System and method for rewriting programs for vehicle electronic control units

Abstract

To improve the precision of a rewriting work of a control program for a vehicular electronic control device.SOLUTION: A processor of a vehicular electronic control device that includes a memory enabling electrical rewriting of data, and the processor reads, when receiving a request which is for rewriting of a control program and which contains object information representing the vehicular electronic control device having the program subjected to rewriting, the identification information of the vehicular electronic control device stored in the memory, and the object information from the rewriting request. Next, the processor checks up the identification information with the object information, and determines whether or not to execute the rewriting of the control program on the basis of the check-up result.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an electronic control device for a vehicle. of Program rewrite system and a program rewriting method. [Background technology]

[0002] Control programs that run on electronic control units (ECUs) mounted on vehicles such as automobiles are sometimes rewritten (reprogrammed) into new versions of the control programs in order to change the functions of the ECUs, repair defects, etc. One example of a technology related to such rewriting of ECU control programs is a technology that determines whether the user of the vehicle is an administrator by comparing first user information, which is information about the user attempting to perform the program update, with second user information, which is information about users pre-registered as administrators of the program update, and controls the process related to the control program update based on the result of the determination, thereby ensuring that the program update is performed appropriately by the administrator. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-27668 Summary of the Invention [Problem to be solved by the invention]

[0004] For example, during a vehicle manufacturing process, after an ECU is shipped from an ECU manufacturing facility to a vehicle manufacturing facility, it may become necessary to rewrite the ECU's control program before the ECU is assembled into the vehicle at the vehicle manufacturing facility. In this case, the shipped ECU is returned to the ECU manufacturing facility, where the control program is rewritten and verified, and then the ECU is shipped again. However, because rewriting the control program in this manner takes time, there is a need to rewrite the control program directly at the vehicle manufacturing facility to which the ECU is shipped. Therefore, there is a need for a method that enables the control program to be rewritten with high accuracy and reliability at the manufacturing facility to which the ECU is shipped.

[0005] Therefore, one aspect of the present invention aims to improve the accuracy of the rewriting of the control program of an ECU. [Means for solving the problem]

[0006] In one aspect of the present invention, A program rewriting system comprising: a vehicle electronic control unit; a file generating device that generates a rewrite file containing information used to rewrite a control program that runs on the vehicle electronic control unit, using a description file containing a rewrite program for the control program and setting information related to program rewriting; and a program rewriting device that is communicably connected to the vehicle electronic control unit and transmits a rewrite request for the control program to the vehicle electronic control unit based on the rewrite file, It is constructed as follows: The file generation device is configured to acquire target information indicating a vehicle electronic control device to be rewritten, and generate the rewrite file including the target information. The program rewriting device is configured to acquire the rewrite file, read the target information from the rewrite file, and transmit a rewrite request for the control program including the target information to the vehicle electronic control device. When the vehicle electronic control device receives the rewrite request, it reads the target information from the rewrite request and reads identification information of the vehicle electronic control device stored in a memory provided in the vehicle electronic control device, and generates the rewrite file including the target information. and determines whether or not to rewrite the control program based on the result of the comparison. [Effects of the Invention]

[0009] According to the present invention, it is possible to improve the accuracy of the rewriting of the control program of the ECU. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram showing an example of a program rewriting system according to an embodiment of the present invention; [Figure 2] 1 is a block diagram showing an example of an outline of a program rewriting system according to an embodiment of the present invention; [Figure 3]10 is a flowchart illustrating an example of a rewrite file generation process performed by the file generation device according to an embodiment of the present invention. [Figure 4] 10 is a flowchart showing an example of a program rewriting process performed by the program rewriting device according to an embodiment of the present invention. [Figure 5] 4 is a flowchart showing an example of a program rewriting process by an ECU according to an embodiment of the present invention. [Figure 6] FIG. 2 is an explanatory diagram showing an example of data of a program rewriting system according to an embodiment of the present invention. [Figure 7] FIG. 2 is an explanatory diagram showing an example of data and processing of a program rewriting system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, specific examples of embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings. Note that in some of the drawings, only the reference numerals of the components are given, and the names of the components are omitted.

[0012] FIG. 1 shows an example of a system for rewriting a control program that runs in an ECU mounted on a vehicle such as an automobile. The system 1 includes a file generation device 10, a program rewriting device 20, and an ECU 30.

[0013] The file generation device 10 is a computer used by a worker or the like who performs the program rewriting work, and has a function of generating a rewrite file that includes information necessary to rewrite the control program of the ECU 30. The file generation device 10 includes a processor 11, a RAM 12, a ROM 13, and an input / output interface 14.

[0014] The processor 11 is hardware that executes an instruction set (such as data transfer, calculation, processing, control, and management) written in a program, and is composed of an arithmetic unit, registers that store instructions and information, peripheral circuits, etc. The processor 11 loads a program stored in a ROM 13 into a RAM 12 and executes it. The processor 11 includes a rewrite file generation unit 111, whose functions are realized by executing the program.

[0015] The rewrite file generation unit 111 generates a rewrite file 501 by using the rewrite program 131 and the description file 132 stored in the ROM 13. At this time, the rewrite file generation unit 111 acquires information indicating the ECU 30 to be rewritten by the program (for example, information that can identify the attributes, characteristics, functions, and uses of the ECU 30 to be rewritten by the program). Then, the rewrite file generation unit 111 generates the rewrite file 501 including target information 601 that indicates the ECU 30 to be rewritten by the program. The target information 601 can be acquired, for example, from information designated by an operator's input or information previously set in association with the rewrite program 131.

[0016] The RAM 12 is a volatile memory in which data is lost when the power supply is cut off, and provides a temporary storage area that the processor 11 uses during operation. The ROM 13 is a nonvolatile memory that is electrically rewritable and includes, for example, a flash ROM or an EEPROM. The ROM 13 includes an area for storing a rewrite program 131 for the control program 332 of the ECU 30, a description file 132 that includes setting information related to program rewriting (measurement variables, various parameters related to data objects of variant dependency relationships, communication parameters, etc.), and a rewrite file 501 (501-1) generated by the rewrite file generation unit 111 using these. The rewrite file 501 includes target information 601 (601-1). The rewrite file 501 is, for example, a PDX file.

[0017] The input / output interface 14 transmits and receives information to and from input / output devices (such as a keyboard, mouse, touch panel, and display, not shown), accepts inputs from users, and outputs the results of computer processing. The input / output interface 14 also writes and reads data to and from external memories such as USB memory and external storage.

[0018] Although not shown, the file generation device 10 further includes a communication interface and the like for realizing communication with an external network.

[0019] The program rewriting device 20 is a computer used by an operator or the like who performs the program rewriting work, and has a function of directly accessing the ECU 30 and sending a control program rewriting request to the ECU 30. The program rewriting device 20 includes a processor 21, a RAM 22, a ROM 23, a communication interface 24, and an input / output interface 25.

[0020] The processor 21 includes a program rewriting unit 211, whose function is realized by executing a program that operates as a program rewriting tool. The program rewriting unit 211 acquires the rewrite file 501 generated by the file generation device 10, and transmits a control program rewrite request 701 including the target information 601 included in the rewrite file 501 to the ECU 30. Then, upon receiving a rewrite program transfer request from the ECU 30, the program rewriting unit 211 transmits the rewrite program included in the rewrite file 501 to the ECU 30.

[0021] The RAM 22 includes an area for storing a program rewrite request 701 (701-1) for the ECU 30, which is generated by the program rewrite unit 211. The rewrite request 701 includes the target information 601 (601-3). The ROM 23 includes an area for storing a rewrite file 501 (501-2) including target information 601 (601-2) generated by the file generation device 10. Note that it is also possible to configure the rewrite file 501 to be written only to the RAM 22 for processing.

[0022] The communication interface 24 transmits and receives data using a protocol that enables communication with the ECU 30. In the present embodiment, as an example, the ECU 30 is in a stage before being mounted on a vehicle, and therefore the program rewriting device 20 and the ECU 30 are directly connected to transmit and receive data. Communication with the file generation device 10 is also possible, and the rewrite file 501 can also be received through communication. The input / output interface 25 receives input from the input / output device through user operations, outputs the results of computer processing, and writes and reads data to and from external memory such as a USB memory or external storage.

[0023] The ECU 30 includes a microcomputer that electronically controls in-vehicle devices (e.g., fuel injection valves, spark plugs, automatic transmissions, brushless motors, etc.) by executing control programs. The microcomputer of the ECU 30 includes a processor 31, a RAM 32, a ROM 33, and a communication interface 34.

[0024] The processor 31 includes a rewrite permission determining unit 311 and a program rewriting unit 312, whose functions are realized by executing a program. When the rewrite possibility determination unit 311 receives a rewrite request 701 generated by the file generation device 10 and including target information 601 indicating the ECU 30 to be rewritten, the rewrite possibility determination unit 311 reads the identification information 331 of the ECU 30 that has been written in advance in the ROM 33 and also reads the target information 601 from the rewrite request 701, compares the identification information 331 with the target information 601, and determines whether or not to rewrite the control program 332 based on the comparison result.

[0025] When the rewrite permission determining unit 311 determines to rewrite the control program 332, the program rewriting unit 312 receives a rewrite program for the control program 332 from the program rewriting device 20 and rewrites the control program 332 with the received rewrite program.

[0026] The RAM 32 is a volatile memory in which data is lost when the power supply is cut off, and provides a temporary storage area used by the processor 31 during operation. The RAM 32 includes an area for storing a rewrite request 701 (701-2) received from the program rewrite device 20. The rewrite request 701 includes target information 601 (601-4).

[0027] The ROM 33 is a nonvolatile memory that is electrically rewritable and includes, for example, a flash ROM or an EEPROM. The ROM 33 includes an area that stores identification information 331 that is information for identifying the ECU 30 (for example, information that can identify the attributes, characteristics, functions, and uses of the ECU 30) and a control program 332 that controls the in-vehicle device to be controlled.

[0028] The communication interface 34 is configured by, for example, a CAN transceiver or the like, and performs communication with the program rewriting device 20 and the in-vehicle network. Although not shown in the figure, the ECU 30 further includes an input / output interface, etc., which is connected to external devices related to the control of the in-vehicle devices to be controlled and provides input / output functions for analog signals and digital signals to the external devices.

[0029] Next, an overview of the program rewriting process in the system 1 will be described with reference to FIG. 2. In the following description of this embodiment, it is assumed that the operating environment of the system 1 includes two types of ECUs: a development device used in the development stage and a mass-production device for products in the stage of assembly into vehicles. Since the control program that runs on the development ECU is usually different from the control program that runs on the mass-production ECU, a rewrite program intended for the development ECU must be accurately written to the development ECU, and a rewrite program intended for the mass-production ECU must be accurately written to the mass-production ECU. In the description using FIG. 2, the development ECU is designated as ECU 30A, and the mass-production ECU is designated as ECU 30B. Note that some of the components shown in FIG. 1 are omitted from FIG. 2.

[0030] First, the rewriting of a program for ECU 30A, which is an ECU for development, will be described. The file generation device 10 generates a rewrite file 501A using a rewrite program 131A and a description file 132A that are targeted for the ECU for development. At this time, the file generation device 10 includes, in the rewrite file 501A, target information 601A that indicates that the target for program rewriting is the ECU for development (S11-S13).

[0031] The program rewriting device 20 then acquires the rewrite file 501A via communication, various external memories, or the like (S14). The program rewriting device 20 then generates a program rewrite request 701A including the target information 601A included in the rewrite file 501A and transmits it to the ECU 30A (S15), and the ECU 30A receives the rewrite request 701A (S16). Note that the target information 601A included in the rewrite file 501A and the target information 601A included in the program rewrite request 701A do not need to have exactly the same values (data contents), as long as they both indicate that they are intended for development ECUs.

[0032] On the other hand, ECU 30A holds identification information 331A, which indicates that the ECU 30A itself is an ECU for development, in ROM 13. Then, ECU 30A compares target information 601A included in rewrite file 501A with identification information 331A, and since both are information indicating that the ECU 30A is an ECU for development, ECU 30A rewrites control program 332.

[0033] Similarly, rewriting of a program for ECU 30B, which is a mass-produced ECU, will be described. The file generation device 10 generates a rewrite file 501B using a rewrite program 131B and a description file 132B that are intended for a mass-produced ECU. At this time, the file generation device 10 includes, in the rewrite file 501B, target information 601B that indicates that the target for program rewriting is a mass-produced ECU (S21-S23).

[0034] The program rewriting device 20 then acquires the rewrite file 501B via communication, various external memories, or the like (S24). The program rewriting device 20 then generates a program rewrite request 701B including the target information 601B included in the rewrite file 501B and transmits it to the ECU 30B (S25), which then receives the rewrite request 701B (S26). Note that the target information 601B included in the rewrite file 501B and the target information 601B included in the program rewrite request 701B do not need to have exactly the same values (data contents), as long as they both indicate that they are intended for mass-produced ECUs.

[0035] On the other hand, ECU 30B holds identification information 331B, which indicates that the ECU itself is a mass-produced ECU, in ROM 13. ECU 30B then compares target information 601B included in rewrite file 501B with identification information 331B, and since both of them indicate that the ECU is a mass-produced ECU, ECU 30B rewrites control program 332.

[0036] Here, a case will be described in which the program rewriting device 20 transmits a rewrite request 701A, which specifies a development ECU as the target of program rewriting, to the ECU 30B, which is a mass-produced ECU (S31). In this case, the ECU 30B compares the target information 601A included in the rewrite request 701A with the identification information 331B, which indicates that the ECU is a mass-produced ECU. As a result, the target ECUs indicated by the target information 601A and the identification information 331B do not match, so the ECU 30B does not rewrite the control program 332.

[0037] Similarly, when the program rewriting device 20 transmits a rewrite request 701B, which specifies a mass-produced ECU as the target of program rewriting, to the ECU 30A, which is a development ECU (S32), the ECU 30A compares the target information 601B included in the rewrite request 701B with the identification information 331A, which indicates that the ECU is a development ECU. As a result, the target ECU indicated by the target information 601B and the identification information 331A do not match, and therefore the ECU 30A does not rewrite the control program.

[0038] Therefore, it is possible to avoid a situation in which the control program of ECU30B, which is a mass-produced ECU, is rewritten with a rewrite program intended for a development ECU, and a situation in which the control program of ECU30A, which is a development ECU, is rewritten with a rewrite program intended for a mass-produced ECU.

[0039] Next, an example of processing executed by file generation device 10 will be described with reference to the flowchart shown in FIG. In step 1001, the rewrite file generation unit 111 reads and acquires the rewrite program 131 and the description file 132 from the ROM 13 in response to a user operation or the like. Note that the rewrite program 131 and the description file 132 can also be acquired via a network or various external memories or the like.

[0040] In step 1002, the rewrite file generation unit 111 acquires information indicating whether the target of the program rewrite is an ECU for development or an ECU for mass production. As described above, the information can be acquired, for example, from information designated by input by an operator or information previously set in association with the rewrite program 131.

[0041] In step 1003, the rewrite file generation unit 111 determines whether the information acquired in step 1002 indicates a development ECU or a mass-production ECU. If the information indicates a development ECU, the process proceeds to step 1004, and if the information indicates a mass-production ECU, the process proceeds to step 1005.

[0042] In step 1004, the rewrite file generating unit 111 generates the rewrite file 501 including the target information 601 indicating that the target of the program to be rewritten is an ECU for development. In step 1005, the rewrite file generating unit 111 generates the rewrite file 501 including the target information 601 indicating that the target of the program to be rewritten is an ECU for mass production.

[0043] Next, an example of processing executed by the program rewriting device 20 will be described with reference to the flowchart shown in FIG. In step 1011, the program rewriting unit 211 acquires the rewrite file 501 generated by the file generation device 10 in response to a user operation or the like. The rewrite file 501 can be acquired via a network, various external memories, or the like.

[0044] In step 1012, the program rewriting unit 211 reads and acquires the target information 601 from the rewrite file 501. In other words, the program rewriting unit 211 acquires information indicating whether the target for program rewriting is an ECU for development or an ECU for mass production.

[0045] In step 1013 , the program rewriting unit 211 generates a program rewriting request 701 A including the target information 601 and transmits it to the ECU 30 . In step 1014, the program rewriting unit 211 receives a response indicating whether or not to execute program rewriting from the ECU 30. More specifically, the response is a request to transfer the rewriting program when the program rewriting is to be executed, and is a response notifying the cancellation of the rewriting process when the rewriting is not to be executed.

[0046] In step 1015, program rewriting unit 211 determines whether the response received in step 1014 indicates that program rewriting will be performed. If program rewriting is to be performed, the process proceeds to step 1016; if not, the process proceeds to step 1017.

[0047] In step 1016, the program rewriting unit 211 transmits the rewriting program contained in the rewriting file 501 to the ECU 30. In step 1017, the program rewriting unit 211 outputs a warning to notify the user that the control program will not be rewritten in the ECU 30. The warning can be issued by any method. For example, the program rewriting unit 211 can output the warning through an output device (not shown) such as a display, or can send a message to a predetermined address.

[0048] Next, an example of processing executed by the ECU 30 will be described with reference to the flowchart shown in FIG. In step 1021 , the rewrite permission determining unit 311 receives the rewrite request 701 from the program rewriting device 20 .

[0049] In step 1022 , the rewrite permission determining unit 311 reads and acquires the identification information 331 from the ROM 33 . In step 1023 , the rewrite permission determining unit 311 reads and acquires the target information 601 included in the rewrite request 701 .

[0050] In step 1024, the rewriting permission determining unit 311 determines whether the identification information 331 indicates a development ECU or a mass-production ECU. If the identification information 331 indicates a development ECU, the process proceeds to step 1025, and if the identification information 331 indicates a mass-production ECU, the process proceeds to step 1028.

[0051] In step 1025, the rewriting permission determining unit 311 determines whether the target information 601 indicates a development ECU or a mass-production ECU. If the target information 601 indicates a development ECU, the process proceeds to step 1026, and if the target information 601 indicates a mass-production ECU, the process proceeds to step 1027 (No).

[0052] In step 1026, the rewrite permission determining unit 311 determines that the condition for rewriting the control program 332 is met because both the identification information 331 and the target information 601 indicate that the ECU is for development. In step 1027, the rewrite permission determining unit 311 determines that the conditions for rewriting the control program 332 are not met because the identification information 331 indicates an ECU for development while the target information 601 indicates a mass-production device.

[0053] In step 1028, the rewriting permission determining unit 311 determines whether the target information 601 indicates a development ECU or a mass-production ECU. If the target information 601 indicates a mass-production ECU, the process proceeds to step 1029. If the target information 601 indicates a development ECU, the process proceeds to step 1030.

[0054] In step 1029, the rewrite permission determining unit 311 determines that the condition for rewriting the control program 332 is met because both the identification information 331 and the target information 601 indicate that the ECU is for mass production. In step 1030, the rewrite permission determining unit 311 determines that the conditions for rewriting the control program 332 are not met because the identification information 331 indicates a mass-production ECU while the target information 601 indicates a development ECU.

[0055] In step 1031, the rewrite permission determining unit 311 determines whether or not the condition for rewriting the control program 332 is met. If the condition is met, the rewrite permission determining unit 311 decides to rewrite the control program and proceeds to step 1032 (Yes), but if the condition is not met, it decides not to rewrite the control program 332 and proceeds to step 1033 (No).

[0056] In step 1032, the program rewriting unit 312 executes the rewriting process for the control program 332. More specifically, the program rewriting unit 312 transmits to the program rewriting device 20 a transfer request for a rewriting program for the control program 332. Then, the program rewriting unit 312 receives the rewriting program transmitted by the program rewriting device 20 in response to the transfer request, and rewrites the control program 332 using the rewriting program.

[0057] In step 1033, the program rewriting unit 312 outputs information (error) indicating that the control program 332 will not be rewritten. At this time, as described above, it is possible to output a warning via the program rewriting device 20.

[0058] Here, the program rewriting process executed in the system 1 will be described with a specific example of data conforming to the UDS (Unified Diagnostic Services) protocol, which is a communication protocol for diagnosing ECUs defined by ISO14229-1.

[0059] FIG. 6 shows a specific example of the data structure of a program rewrite request 701 based on the UDS protocol. This rewrite request 701 is generated based on the PDX file of the rewrite file 501 and indicates a "Download Request" with an SID (Service Identifier) of "34." The rewrite request 701 also includes a "dataFormatIdentifier" parameter. The "dataFormatIdentifier" parameter includes a "compressionMethod" that is compression information in the upper four bits and an "encryptionMethod" that is encryption information in the lower four bits. In this embodiment, a new value definition for this "compressionMethod" is provided, and the target information 601 is set, thereby enabling the target information 601 to be included in the rewrite request 701. More specifically, a "compressionMethod" of "1111b" indicates that the control program 332 for the development ECU is to be rewritten, and a "compressionMethod" of "0001b" is defined as that the control program 332 for the mass-production ECU is to be rewritten.

[0060] figure 7 1 shows a specific example of what kind of data is transmitted and received between the program rewriting device 20 and the ECU 30 using a rewrite request 701 based on the UDS protocol. 7 (A) shows the case where the control program 332 is rewritten. 7 (B) illustrates the case where the control program 332 is not rewritten.

[0061] figure 7Referring to (A), first, the program rewriting device 20 transmits data of the "Download Parameter (Download Request)" with SID "34" to the ECU 30. Then, the rewriting permission determining unit 311 of the ECU 30 determines whether to rewrite the control program 332 based on the target information 601 set in the above-mentioned "compressionMethod." For example, if the identification information 331 stored in the ROM 13 of the ECU 30 is information (EngineeringKEY) indicating that the ECU is a development ECU, the control program 332 is rewritten if the value of "compressionMethod" is "1111b," and is not rewritten if the value is "0001b." Conversely, if the identification information 331 is information (other than EngineeringKEY) indicating that the ECU is a mass-production ECU, the control program 332 is rewritten if the value of "compressionMethod" is "0001b," and is not rewritten if the value is "1111b."

[0062] When the rewrite permission determining unit 311 determines to rewrite the control program 332, the program rewriting unit 312 of the ECU 30 erases the control program 332 (Code Flush). At this time, the program rewriting unit 312 transmits the data "7F 34 78" to the program rewriting device 20, and when the data erasure is complete, returns the data with SID "74" together with the necessary parameters as a response to the "Download Request."

[0063] The program rewriting device 20 then transmits the "Transfer Data" data with SID "36", i.e., data including a rewrite program for the control program 332, to the ECU 30. The program rewriting unit 312 of the ECU 30 then performs the rewrite process for the control program 332. At this time, the program rewriting unit 312 transmits the data "7F 36 78" to the program rewriting device 20, and when the data rewriting is complete, it replies with the data with SID "76" together with the necessary parameters as a response to the "Transfer Data".

[0064] On the other hand, Fig. 7 In (B), the program rewriting device 20 transmits "Download Parameter (Download Request)" data with SID "34" to the ECU 30. However, the rewriting permission determining unit 311 of the ECU 30 determines not to rewrite the control program 332. In this case, the rewriting permission determining unit 311 of the ECU 30 transmits data "7F 34 31" to the program rewriting device 20, indicating that rewriting has not been performed. This data enables the program rewriting device 20 to identify that the control program 332 has not been rewritten in the ECU 30.

[0065] As described above, according to this embodiment, when the control program 332 of the ECU 30 needs to be rewritten, the file generation device 10 generates a rewrite file 501 including target information 601 indicating whether the control program 332 of the ECU for development or the control program 332 of the ECU for mass production is to be rewritten. The program rewriting device 20 then uses the rewrite file 501 to send a rewrite request 701 including the target information 601 to the ECU 30. The ECU 30 then compares its own identification information 331 with the target information 601 included in the rewrite request 701, and rewrites the control program 332 only if both indicate the ECU for development or the ECU for mass production. This makes it possible to prevent a rewrite program intended for a development ECU from accidentally rewriting a control program of a mass-production ECU, or to prevent a rewrite program intended for a mass-production ECU from accidentally rewriting a control program of a development ECU. Therefore, even in a work environment where both development ECUs 30 and mass-produced ECUs 30 exist, the program rewriting work can be performed accurately, improving the accuracy of the program rewriting work, and as a result, it is possible to prevent ECUs 30 with unintentionally rewritten control programs from being released to the market.

[0066] Furthermore, if the ECU 30 determines not to rewrite the control program 332, the rewriting process is stopped and an error is returned to the program rewriting device 20. This allows the program rewriting device 20 to output a warning indicating that the rewriting has failed. This allows the worker to immediately understand that there was a problem with the rewriting work, and makes it possible to redo the work, for example.

[0067] In the present embodiment, an example has been described in which a development ECU and a mass-production ECU are distinguished from each other to control program rewriting. However, by changing the definition of the values in the identification information 331 stored in the ECU 30 and the target information 601 stored in the rewrite file 501 and the rewrite request 701, it is possible to determine whether or not a program rewriting process can be performed for any identification target. For example, if it is desired to determine whether or not a program rewriting process can be performed for each of more specific types, different values may be set for each of the identification information 331 and the target information 601, and the two may be compared. Furthermore, if it is desired to determine whether or not a program rewriting process can be performed for each individual ECU 30, an identifier capable of identifying the individual ECU 30 may be set for both the identification information 331 and the target information 601.

[0068] Furthermore, although the present embodiment has been described assuming that the ECU 30 is installed in a vehicle, the present embodiment can also be applied to a system that rewrites the program of an ECU installed in a vehicle by OTA (Over the Air). For example, the technology described in the present embodiment can be applied to a system that rewrites the program of an ECU installed in a vehicle by including target ECU information in a rewrite request sent to the vehicle, setting identification information in advance in the ECU whose program is to be rewritten, and performing control to determine whether to perform rewriting by comparing the identification information with the target information, thereby making it possible to avoid rewriting a program in the wrong ECU.

[0069] The above-described embodiments of the present invention are merely some of the possible implementations within the technical scope of the present invention, and are disclosed as examples of the present invention, and do not limit the technical scope of the present invention. Furthermore, the functional configurations and physical configurations in each embodiment are not limited to the above-described aspects, and for example, each function or physical resource can be integrated and implemented, or conversely, implemented in a more distributed manner, and further, some configurations can be added, deleted, or replaced with other configurations. [Explanation of symbols]

[0070] 10...file generation device, 111...rewrite file generation unit, 20...program rewriting device, 211...program rewriting unit, 30...ECU, 311...rewrite possibility determination unit, 312...program rewriting unit, 331...identification information, 332...control program, 501...rewrite file, 601...target information, 701...rewrite request

Claims

1. A vehicle electronic control device, a file generating device that generates a rewrite file containing information used to rewrite the control program using a description file containing a rewrite program for the control program running on the vehicle electronic control device and setting information related to the program rewrite; a program rewriting device that is communicably connected to the vehicle electronic control device and that transmits a rewrite request for the control program to the vehicle electronic control device based on the rewrite file; A program rewriting system comprising: the file generation device is configured to acquire target information indicating a vehicle electronic control device to be rewritten, and generate the rewrite file including the target information; the program rewriting device is configured to acquire the rewrite file, read the target information from the rewrite file, and transmit a rewrite request for the control program including the target information to the vehicle electronic control device; A program rewriting system configured such that, when the vehicle electronic control device receives the rewrite request, it reads the target information from the rewrite request and also reads identification information of the vehicle electronic control device stored in a memory provided in the vehicle electronic control device, compares the identification information with the target information, and determines whether or not to rewrite the control program based on the comparison result.

2. the identification information is information indicating whether the vehicle electronic control device is a development device used in a development stage or a mass-produced device that is a product at a stage of being assembled into a vehicle, while the target information is information indicating whether the vehicle electronic control device to be rewritten is the development device or the mass-produced device; 2. The program rewriting system according to claim 1, wherein the vehicle electronic control device is configured to determine to rewrite the control program when both the target information and the identification information indicate that the device is for development, or when both the target information and the identification information indicate that the device is for mass production.

3. 3. The program rewriting system according to claim 1, wherein the vehicle electronic control unit is configured to output a warning when it determines not to rewrite the control program.

4. The program rewriting system of any one of claims 1 to 3, wherein the vehicle electronic control device is configured, when it decides to rewrite the control program, to send a transfer request for a rewrite program for the control program to the program rewriting device, receive the rewrite program sent from the program rewriting device in response to the transfer request, and rewrite the control program using the rewrite program.

5. a vehicle electronic control device; a file generating device that generates a rewrite file containing information used to rewrite the control program using a description file containing a rewrite program for the control program running on the vehicle electronic control device and setting information related to the program rewrite; a program rewriting device that is communicably connected to the vehicle electronic control device and that transmits a rewrite request for the control program to the vehicle electronic control device based on the rewrite file; A program rewriting method executed by the file generation device acquires target information indicating a vehicle electronic control device to be rewritten, and generates the rewrite file including the target information; the program rewriting device acquires the rewrite file, reads the target information from the rewrite file, and transmits a rewrite request for the control program including the target information to the vehicle electronic control device; When the vehicle electronic control device receives the rewrite request, the vehicle electronic control device reads the target information from the rewrite request and also reads identification information of the vehicle electronic control device stored in a memory provided in the vehicle electronic control device, compares the identification information with the target information, and determines whether or not to rewrite the control program based on the comparison result. How to rewrite a program.

Images