JP7087334B2 - Electronic control device - Google Patents

Description

The present invention relates to an electronic control device.

Conventionally, an electronic control device has been provided with a configuration in which a program or data transmitted / received to / from an external device or in a vehicle network is written in a memory and stored. The program or data stored in the memory may be rewritten for various reasons such as version update or bug fix. For example, Patent Document 1 discloses a method of rewriting a program or data by using difference information indicating a difference between old information stored in a memory and new information written in the memory.

Japanese Unexamined Patent Publication No. 2014-182571

Here, even if a physical failure such as a power disconnection occurs, it is necessary to reliably start the control program, especially when rewriting the control program wirelessly in an unmanned environment, so old information and new information are stored in the memory. It is ideal to have two sides. However, in a configuration having two sides of old information and new information, the required memory capacity increases, so that there is a concern about cost increase. In addition, if a defect in the new information or a defect in the affinity with the existing program or data is detected after the rewriting from the old information to the new information is completed, it is necessary to write back from the new information to the old information. However, for example, in an external device, it is necessary to sequentially distribute information indicating the difference from the new information managed for each vehicle to the old information, so there is a concern that the management of the old information in the external device becomes complicated. To.

The present invention has been made in view of the above circumstances, and an object thereof is to suppress an increase in cost and to manage old information even when it is necessary to write back from new information to old information. The purpose of the present invention is to provide an electronic control device that can appropriately write back new information to old information without becoming complicated.

According to the first aspect of the present invention, the memory (1a) stores a program or data transmitted / received to / from the external device (9 to 11) or in the vehicle network (7, 8). The first difference information acquisition unit (12a) acquires the first difference information indicating the difference from the old information to the new information regarding the program or data from the external device or the vehicle network. The old information saving unit (12b) connects the old information stored in the memory to the own device via one or more memories (1b) of the own device and the vehicle network separately from the memory. It is saved in at least one of the memory (2a, 3a, 4a) of another device or the memory of the external device. The new information generation unit (12c) generates new information from the old information saved in another memory and the first difference information. The new information writing unit (12d) writes new information to the memory in a state where the old information stored in the memory is saved in another memory. The second difference information acquisition unit (12e) acquires the second difference information indicating the difference from the new information about the program or data to the old information from the external device or the vehicle network. When the condition for writing back the new information being written to the memory to the old information is satisfied while the new information is being written to the memory, the new information saving unit (12h) stores the new information in the memory after the writing to the memory is completed. The stored new information is saved in one or more memories other than the memory concerned. The old information generation unit (12i) generates old information from the new information saved in another memory and the second difference information. The old information writing unit (12j) writes the old information to the memory in a state where the new information stored in the memory is saved in another memory.

When rewriting the old information stored in the memory to the new information, the old information is saved in another memory, and the new information is written in the memory with the old information saved in another memory. Cost increase can be suppressed by eliminating the need to have both old information and new information in the memory. Further, by saving the old information to another memory, even if it is necessary to write back from the new information to the old information, it is possible to write back using the saved old information. For example, with an external device, it is no longer necessary to sequentially distribute information indicating the difference from the new information managed for each vehicle to the old information, and the management of the old information is not complicated, and the new information is appropriately written back to the old information. be able to.

Functional block diagram showing an embodiment Diagram showing memory configuration Diagram showing the relationship between old information, new information, and first difference information Diagram showing the relationship between old information, new information, and second difference information The figure which shows the mode of rewriting of a program or data (the 1) The figure which shows the mode of rewriting of a program or data (the 2) Flowchart showing rewriting process from old information to new information (Part 1) Flowchart showing rewriting process from old information to new information (Part 2) Flowchart showing the process of saving old information Flow chart showing rewriting process from new information to old information while writing new information A flowchart showing the process of rewriting the new information to the old information after the writing of the new information is completed. Flowchart showing new information save processing

Hereinafter, an embodiment of the present invention will be described with reference to the drawings. As shown in FIG. 1, a plurality of electronic control devices 1 to 4, a relay device 5, and an in-vehicle communication device 6 are mounted in the vehicle. The electronic control devices 1 to 4 each function as a connection node in the vehicle and have a memory for storing a program or data. The electronic control device 1 has memories 1a and 1b, the electronic control device 2 has a memory 2a, the electronic control device 3 has a memory 3a, and the electronic control device 4 has a memory 4a. The number and capacity of the memories provided in the electronic control devices 1 to 4 are arbitrary.

The relay device 5 is connected to the electronic control devices 1 and 2 via the communication bus 7, and is connected to the electronic control devices 3 and 4 via the communication bus 8. The relay device 5 is, for example, a gateway ECU, and has a relay function of relaying a program or data to and from the electronic control devices 1 to 4.

The electronic control units 1 to 4 include, for example, an engine ECU that controls an engine, a brake ECU that controls a brake, a steering ECU that controls steering, a transmission ECU that controls an automatic transmission, and a navigation ECU that controls navigation. , ETC ECU that controls communication with the electronic toll collection system, door ECU that controls door lock / unlock, meter ECU that controls meter display, air conditioner ECU that controls air conditioner, and window open / close control. It is a window ECU or the like.

The communication buses 7 and 8 are, for example, a multimedia communication bus, a power train communication bus, a body communication bus, etc., and are CAN (Controller Area Network, registered trademark), LIN (Local Interconnect Network), CXPI ( It is composed of Clock Extension Peripheral Interface (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport, registered trademark) and the like. The communication buses 7 and 8 may have the same communication protocol, communication speed, or signal format, or may be different from each other. Further, the number of electronic control devices and the number of communication buses are not limited to the illustrated configuration.

When the relay device 5 is wiredly connected to the vehicle diagnostic tool 9 (corresponding to an external device) by attaching a wiring cable to the connector of the vehicle body, a program or data is transmitted to and from the vehicle diagnostic tool 9. Send and receive. The vehicle diagnosis tool 9 is a tool operated by an operator to perform vehicle diagnosis.

Further, the relay device 5 transmits / receives a program or data to / from the in-vehicle communication device 6. When the in-vehicle communication device 6 is wirelessly connected to the cloud 10 (corresponding to an external device) via a wide area communication network, the in-vehicle communication device 6 transmits / receives a program or data to / from the cloud 10. The cloud 10 is, for example, a center terminal, a server, or the like. When the in-vehicle communication device 6 is wirelessly connected to the vehicle connection terminal 11 (corresponding to an external device) via a short-range communication network, the in-vehicle communication device 6 transmits / receives a program or data to / from the vehicle connection terminal 11. The vehicle connection terminal 11 is, for example, a smartphone or tablet terminal that can be carried by the user. Hereinafter, the vehicle diagnostic tool 9, the cloud 10, and the vehicle connection terminal 11 are collectively referred to as external devices 9 to 11.

Next, the configurations of the electronic control devices 1 to 4 will be described. Since the electronic control devices 1 to 4 have basically the same configuration, the electronic control device 1 will be described as a representative. The electronic control device 1 has a microcomputer (hereinafter referred to as a microcomputer) 12, has the above-mentioned memory 1a inside the microcomputer 12, and has the memory 1b outside the microcomputer 12. The microcomputer 12 has a CPU, RAM, ROM, I / O port, etc., and has the first difference information acquisition unit 12a, the old information storage unit 12b, and the new information generation unit as internal functions realized by software or the like. 12c, new information writing unit 12d, second difference information acquisition unit 12e, write-back request acquisition unit 12f, implementation state determination unit 12g, new information saving unit 12h, old information generation unit 12i, and old information. It has a writing unit 12j.

As shown in FIG. 2, the memory 1a of the electronic control device 1 stores a storage-only area 13a for storing a program or data in block units, a flag storage area 13b for storing a rewrite completion flag, and a first difference information. It has a storage area 13c, a storage area 13d for storing the second difference information, a storage area 13e for storing the difference rewriting program, and a storage area 13f for storing the boot program.

When the drive power is turned on, the microcomputer 12 starts the boot program and refers to the rewrite completion flag. The microcomputer 12 determines whether or not the rewriting of the program or data is normally completed by the rewriting completion flag. When the microcomputer 12 determines that the rewrite completion flag is normal and the rewriting is normally completed, the microcomputer 12 activates a control program for executing vehicle control among the programs stored in the storage-only area 13a. On the other hand, when the microcomputer 12 determines that the rewriting completion flag is not normal and the rewriting is not normally completed, the microcomputer 12 activates the differential rewriting program stored in the storage area 13e.

As shown in FIG. 3, the first difference information is information indicating a difference from old information to new information regarding a program or data. As shown in FIG. 4, the second difference information is information showing the difference from the new information to the old information regarding the program or data. The first difference information and the second difference information are information generated by the external devices 9 to 11 managing the version of the program or data transmitted from the external devices 9 to 11 to the electronic control device 1, and are external. This is information transmitted from the devices 9 to 11 to the electronic control device 1.

As shown in FIG. 5, if the current version is version 1, the information indicating the difference when updating from version 1 to the next-generation version 2 is the first difference information. Further, the information indicating the difference when downgrading from version 2 to the previous generation version 1 after updating from version 1 to the next generation version 2 is the second difference information. That is, if the version is two generations, the first difference information is one and the second difference information is also one. On the other hand, as shown in FIG. 6, if the current version is version 2, the information indicating the difference when updating from version 2 to the next-generation version 3 is the first difference information. Further, the information indicating the difference when downgrading from version 3 to the previous generation version 2 after updating from version 2 to the next generation version 3 is the second difference information, and further, the information indicating the difference from version 3 to version 2 is higher than that of version 2. The information indicating the difference when downgrading to version 1 of the previous generation is also the second difference information. That is, if the version is the third generation, the first difference information is one, but the second difference information is two. As described above, the first difference information is one regardless of the number of generations, but the second difference information can be plural depending on the number of generations.

The first difference information acquisition unit 12a acquires the first difference information by receiving the first difference information transmitted from the external devices 9 to 11 to the electronic control device 1. The old information saving unit 12b saves the old information stored in the memory 1a to a preset memory different from the memory 1a in block units. The memory of the save destination of the old information stored in the memory 1a may be the memory 1b in the same connection node, the memories 2a, 3a, 4a in another connection node, or the memory of the external devices 9 to 11. At best, one may be set in advance, or a plurality of may be set in advance. Further, the old information saving unit 12b saves the old information of the saving target to one saving destination if the old information of the saving target does not require redundancy, while the old information of the saving target needs redundancy. If so, the old information of the evacuation target is evacuated to a plurality of evacuation destinations.

The new information generation unit 12c generates new information from the old information saved in another memory and the first difference information. The new information writing unit 12d writes the new information to the memory 1a in a state where the old information stored in the memory 1a is saved in another memory, and when the writing of the new information is completed, the new information writing unit 12d is saved in the save destination memory. Delete the old information.

The second difference information acquisition unit 12e acquires the second difference information by receiving the second difference information transmitted from the external devices 9 to 11 to the electronic control device 1. The write-back request acquisition unit 12f acquires the write-back request when the write-back request transmitted from the external devices 9 to 11 is received by the electronic control device 1. The implementation state determination unit 12g determines the implementation status of vehicle control based on the new information being written or written in the memory 1a.

The new information saving unit 12h determines whether or not the condition for writing back the new information being written or written to the memory 1a to the old information is satisfied when the new information is being written to the memory 1a or the writing is completed. When the write-back request transmitted from the external devices 9 to 11 is received by the electronic control device 1 and the write-back request is acquired, the new information saving unit 12h is writing or writing to the memory 1a. When it is determined that the execution state of the vehicle control based on the information is not normal, it is determined that the condition for writing back is satisfied, and the new information stored in the memory 1a is transferred to a preset memory different from the memory 1a. Evacuate. The memory to save the new information stored in the memory 1a may be the memory 1b in the same connection node, the memories 2a, 3a, 4a in another connection node, or the memory of the external devices 9 to 11. At best, one may be set in advance, or a plurality of may be set in advance. Further, if the new information to be saved does not require redundancy, the new information saving unit 12h saves the new information to be saved to one save destination, while the new information to be saved needs redundancy. If so, the new information to be evacuated is evacuated to a plurality of evacuation destinations.

The old information generation unit 12i generates old information from the new information saved in another memory and the second difference information. The old information writing unit 12j writes the old information to the memory 1a in a state where the new information stored in the memory 1a is saved in another memory, and when the writing of the old information is completed, the old information writing unit 12j is saved in the save destination memory. Erase the new information that was there.

Next, the operation of the above configuration will be described with reference to FIGS. 7 to 12. Here, the rewriting process from the old information to the new information and the rewriting process from the new information to the old information will be described.

(1) Rewriting process from old information to new information In the electronic control device 1, the microcomputer 12 is waiting for the power supply to the electronic control device 1 to be turned on, and the power supply to the electronic control device 1 is turned on. When it is determined (S1), the rewrite completion flag is determined (S2). When the microcomputer 12 determines that the rewrite completion flag is normal and determines that the rewrite is normally completed (S2: YES), the microcomputer 12 activates the control program among the programs stored in the storage-only area 13a (S2: YES). S3). On the other hand, when the microcomputer 2 determines that the rewrite completion flag is not normal and determines that the rewrite is not completed normally (S2: NO), the microcomputer 2 starts the rewriting process from the old information to the new information and stores the storage area 13e. The stored difference rewriting program is started (S4).

When any one of the control program and the rewriting program is started, the microcomputer 12 determines whether or not the authentication request at the time of rewriting from the external devices 9 to 11 has been acquired (S5). When the microcomputer 12 determines that the rewriting authentication request has been acquired (S5: YES), the microcomputer 12 determines whether or not the rewriting authentication has been established (S6). When the microcomputer 12 determines that the destination of the authentication request at the time of rewriting is a legitimate external device 9 to 11 and determines that the rewrite authentication is established (S6: YES), the program started earlier than this is determined. It is determined whether it is a control program or a difference rewriting program (S7). When the microcomputer 12 determines that the control program has been started (S7: YES), the microcomputer 12 shifts to the saving process of the old information (S8). On the other hand, when it is determined that the difference rewriting program has been started (S7: NO), the microcomputer 12 does not shift to the saving process of the old information.

When the microcomputer 12 starts the saving process of the old information, it determines whether or not the old information to be saved requires redundancy (S21). If the program or data to be saved is, for example, information related to the security of key information, the microcomputer 12 determines that redundancy is required (S21: YES), and saves the old information to be saved to a plurality of save destinations. (S22). When the microcomputer 12 determines whether or not the evacuation to all the plurality of evacuation destinations has been completed (S23) and determines that the evacuation to all the plurality of evacuation destinations has been completed (S23: YES), the evacuation target It is determined whether or not the evacuation of all the old information has been completed (S24). On the other hand, the microcomputer 12 determines that redundancy is not required unless the program or data to be saved is information related to the security of key information (S21: NO), and saves the old information to be saved. It is evacuated first (S25), and it is determined whether or not all the old information to be evacuated has been evacuated (S24).

When the microcomputer 12 determines that the evacuation of all the old information to be evacuated has not been completed (S24: NO), the microcomputer 12 returns to the above-mentioned step S21 and repeats steps S21 to S25. When the microcomputer 12 determines that the evacuation of all the old information to be saved has been completed (S24: YES), the microcomputer 12 ends the evacuation process of the old information.

When the microcomputer 12 returns to the process of rewriting the old information to the new information, the microcomputer 12 erases the old information remaining in the memory 1a (S9), and determines whether or not the first difference information has been acquired from the external devices 9 to 11. (S10). When the microcomputer 12 determines that the first difference information has been acquired by receiving the first difference information transmitted from the external devices 9 to 11 to the electronic control device 1 (S10: YES), the acquired first difference information Information is written to the memory 1a (S11).

The microcomputer 12 determines whether or not the second difference information has been acquired from the external devices 9 to 11 (S12). When the microcomputer 12 determines that the second difference information has been acquired by receiving the second difference information transmitted from the external devices 9 to 11 to the electronic control device 1 (S12: YES), the acquired second difference information Information is written to the memory 1a (S13).

The microcomputer 12 reads the old information from the save destination of the old information, and generates new information from the read old information and the first difference information written in the memory 1a (S14). When the microcomputer 12 generates new information, the generated new information is written to the memory 1a in block units (S15), and it is determined whether or not all the new information to be written has been written (S16). When the microcomputer 12 determines that the writing of all the new information to be written has not been completed (S16: NO), the microcomputer 12 returns to the above-mentioned step S10 and repeats steps S10 to S16. That is, the microcomputer 12 writes the new information to be written while acquiring the first difference information and the second difference information from the external devices 9 to 11. When the microcomputer 12 determines that the writing of all the new information to be written has been completed (S16: YES), the microcomputer 12 transmits an erasure request to the save destination of the old information (S17), and saves the old information to the save destination. Erase and end the rewriting process from old information to new information.

In this way, when the microcomputer 12 rewrites the old information stored in the internal memory 1a into new information, the microcomputer 12 replaces the old information with the memory of the connection node in the vehicle or the memory of the external devices 9 to 11 different from the memory 1a. Evacuate to. Then, the microcomputer 12 generates new information from the saved old information and the first difference information acquired from the external devices 9 to 11, and writes the generated new information in the memory 1a.

The above is an example of a configuration in which new information to be written is written while acquiring the first difference information and the second difference information from the external devices 9 to 11, but the first difference information and the first difference information from the external devices 9 to 11 are described. 2 The new information to be written may be written after the acquisition of the difference information is completed. Further, although the configuration for acquiring the second difference information before generating the new information is illustrated, the second difference information may be acquired after it is determined that the writing of all the new information to be written is completed. Further, the second difference information may be acquired in the rewriting process from the old information to the new information, which will be described later.

(2) Rewriting process from new information to old information The microcomputer 12 starts the rewriting process from old information to new information when the power supply to the electronic control device 1 is turned on, but the old information is being written while the new information is being written. There are cases where the rewriting process from the old information to the new information is started, and there are cases where the rewriting process from the old information to the new information is started after the writing of the new information is completed. Hereinafter, the process of rewriting the new information to the old information during the writing of the new information and the process of rewriting the new information to the old information after the writing of the new information is completed will be described.

(2-1) Rewriting process from new information to old information while writing new information The microcomputer 12 is writing new information when the power supply to the electronic control device 1 is turned on (S31). It is determined whether or not the condition for writing back the new information of the above to the old information is satisfied (S32). When the microcomputer 12 determines that the write-back condition is satisfied while acquiring the write-back request from the external devices 9 to 11 or writing to the memory 1a (S32: YES), the microcomputer 12 waits for the end of writing the new information (S32: YES). S33), when it is determined that the writing of the new information is completed (S33: YES), the process of rewriting the new information to the old information is started, and the process shifts to the process of saving the new information (S34).

When the new information save process is started, the microcomputer 12 determines whether or not the new information to be saved requires redundancy (S51). If the program or data to be saved is information related to the security of key information, for example, the microcomputer 12 determines that redundancy is required (S51: YES), and saves the new information to be saved to a plurality of save destinations. (S52). When the microcomputer 12 determines whether or not the evacuation to all the plurality of evacuation destinations has been completed (S53) and determines that the evacuation to all the plurality of evacuation destinations has been completed (S53: YES), the evacuation target It is determined whether or not the evacuation of all new information has been completed (S54). On the other hand, the microcomputer 12 determines that redundancy is not required unless the program or data to be evacuated is, for example, information related to the security of key information (S51: NO), and saves one new information to be evacuated. It is evacuated first (S55), and it is determined whether or not all the new information to be evacuated has been evacuated (S54).

When the microcomputer 12 determines that the evacuation of all new information to be evacuated has not been completed (S54: NO), the microcomputer 12 returns to the above-mentioned step S51 and repeats steps S51 to S55. When the microcomputer 12 determines that the evacuation of all the new information to be saved has been completed (S54: YES), the microcomputer 12 ends the evacuation process of the new information.

When the microcomputer 12 returns to the process of rewriting the new information to the old information, the new information remaining in the memory 1a is erased (S35), the new information is read from the new information save destination, and the read new information and the memory are read. Old information is generated from the second difference information written in 1a (S36). When the old information is generated, the microcomputer 12 writes the generated old information to the memory 1a in block units (S37), and determines whether or not all the old information to be written has been written (S38). When the microcomputer 12 determines that the writing of all the old information to be written has not been completed (S38: NO), the microcomputer 12 returns to the above-mentioned step S36 and repeats steps S36 to S38. When the microcomputer 12 determines that the writing of all the old information to be written has been completed (S38: YES), the microcomputer 12 transmits an erasure request to the new information save destination (S39), and saves the new information to the save destination. Erase and end the rewriting process from new information to old information.

(2-2) Rewriting process from new information to old information after the writing of new information is completed The microcomputer 12 writes in the state where the power supply to the electronic control device 1 is turned on after the writing of the new information is completed (S41). It is determined whether or not the condition for writing back the new information after the end to the old information is satisfied (S42). When the microcomputer 12 determines that the condition for writing back is satisfied (S42: YES), the microcomputer 12 starts the rewriting process from the new information to the old information, and shifts to the saving process of the new information (S43). After that, the microcomputer 12 starts the new information saving process, and when the new information saving process is completed, the microcomputer 12 performs steps S44 to S48 in the same manner as the above steps S35 to S39.

In this way, when the microcomputer 12 rewrites the new information stored in the internal memory 1a to the old information, the microcomputer 12 rewrites the new information in the memory of the connection node in the vehicle or the memory of the external devices 9 to 11 different from the memory 1a. Evacuate to. Then, the microcomputer 12 generates old information from the saved new information and the second difference information acquired from the external devices 9 to 11, and writes the generated old information in the memory 1a.

Although the case of rewriting the program or data stored in the memory 1a inside the microcomputer 12 has been described above, the same applies to the case of rewriting the program or data stored in the memory 1b outside the microcomputer 12. .. That is, the microcomputer 12 rewrites the program or data stored in the external memory 1b according to the same procedure as the rewriting of the program or data stored in the internal memory 1a.

As described above, according to the present embodiment, the following effects can be obtained.
In the electronic control device 1, when the old information stored in the memory 1a is rewritten to the new information, the old information is saved in a memory different from the memory 1a, and the old information is saved in another memory. Information is written to the memory 1a. By eliminating the need to have the old information and the new information on the memory 1a on two sides, it is possible to suppress the cost increase. Further, by saving the old information to another memory, even if it is necessary to write back from the new information to the old information, it is possible to write back using the saved old information. With the external devices 9 to 11, it is no longer necessary to sequentially distribute information indicating the difference from the new information managed for each vehicle to the old information, and the management of the old information with the external devices 9 to 11 is not complicated. You can properly write back from information to old information.

Further, when the writing of the new information to the memory 1a is completed in the electronic control device 1, the old information saved in another memory is erased. The asset of another memory used as the save destination of the old information can be effectively allocated to other processing purposes after the writing of the new information is completed.

Further, in the electronic control device 1, when the condition for writing back the new information to the memory 1a is satisfied, the new information is saved in a memory different from the memory 1a after the writing of the new information to the memory 1a is completed. The old information is written to the memory 1a with the new information saved in another memory. Further, when the condition for writing back the new information to the memory 1a is satisfied in the electronic control device 1, also in this case, the new information is saved in a memory different from the memory 1a and the new information is stored in another memory. The old information is written to the memory 1a in the saved state. Even if vehicle control cannot be performed with the new information due to inadequate new information or incompatibility with existing programs or data, vehicle control can be performed with the old information by writing back from the new information to the old information. It is possible to avoid the occurrence of a situation in which vehicle control becomes impossible.

Further, in the electronic control device 1, it was set as a condition for writing back that the write-back request was acquired from the external devices 9 to 11. For example, the user can manually write back the new information to the old information by operating the vehicle diagnostic tool 9 or the vehicle connection terminal 11.

Further, in the electronic control device 1, it is set as a condition to write back that it is determined that the execution state of the vehicle control based on the new information is not normal. By determining that the vehicle control implementation status based on the new information is not normal, for example, the new information is automatically rewritten to the old information without the user having to operate the vehicle diagnostic tool 9 or the vehicle connection terminal 11. Can be done.

Further, in the electronic control device 1, when the writing of the old information to the memory 1a is completed, the new information saved in another memory is erased. The asset of another memory used as the save destination of the new information can be effectively allocated to other processing purposes after the writing of the old information is completed.

Further, in the electronic control device 1, the second difference information for each of a plurality of generations is acquired from the external devices 9 to 11. It is possible to write back the old information of any generation according to the request of the user or the vehicle system, and it is possible to realize the vehicle control flexibly corresponding to various use cases.

The present disclosure has been described in accordance with the examples, but it is understood that the present disclosure is not limited to the examples and structures. The present disclosure also includes various variations and variations within a uniform range. In addition, various combinations and forms, as well as other combinations and forms containing only one element, more or less, are also within the scope of the present disclosure.

Either the electronic control device 1 or the external devices 9 to 11 may determine which generation version to downgrade to when writing back from the new information to the old information, that is, the receiving side of the second difference information. And either of the transmitting side may decide.

Although the configuration for targeting the program or data transmitted / received between the external devices 9 to 11 is illustrated, the program or data transmitted / received within the vehicle network may be targeted. That is, it may be applied when rewriting a program or data handled only in the vehicle. Further, the first difference request, the second difference information, and the write-back request may be acquired from the vehicle network.

In the drawings, 1 to 4 are electronic control devices, 1a, 1b, 2a, 3a, 4a are memories, 7 and 8 are communication buses (vehicle network), 9 are vehicle diagnostic tools (external devices), and 10 are clouds (external devices). ), 11 is a vehicle connection terminal (external device), 12a is a first difference information acquisition unit, 12b is an old information storage unit, 12c is a new information generation unit, 12d is a new information writing unit, and 12e is a second difference information acquisition unit. , 12f is a write-back request acquisition unit, 12g is an implementation state determination unit, 12h is a new information storage unit, 12i is an old information generation unit, and 12j is an old information writing unit.

Claims (7)

A memory (1a) that stores programs or data transmitted / received between external devices (9 to 11) and in the vehicle network (7, 8).
The first difference information acquisition unit (12a) that acquires the first difference information indicating the difference from the old information to the new information regarding the program or data from the external device or the vehicle network.
The old information stored in the memory is different from the memory and is one or more memories (1b) of the own device, and one or more of another device connected to the own device via the vehicle network. (2a, 3a, 4a), or the old information saving unit (12b) that saves to at least one of the memories of the external device.
A new information generation unit (12c) that generates new information from the old information saved in the other memory and the first difference information, and
A new information writing unit (12d) that writes new information to the memory in a state where the old information stored in the memory is saved in the other memory.
The second difference information acquisition unit (12e) that acquires the second difference information indicating the difference from the new information about the program or data to the old information from the external device or the vehicle network.
If the condition for writing back the new information being written to the memory to the old information is satisfied while the new information is being written to the memory, the new information stored in the memory is stored after the writing of the new information to the memory is completed. With a new information saving unit (12h) that saves the information in one or more memories other than the memory.
The old information generation unit (12i) that generates old information from the new information saved in the other memory and the second difference information, and
An electronic control device including an old information writing unit (12j) for writing old information to the memory in a state where the new information stored in the memory is saved in the other memory . The electronic control device according to claim 1, wherein the new information writing unit erases old information saved in the other memory after the writing of the new information to the memory is completed. When the condition for writing back the new information written in the memory to the old information is satisfied even after the writing of the new information to the memory is completed, the new information saving unit transfers the new information stored in the memory. The electronic control device according to claim 1 or 2, wherein the electronic control device is saved in one or more memories other than the memory . A write-back request acquisition unit (12f) for acquiring a write-back request from the external device or the vehicle network is provided.
The new information saving unit according to any one of claims 1 to 3 , wherein the acquisition of the write-back request is a condition for writing back the new information being written or written to the memory to the old information. Electronic control device. The memory is provided with an execution state determination unit (12 g) for determining an execution state of vehicle control based on new information being written or written.
Claims 1 to 3 that the new information saving unit determines that the execution state of the vehicle control by the new information is not normal as a condition for writing back the new information being written or written to the memory to the old information. The electronic control device according to any one of the above. The electronic control device according to any one of claims 1 to 5, wherein the old information writing unit erases new information saved in the other memory after the writing of the old information to the memory is completed . The electronic control device according to any one of claims 1 to 5 , wherein the second difference information acquisition unit acquires second difference information for each of a plurality of generations from the external device or the vehicle network .

Images