JP6838714B2 - In-vehicle control device - Google Patents

Description

The present invention relates to an in-vehicle control device.

Conventionally, the concept of reprogramming by difference has been proposed. In paragraph [0019] of Patent Document 1, it is described that the difference data of the old and new programs is created in block units as one of the rewriting methods.

In Patent Document 2, paragraph [0006] describes that differential update is realized with a small amount of RAM used.

In Patent Document 3, the current version of the program is compressed and stored in the second memory, then the program in the first memory is updated, and if there is a diagnostic abnormality next, the compressed data in the second memory is decompressed. It is described that the microcomputer can be operated by writing the current version of the program to the first memory.

Japanese Unexamined Patent Publication No. 2012-190075 Japanese Unexamined Patent Publication No. 2011-81561 Japanese Unexamined Patent Publication No. 2016-118879

The difference update generally generates the difference data from the new program and the previous version. However, considering the case of recalling millions of vehicles, it is unlikely that all vehicles are equipped with the previous version of the program. If the driver does not feel any abnormality in his / her own vehicle, he / she may not update the program due to recall or because it is troublesome to go to the dealer. Therefore, it is necessary to prepare the difference data with a plurality of versions for the difference update. This complicates version control.

In order to solve the above problems, it is an object of the present invention to update an in-vehicle control device operating with different versions of execution programs to a new execution program with the same difference data.

In order to solve the above problems, the present invention includes a rewritable execution program and a non-volatile memory in which the specific program is arranged, new difference data between the execution program and the specific program, and the non-volatile memory. The execution program is updated by restoring a new execution program from the specific program and writing to the non-volatile memory, and the non-volatile memory is a first non-volatile memory for storing the execution program. The second non-volatile memory includes the specific program and the second non-volatile memory for storing the difference data, and the second non-volatile memory includes a first difference data storage area for storing the new difference data and the previous difference. It is provided with a second difference data storage area for storing data, and when a new update to the execution program fails, the previous difference data stored in the second difference data storage area and the specific program are used. The previous execution program is restored and written to the first non-volatile memory .

According to the present invention, even in-vehicle control devices operating with different versions of execution programs can be updated to a new execution program with the same difference data.

Schematic diagram showing the overall configuration of the vehicle according to the embodiment of the invention Schematic diagram showing the internal configuration of the SRAM of the in-vehicle control device shown in FIG. Flow chart of compression software and difference generation software of a personal computer for explaining the concept of the embodiment of the present invention. Flow chart of decompression software and difference restoration software of in-vehicle control device explaining the concept of the embodiment of the present invention Schematic diagram showing the internal configuration of the FLASH memory of the in-vehicle control device shown in FIG. Schematic diagram of a configuration in which the FLASH memory of the in-vehicle control device shown in FIG. 1 is composed of a FLASH memory with a built-in microcomputer and an external FLASH memory. Schematic diagram of the internal configuration of the external FLASH memory shown in FIG. 4B. Repro software overall configuration diagram The figure which shows the type of the communication command of the vehicle-mounted writing device and the vehicle-mounted control device of FIG. Flow chart in which the program writing device transmits the difference data using the communication command of FIG. Flow chart in which the in-vehicle control device receives the difference data using the communication command of FIG. Flow chart in which the program writer sends the differential restoration execution and diagnostic execution commands using the communication command shown in FIG. Flowchart of difference restoration software for in-vehicle control device Decompression command used by the decompression software of the in-vehicle control device Processing flow of decompression software for in-vehicle control device Difference commands used by the first difference restoration software and the second difference restoration software of the in-vehicle control device Flowchart of the first difference restoration software of the in-vehicle control device Flowchart of diagnostic software for in-vehicle control device Flowchart of the second difference restoration software of the in-vehicle control device

For reprogramming of the in-vehicle control device, a PC (Personal Computer) or an in-vehicle writing device as a writing tool is connected to an in-vehicle control device (ECU: Electric Control Unit) via a low-speed CAN (Controller Area Network), and binary data is obtained. (New program) Writing to the flash memory of the ECU while dividing and transferring the entire system.

Therefore, even when the update portion of the new program with respect to the old program is small, the entire new program is transferred via the CAN and the entire new program is written.

Therefore, there is a problem that it takes time to write.

The reprogramming of Patent Documents 1 to 3 has some problems.

As the first problem, the difference update generally generates the difference data from the new program and the previous version. However, considering the case of recalling millions of vehicles, it is unlikely that all vehicles are equipped with the previous version of the program. If the driver does not feel any abnormality in his / her own vehicle, he / she may not update the program due to recall or because it is troublesome to go to the dealer. Therefore, it is necessary to prepare the difference data with a plurality of versions for the difference update. This complicates version control. The first challenge is to provide a means of simplifying the complexity of this version control.

The second problem is that if the diagnosis result after the difference update is abnormal, for example, since the old program does not already exist in the non-volatile memory FLASH, reprogramming by the difference becomes impossible. ..

The in-vehicle control device is often composed of a storage device composed of a non-volatile memory FLASH of several megabytes and a small volatile memory SRAM of 1 megabyte or less. This is to realize an inexpensive in-vehicle control device by realizing control only with the memory built in the microcomputer. Therefore, by inputting the difference data from the old program stored in the non-volatile memory FLASH, the new program is differentially restored by the difference restoration software, and the new program is written to the non-volatile memory FLASH to realize the software update. However, it is necessary to diagnose whether the restored new program was restored correctly. For example, the sum value and hash value of the entire new program are received from the writing tool and the in-vehicle writing device, and the sum value and hash value of the new program restored by the in-vehicle control device itself are calculated and match the received values. Diagnosis is possible by checking.

Patent Document 3 describes that the in-vehicle control device requires a compression means because it is necessary to compress and store the current version of the program in the second memory. However, in general, the compression process is complicated, the processing time is long, and the memory used is very large. Therefore, it is difficult to mount it on an in-vehicle control device.

First, the concept of the configuration for solving the first problem will be described with reference to FIGS. 3A, 3B, 4A, 4B, and 4C.

FIG. 3A is a processing flow for generating the difference data of the new program by using the compression software 310 and the difference generation software 340 installed in the personal computer.

First, (a) compressing the specific program with the compression software of the personal computer As shown in the flowchart, the specific program 300 is compressed to generate the compressed data 320. Here, the specific program is not particularly limited, but is assumed to be a program to be installed when the in-vehicle control device is first shipped from the factory for easy understanding.

Next, (b) the difference data 350 is generated by inputting the specific program 300 and the new program 330 into the difference generation software 340 as shown in the flowchart for generating the difference data from the specific program and the new program with the difference generation software of the personal computer. ..

Here, the concept of updating the program of the in-vehicle control device will be described with reference to FIG. 3B.

As a premise, it is assumed that the compressed data 320 is written to the non-volatile memory at the time of shipment from the factory in all the in-vehicle control devices.

The operation of executing the program update of the in-vehicle control device using the difference data 350 will be described. First, the in-vehicle writing device transmits the difference data 350 to the in-vehicle control device while the vehicle is traveling. The in-vehicle control device stores the difference data 350 in the non-volatile memory in the own device.

Next, using (c) a flowchart for restoring a specific program from compressed data with the decompression software of the in-vehicle control device, and (d) a flowchart for restoring a new program from the specific program and the difference data with the difference restoration software for the in-vehicle control device. explain.

First, the decompression software 360 restores the specific program 300 from the compressed data 320.

Next, the difference restoration software 370 restores the new program 330 from the specific program 300 and the difference data 350. Here, the difference data 350 is generated from the specific program 300 and the new program 330, as can be seen from FIG. 3A (b). Therefore, it can be seen that the in-vehicle control device can restore the new program 330 using the difference data 350 as long as the specific program 300 is available.

As described above, in this embodiment, the difference is not updated by using the difference data with the program of the current version of the in-vehicle control device, but by using the difference data with the specific program mounted on all the in-vehicle control devices. To do.

Further, in this embodiment, the in-vehicle control device holds the specific program in the form of compressed data, but if the non-volatile memory capacity is sufficient, the specific program may be held in the form as it is.

Next, a configuration for solving the second problem will be described.

First, the restored new program 330 is written to the non-volatile memory of the in-vehicle control device, and the current version of the program (execution program 331) is updated to the new program 330. Next, the sum value and hash value of the new program 330 are calculated, and the new program 330 is diagnosed. If there is no abnormality in the diagnosis result, the in-vehicle control device can be controlled by using the new program 330. However, if there is a diagnostic abnormality, it is not possible to return to the current version of the program (execution program 331) by the differential update as described above. Therefore, in this embodiment, the difference data storage area is prepared on two sides, the latest difference data storage area and the previous difference data storage area, and the difference data is stored. As a result, if there is a diagnostic abnormality, the current version of the program can be restored using the previous difference data and a specific program. In this way, the point is to keep the latest version and the previous version of the difference data with the specific program.

As described above, in order to solve the first problem, the present embodiment uses a specific program (for example, a program at the time of initial shipment) and a new program instead of the current version program in the in-vehicle control device, and the difference data. Is being generated. That is, even if the in-vehicle control devices are operating with different versions of the program, all the in-vehicle control devices can be differentially updated only by the difference data of this embodiment. As described above, according to this embodiment, it is not necessary to manage the difference data between the programs of a plurality of versions, so that the version management of the program can be simplified.

In order to solve the second problem, even if there is an abnormality as a result of the diagnosis, the current version of the program can be restored from the difference data of the previous version and a specific program. As a result, the in-vehicle control device can be operated.

Hereinafter, the details of the examples will be described with reference to the drawings. First, the configuration and operation of the vehicle including the in-vehicle control device will be described with reference to FIG.

Vehicle includes a vehicle writing device 100 (gateway), a plurality of vehicle-mounted control unit _{200 (200} 1 _{~200 n).} The vehicle-mounted writing device 100 and the vehicle-mounted control device 200 communicate with each other via the vehicle-mounted network CAN.

The in-vehicle control device 200 includes a microcomputer 201, various ICs (Integrated Circuits) 204 according to the application of each in-vehicle control device 200, and a communication device 205 such as a CAN transceiver. The microcomputer 201 has a SRAM 202 (volatile memory) and a FLASH memory 203 (nonvolatile memory).

The configuration of the vehicle-mounted writing device 100 is basically the same as the configuration of the vehicle-mounted control device 200, but a communication device corresponding to the protocol of the network outside the vehicle is further provided. That is, the in-vehicle writing device 100 includes a microcomputer 101, various ICs 104, a communication device 105 such as a CAN transceiver, and a communication device 106 according to the protocol of the network outside the vehicle. The microcomputer 101 has a built-in SRAM 102 (volatile memory) and a FLASH memory 103 (nonvolatile memory).

Next, the configuration of the SRAM 202 of the in-vehicle control device 200 will be described with reference to FIG. FIG. 2 is a schematic view showing the internal configuration of the SRAM 202 shown in FIG.

The SRAM 202 is a reception area 202a for temporarily storing the difference data transmitted from the vehicle-mounted writing device 100, and a specific program that is restored by decompressing the compressed data previously built in the FLASH memory 203 of the vehicle-mounted control device 200. A decompression area 202c for temporarily storing the decompression area 202c and a restoration area 202b for temporarily storing the difference data and the new program differentially restored using a specific program are provided.

Next, the configuration of the FLASH memory 203 will be described with reference to FIG. 4A. FIG. 4A is a schematic view showing the internal configuration of the FLASH memory 203 shown in FIG. The FLASH memory 203 is composed of blocks B # n (n = 1 to B) of a plurality of sizes and repro software 400. Here, the first non-volatile memory 410 for storing the binary data of the current version of the program (binary data of the old program) is an area of block B # n (n = 1 to 7). The second non-volatile memory 420 that stores the compressed data of the specific program of this embodiment is an area of block B # n (n = 8 to B). Further, the difference data storage area 430 for storing the difference data received from the vehicle-mounted writing device 100 is an area of B # n (n = C, D).

Here, block B # n is the minimum size that can be erased. For example, when writing data to block B # n, it is necessary to erase the entire block B # n before writing the data.
Further, the repro software 400 that executes the differential update is mounted on the first block of the FLASH memory 203. Further, although the FLASH memory 203 is composed of blocks B # n (n = 1 to B) having a plurality of sizes, the number of blocks does not limit the present invention.

FIG. 4B is a configuration example in which the FLASH 203 is divided into a FLASH 203a with a built-in microcomputer and an external FLASH 203b. The built-in FLASH 203a is composed of the repro software 400 and the first non-volatile memory 410, and the external FLASH 203b is composed of the second non-volatile memory 420 (compressed data of a specific program) and the difference data storage area 430. This is a configuration in which the data required for differential update is placed on the external FLASH 203b.

In FIG. 4C, the difference data storage area 430 of the external FLASH 203b of FIG. 4B is divided into two areas, the first difference data storage area 430a (latest difference data) and the second difference data storage area 403b (previous difference data). It is a constructed block diagram. The previous difference data is used when the diagnosis is abnormal.

Next, the operation of the repro software 400 will be described with reference to FIG. 5, which shows the overall configuration of the embodiment.

The repro software 400 includes communication software 500 that operates at regular intervals. The difference data receiving software 510 is started from the communication software 500. The difference data receiving software 510 is a means for temporarily storing the difference data received from the in-vehicle writing device 100 in the receiving area 202a of the SRAM 202, and further storing the contents of the receiving area 202a in the first difference data storage area 430a. Next, the communication software 500 starts the difference restoration software 520. The difference restoration software 520 starts the decompression software 540 and the first difference restoration software 550. The decompression software 540 decompresses the compressed data of the second non-volatile memory 420 and stores the specific program in the decompression area 202c. The first difference restoration software 550 receives the latest difference data in the first difference data storage area 430a and a specific program in the decompression area 202c as inputs, executes a difference update, and stores the restored new program in the restoration area 202b.

Next, the block B # n (n = 1 to 7) of the first non-volatile memory 410 is erased, the current version of the program (old program, execution program 331) is deleted, and the new program in the restore area 202b is first. Write to the non-volatile memory 410. This means that the new program can be stored in the first non-volatile memory 410. Next, the communication software 500 starts the diagnostic software and diagnoses whether the new program is correctly restored and correctly written. If the diagnosis result is normal, the software update by the repro software 400 is completed. On the other hand, if the diagnosis result is abnormal, the decompression software 540 is started to decompress the compressed data of the second non-volatile memory 420, and the specific program is stored in the decompression area 202c of the SRAM 202.

Next, the second difference restoration software 560 inputs the previous difference data in the second difference data storage area 430b and the specific program in the decompression area 202c, executes the difference update, and restores the old program (current version program, for execution). The program 331) is stored in the restoration area 202b.

Next, the invalid new program is deleted by erasing the blocks B # n (n = 1 to 7) of the first non-volatile memory 302, and the old program in the restore area 202b is written to the first non-volatile memory 302. This means that the old program can be stored in the first non-volatile memory 302.

In this way, even if the difference restoration fails, the old program can be operated by combining the decompression software 540 and the second difference restoration software 560 using the compressed data of the specific program and the previous difference data. I was able to write to.

Hereinafter, specific types of communication commands, transmission processing in which the program writing device 100 transmits difference data to the in-vehicle control device using communication commands, difference data reception processing in the in-vehicle control device, and difference restoration execution communication in the program writing device 100 The flowcharts of the command and diagnosis execution communication command transmission processing, the differential restoration execution communication command of the in-vehicle controller and the diagnosis execution communication command reception processing are described with reference to FIGS. 6 to 10B, and then the decompression processing command and decompression software processing are described. , The command of the difference processing, the processing of the first difference restoration software, the processing of the diagnostic software, and the processing of the second difference restoration software will be described in detail with reference to FIGS. 10A to 15.

FIG. 6 is a communication command transmitted from the vehicle-mounted writing device 100 to the vehicle-mounted control device 200. The difference data is transmitted to the vehicle-mounted control device 200 using this communication command.

The communication command $ 10 600 is a command for notifying the in-vehicle controller 200 of the start of transmission of the difference data. By receiving this command, the in-vehicle control device 200 can store the difference data in the reception area 202a.

The communication command $ 20 610 is a command for designating the first difference data storage area 430a. The attached MA is the start address of the first difference data storage area 430a, and the MS is the size of the first difference data storage area 430a.

The communication command $ 30 620 is a command with the difference data DATA attached.

The communication command $ 40 630 is a command indicating the end of differential data transmission.

Using the above communication command, the difference data is transmitted from the program writing device 100 to the vehicle-mounted control device 200, and the vehicle-mounted control device 200 stores the difference data in the first difference storage area 430a.

The communication command $ 50 640 is a differential restoration execution command. This is a communication command transmitted from the program writing device 100 to the vehicle-mounted control device 200 after the difference data is stored in the first difference storage area 430a. Upon receiving this communication command, the in-vehicle control device 200 activates the decompression software and the first difference restoration software to generate a new program in the first non-volatile memory 410.

The communication command $ 60 650 is a diagnostic command. The attached MA is the start address of the first non-volatile memory 410, and the MS is its size. The in-vehicle control device 200 calculates the sum value of the area of size MS from the designated start address MA, and makes sure that the sum value matches the sum value stored in the predetermined address of the new program in the first non-volatile memory 410. Diagnose. If they match, the diagnosis is judged to be normal and the repro ends normally. On the other hand, if there is a discrepancy, it is judged that the diagnosis is abnormal, the decompression software and the second difference restoration software are started, and the old program is restored using the specific program and the previous difference data of the second difference data storage area 430b. 1 By writing to the non-volatile memory 410, the in-vehicle control device 200 can be operated.

FIG. 7 is a flowchart in which the program writing device 100 transmits the difference data to the in-vehicle control device 200 in block units by using a communication command.

At 700, the communication command difference data transmission start $ 10 is transmitted.

The communication command 1st difference data storage area 430a is specified by 710, and $ 20 is transmitted.

At 720, the communication command difference data DATA $ 30 is transmitted.

Communication command difference data transmission end at 730 $ 40 is transmitted.

740 determines whether the transmission of the difference data of all the blocks is completed. If the determination result is no, the process returns to 710 and the difference data of the next block is transmitted by repeating 710 to 740.

On the other hand, if the determination result is yes, the difference data transmission is completed.

As described above, the program writing device 100 has transmitted the difference data of all the blocks to the in-vehicle control device 200.

FIG. 8 shows the operation of the difference data receiving software 510 of the in-vehicle control device 200.

The 800 is a process of receiving the communication command A from the in-vehicle writing device 100.

810 determines whether the received communication command A is $ 10, and if yes, executes 815 to initialize the reception area 202a. On the other hand, if no, then 820 is executed.

815 initializes the reception area 202a and the restoration area 202b to prepare for the difference update.

820 determines whether the command A is $ 20, and if yes, executes 825 to store the start address MA of the first difference data storage area 430a and its size MS. On the other hand, if no, then 830 is executed.

The 830 determines whether the command A is $ 30, and if yes, executes 835 to additionally store the difference data DATA attached to the command in the first difference data storage area 430a instructed by the MA. On the other hand, if no, then 840 is executed.

840 determines whether the command A is $ 40, and if yes, executes 845 to complete the reception of the block difference data, while if no, executes 850.

850 determines whether the difference data of all the blocks has been received, and if yes, the process ends. On the other hand, if no, the process returns to 820 and the process of receiving the difference data of the next block is repeated.

With the above, the difference data can be stored in the first difference data storage area 430a.

FIG. 9 is a flowchart for instructing the differential restoration execution and the diagnosis from the program writing device 100 to the in-vehicle control device 200 by using a communication command.
Reference numeral 900 denotes a communication command transmission start notification by the communication command $ 10.
910 is a differential restoration execution notification by the communication command $ 50.
920 is a diagnosis execution notification by the communication command $ 60.

FIG. 10A is a flow of the difference restoration software 520 activated by receiving the difference restoration execution command of FIG. 9 910.

1000 is a process of executing the decompression software 540 to decompress the compressed data of the second non-volatile memory 420 and restore a specific program to the decompression area 202c.

The 1100 executes the first difference restoration software 550 to generate a new program from the difference data in the first difference data storage area 430a and a specific program in the decompression area 202c, and stores the new program in the restoration area 202b. Further, it is a process of writing the new program of the restoration area 202b to the first non-volatile memory 410.

With the above, the old program can be updated to the new program.

FIG. 10B is a decompression command used by the decompression software 540.

Before explaining the decompression software, the outline of the compression software will be explained first. In the compression process, the compression software searches and finds out whether the same sub-instruction sequence as the sub-instruction sequence in the program exists in other parts of the program, and replaces the sub-instruction sequence with a short code. If there are many identical subinstruction sequences, they can be replaced with many short codes, so that they can be compressed more. Therefore, when the compression software searches the program and cannot find the same sub-instruction sequence, the compression software attaches the sub-instruction sequence DATA to the decompression additional command new of 1000A. On the other hand, when the same sub-instruction sequence is found, it is encoded by the decompression copy command copy of 1010A. A subinstruction sequence is represented by a pair of program address MA and size MS. In this way, the compressed data is composed of columns of the decompression addition command new and the decompression copy command copy.

Based on the above preparation, the operation of the decompression software 540 will be described.

FIG. 11 is a flowchart showing the operation of the decompression software 540.

The 1100 reads the compressed data of the second non-volatile memory 420.

1110 analyzes the read compression command.

1120 determines whether the command is the decompression addition command new, and if yes, executes 1125 to add the data DATA attached to the decompression addition command new to the decompression area 202c. On the other hand, if no, 1130 is executed.

The 1130 determines whether the command is a decompression copy command copy, and if yes, executes 1135 and decompresses the partial instruction sequence of size MS from the address MA in the decompression area 202c using the MA and MS attached to the decompression copy command copy. Add to area 202c. On the other hand, if no, 1140 is executed.

1140 determines whether all the difference data has been read from the second non-volatile memory 420, and if yes, the process ends. That is, the specific program can be restored to the decompression area 202c. On the other hand, if no, the process returns to 1100, the compressed data is read from the second non-volatile memory 420, and the process is repeatedly executed.

Next, the difference command used by the first difference restoration software 550 and the second difference restoration software 560 will be described with reference to FIG.

Before explaining the difference restoration software, the outline of the difference generation software will be explained first. In the difference generation process, the difference generation software searches for and finds out whether the partial instruction sequence of the new program 330 exists in the old program 331, and replaces the partial instruction sequence with a short code. If the new program and the old program 331 are similar, there will be many identical subinstruction sequences, and many can be replaced with short codes. Therefore, the difference generation software searches the old program 331 and when the same sub-instruction sequence is not found, attaches the sub-instruction sequence DATA to the 1200 difference addition command new. On the other hand, when the same sub-instruction sequence is found in the old program 331, it is encoded by the differential copy command copy of 1210. The sub-instruction sequence is represented by the pair of the address MA and the size MS of the old program. In this way, the difference data is composed of columns of the difference addition command new and the difference copy command copy.

Based on the above preparations, the operation of the first difference restoration software 550 will be described.

The 1300 reads a difference command from the difference data in the first difference data storage area 430a.

1310 analyzes the difference command, determines in 1320 whether the difference command is the difference addition command new, executes 1325 if yes, and executes 1330 if no.

1325 writes the partial instruction sequence DATA attached to the difference addition command new to the restoration area 202b.

The 1330 determines if the diff command is a diff copy command copy and executes the 1335 if yes, while executing the 1340 if no.

The 1335 additionally writes a partial instruction sequence of size MS from the address MA of the old program to the restore area 202b using the MA and MS attached to the differential copy command copy.

The 1340 determines whether all the difference data has been read from the first difference data storage area 430a, and if yes, executes 1350. On the other hand, if no, the process returns to 1300 and the process is repeated.

The 1350 writes the new program generated in the restoration area 202b to the first non-volatile memory 410.

With the above, the new program that has been differentially restored can be stored in the first non-volatile memory 410.

FIG. 14 is a flowchart of the diagnostic software 530.

As a premise, it is assumed that the sum value of the new program itself is 4 bytes at the specified address of the new program. Diagnosis is performed using this sum value.

The 1400 reads the sum value existing in the new program of the first non-volatile memory 410 and sets it in the variable SUM.

In 1410, the value obtained by adding the data in the area from the start address MA of the first non-volatile memory 410 to the size MS (new program of the first non-volatile memory 410) in 4-byte units is set in the variable S.

The 1420 determines that the variable SUM and the variable S match, and if yes, executes 1425, while if no, executes 1430.

Since the diagnosis result of 1425 is normal, the program update ends normally.

Since the diagnosis result of 1430 is abnormal, first, the decompression software 540 is executed to generate a specific program in the decompression area 202c for the purpose of restoring the old program.

1440 starts the second difference restoration software 560 to restore the old program from the previous difference data in the second difference data storage area 430b and the specific program in the decompression area 202c.

Here, regarding the relationship between the first difference data storage area 430a and the second difference data storage area 430b, the latest difference data storage area is always called the first difference data storage area, and the area where the previous difference data is stored is called the first difference data storage area. It is called the second difference data storage area. Also, the program generated from the previous difference data and the specific program is clearly an old program.

Since the processing contents of the decompression software 540 have already been described in detail in the flowchart of FIG. 11, they will be omitted.

Finally, the flowchart of the second difference restoration software 560 will be described with reference to FIG.

The 1500 reads a difference command from the difference data in the second difference data storage area 430b.

1510 analyzes the difference command, determines whether the difference command is the difference addition command new at 1520, and executes 1525 if yes, while executing 1530 if no.

The 1525 writes the partial instruction sequence DATA attached to the difference addition command new to the restore area 202b.

The 1530 determines if the diff command is a diff copy command copy, and if yes it executes 1535, while if no it executes 1540.

The 1535 additionally writes a partial instruction sequence of size MS from the address MA of a specific program in the decompression area 202c to the restoration area 202b by using the MA and MS attached to the differential copy command copy.

The 1540 determines whether all the difference data has been read from the second difference data storage area 430b, and if yes, executes 1550. On the other hand, if no, the process returns to 1500 and the process is repeated.

The 1550 writes the old program generated in the restoration area 202b to the first non-volatile memory 410.

With the above, the old program that has been differentially restored can be stored in the first non-volatile memory 410.

In this embodiment, a specific program is compressed and the compressed data is stored in the second non-volatile memory 420. However, as a matter of course, if the capacity of the non-volatile memory 203 or the external FLASH 203b is large, the specific program itself may be stored in the second non-volatile memory 420 instead of in the form of compressed data. If this form is possible, the repro software 400 of FIG. 5 may be replaced with transfer software that transfers a specific program of the second non-volatile memory 420 to the decompression area 202c instead of the decompression software 540. As a result, the difference restoration software 520 executes the transfer software, and then executes the first difference restoration software 550. Similarly, the diagnostic software 530 can be realized by executing the transfer software and then executing the second difference restoration software 560.

100 ... In-vehicle writing device (gateway)
101 ... Microcomputer (arithmetic unit)
102 ... SRAM (volatile memory)
103 ... FLASH memory (nonvolatile memory)
104 ... Various ICs
105 ... Communication device (CAN protocol)
106 ... Communication device (protocol of network outside the vehicle)
200 ... In-vehicle control device (ECU)
201 ... Microcomputer (arithmetic unit)
202 ... SRAM (volatile memory)
203 ... FLASH memory (nonvolatile memory)
203a ... FLASH memory with built-in microcomputer 203b ... External FLASH memory 204 ... Various ICs
205 ... Communication device (CAN protocol)
202a ... Reception area 202b ... Restoration area 202c ... Decompression area 300 ... Specific program 310 ... Compression software 320 ... Compression data of specific program 330 ... New program (new execution program)
331 ... Old program (execution program)
340 ... Difference generation software 350 ... Difference data between a specific program and a new program 360 ... Decompression software 370 ... Difference restoration software 400 ... Repro software 410 ... First non-volatile memory (executable program storage area)
420 ... Second non-volatile memory (compressed data storage area for a specific program)
430 ... Difference data storage area 430a ... First difference data storage area (latest difference data storage area)
430b ... Second difference data storage area (previous difference data storage area)
500 ... Communication software 510 ... Difference data reception software 520 ... Difference restoration software 530 ... Diagnostic software 540 ... Decompression software 550 ... First difference restoration software 560 ... Second difference restoration software 600 ... Difference data transmission start Communication command 610 ... Difference data storage Area designation communication command 620 ... Difference data communication command 630 ... Difference data transmission end communication command 640 ... Restoration execution communication command 650 ... Diagnosis execution communication command 1000A ... Decompression addition command 1010A ... Decompression copy command 1200 ... Difference addition command 1210 ... Difference copy command

Claims (3)

A new execution program is provided from a rewritable execution program and a non-volatile memory in which a specific program is arranged, new difference data between the execution program and the specific program, and the specific program in the non-volatile memory. The execution program is updated by restoring and writing to the non-volatile memory.
The non-volatile memory includes a first non-volatile memory for storing the execution program and a second non-volatile memory for storing the specific program and the difference data.
The second non-volatile memory includes a first difference data storage area for storing the new difference data and a second difference data storage area for storing the previous difference data.
When the update to the new execution program fails, the previous execution program is restored from the previous difference data and the specific program stored in the second difference data storage area, and the first execution program is restored. An in-vehicle control device characterized by writing to a non-volatile memory. It said first non-volatile memory is a built-in microcomputer, the second non-volatile memory, the onboard control device according to claim 1, characterized in that the external of said microcomputer. In the second non-volatile memory, the specific program is arranged in the form of compressed data, the compressed data is decompressed to generate the specific program, and then a new execution program is restored to obtain the non-volatile memory. The vehicle-mounted control device according to claim 1 or 2, wherein the data is written to.

Images