Electronic control unit

Abstract

To properly rewrite software even if a free space for holding temporary data is insufficient when rewrite data is written.SOLUTION: An electronic control apparatus 3 includes: a rewrite data acquisition unit 12a which acquires rewrite data from the outside; a rewrite data writing unit 12b which writes the rewrite data to a storage unit; a free space determination unit 12c which determines the amount of free space for holding temporary data when the rewrite data is written; and a temporary data evacuation unit 12d which selects, when the free space is insufficient, a device for evacuation of the temporary data and evacuates the temporary data to the selected device. The rewrite data writing unit writes the rewrite data while the temporary data is evacuated in the device for evacuation.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an electronic control device. [Background technology]

[0002] For example, in an in-vehicle electronic control unit (hereinafter referred to as ECU (Electronic Control Unit)), software (hereinafter referred to as "soft") is configured to be rewritable for the purpose of improving functionality, resolving malfunctions, etc. For example, Patent Document 1 discloses a configuration in which software is rewritten by obtaining rewrite data from a central ECU that functions as a central gateway and writing the obtained rewrite data into a storage unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-24555 Summary of the Invention [Problem to be solved by the invention]

[0004] If the ECU to be rewritten, which is the subject of software rewriting control, does not have enough free space to store temporary data when writing rewrite data, it may become difficult to properly write the rewrite data, which could make it difficult to properly rewrite the software.

[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device that can properly rewrite software even when there is insufficient free space to store temporary data when writing rewrite data. [Means for solving the problem]

[0006] According to the invention recited in claim 1, software is rewritten by writing rewrite data. A rewrite data acquisition unit (12a) acquires rewrite data from the outside. A rewrite data writing unit (12b) writes the rewrite data to a storage unit. A free space determination unit (12c) determines the capacity of free space for storing temporary data when writing the rewrite data. A temporary data saving unit (12d) selects a device to save the temporary data to if the capacity of the free space is insufficient, and saves the temporary data to the selected save destination device. The rewrite data writing unit If the capacity of the free space is sufficient, the rewrite data is written directly to the storage unit without the temporary data being saved to the save destination device, and if the capacity of the free space is insufficient, With the temporary data saved in the save destination device, the rewrite data is written to the storage unit.

[0007] Free space to store temporary data when writing rewritten data If there is enough capacity, the rewritten data is written directly to the memory section. If the capacity is insufficient, a destination device for saving the temporary data is selected, the temporary data is saved to the selected destination device, and the rewrite data is written to the storage unit with the temporary data saved to the destination device.If there is insufficient capacity in the free space for storing the temporary data when writing the rewrite data, the temporary data can be saved to the destination device, allowing the rewrite data to be written appropriately.This allows software rewriting to be performed appropriately even if there is insufficient capacity in the free space for storing the temporary data when writing the rewrite data. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a functional block diagram illustrating an overall configuration of a vehicle-side system according to an embodiment. [Figure 2] Functional block diagram of the ECU to be rewritten [Figure 3] Flowchart showing the processing of the ECU to be rewritten [Figure 4] Flowchart showing the processing of the ECU to be rewritten [Figure 5] Flowchart showing the processing of the ECU to be rewritten [Figure 6] Flowchart showing the processing of the ECU to be rewritten [Figure 7] Flowchart showing central ECU processing [Figure 8] Flowchart showing the processing of the destination ECU [Figure 9] Flowchart showing the processing of the destination ECU [Figure 10] Diagram showing the ECU to be rewritten and the ECU to be saved [Figure 11] Sequence diagram showing the process flow [Figure 12] Sequence diagram showing the process flow DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment will be described below with reference to the drawings. As shown in FIG. 1, a vehicle-side system 1 mounted on a vehicle includes a central ECU 2 functioning as a central gateway and ECUs 3 to 6, which are potential rewrite target ECUs and whose software is to be rewritten by the central ECU 2, connected to each other via an in-vehicle network 7 so as to be capable of data communication. The software includes applications for realizing specific functions and may also be referred to as programs. The in-vehicle network 7 is, for example, a Controller Area Network (CAN) (registered trademark), FLEXRAY (registered trademark), or Clock Extension Peripheral Interface (CXPI) (registered trademark). In this embodiment, four ECUs, ECUs 3 to 6, are connected to the central ECU 2 via the in-vehicle network 7 so as to be capable of data communication, but any number of ECUs may be used.

[0010] The central ECU 2 is connected to a TCU (Telematics Control Unit) 8 that functions as a data communication device. The TCU 8 is wirelessly connected to an OTA center 9 via a communication network 10, thereby being able to receive a distribution package transmitted from the OTA center 9. When the TCU 8 receives the distribution package transmitted from the OTA center 9, it transfers the received distribution package to the central ECU 2. When the distribution package is transferred from the TCU 8, the central ECU 2 extracts rewrite data from the transferred distribution package and transmits the extracted rewrite data to the rewrite target ECU while also transmitting a rewrite request to the rewrite target ECU, causing the rewrite target ECU to rewrite the software.

[0011] The central ECU 2 is also wired to a reprogramming tool (not shown) to receive a distribution package transmitted from the reprogramming tool. When the central ECU 2 receives the distribution package transmitted from the reprogramming tool, it extracts rewrite data from the received distribution package, transmits the extracted rewrite data to the reprogramming target ECU, and transmits a reprogramming request to the reprogramming target ECU, causing the reprogramming target ECU to rewrite its software. That is, the reprogramming target ECU rewrites its software when it receives the reprogramming data and the reprogramming request from the central ECU 2.

[0012] If the reprogramming tool and the ECU to be rewritten are directly connected, the reprogramming tool transmits the rewrite data to the ECU to be rewritten and also transmits a rewrite request to the ECU to have the ECU to rewrite the software. That is, the ECU to be rewritten also rewrites its software when the reprogramming tool transmits the rewrite data and the rewrite request to it.

[0013] The central ECU 2 manages the rewriting of software in multiple ECUs to be rewritten in an integrated manner. The central ECU 2 includes a control unit 11, which is mainly a microcomputer having a CPU, RAM, ROM, I / O, etc. The control unit 11 executes a computer program stored in a non-transient physical storage medium to perform processing corresponding to the computer program and controls the operation of the central ECU 2.

[0014] The ECUs 3 to 6 are, for example, devices that control the drive system, devices that control the ADAS (Advanced Driving Assistant System), devices that control the multimedia system, etc. As described above, the ECUs 3 to 6 have different control targets, but are basically configured the same. Below, the configuration of the ECUs 3 to 6 will be explained using ECU 3 as a representative.

[0015] 2, the ECU 3 includes a control unit 12 mainly composed of a microcomputer having a CPU, RAM, ROM, I / O, etc., and a storage unit 13 mainly composed of a ROM. The control unit 12 executes a computer program stored in a non-transient physical storage medium to perform processing corresponding to the computer program, thereby controlling the operation of the ECU 3.

[0016] The control unit 12 includes a rewrite data acquisition unit 12a, a rewrite data writing unit 12b, a free space determination unit 12c, and a temporary data saving unit 12d for each function. The rewrite data acquisition unit 12a acquires rewrite data from the central ECU 2. The rewrite data writing unit 12b writes the rewrite data in blocks to the storage unit 13. The free space determination unit 12c determines the capacity of free space for storing temporary data when writing the rewrite data. The temporary data may include both the rewrite data transmitted from the central ECU 2 and rollback data for restoring the data to a state before writing if an abnormality occurs during the writing of the rewrite data, or it may include only the rollback data.

[0017] When the free space determination unit 12c determines that the free space capacity is insufficient, the temporary data saving unit 12d selects a destination ECU that is a device to which the temporary data is saved, and saves the temporary data to the selected destination ECU. In this case, the temporary data saving unit 12d selects the destination ECU for the temporary data according to the following selection criteria. The temporary data saving unit 12d may acquire and store ECU information from other ECUs and select the destination ECU for the temporary data based on the stored ECU information, or may select the destination ECU for the temporary data based on ECU information of other ECUs that it has stored in advance. The ECU information includes ECU identification information that identifies the ECU itself, campaign target information that indicates the campaign target, free space information regarding the free space capacity, and processing load information regarding the processing load.

[0018] The temporary data saving unit 12d identifies ECUs that are not the target of the same campaign as save-destination candidate ECUs that are save-destination candidate devices, and does not identify ECUs that are the target of the same campaign as save-destination candidate ECUs. The temporary data saving unit 12d also compares the volume of the temporary data with the capacity of the free space in a single save-destination candidate ECU, and if the volume of the temporary data does not exceed the capacity of the free space in a single save-destination candidate ECU, selects that save-destination candidate ECU as the save-destination candidate ECU, and if the volume of the temporary data exceeds the capacity of the free space in a single save-destination candidate ECU, sets multiple save-destination candidate ECUs.

[0019] When a plurality of save destination candidate ECUs are set, the temporary data save unit 12d compares the free space capacities of the plurality of save destination candidate ECUs and, if the selection criterion is free space capacity, preferentially selects as the save destination ECU a save destination candidate ECU with a larger free space capacity than the others.If the selection criterion is processing load, the temporary data save unit 12d compares the processing loads of the plurality of save destination candidate ECUs and, if the selection criterion is processing load, preferentially selects as the save destination ECU a save destination candidate ECU with a lower processing load than the others.

[0020] Next, the operation of the above-described configuration will be described with reference to Figures 3 to 12. When any of ECUs 3 to 6 becomes a rewrite target ECU, if the rewrite target ECU does not have enough free space to store temporary data when writing rewrite data, it selects one of the remaining ECUs that was not selected as a rewrite target ECU as a save destination ECU. Below, the processing performed by the rewrite target ECU, the processing performed by the central ECU 2, and the processing performed by the save destination ECU will be described in order.

[0021] (1-1) Processing performed by the ECU to be rewritten (see Figures 3 to 6) In the ECU to be rewritten, the control unit 12 performs a rewrite request reception process. When the control unit 12 starts the rewrite request reception process, it determines whether a rewrite request has been received from the central ECU 2 (A1). When the control unit 12 determines that a rewrite request has not been received from the central ECU 2 (A1: NO), it ends the rewrite request reception process. When the control unit 12 determines that a rewrite request transmitted from the central ECU 2 has been received (A1: YES), it determines whether the received rewrite request includes a request to save the rewrite data (A2).

[0022] If the control unit 12 determines that the received rewrite request includes a request to save the rewrite data (A2: YES), it identifies both the rewrite data and the rollback data as temporary data (A3).If the control unit 12 determines that the received rewrite request does not include a request to save the rewrite data (A2: NO), it identifies only the rollback data as temporary data (A4).

[0023] When the control unit 12 identifies the temporary data, it checks the capacity of the free space for storing the temporary data when writing the rewrite data (A5). The control unit 12 compares the capacity of the identified temporary data with the capacity of the free space and determines whether the capacity of the temporary data exceeds the capacity of the free space (A6). If the control unit 12 determines that the capacity of the identified temporary data does not exceed the capacity of the free space, that is, that the capacity of the free space for storing the temporary data is sufficient (A6: NO), it transmits a rewrite response to the rewrite request to the central ECU 2 (A7) and waits to receive the rewrite data from the central ECU 2 (A8).

[0024] When the control unit 12 determines that the rewrite data transmitted from the central ECU 2 has been received (A8: YES), it stores the temporary data in a free area (A9) and checks the storage status of the temporary data (A10). The control unit 12 determines whether the temporary data has been stored normally (A11), and when it determines that the temporary data has been stored normally (A11: YES), it writes the rewrite data to the storage unit 13 (A12) and checks the write status of the rewrite data (A13).

[0025] The control unit 12 determines whether the writing result of the rewrite data is normal (A14), and if it determines that the writing result of the rewrite data is normal (A14: YES), it sends a write normal notification indicating that the writing result of the rewrite data is normal to the central ECU 2 (A15), and terminates the rewrite request receiving process.

[0026] If the control unit 12 determines that the writing result of the rewrite data is abnormal and not normal (A14: NO), it performs a write back using the rollback data included in the temporary data, restoring the state to the state before the rewrite data was written (A16). The control unit 12 transmits a write abnormality notice indicating the abnormality in the writing result of the rewrite data to the central ECU 2 (A17), and ends the rewrite request reception process. On the other hand, if the control unit 12 determines that the temporary data is not normally stored (A11: NO), it transmits a temporary data storage abnormality notice indicating the abnormality in the storage result of the temporary data to the central ECU 2 (A18), and ends the rewrite request reception process.

[0027] On the other hand, if the control unit 12 determines that the capacity of the identified temporary data exceeds the capacity of the free space, i.e., that the capacity of the free space for storing the temporary data is insufficient (A6: YES), it sends a temporary data evacuation request to the other ECU (A19) and waits to receive ECU information from the other ECU (A20).

[0028] When the control unit 12 determines that it has received ECU information transmitted from another ECU (A20: YES), it analyzes the campaign target information included in the received ECU information and determines whether or not there is an ECU that is not the target of the same campaign (A21). When the control unit 12 determines that there is an ECU that is not the target of the same campaign (A21: YES), it identifies the ECU that is not the target of the same campaign as a candidate ECU for evacuation destination (A22). When the control unit 12 determines that there is no ECU that is not the target of the same campaign (A21: NO), it transmits a write abnormality notification due to insufficient write area to the central ECU 2 (A23), and ends the rewrite request reception process.

[0029] The control unit 12 analyzes the free space information included in the ECU information, compares the volume of the temporary data with the volume of the free space of the single save-destination candidate ECU, and determines whether the volume of the temporary data exceeds the volume of the free space of the single save-destination candidate ECU (A24). If the control unit 12 determines that the volume of the temporary data does not exceed the volume of the free space of the single save-destination candidate ECU (A24: NO), it selects the save-destination candidate ECU as the save-destination ECU (A25). If the control unit 12 determines that the volume of the temporary data exceeds the volume of the free space of the single save-destination candidate ECU (A24: YES), it sets multiple save-destination candidate ECUs (A26).

[0030] When multiple save destination candidate ECUs are set, the control unit 12 determines whether the capacity of free space is the selection criterion (A27). If the control unit 12 determines that the capacity of free space is the selection criterion (A27: YES), the control unit 12 compares the free space capacities of the multiple set save destination candidate ECUs, and preferentially selects the save destination candidate ECU with a larger free space capacity as the save destination ECU (A28). The control unit 12 determines whether the processing load is the selection criterion (A29). If the control unit 12 determines that the processing load is the selection criterion (A29: YES), the control unit 12 compares the processing loads of the multiple save destination candidate ECUs, and preferentially selects the save destination candidate ECU with a lower processing load as the save destination ECU (A30).

[0031] After selecting the save destination ECU, the control unit 12 transmits a rewrite response to the rewrite request to the central ECU 2 (A31) and waits to receive the rewrite data from the central ECU 2 (A32). When the control unit 12 determines that it has received the rewrite data transmitted from the central ECU 2 (A32: YES), it transmits the temporary data to the save destination ECU and stores the temporary data in an available area of ​​the save destination ECU (A33). That is, if the control unit 12 identifies both the rewrite data and the rollback data as temporary data, it transmits both the rewrite data and the rollback data to the save destination ECU and stores both the rewrite data and the rollback data in an available area of ​​the save destination ECU. If the control unit 12 identifies only the rollback data as temporary data, it transmits only the rollback data to the save destination ECU and stores only the rollback data in an available area of ​​the save destination ECU.

[0032] After storing the temporary data in the free area of ​​the save destination ECU, the control unit 12 waits to receive a temporary data storage result from the save destination ECU (A34). When the control unit 12 determines that it has received the temporary data storage result from the save destination ECU (A34: YES), it determines whether the temporary data storage in the save destination ECU is normal (A35). When the control unit 12 determines that it has received a temporary data storage normal notification from the save destination ECU and determines that the temporary data storage in the save destination ECU is normal (A35: YES), it stores the ECU information of the temporary data save destination ECU (A36).

[0033] The control unit 12 determines whether the temporary data is both rewrite data and rollback data (A37). If the control unit 12 determines that the temporary data is both rewrite data and rollback data (A37: YES), the control unit 12 waits to receive rewrite data from the save destination ECU (A38). If the control unit 12 determines that the rewrite data transmitted from the save destination ECU has been received (A38: YES), the control unit 12 writes the rewrite data received from the save destination ECU to the storage unit 13 (A39), and performs step S13 and the subsequent steps described above.

[0034] If the control unit 12 determines that the temporary data is not both rewrite data and rollback data (A37: NO), it writes the rewrite data to the storage unit 13 (A39) and performs step S13 and the subsequent steps.

[0035] When the control unit 12 determines that it has received a temporary data retention abnormality notification from the destination ECU and determines that the retention of temporary data at the destination ECU is abnormal (A35: NO), it sends a temporary data retention abnormality notification indicating the abnormality in the retention of temporary data at the destination ECU to the central ECU 2 (A40), and terminates the rewrite request receiving process.

[0036] (1-2) Processing performed by the central ECU2 (see Figure 7) In the central ECU 2, the control unit 11 performs a rewrite request transmission process. When the control unit 11 starts the rewrite request transmission process, it transmits a rewrite request to the rewrite target ECU (B1) and waits to receive a rewrite response from the rewrite target ECU (B2). When the control unit 11 determines that it has received the rewrite response transmitted from the rewrite target ECU (B2: YES), it transmits rewrite data to the rewrite target ECU (B3) and waits to receive a write result of the rewrite data from the rewrite target ECU (B4). Note that the control unit 11 may also transmit a request to save the rewrite data when transmitting the rewrite request. Furthermore, if rollback data is not generated in the rewrite target ECU, the control unit 11 also transmits the rollback data when transmitting the rewrite data.

[0037] When the control unit 11 determines that it has received the write result of the rewrite data from the rewrite target ECU (B4: YES), it determines whether the writing of the rewrite data is normal (B5). When the control unit 11 determines that it has received a write normal notification from the rewrite target ECU and that the writing of the rewrite data is normal (B5: YES), it determines that the writing of the rewrite data is normal (B6) and ends the rewrite request transmission process. When the control unit 11 determines that it has received a write abnormality notification from the rewrite target ECU and that the writing of the rewrite data is abnormal rather than normal (B5: NO), it determines that the writing of the rewrite data is abnormal (B7) and ends the rewrite request transmission process.

[0038] (1-3) Processing performed by the destination ECU (see Figures 8 and 9) In the save destination ECU, the control unit 12 performs temporary data save request reception processing. When the control unit 12 starts the temporary data save request reception processing, it determines whether a temporary data save request has been received from the rewrite target ECU (C1). When the control unit 12 determines that a temporary data save request has not been received from the rewrite target ECU (C1: NO), it ends the temporary data save request reception processing. When the control unit 12 determines that a temporary data save request transmitted from the rewrite target ECU has been received (C1: YES), it prepares ECU information (C2), transmits the prepared ECU information to the rewrite target ECU (C3), and waits for reception of temporary data from the rewrite target ECU (C4).

[0039] When the control unit 12 determines that it has received the temporary data transmitted from the rewrite target ECU (C4: YES), it stores the received temporary data in an available area (C5) and checks the temporary data storage status (C6). The control unit 12 determines whether the temporary data storage result is normal (C7), and when it determines that the temporary data storage result is normal (C7: YES), it transmits a temporary data storage normality notification indicating that the temporary data storage result is normal to the rewrite target ECU (C8).

[0040] The control unit 12 determines whether the temporary data is both rewrite data and rollback data (C9). If the control unit 12 determines that the temporary data is both rewrite data and rollback data (C9: YES), it transmits the rewrite data held as temporary data to the rewrite target ECU (C10) and determines whether the rewrite target ECU will perform a write-back (C11). If the control unit 12 determines that the rewrite target ECU will not perform a write-back (C11: NO), it terminates the temporary data save request reception process. If the control unit 12 determines that the rewrite target ECU will perform a write-back (C11: YES), it transmits the rollback data to the rewrite target ECU (C12) and terminates the temporary data save request reception process.

[0041] When the control unit 12 determines that the temporary data retention result is abnormal and not normal (C7: NO), it sends a temporary data retention abnormality notification indicating the abnormality in the temporary data retention result to the ECU to be rewritten (C13), and terminates the temporary data evacuation request receiving process.

[0042] Below, as shown in Fig. 10, a case will be described in which ECUs 3 to 5 are involved in software rewriting, ECUs 3 and 4 function as rewriting target ECUs for the same campaign, ECU 5 functions as a save destination ECU, and ECU 6 is not involved in software rewriting. Also, a case will be described in which ECU 3 does not have enough free space to store temporary data, and ECU 4 has enough free space to store temporary data. The processing flow when ECU 3 functions as the rewriting target ECU will be explained using Fig. 11, and the processing flow when ECU 4 functions as the rewriting target ECU will be explained using Fig. 12, but ECUs 3 and 4 perform these processes in parallel.

[0043] (2-1) Processing flow when ECU3 functions as the target ECU for rewriting When ECU3, which functions as the ECU to be rewritten, receives a rewrite request sent from central ECU2 (t1), it checks the capacity of the free space for storing temporary data, and since there is insufficient capacity for storing temporary data, it sends a temporary data evacuation request to other ECUs4 to 6 (t2 to t4).

[0044] Of the other ECUs 4 to 6, ECUs 4 and 5 involved in the software rewriting prepare ECU information upon receiving the temporary data save request transmitted from the central ECU 2 and transmit the prepared ECU information to ECU 3 (t5, t6). Of the ECUs 4 to 6, ECU 6 not involved in the software rewriting does not prepare any ECU information and does not transmit it to ECU 3 even when it receives the temporary data save request transmitted from the central ECU 2.

[0045] Upon receiving the ECU information transmitted from ECU4 and ECU5, ECU3 analyzes the campaign target information contained in the received ECU information, and since there is an ECU5 that is not subject to the same campaign, ECU3 identifies ECU5 as a save-destination candidate ECU. ECU3 compares the volume of the temporary data with the capacity of the free space in ECU5 identified as the save-destination candidate ECU, and if it determines that the volume of the temporary data does not exceed the capacity of the free space in ECU5, selects ECU5 identified as the save-destination candidate ECU as the save-destination ECU. After selecting ECU5 as the save-destination ECU, ECU3 transmits a rewrite response to central ECU2 (t7) and waits to receive rewrite data from central ECU2.

[0046] Upon receiving the rewrite data transmitted from the central ECU 2 (t8), the ECU 3 transmits temporary data to the ECU 5 (t9) and waits to receive the temporary data retention result from the ECU 5. In this case, if both rewrite data and rollback data have been transmitted as temporary data, the ECU 3 waits to receive the rewrite data from the ECU 5. Upon receiving a temporary data retention success notification transmitted from the ECU 5 (t10), the ECU 3 stores the ECU information of the ECU that is the destination for saving the temporary data, and waits to receive the rewrite data from the ECU 5. Upon receiving the rewrite data transmitted from the ECU 5, the ECU 3 writes the received rewrite data to the storage unit 13, and if the result of writing the rewrite data is normal, transmits a write success notification to the central ECU 2 (t12).

[0047] (2-2) Processing flow when ECU4 functions as the target ECU for rewriting The central ECU 2 transmits a rewrite request to the ECU 4 (t21). When the ECU 4 receives the rewrite request transmitted from the central ECU 2, it checks the capacity of the free area for storing temporary data, and since the free area for storing temporary data has sufficient capacity, it transmits a rewrite response to the central ECU 2 (t22) without transmitting a temporary data save request to the other ECUs 3, 5 to 6. The ECU 4 then waits for reception of rewrite data from the central ECU 2.

[0048] ECU 4 When the ECU 10 receives the rewrite data sent from the central ECU 2 (t23), it stores the temporary data in an empty area, and if the temporary data is stored normally, it writes the rewrite data to the memory unit 13, and if the writing result of the rewrite data is normal, it sends a write normality notification to the central ECU 2 (t24).

[0049] As described above, according to this embodiment, the following advantageous effects can be obtained. If the free space for storing temporary data is insufficient in the ECU to be rewritten when writing rewrite data, a destination ECU for the temporary data is selected, the temporary data is saved to the destination ECU, and the rewrite data is written with the temporary data saved to the destination ECU.If the free space for storing temporary data is insufficient when writing rewrite data, the temporary data is saved to the destination ECU, allowing the rewrite data to be written appropriately.This allows software rewriting to be performed appropriately even if the free space for storing temporary data is insufficient when writing rewrite data.

[0050] For ECUs to be rewritten, ECUs that are not subject to the same campaign are identified as save-destination candidate ECUs based on campaign target information included in the ECU information, and ECUs that are subject to the same campaign are not identified as save-destination candidate ECUs. By identifying ECUs that are not subject to the same campaign as save-destination candidate ECUs and selecting a save-destination ECU from the identified save-destination candidate ECUs, temporary data can be appropriately saved to the save-destination ECU.

[0051] In the ECU to be rewritten, if the capacity of temporary data does not exceed the capacity of the free space of a single save-destination candidate ECU based on the free space information included in the ECU information, that save-destination candidate ECU is selected as the save-destination ECU, and if the capacity of temporary data exceeds the capacity of the free space of a single save-destination candidate ECU, multiple save-destination candidate ECUs are set.Even if the capacity of temporary data exceeds the capacity of the free space of a single save-destination candidate ECU, by setting multiple save-destination candidate ECUs, the temporary data can be distributed and saved appropriately to multiple save-destination ECUs.

[0052] Among the ECUs to be rewritten, an ECU with a larger free space capacity than the others is given priority in selection as the destination ECU. By giving priority to selecting an ECU with a larger free space capacity than the others as the destination ECU, the resources of the vehicle-side system 1 can be used effectively.

[0053] Among the ECUs to be rewritten, an ECU with a smaller processing load than the others is given priority in selection as the destination ECU. By giving priority to selecting an ECU with a smaller processing load than the others as the destination ECU, the resources of the vehicle-side system 1 can be used effectively.

[0054] By treating both the rewrite data and the rollback data as temporary data, it is possible to appropriately save both the rewrite data and the rollback data to the save destination ECU. By treating only the rollback data as temporary data, it is possible to appropriately save only the rollback data to the save destination ECU.

[0055] Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0056] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium.

[0057] In addition to the inventions set forth in the claims, the present disclosure includes the following inventions. [1] An electronic control device that rewrites software by writing rewrite data, a rewrite data acquisition unit (12a) for acquiring rewrite data from an external device; a rewrite data writing unit (12b) that writes the rewrite data into a storage unit; a free space determination unit (12c) for determining the capacity of a free space for storing temporary data when the rewrite data is written; a temporary data saving unit (12d) that, when the capacity of the free area is insufficient, selects a save destination device for the temporary data and saves the temporary data to the selected save destination device; The rewrite data writing unit writes the rewrite data to the storage unit in a state where the temporary data is saved in the save destination device. [2] The electronic control device according to [1], wherein the temporary data saving unit selects the save destination device based on campaign target information indicating a campaign target. [3] The electronic control device according to [1] or [2], wherein the temporary data evacuation unit selects multiple destination devices when the capacity of the temporary data exceeds the capacity of the free space in a single destination device. [4] The electronic control device according to any one of [1] to [3], wherein the temporary data saving unit selects, as the save destination device, a device having a larger free space capacity than other devices, with priority. [5] The temporary data evacuation unit acquires and stores the free space capacity from multiple candidate devices for evacuation destination, and selects the evacuation destination device from the multiple candidate devices for evacuation destination based on the stored free space capacity. [4] An electronic control device as described in. [6] The electronic control device according to any one of [1] to [3], wherein the temporary data saving unit selects, as the save destination device, a device with a lower processing load than other devices, with priority. [7] The electronic control device described in [6], wherein the temporary data evacuation unit acquires and stores the processing loads from a plurality of candidate evacuation destination devices, and selects the evacuation destination device from among the plurality of candidate evacuation destination devices based on the stored processing loads. [8] the temporary data includes the rewrite data, The electronic control device according to any one of [1] to [7], wherein the free space determination unit determines the capacity of a free space for storing the temporary data including the rewrite data. [9] the temporary data includes rollback data for restoring the data to a state before the data was written when an abnormality occurs in writing the rewritten data; The electronic control device according to any one of [1] to [8], wherein the free space determination unit determines the capacity of free space for storing the temporary data including the rollback data. [Explanation of symbols]

[0058] In the drawing, 3 is an ECU (electronic control unit) to be rewritten, 12a is a rewrite data acquisition unit, 12b is a rewrite data writing unit, 12c is a free space determination unit, and 12d is a temporary data saving unit.

Claims

1. An electronic control device that rewrites software by writing rewrite data, a rewrite data acquisition unit (12a) for acquiring rewrite data from an external device; a rewrite data writing unit (12b) that writes the rewrite data into a storage unit; a free space determination unit (12c) for determining the capacity of a free space for storing temporary data when the rewrite data is written; a temporary data saving unit (12d) that, when the capacity of the free area is insufficient, selects a save destination device for the temporary data and saves the temporary data to the selected save destination device; The rewrite data writing unit writes the rewrite data directly to the memory unit without the temporary data being saved to the save destination device when the capacity of the free space is sufficient, and writes the rewrite data to the memory unit with the temporary data saved to the save destination device when the capacity of the free space is sufficient.

2. An electronic control device that rewrites software by writing rewrite data, a rewrite data acquisition unit (12a) for acquiring rewrite data from an external device; a rewrite data writing unit (12b) that writes the rewrite data into a storage unit; a free space determination unit (12c) for determining the capacity of a free space for storing temporary data when the rewrite data is written; a temporary data saving unit (12d) that, when the capacity of the free area is insufficient, selects a save destination device for the temporary data and saves the temporary data to the selected save destination device; the free space determination unit, when an external rewrite request includes a request to save the rewrite data, determines the capacity of the free space for storing the temporary data including both the rewrite data and rollback data for restoring the data to a state before writing when an abnormality occurs in writing the rewrite data, and when an external rewrite request does not include a request to save the rewrite data, determines the capacity of the free space for storing the temporary data including only the rollback data; The rewrite data writing unit writes the rewrite data to the storage unit in a state where the temporary data is saved in the save destination device.

3. 3. The electronic control device according to claim 1, wherein the temporary data saving unit selects the save destination device based on campaign target information indicating a campaign target.

4. 3. The electronic control unit according to claim 1, wherein the temporary data saving unit selects a plurality of save destination devices when the volume of the temporary data exceeds the free space capacity of a single save destination device.

5. 5. The electronic control unit according to claim 4, wherein the temporary data saving unit selects, as the save destination device, a device having a larger free area capacity than the other devices, with priority.

6. The electronic control device described in claim 5, wherein the temporary data backup unit acquires and stores the free space capacity from multiple candidate backup destination devices, and selects the backup destination device from among the multiple candidate backup destination devices based on the stored free space capacity.

7. 5. The electronic control unit according to claim 4, wherein the temporary data saving unit selects, as the save destination device, a device with a lower processing load than other devices, with priority.

8. An electronic control device as described in Claim 7, wherein the temporary data evacuation unit acquires and retains the processing load from multiple candidate evacuation destination devices, and selects the evacuation destination device from among the multiple candidate evacuation destination devices based on the retained processing load.

Images