Electronic control unit

Abstract

To provide a technique for repressing troublesomeness in version management.SOLUTION: An electronic control device 10, 20, including a rewritable storage device 34, comprises an executing section, a program receiving section, a program updating section and a difference updating section. The program updating section is configured, each time a new control program is received by the program receiving section, to update the control program the executing section is to execute by the new control program. The difference updating section is configured, each time the control program the executing section is to execute is updated by the program updating section, to generate difference data indicative of a difference between an updated control program and a particular program, a control program the electronic control device is allowed to use, stored in a particular program area different from a control program area included in the storage device and store generated difference data as new difference data in the storage device.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a programmable electronic control device that is mounted on a vehicle. [Background technology]

[0002] In electronic control units (hereinafter referred to as ECUs) installed in vehicles, memory for storing control programs and the like is used, such as flash memory, whose stored contents can be rewritten in response to program upgrades, etc. Rewriting of ECU programs is performed, for example, by connecting a writing tool to a connector provided on the vehicle and having this writing tool communicate with the ECU.

[0003] For example, Patent Document 1 below proposes a technique for updating differences, in which a PC (for example, a dealer's PC) generates a difference program and a writing tool writes the difference program into an ECU to be rewritten. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 6838714 Summary of the Invention [Problem to be solved by the invention]

[0005] The difference program in the differential update may be a program that indicates the difference between the upgraded new program and the program already stored in the ECU to be rewritten. However, whether a program has been upgraded or not may vary from vehicle to vehicle, depending on, for example, the owner's awareness of whether or not to support program updates.

[0006] In other words, when a new program is rewritten, the version of the program already stored in the ECU is likely to differ for each vehicle. For this reason, differential updates require the creation of multiple types of differential programs, which creates a problem for vehicle owners and dealers: version management when rewriting ECU programs becomes complicated.

[0007] One aspect of the present disclosure is to provide a technique for reducing the complexity of version management. [Means for solving the problem]

[0008] One aspect of the present disclosure is an electronic control device (10, 20) including a rewritable storage device (34), and including an execution unit (S130), a program receiving unit (S20), a program update unit (S30), and a difference update unit (S70, S80). The execution unit is configured to execute a control program stored in a control program area included in the storage device as a control program for controlling a control object, thereby controlling the control object.

[0009] The program receiving unit is configured to receive a new control program by communicating with an external rewriting device, and the program updating unit is configured to update the control program executed by the executing unit with the new control program every time the program receiving unit receives a new control program.

[0010] The difference update unit is configured to generate difference data indicating the difference between the updated control program and the specific program each time the control program executed by the execution unit is updated by the program update unit, and to store the generated difference data in the storage device as new difference data. The specific program is a control program usable by the electronic control device and is stored in an area SB different from an area SA included in the storage device.

[0011] With this configuration, when rewriting a control program, the external rewriting device transmits the new control program itself, rather than a difference program, to the electronic control device, eliminating the need to generate multiple types of difference programs in advance as is the case with difference updates. As a result, by using the electronic control device of the present disclosure, the complexity of version management of the control program in the rewriting device can be reduced when rewriting the control program of the electronic control device. Furthermore, since the electronic control device is provided with difference data and a specific program, by using these, even if an abnormality occurs in the control program executed by the execution unit, the control program can be restored to the state it was in when the difference data was generated. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a block diagram showing the configuration of an in-vehicle system. [Figure 2] FIG. 2 is an explanatory diagram illustrating the configuration of a flash memory and its operation during update processing. [Figure 3] FIG. 2 is a block diagram showing the functions of a connection node. [Figure 4] 10 is a flowchart of an update process. [Figure 5] 10 is a flowchart of a startup process. [Figure 6] 10 is a flowchart of a repair process. [Figure 7] FIG. 10 is an explanatory diagram illustrating updating of a specific program. [Figure 8] FIG. 10 is an explanatory diagram illustrating an operation by a repair process. [Figure 9] FIG. 1 is an explanatory diagram illustrating how the difference between a program and the original program increases as the number of versions increases. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. [1. First embodiment] [1-1.Configuration] The in-vehicle electronic control system (hereinafter referred to as in-vehicle system 1) shown in Fig. 1 is mounted on a vehicle and includes a connection node 10, a connection node 20, and a relay device 50. The connection node 10, the connection node 20, and the relay device 50 are connected by CAN or Ethernet communication lines to form a vehicle network. Note that CAN and Ethernet are registered trademarks.

[0014] The connection node 10 is an on-board electronic control unit (hereinafter referred to as ECU) that controls control targets mounted on the vehicle, such as the engine, brakes, etc. ECU is an abbreviation for Electronic Control Unit.

[0015] The connection node 10 is mainly composed of a microcomputer (hereinafter referred to as microcomputer 38) including a CPU 31, memory 35 such as RAM 32, ROM 33, flash memory 34, etc., and a data transmission / reception unit 36. The CPU 31 is a calculation device, and the RAM 32 is a volatile memory for temporarily storing the calculation results of the CPU 31, etc. The ROM 33 is a memory having a non-rewritable storage area, and the flash memory 34 is a non-volatile memory having a rewritable storage area. The flash memory 34 may be, for example, an EEPROM. The flash memory 34 stores various programs executed by the CPU 31.

[0016] The data transmitter / receiver 36 transmits and receives data to and from each device constituting the vehicle network via a communication line. The configuration of the flash memory 34 will be described in detail later. Like the connection node 10, the connection node 20 is an ECU that controls control objects mounted on the vehicle. Although not shown in Fig. 1, many control objects are mounted on the vehicle, and many ECUs that control each control object constitute a vehicle network as connection nodes.

[0017] The relay device 50 is connected to the connector 60 and each connection node. The relay device 50 is wired to an external rewriting tool 70 via the connector 60, and relays data transmission and reception between the rewriting tool 70 and the connection node. Although not shown, the relay device 50 includes a communication unit for performing wired communication with the rewriting tool 70.

[0018] The rewriting tool 70 is a device for rewriting programs. For example, the rewriting tool 70 transmits a new control program (hereinafter referred to as a control program) relating to the control target of the connection node to the connection node whose program is to be rewritten. The control program is a program that the connection node 10 uses to control the control target. The rewriting tool 70 can also be said to be a device for rewriting the control program of the connection node that is to be rewritten.

[0019] A control program is a program for which so-called versions are managed. A version indicates the status of updates to the program, the number of updates, etc. In this embodiment, as an example, a version is indicated by a number such as 1, 2, 3, etc. However, the notation of a version is not limited to this. Each time an update is made, the number indicating the version increases.

[0020] Note that the program referred to here refers to a program whose differences from the original program increase with each version (i.e., the larger the version number), as shown in Figure 9. In Figure 9, the original program is shown as program version 0 (i.e., v0) as an example. Figure 9 also shows an image of how the differences increase as the versions progress from the original program (i.e., v0), from version 1 (i.e., v1) → version 2 (i.e., v2) → version 3 (i.e., v3) ...

[0021] For example, the new control program transmitted from the rewriting tool 70 may contain version information together with data indicating the program. The version information is information indicating the version of the control program.

[0022] Next, the configuration of the flash memory 34 will be described with reference to FIG. The flash memory 34 has a signature area SG in which a signature (hereinafter, signature information) is written, and a plurality of areas SA, SB, SC, SD, and SE in which program-related data is written.

[0023] The area SA stores the current program PA, which is a control program received from the rewriting tool 70 and already written in the current flash memory 34, and which is executed by the currently connected node 10 to control the control target.

[0024] The signature information is information (i.e., verification expected value) for confirming (i.e., verifying) that the control program stored in the area SA as the current program PA has not been tampered with. The signature information can be transmitted from the rewriting tool 70, for example, together with the control program.

[0025] The area SB stores a specific program PB. The specific program PB is a control program received from the rewriting tool 70 before the current program PA. In other words, the current program PA and the specific program PB are control programs for the connection node 10 to control the same control target mounted on the vehicle. The specific program PB is a control program of a version earlier than the control program stored as the current program PA.

[0026] In other words, the specific program PB is a control program that is the same as or an earlier version of the control program stored as the current program PA. The specific program PB stored in the area SB is a control program that is not normally used to control the control object because the current program PA is executed, but can be used to control the control object.

[0027] The area SC stores difference data Δ, which is data indicating the difference between the current program PA currently executed by the connection node 10 and a specific program PB stored in the flash memory 34 and available to the connection node 10.

[0028] A repro program is stored in area SD, and a boot program is stored in area SE. The repro program is a program for rewriting the current program PA and the specific program PB stored in flash memory 34 with new control programs. For example, when CPU 31 executes the repro program, the functions of a rewrite control unit 41, a difference generation unit 42, and a storage unit 43 shown in FIG. 3 are realized.

[0029] The boot program is a program executed by the CPU 31 when the power supply of the connection node 10 is switched from off to on, for starting up the connection node 10. For example, the processing of the CPU 31 executing the boot program realizes the functions of the startup unit 44, verification unit 45, and differential restoration unit 46 shown in FIG.

[0030] [1-2. Processing] [2.1 Update process] Next, the procedure by which the connection node 10 executes the reprogram will be described using the flowchart in Figure 4. This procedure is executed when an update request is output from the rewriting tool 70 to the connection node 10. This process is also called update processing. The series of processes from S10 to S80 is also called a processing cycle.

[0031] First, in step (hereinafter, S) 10, the connection node 10 receives an update request from an external rewrite tool 70 via the connection line. The update request includes a command to the connection node (i.e., the connection node 10 in this embodiment) whose control program is to be updated to erase the current program PA, which is the control program already written in area SA of the flash memory 34. The connection node 10 erases area SA in accordance with the update request (i.e., erases the current program PA stored in area SA). Then, the connection node 10 transmits a response indicating that the erasure has been completed to the rewrite tool 70.

[0032] In the following S20, the connection node 10 receives a new control program by communicating with the rewriting tool 70. In this step, the connection node 10 determines whether or not a new control program has been received, and if a new control program has not been received, waits until a new control program is received.

[0033] In the next step S30, the connecting node 10 updates the current program PA with the new control program received in S20. Specifically, the connecting node 10 writes the new control program received from the rewriting tool 70 into the area SA erased in S10.

[0034] When the connection node 10 updates the current program PA with the new control program, it transmits a write completion response to the rewriting tool 70 . In addition, in the above-mentioned S10, the connecting node 10 may erase the areas SA and SG when receiving the update request. Also, in the above-mentioned S20, the connecting node 10 may receive a new control program and signature information related to the new control program from the rewriting tool 70. Then, in the above-mentioned S30, the connecting node 10 may update the current program PA and update the signature information (i.e., write the new signature information received from the rewriting tool 70 into the area SG erased in S10). The connecting node 10 may then transmit a response indicating that the writing is complete.

[0035] Next, in S40, the connection node 10 determines whether or not the specific program PB needs to be updated. The connection node 10 determines whether or not a predetermined specific update condition is satisfied, and if it is determined that the specific update condition is satisfied, it determines that the specific program PB needs to be updated. The specific update condition is a predetermined condition for updating the specific program PB.

[0036] For example, the specific update condition may be that a predetermined number of program updates have been performed between the control program stored as the current program PA and the control program stored as the specific program PB. Such a specific update condition is satisfied when the current program PA has been updated a relatively large number of times since the specific program PB was written to the area SB.

[0037] Incidentally, when differential data Δ is generated in S80 (to be described later) in the flash memory 34, differential capacity information is written to a predetermined area in the flash memory 34. The differential capacity information indicates the data capacity of the generated differential data Δ. When a specific update condition is satisfied (i.e., when the number of times the current program PA has been updated since the specific program PB was written to the area SB is relatively large), the data capacity indicated by the differential capacity information becomes relatively large.

[0038] Therefore, in this embodiment, it is determined whether the specific update condition is satisfied based on the size of the data capacity indicated by the differential capacity information. Note that the differential capacity information acquired in this step indicates the data capacity when the differential data Δ was generated in the previous processing cycle.

[0039] Specifically, in this embodiment, the specific update condition is that differential capacity information is acquired from the flash memory 34, and the data amount indicated by the differential capacity information (i.e., the data capacity of the differential data Δ generated in the previous processing cycle) is equal to or greater than a predetermined capacity threshold. The capacity threshold may be a numerical value indicating the data capacity, expressed in units such as bytes. In other words, the connection node 10 acquires the differential capacity data in this step, and determines that the specific program PB needs to be updated if the data amount indicated by the differential capacity data Δ (i.e., the data capacity of the differential data Δ in the previous processing cycle) is equal to or greater than the capacity threshold.

[0040] If the data amount indicated by the differential capacity data (i.e., the data capacity of the differential data Δ of the previous processing cycle) is equal to or greater than the capacity threshold, it indicates that the number of updates that have been performed since the specific program PB was written is relatively large.

[0041] If the determination in S40 is affirmative (i.e., if the specific update condition is determined to be satisfied), the connection node 10 proceeds to S50, and updates the specific program PB with the received new control program in the subsequent processing. Updating means storing the specific program PB by overwriting it (i.e., by erasing the storage area and writing a new program).

[0042] Specifically, in S50, the connection node 10 erases the area SB of the flash memory 34. As a result, the specific program PB stored in the area SB is erased. In the next step S60, the connecting node 10 stores the new control program received in step S20 as a new specific program PB in the area SB. Then, the connecting node 10 shifts the processing to step S70.

[0043] On the other hand, if a negative determination is made in S40 (that is, if it is determined that the specific update condition is not satisfied), the connection node 10 proceeds to S70 without updating the specific program PB.

[0044] In S70, the connection node 10 generates differential data Δ. That is, the connection node 10 generates differential data Δ between the current program PA stored in area SA and the specific program PB stored in area SB in the current processing cycle. At the same time, the connection node 10 generates differential capacity information indicating the data capacity of the generated differential data Δ, and updates a predetermined area of ​​the flash memory 34 (hereinafter also referred to as the differential capacity area) with the generated differential capacity information.

[0045] As a result, differential capacity information indicating the data capacity of differential data Δ between the current program PA stored in area SA and the specific program PB stored in area SB in this processing cycle is overwritten and stored in the differential capacity area.

[0046] In the next step S80, the connection node 10 updates the difference data Δ already stored in area SC with the difference data Δ generated in S70. As a result, the difference data Δ between the current program PA stored in area SA and the specific program PB stored in area SC in this processing cycle is overwritten and stored in area SC. The connection node 10 then ends this update processing.

[0047] The processing performed by the rewrite control unit 41 corresponds to S10-S30, the processing performed by the difference generation unit corresponds to S70, and the processing performed by the storage unit 43 corresponds to S80. [2.2 Startup process] Next, the startup process performed by the connection node 10 by executing a boot program will be described with reference to the flowchart in Fig. 5. This process procedure is executed when the power supply of the connection node 10 is switched from off to on. The switching of the power supply from off to on can be triggered by, for example, the start of the vehicle, such as the ignition switch being turned on or the start switch being turned on.

[0048] First, in S110, the access node 10 verifies the area SA of the flash memory 34. That is, the access node 10 verifies whether or not an abnormality (e.g., tampering) has occurred in the area SA where the current program PA is stored. The verification method may be, for example, signature verification.

[0049] As described above, the connection node 10 may store in area SG the signature information received together with the new control program from the rewriting tool 70 when executing the reprogram (i.e., during the update process). The signature information is the verification expected value received from the rewriting tool 70, as described above.

[0050] In this step, the access node 10 may generate a verification expectation value for the area SA, and may determine that the verification is successful if the generated verification expectation value matches the signature information stored in the area SG during the update process. Any verification method may be used. For example, MAC authentication may be used instead of signature verification. MAC is an abbreviation for Message Authentication Code.

[0051] In the following S120, if the connection node 10 determines that the verification has been successful, it shifts the process to S130, and if it determines that the verification has failed, it shifts the process to S140. Here, in S130 to which the process proceeds if it is determined that the verification is successful, the access node 10 executes the control program stored in the area SA (that is, the current program PA), and then this activation process ends.

[0052] On the other hand, if it is determined that the verification has failed, the connection node 10 executes a restoration process in S140, and then executes the restored control program in S150, thereby terminating the startup process. Note that hereinafter, restoration may be referred to as restoration.

[0053] Next, the recovery process executed by the connection node 10 in S140 of the above-mentioned startup process will be described with reference to the flowchart shown in FIG. First, in S210, the connection node 10 erases the area SA, that is, erases the current program PA stored in the area SA.

[0054] In the next S220, the connection node 10 executes differential restoration and writing. Specifically, the connection node 10 uses the specific program PB and the differential data Δ to restore the control program as the current program PA when the differential data Δ was generated by adding them together. The connection node 10 then writes the restored control program as the current program PA to the area SA. The connection node 10 then ends the restoration process.

[0055] The connection node 10 may generate a verification expectation when writing the restored control program as the current program PA into the area SA. If the generated verification expectation matches the signature information stored in the area SG, the connection node 10 may determine that the writing was successful and terminate the repair process. If the connection node 10 determines that the writing failed (i.e., if the generated verification expectation does not match the signature information stored in the area SG), it may perform writing again.

[0056] The processing as the startup unit 44 (i.e., the processing performed by executing the boot program) corresponds to S110-S15, of which the processing as the verification unit 45 corresponds to S110, and the processing as the differential restoration unit 46 (program restoration unit) corresponds to S140.

[0057] 2.3 Operation <Operation by update process> The operation of the update process will be described with reference to Figures 2 and 7. For example, as shown in Figure 2, in the flash memory 34 before the update, the control program V1 of version 1 is stored in area SA as the current program PA, and the control program V1 of version 1 is stored in area SB as the specific program PB.

[0058] In the following, the specific program PB may be simply referred to as PB. For example, the control program V1 of version 1 may be simply referred to as v1. For example, if the control program V1 of version 1 is used as the current program PA, the current program PA may be referred to as PA(v1).

[0059] The differential data Δ stored in area SC is the difference between the current program PA and the specific program PB at this point (ie, PA(v1)-PB), and since PB=v1, the data capacity is approximately 0 at this point.

[0060] Here, when the connection node 10 receives the new control program v2 of version 2 from the rewriting tool 70, it updates the current program PA with the received new control program. That is, the connection node 10 writes the new control program v2 of version 2 into the area SA as the new current program PA (i.e., the current program PA is PA(v2)).

[0061] Next, the connection node 10 generates differential data Δ (i.e., PA(v2)-PB) between the updated current program PA (i.e., the received new control program) and the specific program PB, and writes the generated differential data Δ to the area SC as new differential data Δ. The connection node 10 repeats the same operation every time it receives a new control program from the rewriting tool 70.

[0062] In this way, each time a new (i.e., newer version) control program is received, the latest control program is stored in area SA, and the difference data Δ between the latest control program and the specific program PB is overwritten and stored in area SC.

[0063] As a result, as will be described later, even if an abnormality occurs in the current program PA, it is possible to restore the latest control program based on the specific program PB and the difference data Δ.

[0064] 7 shows an example in which, following on from FIG. 2, the control program stored in area SA is updated sequentially to versions 1, 2, ..., 5, and then areas SA and SC are updated by receiving a new control program v6 of version 6. Here, the specific program PB remains the control program v1 of version 1 (i.e., PB=v1), so the data capacity of the difference data Δ, although not shown, increases each time the control program stored in area SA is updated sequentially.

[0065] For example, suppose that at the time when a new control program v6 of version 6 (i.e., PA(v6)) as the current program PA is written to area SA (i.e., after the update), the data capacity of the differential data Δ (i.e., (PA(v5)-PB) is equal to or greater than the capacity threshold. In this case, the connection node 10 determines that the specific update condition is met and updates the specific program PB with the new control program v6 of the latest version 6 (i.e., PB=v6). Furthermore, the connection node 10 overwrites and stores in area SC the differential data Δ (i.e., PA(v6)-PB) between the current program PA (i.e., PA(v6)), which is the latest control program v6, and the specific program PB.

[0066] The differential data Δ stored in the area SC is the difference between the current program PA and the specific program PB at this point in time, and since PB=v6, the data capacity is approximately 0 at this point in time.

[0067] In the connection node 10, the specific program PB is updated in this manner, thereby reducing the data volume of the differential data Δ. <Operation by repair process> The operation of the repair process will be explained using Figure 8. For example, assume that the flash memory 34 has each program and each data written in area SG and area SA-area SB, as shown in "After difference generation" in Figure 2. When the flash memory 34 is in this state, if the power to the connection node 10 is turned on from off, the connection node 10 executes a boot program (i.e., startup process) and verification of area SA fails, the connection node 10 executes repair process.

[0068] Specifically, the connection node 10 first erases areas SG and SA (i.e., "Before Restoration" in FIG. 8). Next, the connection node 10 restores the version 2 control program v2 that was operating as the current program PA by combining the differential data Δ (i.e., PA(v2)-PB) stored in area SC at this time and the specific program PB. Then, the connection node 10 writes the restored control program v2 to area SA as the current program PA (i.e., writes PA(v2) to area SA). The connection node 10 also writes the signature information included in the restored current program PA (i.e., control program v2 of version 2) to area SG.

[0069] In this way, the connection node 10 restores the latest control program at that time (for example, in the case of FIG. 8, the control program v2 of version 2) based on the specific program PB and the difference data Δ.

[0070] [1-3.Effects] According to the first embodiment described above in detail, the following effects are achieved. (1a) In S30, the connection node 10 updates the current program PA with the new control program each time a new control program is received in S20. In S70 and S80, the connection node 10 generates difference data Δ indicating the difference between the updated current program PA and the specific program PB each time the current program PA is updated in S30. The connection node 10 updates the difference data Δ already stored in the flash memory 34 with the generated difference data Δ.

[0071] In other words, the connection node 10 itself generates the difference data Δ each time it receives a new control program. As a result, when the external rewriting tool 70 rewrites the control program, it only needs to transmit the new control program itself, not the difference program, to the connection node 10. Therefore, unlike program rewriting by difference update, it is not necessary to generate multiple types of difference programs in advance. For example, there is no need to generate difference programs in advance using a dealer's PC, etc. Furthermore, the vehicle owner does not need to be aware of the differences in the control program.

[0072] As a result, by using the connection node 10 of this embodiment, it is possible to reduce the complexity of version management of the control program in the rewriting tool 70 when rewriting the control program of the connection node 10. This in turn reduces the complexity of version management of the control program by vehicle owners and dealers.

[0073] Furthermore, the difference data Δ and the specific program PB are stored in the connection node 10. Therefore, even if an abnormality occurs in the current program PA executed by the connection node 10, the control program when the difference data Δ was generated can be restored based on the difference data Δ and the specific program PB.

[0074] Furthermore, each time the current program PA is updated, the connection node 10 updates the difference data Δ indicating the difference between the updated current program PA and the specific program PB. In other words, the control program used as the current program PA when the difference data Δ was generated is the control program when the current program PA was updated, and is the most recent control program received by the connection node 10. Therefore, when restoring using the difference data Δ and the specific program PB, the most recent control program received by the connection node 10 can be restored.

[0075] (1b) The specific program PB is a control program that can be used by the connection node 10 and is a control program that precedes the control program updated by S30. Here, "previous" refers to a previous version. As a result, even if an abnormality occurs in the current program PA and the control program at the time when the difference data Δ was generated based on the difference data Δ and the specific program PB cannot be restored, the connection node 10 can still use the specific program PB to control the control target.

[0076] (1c) In S140, the connecting node 10 restores the control program when the differential data Δ was generated based on the specific program PB and the differential data Δ. This allows the connecting node 10 to restore the latest control program received when the differential data Δ was generated.

[0077] (1d) In S140, the connection node 10 restores the control program if it is diagnosed that an abnormality has occurred in the area SA when the connection node 10 is started. As a result, even if an abnormality has occurred in the current program PA when the connection node 10 is started, the restored control program can be used as the new current program PA to control the control target. In other words, it is possible to reliably execute a control program that is guaranteed to be the latest and to have a normal written state.

[0078] (1e) In S40, when a new control program is received, the connecting node 10 determines whether the specific update condition is satisfied. In S60, if it is determined in S40 that the specific update condition is satisfied, the connecting node 10 updates the specific program PB with the received new control program. This makes it possible to reduce the data volume of the differential data Δ.

[0079] (1f) The specific update condition is that the data capacity of the differential data Δ is equal to or greater than a predetermined capacity threshold. This allows the specific program PB to be updated and the data capacity of the differential data Δ to be reduced if the number of updates to the current program PA after the specific program PB was written to the area SB is relatively large.

[0080] In the above-described embodiment, the connection node 10 corresponds to the electronic control device, execution unit, program reception unit, program update unit, difference update unit, program restoration unit, specific program unit, and condition determination unit. The flash memory 34 corresponds to the storage device, and the rewrite tool 70 corresponds to the rewrite tool. Area SA corresponds to the control program area, and area SB corresponds to the specific program area. S20 corresponds to processing as the program reception unit, S30 corresponds to processing as the program update unit, S40 corresponds to processing as the condition determination unit, and S60 corresponds to processing as the specific program unit. S70 and S80 correspond to processing as the difference update unit, S130 corresponds to processing as the execution unit, and S140 corresponds to processing as the program restoration unit. The current program PA corresponds to the control program executed by the execution unit.

[0081] [2. Second Embodiment] [2-1. Differences from the first embodiment] The second embodiment has the same basic configuration as the first embodiment, so differences will be described below. Note that the same reference numerals as those in the first embodiment indicate the same configuration, and reference will be made to the preceding description.

[0082] In the first embodiment described above, the specific update condition is that the data volume of the differential data Δ is equal to or greater than a volume threshold. The second embodiment differs from the first embodiment in that the specific update condition is that the difference between the value indicating the version of the control program executed in S130 (i.e., the current program PA) and the value indicating the version of the specific program PB is equal to or greater than a version threshold. The version threshold indicates a predetermined value.

[0083] [2-2. Processing] The connection node 10 of the second embodiment executes the same startup process as in the first embodiment (i.e., FIGS. 5-6), and therefore the description thereof will be omitted. The connection node 10 differs from the first embodiment in that it uses the above-mentioned specific update condition in S40 in the update process shown in FIG.

[0084] Specifically, in S40, the connection node 10 acquires a numerical value indicating the version of the control program as the current program PA and a numerical value indicating the version of the control program as the specific program PB. Hereinafter, the version of the control program as the current program PA will also be simply referred to as the version of the current program PA. Also, the version of the control program as the specific program PB will also be simply referred to as the version of the specific program PB.

[0085] Here, when the connection node 10 receives a new control program from the rewriting tool 70 and updates the current program PA (for example, S30), the connection node 10 may store a numerical value indicating the version of the new control program in a predetermined area of ​​the flash memory 34.

[0086] On the other hand, when updating a specific program PB (e.g., S60), the connection node 10 may store a numerical value indicating the version of the new control program used for the update in a predetermined area of ​​the flash memory 34 as a numerical value indicating the version of the specific program PB.

[0087] When the difference between the version number of the current program PA and the version number of the specific program PB is equal to or greater than a version threshold (e.g., 5), the connection node 10 determines that the specific update condition is met and that the specific program PB needs to be updated. The version threshold may be any value that indicates the difference between the versions. The version threshold may be stored in a predetermined area of ​​the flash memory 34.

[0088] [2-3. Effects] According to the second embodiment described above in detail, the effects (1a) to (1e) of the first embodiment described above are achieved, and further, the following effects are achieved.

[0089] (2a) The specific update condition is that the difference between the version of the current program PA and the version of the specific program PB is equal to or greater than a predetermined version threshold value. This allows the specific program PB to be updated and the data volume of the difference data Δ to be reduced when the version of the control program serving as the current program PA and the version of the control program serving as the specific program PB are different from each other.

[0090] 3. Other Embodiments Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms.

[0091] (3a) In the above-described embodiment, the connection node 10 updates the control program by executing an update process and restores the control program by executing a repair process, but the present disclosure is not limited to this. The connection node 20 may be configured similarly to the connection node 10, and the connection node 20 may update and restore the control program by executing an update process and a repair process similar to the connection node 10. The other connection nodes included in the in-vehicle system 1 are also configured similarly to the connection node 20.

[0092] (3b) In the above-described embodiments, the version may be indicated by a combination of a main version (e.g., 1 in the above-described example) and a sub-version (e.g., 1, 2 in the above-described example), such as version 1.1, version 1.2, etc. Note that the information indicating the version is not limited to such numerical values, and may be indicated by numerical values, alphabets, various names, or combinations thereof.

[0093] (3c) In the connection node 10 of the above embodiment, the specific update condition may be that the control program has been updated a predetermined number of times or more between the current program PA and the specific program PB.

[0094] Specifically, for example, the specific update condition may be that the ratio of the data capacity of the differential data Δ to the data capacity of the specific program PB is equal to or greater than a predetermined ratio (e.g., 50%). The predetermined ratio is not limited to 50% and may be set to any desired ratio. The data capacity of the specific program PB may be stored in a predetermined area of ​​the flash memory 34 when the specific program PB is updated (e.g., S60). Furthermore, the ratio of the data capacity of the differential data Δ to the data capacity of the specific program PB may be stored in a predetermined area of ​​the flash memory 34 when the differential data Δ is updated (e.g., S80).

[0095] Furthermore, for example, when a version is indicated by a combination of a main version and a sub-version, the specific update condition may be that the main versions are different.

[0096] (3d) The specific renewal condition may be one of the various specific renewal conditions described above, or may be a combination of multiple conditions from the various specific renewal conditions described above. (3e) In the connection node 10 of the above embodiment, in S10-S30, if the data volume of the new control program is large and the new control program is transmitted in multiple batches from the rewriting tool 70, the above-described processes of S10-S30 are repeated multiple times. Also, in S10-S30, the current program PA may be rewritten using a protocol conforming to ISO 14229. However, the present disclosure is not limited to this, and rewriting may be performed according to a protocol other than ISO 14229.

[0097] (3f) In the above-described embodiment, the relay device 50 is connected to the external rewriting tool 70 by wire via the connector 60. However, the relay device 50 may be provided with a communication unit for wireless communication and may be connected wirelessly to the rewriting tool 70. Alternatively, the rewriting tool 70 may be directly connected by wire to the connection node 10 via a connector (not shown).

[0098] (3g) The connection node 10 and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the connection node 10 and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the connection node 10 and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions to be executed by a computer. The method for implementing the functions of each unit included in the connection node 10 does not necessarily need to include software; all of the functions may be implemented using one or more hardware devices.

[0099] (3h) Multiple functions of one component in the above embodiments may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0100] (3i) In addition to the connection node 10 described above, the present disclosure can also be realized in various forms, such as an in-vehicle system 1 having the connection node 10 as a component, a rewrite system having a rewrite tool 70 and an in-vehicle system 1 including the connection node 10 as components, a program for causing the connection node 10 to function, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a method for rewriting a program. [Explanation of symbols]

[0101] 10...connection node, 20...connection node, 7...rewriting tool, 34...flash memory.

Claims

1. An electronic control device (10, 20) including a rewritable memory device (34), an execution unit (S130) configured to execute a control program for controlling a control object stored in a control program area included in the storage device to control the control object; a program receiving unit (S20) configured to receive the new control program by communicating with an external rewriting device; a program update unit (S30) configured to update the control program executed by the execution unit with the new control program every time the program reception unit receives the new control program; a difference update unit (S70, S80) configured to generate difference data indicating a difference between the updated control program and a specific program usable by the electronic control device and stored in a specific program area different from the control program area included in the storage device, each time the control program executed by the execution unit is updated by the program update unit, and to store the generated difference data in the storage device as new difference data; a program restoration unit (S140) configured to restore the control program when it is diagnosed that an abnormality has occurred in the control program area when the electronic control device is started up; An electronic control device comprising:

2. 2. The electronic control device according to claim 1, The program restoration unit restores the control program at the time when the differential data was generated based on the specific program and the differential data. Electronic control unit.

3. An electronic control device (10, 20) including a rewritable memory device (34), an execution unit (S130) configured to execute a control program for controlling a control object stored in a control program area included in the storage device to control the control object; a program receiving unit (S20) configured to receive the new control program by communicating with an external rewriting device; a program update unit (S30) configured to update the control program executed by the execution unit with the new control program every time the program reception unit receives the new control program; a difference update unit (S70, S80) configured to generate difference data indicating a difference between the updated control program and a specific program usable by the electronic control device and stored in a specific program area different from the control program area included in the storage device, each time the control program executed by the execution unit is updated by the program update unit, and to store the generated difference data in the storage device as new difference data; a program restoration unit (S140) configured to restore the control program at the time when the differential data was generated based on the specific program and the differential data; Equipped with The program restoration unit restores the control program when it is diagnosed that an abnormality has occurred in the control program area when the electronic control device is started up. Electronic control unit.

4. 4. The electronic control device according to claim 1, a condition determination unit (S40) configured to determine whether a predetermined specific update condition for updating the specific program is satisfied when the new control program is received; and a specific program unit (S60) configured to update the specific program with the received new control program when the condition determination unit determines that the specific update condition is satisfied. Electronic control unit.

5. 5. The electronic control device according to claim 4, The specific update condition includes at least that the data volume of the differential data is equal to or greater than a predetermined volume threshold. Electronic control unit.

6. The electronic control device according to claim 4 or 5, The specific update condition includes at least a condition that a difference between a numerical value indicating the version of the control program executed by the execution unit and a numerical value indicating the version of the specific program is equal to or greater than a version threshold value indicating a predetermined numerical value. Electronic control unit.

7. An electronic control device (10, 20) including a rewritable memory device (34), an execution unit (S130) configured to execute a control program for controlling a control object stored in a control program area included in the storage device to control the control object; a program receiving unit (S20) configured to receive the new control program by communicating with an external rewriting device; a program update unit (S30) configured to update the control program executed by the execution unit with the new control program every time the program reception unit receives the new control program; a difference update unit (S70, S80) configured to generate difference data indicating a difference between the updated control program and a specific program usable by the electronic control device and stored in a specific program area different from the control program area included in the storage device, each time the control program executed by the execution unit is updated by the program update unit, and to store the generated difference data in the storage device as new difference data; a condition determination unit (S40) configured to determine whether a predetermined specific update condition for updating the specific program is satisfied when the new control program is received; a specific program unit (S60) configured to update the specific program with the received new control program when the condition determination unit determines that the specific update condition is satisfied; Equipped with The specific update condition includes at least that the data volume of the differential data is equal to or greater than a predetermined volume threshold. Electronic control unit.

8. The electronic control device according to claim 7 , The specific update condition includes at least a condition that a difference between a numerical value indicating the version of the control program executed by the execution unit and a numerical value indicating the version of the specific program is equal to or greater than a version threshold value indicating a predetermined numerical value. Electronic control unit.

9. An electronic control device (10, 20) including a rewritable memory device (34), an execution unit (S130) configured to execute a control program for controlling a control object stored in a control program area included in the storage device to control the control object; a program receiving unit (S20) configured to receive the new control program by communicating with an external rewriting device; a program update unit (S30) configured to update the control program executed by the execution unit with the new control program every time the program reception unit receives the new control program; a difference update unit (S70, S80) configured to generate difference data indicating a difference between the updated control program and a specific program usable by the electronic control device and stored in a specific program area different from the control program area included in the storage device, each time the control program executed by the execution unit is updated by the program update unit, and to store the generated difference data in the storage device as new difference data; a condition determination unit (S40) configured to determine whether a predetermined specific update condition for updating the specific program is satisfied when the new control program is received; a specific program unit (S60) configured to update the specific program with the received new control program when the condition determination unit determines that the specific update condition is satisfied; Equipped with The specific update condition includes at least a condition that a difference between a numerical value indicating the version of the control program executed by the execution unit and a numerical value indicating the version of the specific program is equal to or greater than a version threshold value indicating a predetermined numerical value. Electronic control unit.

10. 10. An electronic control device according to any one of claims 1 to 9, The specific program is the control program that can be used by the electronic control unit and is the control program that is older than the control program updated by the program update unit. Electronic control unit.

Images