JP2019175024A - In-vehicle control device - Google Patents

Abstract

To update a different version execution program to a new execution program based on the same differential data even in an in-vehicle control device operating with the different version execution program.SOLUTION: A nonvolatile memory is provided with arrangement of a rewritable execution program and a specific program 300. A new execution program 330 is restored from a difference data 350 between the new execution program 330 and the specific program 300 and the specific program 300 of the nonvolatile memory, and is written in the nonvolatile memory, so that the execution program is updated.SELECTED DRAWING: Figure 3B

Description

  The present invention relates to an in-vehicle control device.

  Conventionally, the idea of reprogramming by difference has been proposed. Paragraph [0019] of Patent Document 1 describes creating difference data of old and new programs in block units as one of the rewriting methods.

  In Patent Document 2, paragraph [0006] describes that differential update is realized with a small amount of RAM used.

  In Patent Document 3, the current version of the program is compressed and stored in the second memory, and then the program in the first memory is updated. If there is a diagnosis abnormality next, the compressed data in the second memory is decompressed. It describes that the microcomputer can be operated by writing the current version of the program into the first memory.

JP 2012-190075 A JP 2011-81561 A Japanese Patent Laid-Open No. 2006-118879

  In the differential update, generally, differential data is generated from the new program and the previous version. However, considering the case of millions of recalls, it is unlikely that all vehicles have the previous version of the program. If the driver does not feel any abnormality in the car, the driver may not update the program due to the case where the program is not updated due to the recall or the trouble of going to the dealer. For this reason, it is necessary to prepare difference data with a plurality of versions for the difference update. This complicates version management.

  In order to solve the above-described problems, an object of the present invention is to update a new execution program with the same difference data even in an in-vehicle control device that is operating with an execution program of a different version.

  In order to solve the above-mentioned problems, the present invention comprises a non-volatile memory in which a rewritable execution program and a specific program are arranged, a difference data between the new execution program and the specific program, and the non-volatile memory The execution program is updated by restoring the new execution program from the specific program and writing it into the nonvolatile memory.

  According to the present invention, even an in-vehicle control device operating with different versions of an execution program can be updated to a new execution program with the same difference data.

The schematic diagram which shows the whole structure of the vehicle by embodiment of invention. The schematic diagram which shows the structure inside SRAM of the vehicle-mounted control apparatus shown in FIG. Flowchart of PC compression software and difference generation software for explaining the concept of the embodiment of the present invention Flowchart of decompression software and difference restoration software of in-vehicle control device for explaining concept of embodiment of the present invention The schematic diagram which shows the structure inside the FLASH memory of the vehicle-mounted control apparatus shown in FIG. Schematic diagram of a configuration in which the FLASH memory of the in-vehicle control device shown in FIG. 1 is composed of a microcomputer built-in FLASH memory and an external FLASH memory Schematic diagram of internal configuration of external FLASH memory shown in FIG. 4B Repro software overall configuration diagram The figure which shows the kind of communication command of the vehicle-mounted writing apparatus of FIG. 1, and a vehicle-mounted control apparatus Flowchart in which program writing device transmits difference data using communication command of FIG. Flowchart for in-vehicle control device to receive difference data using communication command of FIG. Flowchart in which the program writing device transmits the differential restoration execution and diagnosis execution commands using the communication command of FIG. Flow chart of difference restoration software for in-vehicle controller Decompression command used by in-vehicle controller decompression software Processing flow of in-vehicle control device decompression software Difference command used by first difference restoration software and second difference restoration software of in-vehicle control device Flowchart of first difference restoration software of in-vehicle control device Flow chart of diagnostic software for in-vehicle controller Flow chart of second difference restoration software of in-vehicle control device

  Reprogramming the in-vehicle control device connects binary data by connecting a PC (Personal Computer) or in-vehicle writing device as a writing tool to the in-vehicle control device (ECU: Electric Control Unit) via a low-speed CAN (Controller Area Network). (New program) Writing to the flash memory of the ECU while dividing and transferring the entire program.

  For this reason, even when the update part of the new program with respect to the old program is small, the whole new program is transferred via CAN and the whole new program is written.

  Therefore, there is a problem that it takes time to write.

  The reprogramming of Patent Documents 1 to 3 has some problems.

  As a first problem, the difference update generally generates difference data from the new program and the previous version. However, considering the case of millions of recalls, it is unlikely that all vehicles have the previous version of the program. If the driver does not feel any abnormality in the car, the driver may not update the program due to the case where the program is not updated due to the recall or the trouble of going to the dealer. For this reason, it is necessary to prepare difference data with a plurality of versions for the difference update. This complicates version management. The first problem is to provide means for simplifying the complexity of version management.

  The second problem is that if the diagnosis result after the difference update is abnormal, for example, since the old program does not already exist in the nonvolatile memory FLASH, reprogramming by the difference becomes impossible. .

  In-vehicle control devices are often composed of a storage device composed of a non-volatile memory FLASH of several megabytes and a small volatile memory SRAM of 1 megabyte or less. This is to realize an inexpensive in-vehicle control device by realizing the control only with the memory built in the microcomputer. Therefore, the old program stored in the nonvolatile memory FLASH and the difference data are input, the new program is differentially restored by the differential restoration software, and the software update is realized by writing the new program into the nonvolatile memory FLASH. However, it is necessary to diagnose whether the restored new program has been restored correctly. For example, the sum value or hash value of the entire new program is received from the writing tool or in-vehicle writing device, and the sum value or hash value of the new program restored by the in-vehicle control device itself is calculated and matches the received value. Diagnosis is possible by checking this.

  Patent Document 3 describes that the in-vehicle control device needs compression means because the current version of the program needs to be compressed and stored in the second memory. However, in general, the compression process is complicated, takes a long processing time, and uses a large amount of memory. For this reason, it is difficult to mount on a vehicle-mounted control device.

  First, the concept of the configuration for solving the first problem will be described with reference to FIGS. 3A, 3B, 4A, 4B, and 4C.

  FIG. 3A is a processing flow for generating difference data of a new program using compression software 310 and difference generation software 340 installed in a personal computer.

  First, as shown in the flowchart of (a) compressing a specific program with compression software of a personal computer, the specific program 300 is compressed to generate compressed data 320. Here, the specific program is not particularly limited, but is assumed to be a program installed when the vehicle-mounted control device is shipped from the factory for the first time for easy understanding.

  Next, (b) the difference program 350 is generated by inputting the specific program 300 and the new program 330 to the difference generation software 340 as shown in the flowchart of generating difference data from the specific program and the new program by the difference generation software of the personal computer. .

  Here, the concept of the program update of the in-vehicle control device will be described with reference to FIG. 3B.

  As a premise, it is assumed that the compressed data 320 is written in the nonvolatile memory at the time of factory shipment in all on-vehicle controllers.

  An operation of executing the program update of the in-vehicle control device using the difference data 350 will be described. First, the in-vehicle writing device transmits the difference data 350 to the in-vehicle control device while the vehicle is traveling. The in-vehicle control device stores the difference data 350 in a nonvolatile memory in the own device.

  Next, (c) using a flowchart for restoring the specific program from the compressed data by the decompression software of the in-vehicle control device, and (d) using a flowchart for restoring the new program from the specific program and the difference data by the difference restoration software of the in-vehicle control device explain.

  First, the decompression software 360 first restores the specific program 300 from the compressed data 320.

  Next, the differential restoration software 370 restores the new program 330 from the specific program 300 and the difference data 350. Here, the difference data 350 is generated from the specific program 300 and the new program 330, as can be seen from FIG. 3A (b). Therefore, it can be seen that the in-vehicle control device can restore the new program 330 using the difference data 350 as long as the specific program 300 exists.

  Thus, the present embodiment does not update the difference using the difference data with the current version program of the in-vehicle control device, but uses the difference data with the specific program installed in all the in-vehicle control devices. To do.

  In this embodiment, the specific program is held in the form of compressed data in the in-vehicle control device. However, if the nonvolatile memory capacity is sufficient, the specific program may be held as it is.

  Next, a configuration for solving the second problem will be described.

  First, the restored new program 330 is written into the nonvolatile memory of the in-vehicle control device, and the current version of the program (execution program 331) is updated to the new program 330. Next, the sum value and hash value of the new program 330 are calculated, and the new program 330 is diagnosed. If there is no abnormality in the diagnosis result, the in-vehicle control device can be controlled using the new program 330. However, if there is a diagnosis abnormality, it is not possible to return to the current version of the program (execution program 331) by differential update as described above. Therefore, in this embodiment, two difference data storage areas, the latest difference data storage area and the previous difference data storage area, are prepared and the difference data is stored. As a result, if there is a diagnosis abnormality, the current version of the program can be restored using the previous difference data and the specific program. In this way, it is important to keep the difference data with the specific program in the latest version and the previous version.

  As described above, in order to solve the first problem, the present embodiment uses a specific program (for example, a program at the time of initial shipment) and a new program instead of the current version program in the in-vehicle control device. Is generated. That is, even if the vehicle-mounted control device is operating with a different version of the program, all the vehicle-mounted control devices can be differentially updated with only the difference data of this embodiment. As described above, according to the present embodiment, it is not necessary to manage the difference data with a plurality of versions of the program, so that the version management of the program can be simplified.

  In order to solve the second problem, even if there is an abnormality as a result of diagnosis, the current version of the program can be restored from the previous version of the difference data and the specific program. As a result, the in-vehicle control device can be operated.

  Details of the embodiments will be described below with reference to the drawings. First, the configuration and operation of a vehicle including an in-vehicle control device will be described with reference to FIG.

The vehicle includes an in-vehicle writing device 100 (gateway) and a plurality of in-vehicle control devices 200 (200 ₁ to 200 _n ). The in-vehicle writing device 100 and the in-vehicle control device 200 communicate with each other via the in-vehicle network CAN.

  The in-vehicle control device 200 includes a microcomputer 201, various ICs (Integrated Circuits) 204 corresponding to the use of each in-vehicle control device 200, and a communication device 205 such as a CAN transceiver. The microcomputer 201 incorporates an SRAM 202 (volatile memory) and a FLASH memory 203 (nonvolatile memory).

  The configuration of the in-vehicle writing device 100 is basically the same as that of the in-vehicle control device 200, but further includes a communication device according to a network protocol outside the vehicle. That is, the in-vehicle writing device 100 includes a microcomputer 101, various ICs 104, a communication device 105 such as a CAN transceiver, and a communication device 106 according to a network protocol outside the vehicle. The microcomputer 101 includes an SRAM 102 (volatile memory) and a FLASH memory 103 (nonvolatile memory).

  Next, the configuration of the SRAM 202 of the in-vehicle control device 200 will be described with reference to FIG. FIG. 2 is a schematic diagram showing an internal configuration of the SRAM 202 shown in FIG.

  The SRAM 202 is a reception area 202a for temporarily storing the difference data transmitted from the in-vehicle writing device 100, and a specific program obtained by decompressing and restoring the compressed data previously stored in the FLASH memory 203 of the in-vehicle control device 200. A decompression area 202c for temporarily storing and a restoration area 202b for temporarily storing a differential program and a new program restored using a specific program are provided.

  Next, the configuration of the FLASH memory 203 will be described with reference to FIG. 4A. 4A is a schematic diagram showing an internal configuration of the FLASH memory 203 shown in FIG. The FLASH memory 203 is composed of a plurality of blocks B # n (n = 1 to B) and repro software 400. Here, the first non-volatile memory 410 storing the binary data of the current version program (the binary data of the old program) is an area of block B # n (n = 1 to 7). The second non-volatile memory 420 that stores the compressed data of the specific program of this embodiment is an area of block B # n (n = 8 to B). Furthermore, the difference data storage area 430 for storing the difference data received from the in-vehicle writing device 100 is an area of B # n (n = C, D).

Here, the block B # n is the minimum erasable size. For example, when data is written to the block B # n, it is necessary to erase the entire block B # n before writing the data.
Further, repro software 400 for executing differential update is mounted on the top block of the FLASH memory 203. Further, although the FLASH memory 203 is composed of a plurality of blocks B # n (n = 1 to B), the number of blocks does not limit the present invention.

  FIG. 4B shows a configuration example in which the FLASH 203 is divided into a microcomputer built-in FLASH 203a and an external FLASH 203b. The built-in FLASH 203a is composed of repro software 400 and a first nonvolatile memory 410, and the external FLASH 203b is composed of a second nonvolatile memory 420 (compressed data of a specific program) and a differential data storage area 430. In this configuration, data necessary for differential update is arranged in the external FLASH 203b.

  4C shows the difference data storage area 430 of the external FLASH 203b of FIG. 4B in two areas, a first difference data storage area 430a (latest difference data) and a second difference data storage area 403b (previous difference data). It is the block diagram which comprised. The previous difference data is used when diagnosis is abnormal.

  Next, the operation of the repro software 400 will be described with reference to FIG. 5 showing the overall configuration of the embodiment.

  The repro software 400 includes communication software 500 that operates at a fixed period. The difference data reception software 510 is activated from the communication software 500. The difference data reception software 510 is means for temporarily storing the difference data received from the in-vehicle writing device 100 in the reception area 202a of the SRAM 202 and further storing the contents of the reception area 202a in the first difference data storage area 430a. Next, the communication software 500 activates the difference restoration software 520. The difference restoration software 520 activates the decompression software 540 and the first difference restoration software 550. The decompression software 540 decompresses the compressed data in the second nonvolatile memory 420 and stores the specific program in the decompression area 202c. The first difference restoration software 550 receives the latest difference data in the first difference data storage area 430a and the specific program in the decompression area 202c, executes difference update, and stores the restored new program in the restoration area 202b.

  Next, the block B # n (n = 1-7) in the first nonvolatile memory 410 is erased to delete the current version of the program (old program, execution program 331), and the new program in the restoration area 202b is changed to the first program. Write to the non-volatile memory 410. Thus, the new program can be stored in the first nonvolatile memory 410. Next, the communication software 500 activates the diagnostic software to diagnose whether the new program has been correctly restored and written correctly. If the diagnosis result is normal, the software update by the repro software 400 ends. On the other hand, if the diagnosis result is abnormal, the decompression software 540 is activated to decompress the compressed data in the second nonvolatile memory 420 and store the specific program in the decompression area 202c of the SRAM 202.

  Next, the second difference restoration software 560 executes the difference update with the previous difference data in the second difference data storage area 430b and the specific program in the decompression area 202c as inputs, and restores the restored old program (current version program, for execution). The program 331) is stored in the restoration area 202b.

  Next, the block B # n (n = 1 to 7) in the first nonvolatile memory 302 is erased to delete an illegal new program, and the old program in the restoration area 202b is written into the first nonvolatile memory 302. Thus, the old program can be stored in the first nonvolatile memory 302.

  In this way, even when the difference restoration fails, the old program is made to operate by combining the decompression software 540 and the second difference restoration software 560 using the compressed data of the specific program and the previous difference data, and operating the old program. I was able to write to.

  Hereinafter, specific types of communication commands, transmission processing in which the program writing device 100 transmits differential data to the in-vehicle control device using the communication command, differential data reception processing in the in-vehicle control device, differential restoration execution communication of the program writing device 100 The flowchart of the command and diagnosis execution communication command transmission process, the difference restoration execution communication command and the diagnosis execution communication command reception process of the in-vehicle control device will be described with reference to FIGS. 6 to 10B, and then the decompression process command and decompression software process Detailed description of the difference processing command, the first difference restoration software processing, the diagnosis software processing, and the second difference restoration software processing will be described with reference to FIGS. 10A to 15.

  FIG. 6 shows communication commands transmitted from the in-vehicle writing device 100 to the in-vehicle control device 200. Difference data is transmitted to the vehicle-mounted control apparatus 200 using this communication command.

  The communication command $ 10 600 is a command for notifying the in-vehicle control device 200 of the start of transmission of difference data. By receiving this command, the in-vehicle control device 200 can store the difference data in the reception area 202a.

  The communication command $ 20 610 is a command for designating the first differential data storage area 430a. The attached MA is the head address of the first differential data storage area 430a, and MS is the size of the first differential data storage area 430a.

  The communication command $ 30 620 is a command attached with difference data DATA.

  The communication command $ 40 630 is a command indicating the end of difference data transmission.

  Using the above communication command, the difference data is transmitted from the program writing device 100 to the in-vehicle control device 200, and the in-vehicle control device 200 stores the difference data in the first difference storage area 430a.

  The communication command $ 50 640 is a differential restoration execution command. The communication command is transmitted from the program writing device 100 to the in-vehicle control device 200 after the difference data is stored in the first difference storage area 430a. When receiving this communication command, the in-vehicle control device 200 activates the decompression software and the first difference restoration software to generate a new program in the first nonvolatile memory 410.

  Communication command $ 60 650 is a diagnostic command. The attached MA is the head address of the first non-volatile memory 410, and MS is its size. The in-vehicle control device 200 calculates the sum value of the area of the size MS from the designated head address MA, and confirms that it matches the sum value stored at the predetermined address of the new program in the first nonvolatile memory 410. Diagnose. If they match, it is determined that the diagnosis is normal and the repro ends normally. On the other hand, in the case of mismatch, it is determined that the diagnosis is abnormal, the decompression software and the second difference restoration software are started, the old program is restored using the specific program and the previous difference data in the second difference data storage area 430b, 1 The in-vehicle control device 200 can be operated by writing to the nonvolatile memory 410.

  FIG. 7 is a flowchart in which the program writing device 100 transmits the difference data to the in-vehicle control device 200 in block units using a communication command.

  At 700, a communication command difference data transmission start $ 10 is transmitted.

  At 710, the communication command first differential data storage area 430a is designated and $ 20 is transmitted.

  At 720, the communication command difference data DATA $ 30 is transmitted.

  At 730, a communication command difference data transmission end $ 40 is transmitted.

  In step 740, it is determined whether transmission of the difference data of all the blocks has been completed. If the determination result is no, the process returns to 710 and the difference data of the next block is transmitted by repeating 710-740.

  On the other hand, if the determination result is yes, transmission of difference data is complete.

  Thus, the program writing device 100 has transmitted the difference data of all the blocks to the in-vehicle control device 200.

  FIG. 8 shows the operation of the difference data reception software 510 of the in-vehicle control device 200.

  Reference numeral 800 denotes processing for receiving the communication command A from the in-vehicle writing device 100.

  In step 810, it is determined whether the received communication command A is $ 10. If yes, step 815 is executed to initialize the reception area 202a. On the other hand, if no, 820 is executed.

  In step 815, the reception area 202a and the restoration area 202b are initialized to prepare for differential update.

  820 determines whether the command A is $ 20, and if yes, executes 825 to store the start address MA of the first differential data storage area 430a and its size MS. On the other hand, if no, 830 is executed.

  830 determines whether the command A is $ 30, and if yes, executes 835 to additionally store the difference data DATA attached to the command in the first difference data storage area 430a designated by MA. On the other hand, if no, 840 is executed.

  In step 840, it is determined whether the command A is $ 40. If yes, step 845 is executed to complete reception of the difference data of the block, while if no, step 850 is executed.

  In step 850, it is determined whether the difference data of all the blocks has been received. If yes, the process ends. On the other hand, if no, the process returns to 820, and the process of receiving the difference data of the next block is repeated.

  Thus, the difference data can be stored in the first difference data storage area 430a.

FIG. 9 is a flowchart for instructing execution and diagnosis of difference restoration from the program writing device 100 to the in-vehicle control device 200 using a communication command.
900 is a communication command transmission start notification by the communication command $ 10.
Reference numeral 910 denotes a difference restoration execution notification by the communication command $ 50.
920 is a diagnosis execution notification by the communication command $ 60.

  FIG. 10A is a flow of the differential restoration software 520 activated by receiving the differential restoration execution command 910 in FIG.

  1000 is processing for executing decompression software 540 to decompress the compressed data in the second nonvolatile memory 420 and restoring a specific program to the decompression area 202c.

  The 1100 executes the first difference restoration software 550 to generate a new program from the difference data in the first difference data storage area 430a and a specific program in the decompression area 202c and store it in the restoration area 202b. Furthermore, the new program in the restoration area 202b is written into the first nonvolatile memory 410.

  Thus, the old program can be updated to the new program.

  FIG. 10B shows a decompression command used by the decompression software 540.

  Before explaining the decompression software, the outline of the compression software will be explained first. In the compression process, the compression software searches for a partial instruction sequence that is the same as the partial instruction sequence in the program in another part of the program and finds it, and replaces the partial instruction sequence with a short code. If there are many identical partial instruction sequences, they can be compressed more because they are replaced with short codes. For this reason, the compression software searches the program and, if the same partial instruction sequence is not found, attaches the partial instruction sequence DATA to the decompression addition command new of 1000A. On the other hand, if the same partial instruction sequence is found, it is encoded as a decompression copy command copy of 1010A. A partial instruction sequence is expressed by a pair of program address MA and size MS. Thus, the compressed data is composed of a sequence of a decompression addition command new and a decompression copy command copy.

  Based on the above preparation, the operation of the decompression software 540 will be described.

  FIG. 11 is a flowchart showing the operation of the decompression software 540.

  1100 reads the compressed data in the second nonvolatile memory 420.

  1110 analyzes the read compression command.

  1120 determines whether the command is a decompression addition command new. If yes, 1125 is executed to add the data DATA attached to the decompression addition command new to the decompression area 202c. On the other hand, if no, 1130 is executed.

  1130 determines whether the command is the decompression copy command copy. If yes, execute 1135 and decompress the partial instruction sequence of size MS from the address MA in the decompression area 202c using MA and MS attached to the decompression copy command copy. Add to area 202c. On the other hand, if no, 1140 is executed.

  1140 determines whether all the differential data has been read from the second non-volatile memory 420, and if yes, the process ends. That is, the specific program can be restored to the decompression area 202c. On the other hand, if no, the process returns to 1100, the compressed data is read from the second nonvolatile memory 420, and the process is repeatedly executed.

  Next, difference commands used by the first difference restoration software 550 and the second difference restoration software 560 will be described with reference to FIG.

  Before describing the difference restoration software, first, an outline of the difference generation software will be described. In the difference generation process, the difference generation software searches to find out whether the partial instruction sequence of the new program 330 exists in the old program 331, and replaces the partial instruction sequence with a short code. If the new program and the old program 331 are similar, there will be many identical partial instruction sequences, and many can be replaced with short codes. Therefore, when the difference generation software searches the old program 331 and does not find the same partial instruction sequence, it adds the partial instruction sequence DATA to the 1200 difference addition command new. On the other hand, when the same partial instruction sequence is found in the old program 331, it is encoded like the differential copy command copy of 1210. A partial instruction sequence is expressed by a pair of the address MA and size MS of the old program. The difference data is thus composed of columns of a difference addition command new and a difference copy command copy.

  Based on the above preparation, the operation of the first difference restoration software 550 will be described.

  1300 reads a difference command from the difference data in the first difference data storage area 430a.

  1310 analyzes the difference command and determines in 1320 whether the difference command is a difference addition command new. If yes, 1325 is executed, and if no, 1330 is executed.

  1325 writes the partial instruction string DATA attached to the difference addition command new to the restoration area 202b.

  1330 determines whether the differential command is the differential copy command copy. If yes, execute 1335, and if no, execute 1340.

  1335 additionally writes a partial instruction sequence of size MS from the address MA of the old program to the restoration area 202b using MA and MS attached to the differential copy command copy.

  1340 determines whether all the differential data has been read from the first differential data storage area 430a. If yes, 1350 is executed. On the other hand, if no, return to 1300 and repeat the process.

  In 1350, the new program generated in the restoration area 202b is written into the first nonvolatile memory 410.

  As described above, the newly restored differential program can be stored in the first nonvolatile memory 410.

  FIG. 14 is a flowchart of the diagnostic software 530.

  As a premise, it is assumed that 4 bytes of the new program's own sum value exists at an address determined by the new program. Diagnosis is performed using this sum value.

  1400 reads the sum value existing in the new program of the first nonvolatile memory 410 and sets it in the variable SUM.

  1410 sets a variable S to a value obtained by adding the data in the area from the start address MA to the size MS of the first nonvolatile memory 410 (new program of the first nonvolatile memory 410) in units of 4 bytes.

  1420 performs a match determination between the variable SUM and the variable S, and if yes, execute 1425, and if no, execute 1430.

  In 1425, since the diagnosis result is normal, the program update ends normally.

  In 1430, since the diagnosis result is abnormal, the decompression software 540 is first executed to generate a specific program in the decompression area 202c in order to restore the old program.

  1440 activates the second difference restoration software 560 to restore the old program from the previous difference data in the second difference data storage area 430b and the specific program in the decompression area 202c.

  Here, regarding the relationship between the first difference data storage area 430a and the second difference data storage area 430b, the latest difference data storage area is always referred to as the first difference data storage area, and the area in which the previous difference data is stored. This is called a second differential data storage area. The program generated from the previous difference data and the specific program is obviously an old program.

  The processing content of the decompression software 540 has already been described in detail with reference to the flowchart of FIG.

  Finally, a flowchart of the second difference restoration software 560 will be described with reference to FIG.

  1500 reads the difference command from the difference data in the second difference data storage area 430b.

  1510 analyzes the differential command, and determines whether the differential command is a differential addition command new in 1520. If yes, execute 1525, and if no, execute 1530.

  1525 writes the partial instruction string DATA attached to the difference addition command new to the restoration area 202b.

  1530 determines whether the differential command is the differential copy command copy. If yes, execute 1535, and if no, execute 1540.

  1535 additionally writes a partial instruction string of size MS from the address MA of a specific program in the decompression area 202c to the restoration area 202b using MA and MS attached to the differential copy command copy.

  In step 1540, it is determined whether all the difference data has been read from the second difference data storage area 430b. On the other hand, if no, return to 1500 and repeat the process.

  In 1550, the old program generated in the restoration area 202b is written into the first nonvolatile memory 410.

  Thus, the old program that has been differentially restored can be stored in the first nonvolatile memory 410.

  In the present embodiment, a specific program is compressed, and the compressed data is stored in the second nonvolatile memory 420. However, as a matter of course, if the capacity of the nonvolatile memory 203 or the external FLASH 203b is large, a specific program itself may be stored in the second nonvolatile memory 420 instead of the compressed data form. If this form is possible, the repro software 400 of FIG. 5 may be replaced with transfer software that transfers a specific program in the second nonvolatile memory 420 to the decompression area 202c instead of the decompression software 540. As a result, the difference restoration software 520 executes the transfer software and then executes the first difference restoration software 550. Similarly, the diagnosis software 530 can be realized by executing the transfer software and then executing the second difference restoration software 560.

100: In-vehicle writing device (gateway)
101: Microcomputer (arithmetic unit)
102 ... SRAM (volatile memory)
103 ... FLASH memory (nonvolatile memory)
104 ... Various ICs
105 ... Communication device (CAN protocol)
106: Communication device (network protocol outside the vehicle)
200: On-vehicle control device (ECU)
201: Microcomputer (arithmetic unit)
202 ... SRAM (volatile memory)
203 ... FLASH memory (nonvolatile memory)
203a ... FLASH memory with built-in microcomputer 203b ... External FLASH memory 204 ... Various ICs
205 ... Communication device (CAN protocol)
202a ... Reception area 202b ... Restoration area 202c ... Decompression area 300 ... Specific program 310 ... Compression software 320 ... Compression data 330 of specific program ... New program (new execution program)
331 ... Old program (execution program)
340 ... Difference generation software 350 ... Difference data 360 between a specific program and a new program ... Decompression software 370 ... Difference restoration software 400 ... Repro software 410 ... First nonvolatile memory (executable program storage area)
420 ... 2nd non-volatile memory (compressed data storage area of specific program)
430 ... Difference data storage area 430a ... First difference data storage area (latest difference data storage area)
430b ... second difference data storage area (previous difference data storage area)
500 ... Communication software 510 ... Difference data reception software 520 ... Difference restoration software 530 ... Diagnosis software 540 ... Decompression software 550 ... First difference restoration software 560 ... Second difference restoration software 600 ... Difference data transmission start communication command 610 ... Difference data storage Area designation communication command 620 ... difference data communication command 630 ... difference data transmission end communication command 640 ... restoration execution communication command 650 ... diagnosis execution communication command 1000A ... decompression addition command 1010A ... decompression copy command 1200 ... difference addition command 1210 ... difference copy command

Claims (5)

  A non-volatile memory in which a rewritable execution program and a specific program are arranged, and a new execution program based on difference data between the new execution program and the specific program, and the specific program in the non-volatile memory The in-vehicle control device is characterized in that the execution program is updated by restoring the program and writing it into the nonvolatile memory.   The in-vehicle control according to claim 1, wherein the nonvolatile memory includes a first nonvolatile memory that stores the execution program, and a second nonvolatile memory that stores the specific program and the difference data. apparatus.   The in-vehicle control device according to claim 2, wherein the first nonvolatile memory is built in a microcomputer, and the second nonvolatile memory is externally attached to the microcomputer. The second non-volatile memory includes a first difference data storage area for storing the new difference data, and a second difference data storage area for storing the previous difference data,
When the update to the new execution program fails, the previous execution program is restored from the previous difference data stored in the second difference data storage area and the specific program, and the first execution program is restored. 4. The in-vehicle control device according to claim 2, wherein the data is written in a nonvolatile memory.   The second non-volatile memory includes the specific program arranged in the form of compressed data, decompresses the compressed data to generate the specific program, and then restores the new execution program to restore the non-volatile memory. The vehicle-mounted control device according to claim 1, wherein the vehicle-mounted control device is written to the vehicle-mounted control device.

Images