JP7091630B2 - Electronic control device - Google Patents

Description

The present invention relates to an electronic control device.

Conventionally, in an electronic control device connected to a vehicle network, a configuration has been provided in which a program or data transmitted / received to / from an external device or in the vehicle network is written and stored in a memory (see, for example, Patent Document 1). ).

Japanese Unexamined Patent Publication No. 2017-11374

In this type of configuration, rewriting of programs or data stored in memory may be performed in an unmanned environment. In that case, the electronic control device is started by remote control to start rewriting, but it is necessary to end the rewriting in a state where the supply voltage value to the electronic control device exceeds the rewrite guaranteed voltage value. That is, if the supply voltage value is rewritten in a state where the voltage value is lower than the guaranteed rewrite voltage value, the written program or data may be garbled or missing, and the written program or data may not be guaranteed. There is. Under such circumstances, a mechanism for avoiding the occurrence of a situation in which a program or data is rewritten while the supply voltage value is lower than the rewrite guaranteed voltage value is desired.

The present invention has been made in view of the above circumstances, and an object of the present invention is to avoid a situation in which a program or data is rewritten while the supply voltage value is lower than the rewrite guaranteed voltage value. It is to provide an electronic control device capable of.

According to the invention described in claim 1, the memory (1a, 2a, 2b, 3a, 3b, 4a, 5a) transmits / receives to / from the external device (10 to 12) or in the vehicle network (8, 9). Accumulate the program or data to be used. The rewriting unit (17c) rewrites the program or data stored in the memory. The transition status acquisition unit (17d) acquires the transition status of the supply voltage value to the own device being rewritten. The progress status acquisition unit (17e) acquires the progress status of rewriting. The determination unit (17h) uses the transition status of the supply voltage value during rewriting and the progress status of rewriting, and determines whether or not the supply voltage value to the own device becomes less than the rewriting guaranteed voltage value before the completion of writing. Whether or not the rewriting can be continuously performed is continuously determined during the rewriting .

Using the transition status of the supply voltage value to the own device during rewriting and the progress status of rewriting , rewriting is continued depending on whether the supply voltage value to the own device is less than the rewrite guaranteed voltage value before the writing is completed. Whether or not it is feasible is continuously determined during rewriting . It is possible to avoid the situation where the program or data is rewritten when the supply voltage value is lower than the rewrite guaranteed voltage value, and the program when the supply voltage value exceeds the rewrite guaranteed voltage value. Alternatively, the rewriting of data can be guaranteed. As a result, the written program or data can be appropriately guaranteed by rewriting the program or data in a state where the supply voltage value exceeds the rewrite guaranteed voltage value.

The figure which shows the electronic control apparatus which shows one Embodiment and the peripheral structure. Functional block diagram Diagram showing memory configuration Figure showing transition of supply voltage value and remaining amount of rewriting (No. 1) Figure showing transition of supply voltage value and remaining amount of rewriting (Part 2) Sequence diagram showing wakeup processing Sequence diagram showing rewriting process Flowchart showing rewriting process (1) Flowchart showing rewriting process (Part 2)

Hereinafter, an embodiment of the present invention will be described with reference to the drawings. As shown in FIG. 1, a plurality of electronic control devices 1 to 5, an in-vehicle communication device 6, and a power supply control device 7 are mounted in the vehicle. The electronic control devices 1 to 5 each function as a node in the vehicle and have a memory for storing a program or data. The electronic control device 1 has a memory 1a, the electronic control device 2 has the memories 2a and 2b, the electronic control device 3 has the memories 3a and 3b, and the electronic control device 4 has the memory 4a and is electronically controlled. The device 5 has a memory 5a. The number and capacity of the memories provided in the electronic control devices 1 to 5 are arbitrary.

The electronic control device 1 is connected to the electronic control devices 2 and 3 and the power supply control device 7 via the communication bus 8 (corresponding to the vehicle network), and is an electronic control device via the communication bus 9 (corresponding to the vehicle network). It is connected to 4 and 5. The electronic control device 1 is, for example, a gateway ECU, and has a relay function of relaying a program or data between the electronic control devices 2 and 5. The electronic control device 1 functions as a distribution node that manages rewriting of the program or data stored in the memory of each node by distributing the program or data to each node in the vehicle.

The electronic control devices 2 to 5 function as a rewriting node that rewrites the program or data stored in the memory by receiving the program or data distributed from the electronic control device 1 that functions as the distribution node. The electronic control units 2 to 5 include, for example, an engine ECU that controls an engine, a brake ECU that controls a brake, a steering ECU that controls steering, a transmission ECU that controls an automatic transmission, and a navigation ECU that controls navigation. , ETC ECU that controls communication with the electronic toll collection system, door ECU that controls door lock / unlock, meter ECU that controls meter display, air conditioner ECU that controls air conditioner, and window open / close control. It is a window ECU or the like.

The communication buses 8 and 9 are, for example, a multimedia communication bus, a power train communication bus, a body communication bus, etc., and are CAN (Controller Area Network, registered trademark), LIN (Local Interconnect Network), CXPI ( It is composed of Clock Extension Peripheral Interface (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport, registered trademark) and the like. The communication buses 8 and 9 may have the same communication protocol, communication speed, and signal format, or may be different from each other. Further, the number of electronic control devices and the number of communication buses are not limited to the illustrated configuration.

When the electronic control device 1 is wiredly connected to the vehicle diagnostic tool 10 (corresponding to an external device) by attaching a wiring cable to the connector of the vehicle body, a program or data is provided between the electronic control device 1 and the vehicle diagnostic tool 10. To send and receive. The vehicle diagnosis tool 10 is a tool operated by an operator to perform vehicle diagnosis.

Further, the electronic control device 1 transmits / receives a program or data to / from the in-vehicle communication device 6. When the in-vehicle communication device 6 is wirelessly connected to the cloud 11 (corresponding to an external device) via a wide area communication network, the in-vehicle communication device 6 transmits / receives a program or data to / from the cloud 11. The cloud 11 is, for example, a center terminal, a server, or the like. When the in-vehicle communication device 6 is wirelessly connected to the vehicle connection terminal 12 (corresponding to an external device) via a short-range communication network, the in-vehicle communication device 6 transmits / receives a program or data to / from the vehicle connection terminal 12. The vehicle connection terminal 12 is, for example, a smartphone or tablet terminal that can be carried by the user. Hereinafter, the vehicle diagnostic tool 10, the cloud 11, and the vehicle connection terminal 12 are collectively referred to as external devices 10 to 12. The power supply control device 7 controls the supply of the power supply voltage from the battery mounted on the vehicle to each node.

Next, the configurations of the electronic control devices 1 to 5 will be described. Since the electronic control devices 2 to 5 which are the rewriting nodes have basically the same configuration, the electronic control device 2 will be described as a representative. That is, the relationship between the electronic control device 1 and the electronic control device 2 will be described as the relationship between the distribution node and the rewrite node, but the same applies to the relationship between the electronic control device 1 and the electronic control devices 3 to 5.

As shown in FIG. 2, the electronic control device 1 which is a distribution node has a wake-up control unit 13 and a microcomputer (hereinafter, referred to as a microcomputer) 14. The wake-up control unit 13 outputs a wake-up request or a sleep request to the microcomputer 14, and switches between the wake-up state and the sleep state of the microcomputer 14. The microcomputer 14 operates with low power consumption in the sleep state, and monitors the input of the wakeup request from the wakeup control unit 13. The microcomputer 14 has a CPU, RAM, ROM, I / O port, etc., and has internal functions realized by software, etc., such as a transmission / reception unit 14a, a distribution unit 14b, a battery voltage value acquisition unit 14c, and a supply voltage. It has a value acquisition unit 14d.

The transmission / reception unit 14a transmits / receives a program or data to / from the communication buses 8 and 9, thereby transmitting data related to the vehicle state and control history transmitted from the vehicle side to the external devices 10 to 12, and the external devices 10 to 10. The program or data related to vehicle control received from 12 to the vehicle side is received. The distribution unit 14b distributes the program or data to the electronic control devices 2 to 5 which are rewriting nodes via the communication buses 8 and 9.

The battery voltage value acquisition unit 14c transmits a battery voltage value request to the power supply control device 7, and receives and acquires the battery voltage value of the vehicle battery from the power supply control device 7. The supply voltage value acquisition unit 14d transmits a supply voltage value request to the electronic control devices 2 to 5, and receives and acquires the supply voltage value of the electronic control devices 2 to 5 from the electronic control devices 2 to 5.

The electronic control device 2 which is a rewrite node has a wake-up control unit 15, a supply voltage value monitoring unit 16, and a microcomputer 17. The wake-up control unit 15 outputs a wake-up request or a sleep request to the microcomputer 17, and switches between the wake-up state and the sleep state of the microcomputer 17. The supply voltage value monitoring unit 16 monitors the supply voltage value to the electronic control device 2. The microcomputer 17 operates with low power consumption in the sleep state, and monitors the input of the wakeup request from the wakeup control unit 15. The microcomputer 17 has a CPU, RAM, ROM, I / O port, etc., and has a transmission / reception unit 17a, a mode switching unit 17b, a rewriting unit 17c, and a transition status acquisition unit as internal functions realized by software or the like. It has a 17d, a progress status acquisition unit 17e, a writing completion timing calculation unit 17f, a threshold timing calculation unit 17g, a determination unit 17h, and a control execution unit 17i.

As shown in FIG. 3, the memory 2a of the electronic control device 2 has a control storage area 18a for storing a control program, control data, and a rewrite program, and a first storage-dedicated area 18b and a second storage area for storing the program or data. It has a dedicated area 18c and a storage area 18d for storing flag information. The memory 2a of the electronic control device 2 stores a program or data in a two-sided configuration. If the program or data is rewritten while the supply voltage value exceeds the rewrite guaranteed voltage value, the written program or data can be guaranteed, but the rewrite guaranteed voltage value is lowered. If the program or data is rewritten, the written program or data may be garbled or omitted, and the written program or data may not be guaranteed.

The transmission / reception unit 17a receives the program or data related to the vehicle state and control history transmitted from the vehicle side to the external devices 10 to 12 by transmitting / receiving the program or data to / from the communication bus 8, and the external device 10 to The program or data related to vehicle control received from 12 to the vehicle side is received. The mode switching unit 17b switches between the sleep mode and the wakeup mode.

The rewriting unit 17c rewrites the program or data stored in either the first storage-only area 18b or the second storage-only area 18c of the memory 2a. The transition status acquisition unit 17d acquires the transition status of the supply voltage value being rewritten. The progress status acquisition unit 17e acquires the progress status of rewriting. The writing completion timing calculation unit 17f calculates the writing completion timing from the progress of rewriting. The threshold timing calculation unit 17g calculates the threshold timing at which the supply voltage value is less than the rewrite guaranteed voltage value from the transition status of the supply voltage value during rewriting.

The determination unit 17h determines whether or not the rewriting can be continued by using the transition status of the supply voltage value during the rewriting and the progress status of the rewriting. That is, as shown in FIG. 4, the determination unit 17h determines that the rate of decrease in the remaining amount of rewriting is relatively fast with respect to the rate of decrease in the supply voltage value, and the write completion timing is before the threshold timing. It is determined that rewriting can be continued. That is, since the rewriting of the program or data is terminated in the state where the supply voltage value exceeds the rewriting guaranteed voltage value, the written program or data can be guaranteed.

On the other hand, as shown in FIG. 5, the determination unit 17h determines that the rate of decrease in the remaining amount of rewriting is relatively slow with respect to the rate of decrease in the supply voltage value, and the write completion timing is later than the threshold timing. It is determined that rewriting cannot be continued. That is, the program or data is not rewritten when the supply voltage value exceeds the rewrite guaranteed voltage value, and the program or data is rewritten when the supply voltage value is lower than the rewrite guaranteed voltage value. The written program or data may be garbled or missing, and the written program or data cannot be guaranteed.

The control executing unit 17i executes vehicle control using a program or data stored in either the first storage-only area 18b or the second storage-only area 18c of the memory 2a.

Next, the operation of the above configuration will be described with reference to FIGS. 6 to 9.
As shown in FIG. 6, when the electronic control device 1 which is a distribution node receives the wakeup request transmitted from the external devices 10 to 12, it shifts from the sleep state to the wakeup state and sends the wakeup request to the power supply control device. 7 is transmitted, and the battery voltage value request is transmitted to the power supply control device 7. When the power supply control device 7 receives the wake-up request transmitted from the electronic control device 1, it shifts from the sleep state to the wake-up state, and when it receives the battery voltage value request transmitted from the electronic control device 1, it is at that time. Check the battery voltage value of the vehicle battery, send a positive response to the electronic control device 1 if the battery voltage value is above the predetermined voltage value, and electronically control the negative response if the battery voltage value is not above the predetermined voltage value. Send to device 1.

When the electronic control device 1 receives the affirmative response from the power supply control device 7, it acquires the battery voltage value, transmits the affirmative response to the external devices 10 to 12, and waits for the reception of the program or data from the external devices 10 to 12. do. When the electronic control device 1 receives a program or data from the external devices 10 to 12, it identifies a delivery destination of the received program or data, sends an acknowledgment to the external devices 10 to 12, and programs or wakes up a wakeup request. Send to the data delivery destination. That is, when the electronic control device 1 specifies the electronic control device 2 as the delivery destination of the program or data, the electronic control device 1 transmits a wakeup request to the electronic control device 2.
Hereinafter, the rewriting process of the microcomputer 17 of the electronic control device 2 which is the rewriting node will be described.

The microcomputer 17 determines whether or not a wakeup request has been input from the wakeup control unit 15 in the sleep state (S1). When the microcomputer 17 determines that the wakeup request has been input from the wakeup control unit 15 due to the reception of the wakeup request from the electronic control device 1 (S1: YES), the microcomputer 17 shifts from the sleep state to the wakeup state (S1: YES). S2), the rewriting process is started, and it is determined whether or not the input wakeup request is a wakeup request addressed to the own node (S3). When the microcomputer 17 determines that the wake-up request is not addressed to its own node (S3: NO), the microcomputer 17 shifts from the wake-up state to the sleep state (S4), and ends the rewriting process.

When the microcomputer 17 determines that the wake-up request is addressed to its own node (S3: YES), the microcomputer 17 performs authentication (S5). The microcomputer 17 determines whether or not the authentication is established (S6), and if it is determined that the authentication is not established (S6: NO), the rewriting process ends.

When the microcomputer 17 determines that the authentication is established (S6: YES), the microcomputer 17 transmits a constant response to the electronic control device 1 (S7), and waits for the reception of the supply voltage value request from the electronic control device 1 (S8). When the microcomputer 17 determines that the supply voltage value request is received from the electronic control device 1 (S8: YES), the microcomputer 17 confirms the supply voltage value at that time (S9), and whether or not the supply voltage value is equal to or higher than the predetermined voltage value. (S10). When the microcomputer 17 determines that the supply voltage value is not equal to or higher than the predetermined voltage value (S10: NO), it determines that the rewriting condition is not satisfied, transmits a negative response to the electronic control device 1 (S11), and performs the rewriting process. finish.

When the microcomputer 17 determines that the supply voltage value is equal to or higher than the predetermined voltage value (S10: YES), it determines that the rewriting condition is satisfied, transmits an acknowledgment to the electronic control device 1 (S12), and supplies the positive response. The voltage value is stored as the voltage value before rewriting (S13), and the reception of the erasure request from the electronic control device 1 is waited for (S14).

When the microcomputer 17 determines that the erase request has been received from the electronic control device 1 (S14: YES), the microcomputer 17 confirms the supply voltage value at that time (S15), uses the supply voltage value, and changes the supply voltage value. From the above, the threshold timing at which the supply voltage value becomes less than the rewrite guaranteed voltage value is calculated (S16). The microcomputer 17 compares the supply voltage value with the rewrite guaranteed voltage value (S17), and if it is determined that the supply voltage value does not exceed the rewrite guaranteed voltage value (S17: NO), it is determined that the rewrite condition is not satisfied. Then, a negative response is transmitted to the electronic control device 1 (S18), and the rewriting process is terminated.

When the microcomputer 17 determines that the supply voltage value exceeds the rewrite guaranteed voltage value (S17: YES), it determines that the rewrite condition is satisfied, performs the erasure process (S19), and normally performs the erasure process. When finished, an acknowledgment is transmitted to the electronic control device 1 (S20), and the reception of the program or data to be written from the electronic control device 1 is awaited (S21).

When the microcomputer 17 determines that the reception of the program or data to be written has started from the electronic control device 1 (S21: YES), the microcomputer 17 confirms the supply voltage value at that time (S22), uses the supply voltage value, and uses the supply voltage value. The threshold timing at which the supply voltage value becomes less than the guaranteed rewrite voltage value is calculated from the transition status of the supply voltage value (S23), the program to be written or the data is written (S24), and the writing is performed from the progress of the rewriting. The completion timing is calculated (S25).

The microcomputer 17 compares the write completion timing with the threshold timing (S26), and if it is determined that the write completion timing is later than the threshold timing (S26: NO), it is determined that the rewrite condition is not satisfied, and the result is negative. The response is transmitted to the electronic control device 1 (S27), and the rewriting process is terminated. That is, the microcomputer 17 determines that the rewriting cannot be continuously performed.

When the microcomputer 17 determines that the write completion timing is earlier than the threshold timing (S26: YES), the microcomputer 17 determines that the rewriting can be continued, and ends the reception of the program or data to be written from the electronic control device 1. (S28). When the microcomputer 17 determines that the reception of the program or data to be written from the electronic control device 1 has not been completed (S28: NO), the microcomputer 17 returns to step S22 and repeats steps S22 and subsequent steps. That is, when the microcomputer 17 starts receiving the program or data to be written, the microcomputer 17 continues to check the supply voltage value until the reception of the program or data to be written is completed, and whether or not the rewriting can be continuously performed. Continue to judge. When the microcomputer 17 determines that the reception of the program or data to be written has been completed from the electronic control device 1 (S28: YES), the microcomputer 17 transmits an acknowledgment to the electronic control device 1 (S29), and verifies from the electronic control device 1. Wait for the request to be received (S30).

When the microcomputer 17 determines that the verification request has been received from the electronic control device 1 (S30: YES), the verification process is performed (S31), and when the verification process is completed normally, an acknowledgment is transmitted to the electronic control device 1. (S32), the wake-up state is autonomously shifted to the sleep state (S33), and the rewriting process is terminated.

Although the electronic control device 2 which is a rewrite node has been exemplified above, the same applies to the electronic control devices 3 to 5 which are rewrite nodes. That is, the electronic control devices 3 to 5 perform rewriting in the same manner as the electronic control device 2 compares the write completion timing with the threshold value timing to determine whether or not the rewriting can be continuously performed. Determine if continuous implementation is possible.

As described above, according to the present embodiment, the following effects can be obtained.
In the electronic control devices 2 to 5, it is determined whether or not the rewriting can be continuously performed by using the transition status of the supply voltage value during the rewriting of the program or data and the progress status of the rewriting. It is possible to avoid the situation where the program or data is rewritten when the supply voltage value is lower than the rewrite guaranteed voltage value, and the program when the supply voltage value exceeds the rewrite guaranteed voltage value. Alternatively, the rewriting of data can be guaranteed. As a result, the written program or data can be appropriately guaranteed by rewriting the program or data in a state where the supply voltage value exceeds the rewrite guaranteed voltage value.

Further, in the electronic control devices 2 to 5, the writing completion timing is calculated from the progress of rewriting, and the threshold timing at which the supply voltage value becomes less than the guaranteed rewriting voltage value is calculated from the transition status of the supply voltage value during rewriting. When the writing completion timing is before the threshold timing, it is determined that the rewriting can be continued, and when the writing completion timing is later than the threshold timing, it is determined that the rewriting cannot be continued. .. By comparing the write completion timing with the threshold timing, it is possible to determine whether or not rewriting can be continued.

Further, in the electronic control devices 2 to 5, when the program or data is stored in a two-sided configuration and the rewriting of the program or data stored in the old side is stopped, the rewriting timing is newer. Control was performed using the program or data accumulated on the surface. For example, even if the rewriting does not end normally due to a sudden drop in the supply voltage value during rewriting, vehicle control is performed using the program or data stored in the newer side of the rewriting timing. be able to.

Further, in the electronic control devices 2 to 5, after the sleep mode is changed to the wakeup mode by receiving the wakeup request from the electronic control device 1 which is the distribution node, the source of the wakeup request is the program or data. Changed to start rewriting when the authentication of being a legitimate distributor is established. By shifting the electronic control device to be rewritten from the sleep mode to the wake-up mode at the time of rewriting, it is possible to appropriately suppress the increase in power consumption.

Further, in the electronic control devices 2 to 5, when the rewriting is completed, the wake-up mode is autonomously shifted to the sleep mode. By shifting to the sleep mode without receiving the sleep request from the electronic control device 1 which is the distribution node, it is possible to appropriately suppress the increase in power consumption. In particular, in a configuration in which the power supplied from the vehicle battery is used as the drive power, it is possible to appropriately avoid the so-called dead battery by suppressing the increase in power consumption. In this case, since the electronic control device 1 does not transmit the sleep request, it is possible to appropriately suppress the increase in the bus load on the communication buses 8 and 9.

Further, when the electronic control devices 2 to 5 determine that the rewriting cannot be continued, the rewriting is stopped and the external devices 10 to 12 are notified that the rewriting cannot be continued. It is possible to notify the outside of the vehicle that rewriting cannot be continued.

Further, in the electronic control device 1, the battery voltage value of the vehicle battery is acquired from the power supply control device 7, and when the battery voltage value is equal to or higher than the rewrite guaranteed voltage value, the program or data is delivered to the delivery destination. By determining whether or not the voltage environment is rewritable at the timing before rewriting based on the battery voltage value of the vehicle battery, it is possible to avoid the occurrence of a situation in which the program or data is unnecessarily distributed.

Further, in the electronic control device 1, the supply voltage value of the delivery destination of the program or data is acquired, and when the supply voltage value of the delivery destination is equal to or higher than the rewrite guaranteed voltage value, the program or data is delivered to the delivery destination. did. By determining whether or not the voltage environment is rewritable at the timing before rewriting based on the supply voltage value of the delivery destination, it is possible to avoid the occurrence of a situation in which the program or data is unnecessarily delivered.

The present disclosure has been described in accordance with the examples, but it is understood that the present disclosure is not limited to the examples and structures. The present disclosure also includes various variations and variations within a uniform range. In addition, various combinations and forms, as well as other combinations and forms containing only one element, more or less, are also within the scope of the present disclosure.

In the electronic control devices 2 to 5 which are rewrite nodes, a configuration in which the program or data stored in the memory is rewritten according to the program or data distributed from the electronic control device 1 is exemplified, but the electronic control device which is a distribution node is illustrated. In 1, the program or data stored in the memory may be rewritten.

In the electronic control devices 2 to 5, when the rewriting is completed, the configuration of autonomously shifting from the wake-up mode to the sleep mode is illustrated. However, when the sleep request is received from the electronic control device 1, the wake-up mode is changed to the sleep mode. It may be a configuration to be migrated. With this configuration, even if the configuration cannot autonomously switch to the sleep mode, the increase in power consumption can be appropriately suppressed by receiving the sleep request from the electronic control device 1 and shifting to the sleep mode. ..

Although the configuration for targeting the program or data transmitted / received between the external devices 10 to 12 is illustrated, the program or data transmitted / received within the vehicle network may be targeted. That is, it may be applied when rewriting a program or data handled only in the vehicle. Further, the configuration may be such that a wake-up request or a sleep request is received from the vehicle network, and if it is determined that the rewriting cannot be continuously executed, the configuration may be transmitted to the vehicle network to the effect that the rewriting cannot be continuously executed.

In the drawings, 1 to 5 are electronic control devices, 1a, 2a, 2b, 3a, 3b, 4a, 5a are memories, 8 and 9 are communication buses (vehicle network), 10 are vehicle diagnostic tools (external devices), and 11 are. Cloud (external device), 12 is a vehicle connection terminal (external device), 14b is a distribution unit, 14c is a battery voltage value acquisition unit, 14d is a supply voltage value acquisition unit, 17a is a transmission / reception unit, 17b is a mode switching unit, and 17c is. The rewriting unit, 17d is a transition status acquisition unit, 17e is a progress status acquisition unit, 17f is a write completion timing calculation unit, 17g is a threshold timing calculation unit, and 17h is a determination unit.

Claims (9)

An electronic control device connected to the vehicle network (8, 9).
A memory (1a, 2a, 2b, 3a, 3b, 4a, 5a) that stores programs or data transmitted / received to / from an external device (10 to 12) or in a vehicle network (8, 9).
A rewriting unit (17c) that rewrites the program or data stored in the memory, and
The transition status acquisition unit (17d) that acquires the transition status of the supply voltage value to the own device being rewritten, and
The progress acquisition unit (17e) that acquires the progress of rewriting,
Using the transition status of the supply voltage value during rewriting and the progress status of rewriting , rewriting can be continued depending on whether the supply voltage value to the own device is less than the rewriting guaranteed voltage value before the writing is completed . An electronic control device including a determination unit (17h) that continuously determines whether or not the voltage is present during rewriting . The write completion timing calculation unit (17f) that calculates the write completion timing from the progress of rewriting,
It is equipped with a threshold timing calculation unit (17 g) that calculates the threshold timing at which the supply voltage value becomes less than the guaranteed rewrite voltage value from the transition status of the supply voltage value during rewriting.
The rewriting unit starts rewriting when the supply voltage value before rewriting is equal to or higher than the predetermined voltage value.
After the rewriting is started, the determination unit determines that the rewriting can be continued if the writing completion timing is before the threshold timing, and the writing completion timing is later than the threshold timing. In this case, the electronic control device according to claim 1, wherein it is determined that the rewriting cannot be continuously performed. It is equipped with a control implementation unit (17i) that implements vehicle control.
The memory stores a program or data in a two-sided configuration.
The rewriting unit rewrites the program or data stored in the side with the older rewriting timing.
When the rewriting of the program or data stored in the old side of the rewriting timing is stopped, the control executing unit controls the vehicle by using the program or data stored in the side having the new rewriting timing. The electronic control device according to claim 1 or 2 to be implemented. Equipped with a mode switching unit (17b) that switches between sleep mode and wakeup mode.
When the wakeup request is received from the external device or the vehicle network, the mode switching unit switches from the sleep mode to the wakeup mode.
The claim that the rewriting unit starts rewriting after the sleep mode is switched to the wakeup mode and the authentication that the source of the wakeup request is a legitimate distribution source of the program or data is established. The electronic control device according to any one of 1 to 3. The electronic control device according to claim 4, wherein the mode switching unit autonomously switches from the wake-up mode to the sleep mode when the rewriting is completed. The electronic control device according to claim 4, wherein the mode switching unit switches from the wake-up mode to the sleep mode when a sleep request is received from the external device or the vehicle network when the rewriting is completed. A transmission / reception unit (17a) for transmitting / receiving notification information to / from the external device or the vehicle network is provided.
When it is determined that the rewriting cannot be continued, the rewriting unit stops the rewriting and cancels the rewriting.
The electronic control device according to any one of claims 1 to 6, wherein the transmission / reception unit transmits to the external device or the vehicle network that the rewriting cannot be continued when the rewriting is stopped. The distribution unit (14b) that distributes the program or data to the distribution destination,
A battery voltage value acquisition unit (14c) that acquires a battery voltage value of a vehicle battery from a power supply control device (7) having a vehicle power supply control function is provided.
The electronic control device according to any one of claims 1 to 7, wherein the distribution unit distributes a program or data to a distribution destination when the battery voltage value of the vehicle battery is equal to or higher than the rewrite guaranteed voltage value. It is equipped with a supply voltage value acquisition unit (14d) that acquires the supply voltage value of the program or data distribution destination.
The electronic control device according to claim 8, wherein the distribution unit distributes a program or data to a distribution destination when the supply voltage value of the distribution destination is equal to or higher than the rewrite guaranteed voltage value.

Images