second management table receiving unit (11f) that receives from the backup destination electronic control device the management table in which record information indicating that the backup data has been stored in the backup destination electronic control device is recorded.

2. The electronic control device described in claim 1, wherein the first management table transmission unit identifies a destination of the management table in accordance with the priority recorded in the management table, and transmits the management table to the backup electronic control device identified as the destination.

3. a rewrite data transmission request receiving unit (11d) for receiving a rewrite data transmission request from the backup electronic control device; The electronic control device according to claim 1 or 2, wherein the rewrite backup data transmission unit transmits at least a portion of the stored data as backup data to the backup electronic control device, on condition that the rewrite data transmission request is received by the rewrite data transmission request receiving unit.

4. 4. The electronic control device according to claim 1, wherein the rewrite backup data transmission unit divides the stored data and transmits the divided data as the backup data to each of the plurality of backup destination electronic control devices.

5. a rewrite time data transmission request transmitting unit (12a) for transmitting the rewrite time data transmission request to the electronic control device to be rewritten; The electronic control device according to claim 1 , further comprising: a rewrite backup data receiving unit (12b) that receives the backup data from the electronic control device that is to be rewritten.

6. A recovery request determination unit (13a) for determining whether a data recovery request has been generated; a restoration data transmission request transmission unit (13b) for transmitting a restoration data transmission request to the backup electronic control device when it is determined that the data restoration request has been generated; The electronic control device according to any one of claims 1 to 5, further comprising: a recovery backup data receiving unit (13c) that receives the backup data stored in the backup destination electronic control device from the backup destination electronic control device.

7. 7. The electronic control device according to claim 6, wherein the recovery time data transmission request sending unit identifies a destination of the recovery time data transmission request in accordance with the priority recorded in the management table, and transmits the recovery time data transmission request to the backup destination electronic control device identified as the destination.

8. a recovery time data transmission request receiving unit (14a) for receiving the recovery time data transmission request from the electronic control device to be rewritten; The electronic control device according to claim 6 or 7, further comprising: a recovery backup data transmission unit (14b) that transmits the backup data to the electronic control device to be rewritten on condition that the recovery data transmission request is received by the recovery data transmission request receiving unit.

9. 9. The electronic control device according to claim 1, further comprising a recorded information deleting unit (16a) for deleting the recorded information from the management table.

Images