DE102018210868A1 - Electronic control unit - Google Patents

Abstract

An electronic control unit (13) has a ROM (34) as a rewritable memory. The ROM undergoes the rewrite so that the data is erased block by block, and then destination data is written to each block having an erase state after all of the data has been erased. The electronic control unit has an information element detection section (S85) and a storage execution section (S95, S105, S110). Each time the progress information item is detected, the storage execution section stores the acquired progress information item in at least one of a plurality of management blocks such that the acquired progress information item in a management block other than a management block in which the progress information item was stored at a previous time, is stored under the multiple management blocks.

Description

The present invention relates to an electronic control unit having a rewritable memory.

The JP 2005-056144 A describes an electronic control unit having a nonvolatile memory which is a rewritable memory.

When data is rewritten in a nonvolatile memory, the data stored in the nonvolatile memory is erased in blocks; subsequently, target data, all predetermined multiple bytes, are written in the block in which the data has been deleted. The target data identifies data as a rewrite target. That is, rewrite of a nonvolatile memory is achieved by rewriting one or more blocks in turn. In the JP 2005-056144 A The electronic control unit stores the information item (hereinafter referred to as the history information item) indicating a block in which rewriting is completed in a predetermined block in the nonvolatile memory.

Further, in the above electronic control unit, the data stored in a block storing the history information item is deleted, and then the new history information item is written in the block; This updates the history information item. Suppose a case where the data of one block storing the history information is cleared, and the power supply of the nonvolatile memory is turned off. In such a case, the history information element may be lost.

According to one aspect of the present invention, there is provided an electronic control unit having a nonvolatile memory with a technology that maintains the information item describing progress in rewrite in the nonvolatile memory even when the power supply is turned off.

According to one aspect of the present invention, an electronic control unit having a nonvolatile memory which is a rewritable memory is provided as follows. The nonvolatile memory has a plurality of blocks each providing a memory area having a predetermined data volume. The nonvolatile memory is configured to (i) erase stored data in blocks, (ii) to accept an erase state as soon as its stored data is erased, and then (iii) to include destination data which is a rewrite destination Block are written, which has the erase state.

The electronic control unit has an information acquisition section and a storage execution section.

The information acquiring section is configured to repeatedly detect the progress information item indicating a rewriting advance degree. Each time a progress information item is detected, the storage execution section is configured to store the acquired progress information item in at least one of a plurality of predetermined management blocks other than a block in which the destination data is stored. The storage execution section is further configured to store the acquired progress information item at a current time in a management block among the plurality of management blocks different from a management block in which a progress information item has been stored at a previous time.

Such a configuration enables the nonvolatile memory to store the progress information item newly detected at the current time in a management block among the plurality of management blocks different from a management block in which the progress information item has been stored at the previous time. That is, even if the supply of electric power to the nonvolatile memory stops during rewriting of the progress information item, each of the plurality of management blocks is capable of storing the progress information item. This allows the electronic control unit having a nonvolatile memory to hold the information item describing progress in rewriting in the nonvolatile memory even when the power supply is turned off.

It is noted that the reference numerals in parentheses in the claims indicating a correspondence relationship to certain elements described as an example in the following embodiment do not limit the scope of the present invention.

• 1 ein Blockdiagramm zur Veranschaulichung einer Konfiguration eines Fahrzeugsteuersystems;
• 2 eine Abbildung zur Veranschaulichung eines Speicherbereichs eines ROM;
• 3 eine Abbildung zur Veranschaulichung von mehreren Umschreibeabläufen für ein Steuerprogramm;
• 4 eine Abbildung zur Veranschaulichung einer Verarbeitungssequenz, wenn ein Umschreibeprozess aus einem Hauptablauf unter mehreren Umschreibeabläufen gestartet wird;
• 5 eine Abbildung zur Veranschaulichung von Übergängen des Fortschrittsinformationselements in der 4;
• 6 eine Abbildung zur Veranschaulichung einer Verarbeitungssequenz, wenn ein Umschreibeprozess aus einem zwischenrangigen Ablauf unter mehreren Umschreibeabläufen neu gestartet wird;
• 7 eine Abbildung zur Veranschaulichung von Übergängen des Fortschrittsinformationselements in der 6;
• 8 ein Ablaufdiagramm eines von einer ECU ausgeführten Startprozesses;
• 9 ein Ablaufdiagramm eines von einer ECU ausgeführten Umschreibeprozesses (1/2);
• 10 ein Ablaufdiagramm eines von einer ECU ausgeführten Umschreibeprozesses (2/2); und
• 11 ein Ablaufdiagramm eines von einer externen Vorrichtung ausgeführten externen Prozesses.

The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings shows:

• 1 a block diagram illustrating a configuration of a vehicle control system;
• 2 an illustration for illustrating a storage area of a ROM;
• 3 an illustration illustrating a plurality of rewrite processes for a control program;
• 4 an illustration for illustrating a processing sequence when a rewrite process is started from a main flow among a plurality of rewrite processes;
• 5 an illustration illustrating transitions of the progress information item in the 4 ;
• 6 FIG. 4 is an illustration illustrating a processing sequence when a rewrite process is restarted from an interim flow among a plurality of rewrite processes; FIG.
• 7 an illustration illustrating transitions of the progress information item in the 6 ;
• 8th a flowchart of a starting process executed by an ECU;
• 9 a flowchart of a rewrite process (1/2) performed by an ECU;
• 10 a flowchart of a rewrite process (2/2) performed by an ECU; and
• 11 a flowchart of an executed by an external device external process.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[Configuration]

An Indian 1 shown vehicle control system 1 is a system that executes a rewrite process for a control program and / or data in an ECU (Electronic Control Unit) 13 used in an in-vehicle control system 10 contained in a vehicle such as a car. The rewrite process involves (i) rewriting a control program and / or data previously stored in the ECU 13 and (ii) writing a control program and / or data, for the first time, to the ECU 13 ,

The vehicle control system 1 has an in-vehicle control system 10 and an external device 20 on. The external device 20 , which is a device located outside the vehicle in which the in-vehicle control system 10 fixed, can be a center 21 and a diagnostic device 22 include.

The center 21 is fixedly arranged at a predetermined location. The center 21 has a communication device and a computer having a CPU and a memory such as a RAM, a ROM (all not shown). The memory stores a control program. When updating one in the ECU 13 in the in-vehicle control system 10 stored control program is required, sends the center 21 a new control program stored in the memory of the center 21 is stored and writes the control program in the ECU 13 around.

The diagnostic device 22 receives the data via the ECU 13 serving as a diagnostic target from the ECU 13 ; and diagnoses a vehicle in which the in-vehicle control system 10 attached while in the ECU 13 stored data, depending on the diagnostic result. The diagnostic device 22 has a communication device and a computer having a CPU and a memory such as a RAM, a ROM (all not shown).

It should be noted that the diagnostic device 22 may be designed to be a new control program stored in the memory of the diagnostic device 22 is stored, send and a control program in the ECU 13 in the in-vehicle control system 10 rewrite when updating the ECU 13 stored control program is required.

The in-vehicle tax system 10 that the ECU 13 An outside vehicle communication device (hereinafter referred to as DCM-ECU, ie, data communication module ECU) 11 and a central gateway (hereinafter referred to as C-GW) 12 may comprise. The DCM-ECU 11 , the C-GW 12 and the ECU 13 are via a communication line 15 connected to communicate with each other according to a CAN standard. It should be noted that CAN is a registered trademark.

That is, the ECU 13 is over the communication line 15 with the DCM-ECU 11 and the C-GW 12 connected to communicate with each other, thus forming a vehicle network. Although not shown in the drawings, the ECU may 13 over the communication line 15 be connected to another ECU which is mounted in the vehicle so as to form a vehicle network. It should be noted that the external device 20 is equivalent to a device outside a vehicle network.

The DCM-ECU 11 is a device that provides wireless communication with the center 21 performs. The C-GW 12 is a device that communicates over the communication line 5 with the diagnostic device 22 is connected and with the diagnostic device 22 communicates according to a CAN standard.

The ECU 13 is an electronic control unit that controls a control target mounted in the vehicle, such as an internal combustion engine, a brake. The ECU 13 has a microcomputer with a CPU 31 and a semiconductor memory (hereinafter referred to as memory 32 referred to), such as a RAM 33 , a ROM 34 , on. The ECU 13 has an electric power source unit (hereinafter referred to as an energy source). The ECU 13 is configured to receive an electric power supply when the power source is turned on and unable to receive an electric power supply when the power source is turned off.

The CPU 31 is an arithmetic unit; the RAM 33 is a volatile memory for temporarily storing data, such as a result of operation by the CPU 31 , The ROM 34 is a nonvolatile memory containing a rewritable memory area. The nonvolatile memory may include, for example, a flash memory, an EEPROM. The ROM 34 stores the various programs by the CPU 31 be executed. The ROM 34 is described in more detail below.

The different functions of the ECU 13 be through the CPU 31 scored in the ROM 34 stored programs. The ECU 13 achieves the rewrite one in ROM 34 stored control program by executing a rewrite process described below.

The ROM 34 contains, as in 2 shown a non-rewritable area 341 and a rewritable area 342 ; the non-rewritable area 341 is an area where rewriting is not possible during the rewritable area 342 is an area where rewriting is possible. The ROM 34 contains blocks each having a range of a predetermined data volume, such as several tens of bytes to several hundreds of bytes.

In the ROM 34 is the deletion of data in stages of blocks, ie block by block, according to a command from the CPU 31 possible. In contrast, in ROM 34 , the writing of data in stages of one byte or several bytes, ie byte by byte or byte by byte or multiple bytes for several bytes possible; the multiple bytes may be, for example, two bytes or four bytes. An initial state of the ROM 34 is defined as a state where 1 sen (ie, one (s)) are written as the total of logical values in each block of all the blocks. More specifically, each block contains only 1 sen (ie, one (s)) as the set of logical values. Further, an erase state of each block of the ROM 34 is defined as a state in which all of the data in each block of all the blocks are completely deleted. Rewriting of a respective block that is any one of the blocks is such that (i) the block concerned first assumes an erase state after the data in the block in question has been erased, and (ii) subsequently, target data into that block in the erase state to be written. The target data corresponds to data as a rewrite target. A block in an erase state contains only 1 (sen) (ie, one (s)) as the set of logical values.

The non-rewritable area 341 saves a reprogramming program. The reprogramming program is a program that comes from the CPU 31 is executed to a rewritable area 342 rewrite saved control program. A rewrite process describes the rewrite operations when the reprogrammer is run.

The rewritable area 342 stores a control program, a completion flag, and a progress information item. The control program is a program for the CPU 31 to carry out and control the tax objective of the ECU 13 ,

It is noted that "information" may be used herein as countable as well as non-countable, and may correspond to "an information" or "an informational element (i.e., an informational element)". Thus, "different information" may be used and may be synonymous with "multiple information elements (multiple informational elements)". Further, "info" in the drawings may be used for convenience as "information". Further, "data" may correspond to "a data item" or "a date" as well as "data" or "data items".

The completion flag is a flag indicating whether or not rewrite of a control program in the ROM 34 is completed; the control program serves as a rewrite target by the reprogramming program. The completion flag in the cleared state (OFF) shows the state in which the rewrite for the control program is not completed; In contrast, this shows Set flag (ON) the state in which the rewrite for the control program is completed. The completion flag is cleared (OFF) in an initial state assumed at the start of execution of the reprogramming program.

The progress information item is an information item that has a degree of progress in the ROM 34 when rewriting for a control program as a rewrite target by a reprogramming program. The progress information item is stored in one of a plurality of management blocks in the ROM 34 saved. The management blocks correspond to a plurality of blocks that are within multiple blocks in the ROM 34 are predetermined, and differ from the blocks in the destination data in the ROM 34 to be written.

More precisely, two different blocks of a first information block 101 and a second information block 102 in the rewritable area 342 in the ROM 34 are synonymous with management blocks. The progress information item contained in the first information block 101 is stored is referred to as a first information element; the progress information item contained in the second information block 102 is stored is referred to as a second information element.

As in 3 shown is the ROM 34 adapted to rewrite a control program based on the series of executions of a plurality of predetermined rewrite procedures by the ECU 13 as a rewrite target. The ECU 13 performs the rewriting for the control program based on the communication with the external device 20 out, which is either the center 21 or the diagnostic device 22 is. The multiple rewrite operations include an authentication process, a deletion process, a write process, a verification process, and a completion process.

If, for example, an expiration (ie a completed expiration), its execution by the ECU 13 is completed, is recognized among the multiple processes, the completed process can describe the degree of progress in rewriting for the control program.

The authentication process confirms or authenticates whether the external device 20 a correct communication partner of the ECU 13 is. The authentication process corresponds, for example, A6 to A8 in the 4 , which is described in more detail below. The erase procedure causes a target block to transition to an erase state in accordance with an erase request from the external device 20 ; the target block is a block in the ROM 34 in which a control program serving as a rewrite target is written. The erase sequence corresponds for example to A9 to A12 in the 4 ,

The writing process writes to the ROM 34 the ECU 13 , a control program that serves as a rewrite target and from the external device 20 Will be received. The writing operation may be performed for each of data parts (data partitions) if the data describing the control program as the rewrite target is divided into the data parts. Each of the data parts may correspond to the data for one block. It should be noted that, in the present embodiment, the ECU 13 is operated to send an ACK to the external device 20 to send when the writing of each data part is completed. The writing sequence corresponds to A13 to A20 in the example 4 ,

The verification process verifies that the control program is rewritten as the rewrite target normally. For example, the verification procedure corresponds to A21 through A24 in FIG 4 , The completion process determines whether the rewrite of the control program is completed as the rewrite target. The graduation procedure corresponds for example to A25 to A27 in the 4 ,

The multiple rewrite operations are performed individually in sequence (i.e., in order) of the authentication procedure, the deletion procedure, the writing procedure, the verification procedure, and the completion procedure. One or more of the processes for rewriting are assigned predetermined identification marks. For example, the identifier, which is a symbol or a number or a combination of symbol and number, allows recognition of a corresponding rewrite process.

In the present embodiment, the data describing a control program as a rewrite target includes a first data part and a second data part. Further, the flags are assigned to the processes as follows. The deletion procedure is assigned "1". A first write that writes the first data part is assigned "2". A second write that writes the second data part is assigned "3". The verification process is assigned a "4". The completion process is assigned "5". Of the multiple rewrite sequences, a process to which an identifier is assigned is referred to as an assigned rewrite operation.

[Processing]

[Rewrite sequence from a first-order rewrite process]

Next, a processing sequence described by the ECU 13 This will do a rewriting for a control program while it is communicating with the external device 20 communicates on the basis of a rewrite process. It should be noted that the center 21 for example as an external device 20 serves. If the diagnostic device 22 as an external device 20 serves processing in a corresponding sequence.

4 shows a rewrite processing sequence for a control program from a first-level process among the several rewrite processes in cases where the ECU 13 changes from an energy-off state to an energy-on state. It should be noted that the state in which the power source of the ECU 13 is off, may be referred to as an energy-off state; the state in which the power source of the ECU 13 is turned on, may be referred to as an energy ON state. The ECU 13 For example, it is designed to switch to an off-power state when communicating with the external device 20 stopped or interrupted.

First, the ECU changes 13 , in A1, in a power-ON state (EV ON) in which the electrical power source of the ECU 13 is turned on. This power ON state may include a state in which the electric power source of the ECU 13 is turned on after the electric power source of the ECU 13 Once switched off, since the communication with the external device 20 was interrupted.

Subsequently, the ECU confirms 13 in A2, the completion flag that is cleared (OFF). Following this, the ECU reads 13 , in A3 and A4, since the completion flag is cleared (OFF), a progress information item from the ROM 34 ,

Then the ECU recognizes 13 , in A5, reboots in accordance with the read progress information item and notifies the ECU 13 the restart process to the external device 20 , The restart process, which is one of several rewrite operations, is a process that is ordered the first time the rewrite is resumed. In this case, the ECU recognizes 13 , as a restart process, the authentication process, which is a major flow among the multiple rewrite procedures. Subsequently, the ECU sends 13 an information item indicating the restarting process to the external device 20 , The main flow is a first-level flow that is executed for the first time among the multiple flows when the rewrite is started. The restart process is recognized on the basis of the progress information item in the rewrite process, which will be described later.

Subsequently, in A6, the ECU receives 13 an ACK coming from the external device 20 is sent. This ACK is a response indicating that the restart process is from the external device 20 Will be received. Subsequently, in A7, the ECU receives 13 an authentication request made by the external device 20 is sent. The authentication request is a communication frame with which the external device 20 the ECU 13 requests the external device 20 to authenticate. The authentication request includes an information element (hereinafter referred to as a characteristic information element) for recognizing the external device 20 ,

Subsequently, in A8, the ECU confirms 13 whether the characteristic information item on the external device 20 in advance in the ROM 34 the ECU 13 stored matches the identification information contained in the authentication request. The ECU 13 sends an ACK to the external device 20 if both match. This ACK is a response indicating that the authentication of the external device 20 successfully completed.

Subsequently, in A9, the ECU receives 13 a deletion request made by the external device 20 is sent. The delete request is a request to put each of the destination blocks in an erase state. The target blocks are blocks that store data as a rewrite target when executing the flow (s) among the multiple processes after the reboot process. In the present case, the main process corresponds to the restart process. The received delete request, as a deletion destination, indicates (i) all blocks storing a control program as a rewriting destination; (ii) the first information block 101 ; and (iii) the second information block 102 to.

Subsequently, in A10, the ECU leads 13 deleting for the blocks in accordance with the deletion request. The erase for the blocks determines all of the logical values of the bits in the allocated blocks as 1 (sen) (ie, one (s)) as described above.

Subsequently, in A11, the ECU updates 13 the progress information item. More precisely, the ECU 13 defines the completed process as the deletion process and thus writes "1", which a flag indicating the deletion procedure is in the first block of information 101 as the progress information element.

Subsequently, in A12, the ECU sends 13 an ACK to the external device 20 , This ACK is a response indicating that the deletion in the blocks has been successfully completed. Subsequently, in A13, the ECU receives 13 the first data part from the external device 20 is sent.

Subsequently, in A14, the ECU writes 13 the first data part in the address corresponding to the first data part in the ROM 34 , Hereupon, in A15, the ECU updates 13 the progress information item. More precisely, the ECU 13 defines the completed process as the first writing process and thus writes "2", which is a flag indicating that the first writing has been completed successfully, into the second information block 102 as the progress information element.

Subsequently, in A16, the ECU sends 13 an ACK to the external device 20 , This ACK is a response indicating that the first write has completed successfully. Subsequently, in A17, the ECU receives 13 the second data part from the external device 20 is sent.

Hereupon, in A18, the ECU writes 13 the second data part in the address corresponding to the second data part in the ROM 34 , Subsequently, in A19, the ECU updates 13 the progress information item. More precisely, the ECU 13 puts the first information block 101 once in the extinguishing state; defines the completed process as the second writing process and thus writes "3", which is a flag indicating that the second writing has been completed successfully, into the first information block 101 as the progress information element.

Subsequently, in A20, the ECU sends 13 an ACK to the external device 20 , This ACK is a response indicating that the second write has completed successfully. Subsequently, in A21, the ECU receives 13 a verification request made by the external device 20 is sent. The verification request should be the ECU 13 request to verify that the rewrite of the control program is completed normally.

Subsequently, in A22, the ECU passes 13 the verification off. The verification may be by various methods, such as a parity bit or an error correction code. Subsequently, in A23, the ECU updates 13 the progress information item when the verification verifies that the control program is rewritten normally. More precisely, the ECU 13 puts the second information block 102 once in the extinguishing state; defines the completed flow as the verification flow and thus writes "4", which is a flag indicating that the verification flow has been completed successfully, to the second block of information 102 as the progress information element.

Subsequently, in A24, the ECU sends 13 an ACK to the external device 20 , This ACK is a response indicating completion of the verification. Subsequently, in A25, the ECU receives 13 a completion notification sent by the external device 20 is sent. This completion notification is a notification indicating the completion of sending all the data of the control program to be rewritten.

Subsequently, in A26, the ECU updates 13 the progress information item. More precisely, the ECU 13 puts the first information block 101 once in the extinguishing state; defines the completed flow as the completion flow and thus writes "5", which is a flag indicating that the completion flow has been successfully completed, to the first block of information 101 as the progress information element.

Finally, in A25, the ECU sends 13 an ACK to the external device 20 , This ACK is a response (hereinafter referred to as a final answer) indicating the completion of the entire rewrite of the control program as the rewrite target.

The ECU 13 communicates with the external device as described above 20 so as to execute the rewrite of the control program as the rewrite target. In this case, the progress information item (ie, both the first information item and the second information item) changes as in FIG 5 shown. 5 FIG. 12 shows a transition of the progress information items until the completion of the second writing operation using the flags and "FFH" indicating "erase state".

That is, whenever a rewrite operation is completed, the corresponding progress information item alternately enters the first information block 101 and in the second information block 102 written. More specifically, every time a rewrite operation is completed, the progress information item becomes among a plurality of management blocks, such as the first information block 101 and the second information block 102 , written in a management block that is different from a management block, into which the progress information item was written at a previous time.

[Rewrite sequence from an intermediate rewrite process]

6 FIG. 12 shows a rewrite processing sequence for a control program from an interim flow among the multiple processes in cases where the ECU 13 into an energy-off state and then into an energy-on state. That is, the processing sequence for rewrite of a control program is different from the main flow among the multiple rewrite processes in cases where the rewriting is carried out during execution of the rewrite by the ECU 13 for the control program is interrupted. 6 shows an example in which the power source of the ECU 13 while running in A18 the 4 is turned off. The interruption of the power supply (EV OFF), which will be described later, corresponds to turning off the power source.

First, in B1, the source of energy is the ECU 13 switched on (EV ON) after the rewriting has been interrupted due to the power supply interruption (EV OFF). Subsequently, in B2, the ECU confirms 13 the completion flag. The completion flag is cleared (OFF).

Subsequently, in B3 and B4, the ECU reads 13 Since the completion flag is cleared (OFF), the progress information item from the ROM 34 , Subsequently, in B5, the ECU identifies 13 a restart process in accordance with the read progress information item and notifies the ECU 13 the restart process to the external device 20 , In this case, as in 7 at the time of restart, the first information item is "FFH" and the second information item is "2"; the ECU 13 identifies the first writing process corresponding to "2" as a completed process in accordance with the rewrite process, which will be described later, and identifies the second writing process following the completed process as the restarting process. The ECU 13 thus defines the second writing process as the restarting process and sends the informational item indicating the restarting process to the external apparatus 20 ,

Subsequently, in B6, the ECU receives 13 an ACK coming from the external device 20 is sent. This ACK is a response indicating that the restart process is from the external device 20 is received, and simultaneously a processing request by the external device 20 to the ECU 13 to initiate the restart process.

Subsequently, in B7, the ECU receives 13 an authentication request made by the external device 20 is sent. Following this, in B8, the ECU sends 13 an ACK to the external device 20 , This ACK is a response indicating that the authentication of the external device 20 successfully completed.

Subsequently, in B9, the ECU receives 13 a deletion request made by the external device 20 is sent. This deletion request determines, from the control program as the rewrite target, all the blocks storing the second data part as a destination for deletion because the second write operation is determined as a rebooting process.

Then, in B10, the ECU is leading 13 deleting for the blocks in accordance with the deletion request. Subsequently, in B11, the ECU sends 13 an ACK to the external device 20 , This ACK is a response indicating that the deletion in the blocks has been successfully completed.

Then, after B12, the ECU is leading 13 the same process as in A17 and the following steps in the 4 out. In the present embodiment, in B7 to B8, the authentication process is repeated between the ECU 13 and the external device 20 executed when rewriting is resumed. This is because safer communication with higher robustness is achieved. However, the present invention is not limited thereto. This authentication process can be skipped.

Further, when the writing is resumed in blocks to which the writing has been made until just before, those blocks, from the characteristic of nonvolatile memory, must once go to an erase state. The data within the respective blocks are thus deleted, in B9 to B11.

As described above, the ECU performs 13 rewrite the control program as the rewrite target in cases where the power supply interrupt occurs due to the communication interruption. The progress information item becomes a block of the first information block at a current time 101 and the second information block 102 written in the management blocks; one block is different from the other of the first block of information 101 and the second information block 102 in which the progress information item was written at a previous time. Ie, if the ECU 13 a Energy supply interruption, the ECU becomes 13 allows a restart process, which is a rewrite operation, to be restarted based on the first information item that is in the first information block 101 is written, and the second information element, in the second information block 102 is written to recognize.

It is intended, for example, with reference to the 7 to adopt a case in which the ECU 13 a power supply interruption during the writing of the progress information item via the second write operation into the first information block 101 experiences. Even in such a case, the ECU 13 allows the second writing operation corresponding to "3" following "2" as a restarting operation on the basis of "2" as the second information item already in the second information block 102 is written from the first information block 101 and the second information block 102 to recognize. The second write process is thus executed again. It should be noted that the restart process is recognized in accordance with the rewrite process described below.

[Processes carried out by the ECU]

Below are from the ECU 13 executed processes with reference to those in the 8th to 10 shown flowcharts described.

[Start Process]

The Indian 8th The starting process shown occurs when the power source of the ECU 13 is turned on after it has been turned off. The startup process describes a flowchart when a launcher is run. The launcher will be in the non-rewritable area in advance 341 in the ROM 34 saved.

First, the ECU determines 13 in S5, if the completion flag is set (ON). That is, it is determined whether the rewrite of the control program is completed. The ECU 13 proceeds to flow to S10 when the completion flag is set (ON); the ECU 13 proceeds to S15 in the process when the completion flag is clear (OFF).

In S10 starts the ECU 13 a predetermined control program and ends the ECU 13 the ongoing startup process. In S15 starts the ECU 13 a reprogramming program and exit the ECU 13 the ongoing startup process.

[Umschreibeprozess]

The in the 9 and 10 Written transcript processes describe processing operations when the ECU 13 determines that the rewrite of the control program is not completed, and executes the reprogramming program in S15 of the startup process.

In S20 records the ECU 13 the progress information item. More precisely, the ECU 13 detects the first information element and the second information element from the first information block 101 or from the second information block 102 , Such a detection corresponds to a readout of the first information element and the second information element from the first information block 101 or from the second information block 102 through the ECU 13 ,

In S25 determines the ECU 13 whether the first information element is FFH. That is, it determines if the first information block 101 has an erase state. The ECU 13 proceeds to S30 when the first information item is FFH; the ECU 13 proceeds to S40 when the first information item is not equal to FFH.

In S30 determines the ECU 13 whether the second information element is FFH. That is, it is determined whether the second information block 102 has an erase state. The ECU 13 proceeds in sequence to S35 when the second information item is FFH; the ECU 13 proceeds in sequence to S55 when the second information item is not equal to FFH.

In S35 identifies the ECU 13 , as a restart process, the authentication process which is the main flow of the above-mentioned multiple rewrite processes. The ECU 13 sends the information item indicating the restarting process to the center 21 , Then the ECU moves forward 13 in progress to S70 ahead.

In S40 determines the ECU 13 whether the second information element is FFH. The ECU 13 proceeds in sequence to S60 when the second information item is FFH; the ECU 13 progresses to S45 in the flow when the second information item is not equal to FFH.

In S45 determines the ECU 13 whether there is any continuity between the completed process described by the first information element and the completed process described by the second information element. That is, it is determined whether the completed process by the first Information element is described, and the completed process, which is described by the second information element, sequential operations in the order of the multiple rewrite sequences. In S45 neither the first information element nor the second information element is FFH. An update information item, which will be described later, is a progress information item (ie, the first information item or the second information item) that does not describe an erase state.

That is, in S45, when a plurality of update information items are included in the progress information items detected in S20, the ECU determines 13 Whether or not a plurality of operations described by the update information items are sequential operations in the order of the multiple rewriting operations.

As described above, the completed process is assigned the identifier with a numerical value such as "1", "2". The ECU 13 advances to S50 in the sequence when there is continuity between (i) the information item indicating the completed procedure using the first information item, and (ii) the information item indicating the completed operation using the second information item. In contrast, the ECU is progressing 13 progresses to S35 if there is no continuity between them.

When it is determined in S45 that there is continuity between (i) the information item indicating the completion of the process using the first information item, and (ii) the information item indicating the completion of the process using the second information item, the process proceeds as described above, to S50. In S50 identifies the ECU 13 an immediately previous flow under (i) the completed flow using the first information element and (ii) the completed flow using the second information element; the immediate previous flow is defined as a flow closest to the final flow of the multiple rewrite flows.

Suppose a case where the flag as the information item indicating the completed operation using the first information item is larger than the identifier as the information item indicating the completed operation using the second information item. In such a case, the ECU identifies 13 the completed procedure using the first information item as the immediately previous procedure, and the ECU proceeds 13 in the process to S60 ahead. On the other hand, another case is to be adopted in which the flag as the information item indicating the completed operation using the first information item is smaller than the identifier as the information item indicating the completed operation using the second information item. In such a case, the ECU identifies 13 the completed procedure using the second information item as the immediately previous procedure, and the ECU proceeds 13 in the process to S55 ahead.

In S55 records the ECU 13 the second information element. That is, the completion information item described using the second information item is detected. Then the ECU moves forward 13 in the process to S65 ahead. In contrast, the ECU detects 13 , in S60, the first element of information. That is, the completion information item described using the first information item is detected. Then the ECU moves forward 13 in the process to S65 ahead.

In S65 identifies the ECU 13 , as a restart process, a subsequent process that is a process following the completed process detected in S55 or S60 among the plural rewrite processes. The ECU 13 sends the information item indicating the restarting process to the center 21 , Then the ECU moves forward 13 in progress to S70 ahead.

In S70 determines the ECU 13 Whether a processing request requesting execution of the restart process from the center 21 Will be received. The ECU 13 holds until the processing request is received, and advances to S75 in the process when the processing request is received.

In S75 leads the ECU 13 a flow in accordance with the processing request. In S80 determines the ECU 13 whether the process requested by the processing request is completed. The ECU 13 holds until the process requested by the processing request is completed, and advances to S85 in the flow when the process requested by the processing request is completed.

In S85 records the ECU 13 a new progress information element. In this case, the ECU generates 13 a new progress information item including a completion information item indicating a completion process that is a process consistent with the Processing request is requested and its execution is completed.

In S90 determines the ECU 13 whether any progress information item stored in each of all the management blocks is FFH. More precisely, the ECU 13 determines if the first information block 101 and the second information block 102 each have an erase state.

The ECU 13 proceeds to S95 when all of the progress information items are FFH. In S95 updates the ECU 13 a management block that is either the first block of information 101 or the second information block 102 is, whichever is predetermined. Such updating corresponds to writing a new progress information item detected in S85 into the one management block. In this case, the ECU updates 13 the first information block 101 , That is, the ECU 13 writes the new progress information item detected in S85 into the first information block 101 , Then the ECU moves forward 13 in the process to S115. In contrast, the ECU is progressing 13 in the flow to S100, unless it is determined that all of the progress information items are FFH.

In S100 determines the ECU 13 whether FFH is included in any of all the progress information items. That is, the ECU 13 determines whether either the first information block 101 or the second information block 102 has an erase state. The ECU 13 proceeds to S105 in the process when it is determined that either the first information block 101 or the second information block 102 has an erase state. The ECU 13 updates the block in the erase state under the first information block 101 and the second information block 102 , That is, the new progress information item detected in S85 is written into the block in the erase state. Then the ECU moves forward 13 in the process to S115.

In contrast, the ECU is progressing 13 in the flow to S110, when it is determined that no block from the first block of information 101 and the second information block 102 in the extinguishing state is present. That is, when the progress information item stored in each of the plurality of management blocks is an update information item, the ECU proceeds 13 in the process to S110 ahead. In S110 The new progress information item detected in S85 is either in the first information block 101 or in the second information block 102 depending on which, as the progress information item describing the completed procedure, has the smaller identifier.

In S105 identifies the ECU 13 a next process closest to the main process, the completed process described with the first information element, and the completed process described with the second information element; then updates the ECU 13 the management block which stores the information item indicating the recognized next process. Then the ECU moves forward 13 in the process to S115.

In S115 determines the ECU 13 whether the final notification from the center 21 Will be received. The ECU 13 proceeds to S120 in the process when the completion notification is received. In contrast, the ECU is progressing 13 in the flow to S70, if the completion notification is not received so as to repeat the above-described processing in S70 to S110. That is, the ECU 13 repeatedly executes the processing in S70 to S110 from the restarting process to the final processing.

In S120 sends the ECU 13 an ACK as a final response in replying to the completion notification sent by the center 21 is received and ends the ECU 13 the rewrite process.

[Process performed by the external device]

The following is an external process by the external device 20 to send a new control program that is in the external device 20 is stored and for rewriting a control program in the ECU 13 referring to a in the 11 shown flowchart described. The external device 20 is designed to interrupt the communication with the ECU 13 capture. The Indian 11 For example, the process shown is in response to communication with the ECU 13 is interrupted, started.

First, the external device determines 20 in S210, whether the restart process of the ECU 13 Will be received. The external device 20 will hold until it is determined that the restart process will be received if it determines that the restart process is not received. The external device 20 proceeds to S220 in the process when it is determined that the restart process is being received.

In S220 sends the external device 20 the processing request to the ECU 13 , This processing request asks the ECU 13 to execute the reboot process executed by the ECU 13 Will be received. In S230 determines the external device 20 whether an ACK from the ECU 13 Will be received. This ACK is a response indicating that the flow is in the ECU in accordance with the processing request sent in S230 13 is performed. The external device 20 holds until it is determined that an ACK is received if it is determined that no ACK is being received. The external device 20 proceeds to S240 in the process when it is determined that an ACK is received.

In S240 determines the external device 20 whether all of the multiple rewrite operations have been completed. The external device 20 proceeds to S250 in the process when it is determined that all of the multiple rewrite operations are completed. In contrast, the external device proceeds 20 in the flow to S220, if it is not determined that all of the multiple rewriting operations are completed, so as to repeatedly execute the processing in S220 to S240 with respect to each of the processes from the restarting process to the final processing.

In S250 sends the external device 20 the final notification to the ECU 13 , In S260 determines the external device 20 whether an ACK, which describes the final answer, from the ECU 13 Will be received. The external device 20 holds until it is determined that an ACK describing the final response is received when it is determined that an ACK describing the final answer is not received. When it is determined that this ACK is received, the current external process is terminated.

[Advantageous effect]

The embodiment described above achieves the following advantageous effects.

3a. The ECU 13 has the ROM 34 as a non-volatile memory. In S85 records the ECU 13 repeats the new progress information item. In S85 . S95 and S100 saves the ECU 13 the progress information item in at least one of a plurality of management blocks, such as the first information block 101 and the second information block 102 whenever the progress information item is detected. In particular, the ECU saves 13 the detected progress information item at a current time in a management block other than a management block in which the progress information item has been stored at a previous time is among the plurality of management blocks.

This allows the progress information item to be stored in any of a plurality of management blocks even when the ECU 13 undergoes a power supply interrupt while the rewrite of the progress information item occurs. That is, the ECU 13 having a nonvolatile memory can hold the progress information item describing a rewriting step in the nonvolatile memory even if the ECU 13 the power supply interruption learns or the electrical energy supply is turned off.

(3b) According to the configuration in (3a), the ECU detects 13 in S85, the progress information item each time a rewrite operation occurs. The progress information item includes the information item indicating the completed procedure. In S95 . S105 and S110 saves the ECU 13 the detected progress information item at a current time in a management block other than a management block in which the progress information item has been stored at a previous time is among the plurality of management blocks.

In S5 determines the ECU 13 whether all of the multiple rewrite operations have occurred and the rewrite of the ROM 34 is completed when the ECU 13 changes from the power-off state to the power-on state. In S20 records the ECU 13 the progress information item from each of the plurality of management blocks when it is determined that the rewrite is not completed. In S35 and S65 identifies the ECU 13 the restart process based on the acquired progress information item.

As a result, the completion information item included in the progress information item describes a completed operation whose execution is completed among the plurality of rewriting operations described above; based on the completion information item, the restart process can be identified. Further, the progress information item is stored at a current time in the block among the plurality of management blocks, which is different from the management block in which the progress information item has been stored at a previous time. Even if the ECU 13 When the progress information item is written in one of the plural management blocks, the other progress information item is already stored in the other of the plurality of management blocks.

Consequently, the progress information item can be kept even if the ECU 13 the power supply interruption learns. Further, the rewriting from the restarting process recognized on the basis of the progress information item may be resumed; this can shorten the time required for rewriting.

(3c) According to the configuration described in (3b), the ECU determines 13 in S35, whether all of the progress information items acquired from the plurality of management blocks in S20 describe the deletion state; subsequently the ECU identifies 13 the main flow of the multiple processes as a restart process when all of the progress information elements describe the deletion state.

As a result, even if all of the multiple management blocks have the erase state, the main flow is recognized as a restart process; consequently, rewrite of the control program can be resumed with certainty.

(3d) According to the configuration described in (3b) or (3c), the ECU determines 13 in S65, if at least one of the progress information items detected from the plurality of management blocks in S20 corresponds to an update information item that does not describe the deletion condition, and identifies the ECU 13 a restart process based on the update information item when at least one of the progress information items is the update information item.

That is, when at least one update information item is detected, the restart process can be identified on the basis of the update information item. As a result, the time required for rewriting can be shortened.

(3e) According to the configuration described in (3d), the ECU identifies 13 , in S65, an immediate previous procedure and then a restart procedure as follows. Suppose a case where a plurality of update information items describing a plurality of completed procedures are included in the progress information items acquired from the plurality of management blocks. In such a case, the ECU identifies 13 of the multiple completed procedures, an immediately previous procedure, which is a routine closest to the final procedure in the multiple procedures, identifies the ECU 13 then a flow following the immediate previous flow as the restart cycle.

That is, if a plurality of update information items are detected, a rewrite may be resumed from the process closer to the final operation. As a result, the time required for rewriting can be shortened.

(3f) According to the configuration described in (3e), the ECU determines 13 , in S45, the continuity of operations as follows. That is, when a plurality of update information items are included in the progress information items, it is determined whether the plurality of completed operations are successive operations in the order of the multiple rewrite operations (ie, it is determined whether the plurality of completed operations are consecutive operations among the plurality of rewrite operations).

Suppose a case where the progress information items are stored in a predetermined sequence in the plurality of management blocks, and thus a plurality of completed operations are determined as successive operations in the order of the multiple rewriting operations. Such a case enables recognition of the progress information items as normally stored.

(3g) According to the configuration described in (3f), the ECU identifies 13 , in S65, an immediately previous flow, and then a flow following the immediately preceding flow, when it is determined that the plurality of completed flows are consecutive runs in the order of the multiple rewrite flows.

That is, if the situation where the progress information items are normally stored is recognized, the rewrite may be resumed from the process closer to the final operation. As a result, the process from which the rewrite must be restarted can be accurately identified.

(3h) According to the configuration described in (3f) or (3g), the ECU identifies 13 in S65, the main flow among the multiple flows is considered to be a restart flow unless it is determined that the plurality of completed flows are sequential runs in the order of the several rewrite flows.

That is, when the situation where the progress information items are not normally stored is recognized, rewrite from the main routine is resumed. As a result, the rewriting can be carried out with certainty.

(3i) According to the configuration described in any one of (3d) to (3h), the ECU identifies 13 , in S35, reboot as follows. Consider a case where a single update information item is included in the progress information items acquired from the plurality of management blocks. In such a case, the ECU identifies 13 a process following the completed process described by the update information item as a restart process.

That is, when an update information item is detected, the restart process can be identified on the basis of the acquired update information item. As a result, the time required for rewriting can be shortened.

(3j) According to the configuration described in any one of (3b) to (3i), the ECU is 13 mounted in a vehicle and via a communication line 15 for communication with other in-vehicle electronic control units, such as a DCM-ECU 11 and a C-GW 12 connected to form such a vehicle network. In S35 and S65 sends the ECU 13 an information element describing a restart process to an external device 20 located outside the vehicle or the vehicle network and with the ECU 13 can communicate.

The external device 20 As described above, it is configured to send target data to the ECU 13 to send. The ECU 13 is designed to perform the rewrite by sending target data from the external device 20 be received in the ROM 34 writes. In the present embodiment, the restarting process to the external device 20 sent to the external device 20 to allow destination data needed for restarting the rewrite to be sent among the data contained in the control program.

(3k) According to the configuration described in any one of (3b) to (3j), the ECU is 13 , in S95, configured to determine whether all of the management blocks have the erase state and configured to store the progress information item in a predetermined block among the management blocks when all of the management blocks have the erase state. Since a management block storing the progress information item is predetermined, the progress information item may be stored with certainty when each of all the management blocks has the deletion state.

(3l) According to the configuration described in any one of (3b) to (3k), the ECU 13 in S105, configured to determine whether at least one management block among all the management blocks has the erase state, and configured to store the progress information item in one of the at least one management block if the at least one management block among all the management blocks has the erase state. For example, as described above, if either the first information block 101 or the second information block 102 has the erase state, the progress information element either in the first block of information 101 or in the second information block 102 stored, whichever has the erase state.

That is, a new progress information item is stored in an erase state management block instead of any management block that does not have the erase state; a past (previous) progress information item and a new (current) progress information item can thus be stored in mutually different management blocks. As a result, an advantageous effect similar to that in (3a) can be achieved.

(3m) According to the configuration described in any of (3b) to (3l), the ECU is 13 , in S110, configured to determine whether all of the management blocks have the non-erase state (ie, not the erase state). When all of the management blocks have the non-clear state and thus store respective completed procedures, the ECU stores 13 the progress information item in one of the management blocks that stores a completed process closest to the main process.

For example, consider a case in which both the first information block 101 as well as the second information block 102 have the non-erase state and thus store respective completed processes. In such a case, the progress information item becomes either in the first information block 101 or in the second information block 102 stored, whichever stores a completed process that is closer to the main process. As a result, a newer progress information item can be stored.

According to the above embodiment, the vehicle control system is 1 synonymous with a tax system. The ECU 13 is synonymous with an electronic control unit. The ROM 34 is synonymous with a nonvolatile memory. Furthermore, the ECU 13 is equivalent to each of an information acquisition section, a storage execution section, a termination determination section, a restart detection section, a continuity determination section, and a restart end section. Further, the step S85 equivalent to a processing as an information acquiring section; are the steps S95 . S105 and S110 equivalent to a processing as a storage execution section; is the step S5 equivalent to processing as a completion determination section; are the steps S35 and S65 equivalent to processing as a restart detection section and a restart end section; and is the step S45 synonymous with processing as a continuity determining section.

The DCM-ECU 11 or the C-GW 12 are synonymous with another (ie different) electronic control unit that forms a vehicle network. Both the first information block 101 as well as the second information block 102 is synonymous with a management block. Both the first information element and the second information element are synonymous with a progress information element. Several processes are synonymous with multiple rewrite procedures. Furthermore, the main flow is equivalent to a first order flow among a plurality of rewrite flows; a final process is equivalent to a final process under several rewrite procedures.

[Other Embodiments]

Although the present invention is described above with reference to its embodiment, it is not limited to these, but modifiable in various ways.

(4a) In the above embodiment, the DCM-ECU 11 , the C-GW 12 and the ECU 13 designed to communicate with each other in accordance with the CAN standard. However, the present invention is not limited thereto. The DCM-ECU 11 , the C-GW 12 and the ECU 13 are designed to communicate with each other in accordance with the Ethernet standard. Ethernet is a registered trademark.

(4b) In the above embodiment, a plurality of rewriting procedures (including the plural rewrite procedures) include an authentication procedure, an erase procedure, a write operation including a first write operation and a second write operation, a verification procedure, and a completion procedure. However, the present invention is not limited thereto. The plurality of rewrite sequences may include one or more of an authentication procedure, an erase procedure, a write operation including a first write operation and a second write operation, a verification procedure, and a completion procedure. The writing can be done without subdividing the control program as a rewrite target.

(4c) In the above embodiment, the progress information item is alternately divided into two different management blocks, such as the first information block 101 and the second information block 102 , saved. However, the present invention is not limited thereto. The progress information items may be in three different management blocks, such as a first information block 101 , a second information block 102 and a third block of information (not shown). Alternatively, the progress information items may be stored in four or more different management blocks. In each of the above configurations, a progress information item in a management block other than a management block in which a progress information item has been stored at a previous time can be stored, whereby an advantageous effect similar to that in the above embodiment is achievable.

(4d) In the above embodiment, the rewriting of a control program is described as an example. However, the present invention is not limited thereto. The ECU 13 for example, in a rewritable area 342 in the ROM 34 which stores data (hereinafter referred to as diagnostic data) in accordance with a diagnostic result of a vehicle by the diagnostic device 22 be rewritten. The ECU 13 may perform a rewriting process similar to the above embodiment so as to rewrite the diagnosis data using the diagnosis data as the target data stored in the ROM 34 saved to achieve.

(4e) In the above embodiment, the ECU stores 13 a progress information item in one of a plurality of management blocks whenever the progress information item is detected in S85. However, the present invention is not limited thereto. Whenever a progress information item is detected in S85, the ECU 13 be configured to store the acquired progress information item in two or more management blocks among a plurality of management blocks.

(4f) In the above embodiment, a management block whose progress information item is to be updated is terminated of a rewriting process, as in the description of the second writing process with reference to FIG 5 and 7 described. However, the present invention is not limited thereto. The management block whose progress information item is to be updated may be deleted just before the start of a rewrite process. In the 5 and 7 For example, the first information block 101 corresponding to a management block whose progress information item is updated to be cleared just before the start of the second writing operation.

(4g) In the above embodiment, when a restarting process is executed by the ECU 13 in B5 the 6 is reported, the external device 20 designed to have an ACK to the ECU in B6 13 to send; the ACK serves as an informational element indicating a reboot process initiated by the ECU 13 has been received. However, the present invention is not limited thereto. The ECU 13 may be configured to determine in B6 whether a reboot process matches a reboot process initiated by the external device 20 as an ACK is received. In this case, the ECU 13 be configured to perform B7 and its subsequent processing, if it is determined that a restart process coincides with a restart process that the external device 20 as an ACK is received. On the other hand, when it is determined that a restarting operation does not coincide with a restarting process, the external device may determine 20 when an ACK is received, the ECU 13 be designed to apply a negative ACK to the external device 20 to send and to the external device 20 to request that you rewrite from the main process.

(4h) The above embodiment may be referred to as a vehicle control system 1 be realized. The vehicle control system 1 Mounted in a vehicle to form a vehicle network may be (i) an ECU 13 a nonvolatile memory as a rewritable memory; and (ii) an external device 20 located outside the vehicle network and with the ECU 13 communicates. Furthermore, the vehicle control system 1 be designed to be an ECU 13 according to (3a). Furthermore, the ECU 13 used in the vehicle control system 1 is configured according to (3b) to (3m).

(4i) Multiple functions of one constituent element in the above embodiment can be achieved by plural constituent elements; a function of one constituent element can be achieved by several constituent elements. Further, several functions of a plurality of constituent elements in the above embodiment can be achieved by a constituent element; a function of a plurality of constituent elements can be achieved by a constituent element. Moreover, part of the configuration in the above embodiment may be omitted. Further, at least part of the configuration in the above embodiment may be replaced or added to the configuration of another embodiment described above. All examples included in a technical idea according to the claims are embodiments of the present invention.

(4j) The present invention can be realized in various ways, such as a device, a program, a storage medium and a rewrite method. The device has a vehicle control system 1 , an in-vehicle tax system 10 , an external device 20 , a center 21 , a diagnostic device 22 or an ECU 13 on. The program operates the vehicle control system 1 , the in-vehicle tax system 10 , the external device 20 , the center 21 , the diagnostic device 22 or ECU 13 , The storage medium is a non-volatile physical storage medium storing the above program, such as a semiconductor memory.

Above, an electronic control unit is described.

An electronic control unit 13 has a ROM 34 as a rewritable memory. The ROM undergoes the rewrite so that the data is erased block by block, and then destination data is written to each block having an erase state after all of the data has been erased. The electronic control unit has an information element detection section S85 and a storage execution section S95 . S105 . S110 on. Each time the progress information item is detected, the storage execution section stores the acquired progress information item in at least one of a plurality of management blocks such that the acquired progress information item in a management block other than a management block in which the progress information item was stored at a previous time, is stored under the multiple management blocks.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• JP 2005056144 A [0002, 0003]

Claims (10)

An electronic control unit having a nonvolatile memory as a rewritable memory, wherein the nonvolatile memory has a plurality of blocks each providing a memory area with a predetermined data volume, the nonvolatile memory is configured to (i) erase stored data block by block, (ii) a block in which the stored data is erased, once cleared, and then (iii) rewrite target data to be written to the block has the erase state, wherein the electronic control unit comprises: an information acquiring section (S85) configured to repeatedly acquire a progress information item indicating a rewriting advance degree; and a storage execution section (S95, S105, S110) adapted to store the acquired progress information item in at least one of a plurality of predetermined management blocks different from a block in which the destination data is stored every time the progress information item is detected be, where the storage execution section is adapted to store the progress information item in a management block among the plurality of management blocks different from a management block in which the progress information item has been stored at a previous time. Electronic control unit after Claim 1 Characterized in that - the non-volatile memory is adapted to thereby find out the rewriting requires that a plurality of predetermined Umschreibeabläufe are sequentially carried out for; the information acquiring section is adapted to detect a progress information item each time a process is executed among the plurality of rewrite processes, the progress information item indicating a completed process being the one whose execution is completed; and the storage execution section is adapted to store the progress information item in a management block among the plurality of management blocks different from the management block in which the progress information item has been stored at the previous time, the electronic control unit further comprising: a completion determination section (S5 ) configured to determine whether the rewrite has been completed, due to all of the multiple rewrite operations being executed; and - a restart detection section (S35, S65) configured to: - detect the progress information item from the plurality of management blocks in response to the completion determination section determining that the rewrite is not completed, and - a restart process based on the acquired progress information item where the restart process is one of the multiple rewrite processes and is executed first when the rewrite is restarted. Electronic control unit after Claim 2 characterized in that the restart detecting section (S35) is adapted to: - determine whether all of the progress information items detected from the plurality of management blocks respectively indicate the deletion state, and - as the restarting process, identify a first-order operation in response in that it is determined that all of the progress information items respectively indicate the deletion state, the first order one of the plural operations that is executed first at rewriting. Electronic control unit after Claim 2 or Claim 3 characterized in that the restart detecting section (S65) is adapted to: determine whether at least one of the progress information items detected from the plurality of management blocks is an update information item that is an information item that does not indicate the deletion condition; Restarting process on the basis of the update information item in response to identifying that at least one of the progress information items is the update information item. Electronic control unit after Claim 4 characterized in that, in response to the progress information items detected from the plurality of management blocks having a plurality of update information items, the restart detecting portion (S65) is adapted to: - identify an immediately prior process consisting of a plurality of completed operations, which are described by the plurality of update information items and which is closest to a final run of the plurality of rewrite operations, and subsequently a subsequent one of one of the several operations after the immediately preceding one previous procedure is to identify as the restart process. Electronic control unit after Claim 5 characterized in that the restart detecting section (S65) has a continuity determining section (S45) adapted to determine whether the plurality of completed operations are consecutive operations of the plurality of rewrite operations in response to the plurality of update information items included in the progress information items are. Electronic control unit after Claim 6 characterized in that the restart detecting section (S65) is arranged to: - identify the immediately previous flow in response to it being determined that the plural completed flows are consecutive flows of the plurality of rewrite flows, and then the subsequent flow which following the immediately preceding expiration, as identifying the restart process. Electronic control unit after Claim 6 or 7 characterized in that the restart detecting section (S35) is arranged to identify, as the restarting operation, a first order process which is a process executed first among the plurality of rewriting processes, in response to being determined that the plurality of completed ones Operations are not consecutive operations of the multiple rewrite operations. Electronic control unit according to one of Claims 4 to 8th characterized in that, in response to determining that the plurality of progress information items detected from the plurality of management blocks has an update information item, the restart detection portion (S65) is configured to identify, as the restarting operation, a subsequent operation, which follows a completed process described by the one update information item. Electronic control unit according to one of Claims 2 to 9 characterized in that the electronic control unit is mounted in a vehicle and connected via a communication line (15) to another electronic control unit mounted in the vehicle so as to form a vehicle network in the vehicle, the electronic control unit further comprising a restart end section (S35, S65) adapted to send an information item describing the restarting process to an external device (20) located outside the vehicle network and communicating with the electronic control unit.

Images