WO2019123747A1 - Electronic control device for automobile and control method thereof - Google Patents

Abstract

An objective of the present invention is to provide an electronic control device for automobile capable of reducing an update time of software stored in a nonvolatile memory. This electronic control device for automobile comprises a nonvolatile memory in which data can be deleted in deletion block units and data can be written in writing block units which are the same as or smaller than the deletion blocks, a control program being stored in each of storage regions configured in units of integer multiples of the deletion blocks in the nonvolatile memory, and the device is characterized in that when, in response to an external overwrite request, a portion of the data in the nonvolatile memory is deleted in the deletion block units and the data is written to the nonvolatile memory in the write block units, an overwrite error check is carried out for each of the blocks.

Description

Electronic controller for automobile and control method thereof

The present invention relates to an electronic control device for a vehicle and a control method thereof, and more particularly to a technology for updating control software in an ECU (Electric Control Unit) mounted on a vehicle.

Conventionally, in a case where a program or data written in a non-volatile memory such as a flash ROM (Read Only Memory) is rewritten and updated in this type of electronic control device, a method as described in Patent Document 1, for example I was going there. That is, in response to an instruction from a tool (memory rewriter) connected to the electronic control device, the target area of the non-volatile memory is erased, and a program or data sequentially transmitted from the tool is written to the non-volatile memory. It was.

JP-A-9-128229

By the way, in recent years, the scale of control software installed in electronic control devices for automobiles has been steadily increasing, and along with this, the rewriting time for updating programs and data has become longer. In the current communication technology, for example, about 25 minutes are required to rewrite the storage capacity of 4 Mbytes. Considering that the storage capacity of the non-volatile memory and the scale of the control software will further increase in the future, the update will take longer.

The present invention has been made in view of the above circumstances, and it is an object of the present invention to provide an electronic control apparatus for a vehicle capable of shortening the update time of software stored in a non-volatile memory and a control method thereof. It is in.

The electronic control unit for a motor vehicle according to one aspect of the present invention has a non-volatile memory capable of erasing data in erase block units and writing data in write block units identical or smaller than the erase block. An electronic control unit for a motor vehicle in which a control program is stored for each storage area configured in units of integral multiples of erase blocks in the nonvolatile memory, the non-volatile memory corresponding to an external rewrite request. A processor is provided which erases the data of a part in an erase block unit and, when writing the data in a write block unit in the non-volatile memory, comprises a processor for confirming rewriting correctness / incorrectness for each block.

The control method of the electronic control unit for a motor vehicle according to one aspect of the present invention is non-volatile, capable of erasing data in erase block units and writing data in write block units identical or smaller than the erase block. A control method of an electronic control unit for a motor vehicle having a memory and storing a control program for each storage area configured in units of integral multiples of erase blocks in the non-volatile memory, the control method according to an external rewrite request. And erase the partial data of the non-volatile memory in erase block units, and when writing the data in the non-volatile memory in write block units, check whether the rewriting is correct or not for each of the blocks. I assume.

According to the present invention, the control program is stored in the non-volatile memory for each storage area configured in units of integral multiples of the erase block, and the assignment of the control program corresponds to the erase block. This can be done for each control program, and the amount of data transfer can be reduced to shorten the software update time.
Further, in response to an external rewrite request, a part of the storage area of the non-volatile memory is erased, and writing in this erase area in units of write blocks can reduce the size of the rewrite target area. The write time can be shortened to shorten the software update time.

FIG. 1 is a schematic view showing a data rewriting system of an electronic control unit for a car according to a first embodiment of the present invention. It is a block diagram which shows the structural example of the electronic controller for motor vehicles in the system shown in FIG. FIG. 3 is a diagram showing an example of a memory configuration of a flash ROM in FIG. 2; It is a block diagram which shows the structural example of the tool in the system shown in FIG. FIG. 6 is a flowchart for explaining an example of data rewrite processing, and a diagram showing a memory configuration of storage on the tool side and a memory configuration of a flash ROM on the ECU side. FIG. 7 is a diagram showing states of storage, flash ROM and RAM before and during rewriting in the ENG control program to be rewritten. FIG. 7 is a diagram showing states of the flash ROM and the RAM during and after rewriting in the ENG control program to be rewritten. FIG. 13 is an explanatory view showing memory configurations before and after countermeasure in comparison with each other when the capacity of the rewrite area is over. FIG. 10 is a flowchart for explaining another example of the data rewrite process, and a diagram showing a memory configuration of storage on the tool side and a memory configuration of a flash ROM on the ECU side. It is a flowchart for demonstrating another example of a data rewriting process following FIG. 9A. It is a schematic diagram showing a data rewriting system in an electronic control unit for a car according to a second embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows an example of a data rewriting system which rewrites data of an electronic control unit (ECU: Electronic Control Unit) mounted on a vehicle. The ECU 10 to be rewritten is detachably connected to the tool 30 via a network cable 20 such as CAN (Controller Area Network), serial communication, FlexRay (registered trademark) and Ethernet (registered trademark). Then, the operator operates the tool 30 to rewrite the ECU 10.
The ECU 10 and the tool 30 are not limited to wired using the network cable 20, and may be connected to each other by wireless communication using a wireless transceiver.

The ECU 10 is an electronic device that controls various devices mounted on a vehicle, such as a fuel injection valve, a transmission, an electric brake system, an ABS (Antilock Brake System), a variable valve timing mechanism, and a brushless motor. It has a built-in computer. Specifically, as shown in FIG. 2, the ECU 10 includes a processor 11 such as a central processing unit (CPU), a communication device 12 for connecting to a network, a flash ROM 13 as an example of a non-volatile memory, and volatilization It has RAM (Random Access Memory) 14 as an example of sex memory, and bus 15. Here, the bus 15 mutually connects the processor 11, the communication device 12, the flash ROM 13 and the RAM 14. The communication device 12 also includes a connector (not shown) that detachably connects the network cable 20.

The storage area of the flash ROM 13 is divided into a plurality of erase blocks EB1 to EBq of a predetermined size, as shown in FIG. Each erase block EB1 to EBq is partitioned into a plurality of write blocks WB1, WB2,..., WBx of a predetermined size. Here, the erase block defines the minimum unit for erasing data, the write block defines the minimum unit for writing data, and the write block has the same or smaller capacity than the erase block. . Then, when rewriting data of a certain write block, after erasing all data of the erase block to which the write block belongs, the procedure of writing the data to all the write blocks belonging to the erase block from which the data is erased It is supposed to go through. If the size of the erase block in the flash ROM 13 is not the same, the number of write blocks belonging to each erase block may be different.

For example, an ENG (Engine) control program is stored in the storage area corresponding to the erase blocks EB1 to EBm of the flash ROM 13, and the surplus part is an empty area. Identification information (for example, identification of new and old programs) or identification information for identifying each erase block is added to the start address of the erase block EB1. As identification information, a hash value (hash value 1) is used in this example.

The hash value is an example of identification information for comparing the identity of data, and it is preferable to adopt similar data that takes largely different values. Then, the processor 31 temporarily stores the hash value calculated from the data of the erase block EB1 in a storage medium such as a RAM in the processor 31.

For example, a TCU (Transmission Control Unit) control program is stored in the storage area corresponding to the erase blocks EBm + 1 to EBn, and the surplus portion is an empty area. Identification information (for example, a hash value 2) for identifying the stored control program and the control program to be rewritten or identifying the respective erase blocks is given to the start address of the erase block EBm + 1.

For example, an API (Application Programming Interface) is stored in the storage area corresponding to the erase block EBn + 1 to EBo, and the surplus portion is an empty area. Identification information (for example, hash value 3) for identifying the stored control program and the control program to be rewritten or identifying the respective erase blocks is given to the top address of the erase block EBn + 1.
For example, a BIOS (Basic Input Output System) is stored in the storage area corresponding to the erase block EBo + 1 to EBp, and the surplus portion is an empty area. Identification information (for example, hash value 4) for identifying the stored control program and the control program to be rewritten or identifying the respective erasure blocks is given to the top address of the erasure block EBo + 1.

The storage areas corresponding to the erase blocks EBp + 1 to EBq are common free areas (common areas). Identification information (for example, hash value 5) for identifying a free area or identifying each of the erase blocks is given to the top address of the erase block EBp + 1.
As described above, various programs are stored in the flash ROM 13 for each storage area configured in units of integral multiples of the erase block.

The tool 30 is an electronic device with which an operator performs data rewriting work of the ECU 10, and is configured of, for example, a personal computer. Specifically, as shown in FIG. 4, the tool 30 works with a processor 31 such as a CPU, a communication device 32 for connecting to a network, a storage 33 such as a hard disk drive or a solid state drive (SSD), It comprises an input / output device 34 serving as an interface to the user, and a bus 35 for interconnecting these devices. Here, the communication device 32 includes a connector (not shown) for detachably connecting the network cable 20. The input / output device 34 also includes a display such as an LCD (Liquid Crystal Display), a keyboard, and a pointing device such as a mouse. The storage 33 may be, for example, storage of a NAS (Network Attached Storage) or a server connected to a network (not shown).

The storage 33 stores rewrite data for rewriting the flash ROM 13 of the ECU 10. The rewrite data includes, for example, a control program for controlling various devices mounted on a vehicle, and control parameters such as constants and maps used in the control program. The rewrite data stored in the storage 33 is transferred to the communication device 32 through the bus 35 under the control of the processor 31 and transmitted to the ECU 10 from the connector (not shown) through the network cable 20.

Next, data rewriting processing (reprogramming) in the configuration as described above will be described with reference to FIGS. FIG. 5 shows an example of a procedure for updating a part of the control program of the flash ROM 13 of the ECU 10, the memory configuration of the storage on the tool side, and the memory configuration of the flash ROM on the ECU side. FIG. 6 shows the states of the storage, flash ROM and RAM before and during rewriting in the ENG control program to be rewritten. FIG. 7 shows the states of the flash ROM and the RAM during and after rewriting in the ENG control program to be rewritten.

The data rewriting process is performed when the operator performs a predetermined operation in the tool 30 after the tool 30 is connected to the ECU 10 with the network cable 20. Here, the ECU 10 is premised to be supplied with electric power and activated when connected to the tool 30 via the network cable 20, but may be activated by connection of another power cable.

The storage 33 in the tool 30 has a memory configuration in which an ENG control program, a TCU control program, an API, a BIOS, and a free area are allocated as in FIG. 3. In this example, version 2 (Ver: 2) is granted. Further, the software written in the flash ROM 13 in the ECU 10 has a memory configuration in which an ENG control program, a TCU control program, an API, a BIOS, and a free area are allocated as in FIG. Then, version 1 (Ver: 1) is assigned as identification information of the ENG control program, and version 2 (Ver: 2) is assigned as identification information to the TCU control program, API, BIOS and free space.

Thus, the data rewriting system compares new and old control programs, and rewrites only blocks having different versions. As a result, the old version 1 ENG control program written in the flash ROM 13 is rewritten to the new version 2 ENG control program in the storage 33.
FIG. 6A shows the ENG control program (Ver: 2) of the storage 33 on the tool 30 side and the ENG control program (Ver: 1) of the flash ROM 13 before rewriting on the ECU 10 side. There is free space in the surplus part.

First, an identification information collation request is issued from the tool 30 to the ECU 10 (step S1), and identification information (here, software Ver: 2) stored in the storage 33 in the tool 30 and identification stored in the flash ROM 13 in the ECU 10 The information (here, software Ver: 1) is compared by the ECU 10 (step S2). If there is a difference in the identification information, the ECU 10 makes a request to send the rewrite data to the tool 30 (step S3). As a result, the tool 30 outputs an erase request for the rewrite target (area) (step S4). When the ECU 10 receives the deletion request from the tool 30, deletion of the rewrite target (area) is started (step S5). When the erasing is completed, the ECU 10 notifies the tool 30 of the end of the erasing (step S6).

Next, write data (software Ver: 2 ENG control program) is transferred from the tool 30 to the ECU 10 (step S7), and the write data is stored in the RAM 14 (step S8). When the writing of data to the RAM 14 is completed (step S9), the ECU 10 determines whether there is a writing abnormality (step S10). If there is no difference in the identification information at step S2 and if it is determined at step S10 that "writing abnormality is not present", the ECU 10 notifies the tool 30 of writing completion (step S13), and the tool 30 completes writing When the notification is received, the writing completion is displayed on the display of the input / output device 34 to notify the worker (step S14). If there are a plurality of rewrite targets, an identification information collation request is issued for the next write target, and the process moves to the next rewrite target (step S15), and the same operation as the above-described step is repeated.

On the other hand, if it is determined in step S10 that "write error", that is, it is determined that write data has an error, the erase block including the corresponding write block (abnormal portion) is erased (step S11). Rewriting is performed using the held data (step S12). During this erase and rewrite, external communication is not interrupted.

For example, as shown in (b) of FIG. 6, it is assumed that a write failure area occurs in the write block WBo in the erase block EB3 in the flash ROM 13 after rewriting. In this case, as shown in (a) of FIG. 7, the data of erase blocks EB1 and EB2 for which rewriting has been completed normally is held, and only erase block EB3 is erased (at this time, erase block EB4 is in the erased state). Write blocks WBn + 1 to WBo and WBo + 1 to WBp are rewritten. Similarly, when a write failure area occurs in the write block in the erase block EB4, only the erase block EB4 is erased and the write blocks WBo + 1 to WBp are rewritten.

At this time, by saving the data written in the write blocks WBn + 1 to WBo-1 of the flash ROM 13 in the RAM 14, it is possible to write in a short time using the data in the RAM 14 when rewriting. That is, at the time of erase in erase block units in the flash ROM 13, data of the write block which is normally written is saved (copied) to the RAM 14 and then erased, and the remaining data which is not normally written Are received again from the tool 30 to perform rewriting.

Alternatively, the write data to the write blocks WBn + 1 to WBo-1 may be retransferred from the storage 33 of the tool 30 to the RAM 14 and written again. When writing by retry is completed, as shown in (b) of FIG. 7, the ENG control program of the same version 2 as the storage 33 on the tool 30 side is written to the flash ROM 13 and updating from the old version to the new version finish.

During the above steps S11 and S12, the tool 30 receives and monitors the busy signal output from the ECU 10 (step S16) to avoid communication timeout between the tool 30 and the ECU 10. When writing is completed, the ECU 10 notifies the tool 30 of writing completion (step S13), and when the tool 30 receives the writing completion notification, the tool 30 displays it on the display of the input / output device 34 to notify the operator of writing completion (step S14). Then, if there are a plurality of rewrite targets, an identification information collation request is issued for the next write target, and the process moves to the next rewrite target (step S15), and the same operation as the above-described step is repeated.

In the above embodiment, an example has been shown in which identification information to be rewritten is sequentially compared to determine whether or not rewriting is necessary. In this way, the case of reprogramming by wireless communication is taken into consideration, and since an unspecified number of vehicles are targeted in wireless communication, it is possible to grasp what state the other vehicle is in. Reprogramming may take place without In particular, when changing from the state of being reprogrammed several times in the past to the latest program, it is not known where it has been reprogrammed.
However, when the object to be rewritten is clear, the control program, the erase block or the write block to be rewritten may be designated from the tool 30 to the ECU 10 and the block may be rewritten. That is, an erase block for executing rewriting of the non-volatile memory can be set in advance, and the write block in the erase block can be rewritten.

FIG. 8 shows a comparison of the memory configurations before and after the countermeasure when the amount of data to be written is larger than the amount of written data and the capacity of the rewrite area is over in the data rewriting process described above. ing. Here, as shown in FIG. 8A, it is assumed that the flash ROM 13 has the same memory configuration as that shown in FIG. 3, and the case of rewriting the ENG control program will be described as an example. As shown in (b) of FIG. 8, the ENG control program includes “function A call” and “function A main body”, and writes an additional ENG control program in the free space of this ENG control program. Shall be included. Here, the additional ENG control program includes "function B call", "function B main body", "function C call" and "function C main body". If the additional ENG control program has a larger capacity than the empty area and can not fit in the empty area, other control programs that do not need to be rewritten, for example, the TCU control program, API and BIOS must also sequentially rewrite the address and rewrite It does not.

Therefore, as shown in FIG. 8C, "function A call" and "function B call" and "function C call" in the additional ENG control program are written in the ENG control program. Then, the "function A main body" and the "function B main body" and the "function C main body" in the ENG control program for the additional portion are respectively written in the common free space (common area).

As described above, basically the free space of each control program area is used to secure the additional data capacity, but when a specific control program area overflows, (b) and (c) of FIG. As shown in), an arbitrary function call unit may be placed in the control program area, and the function body may be moved to a common free area.

According to such a data rewriting system, when rewriting a part of a plurality of control programs, the address is sequentially shifted even if the additional portion has a capacity larger than the vacant area of the control program. There is no need to rewrite other control programs, and it is possible to rewrite with a minimum amount of data by using a common free space. Therefore, the memory area to be rewritten can be reduced to shorten the software update time.
When a plurality of control areas are over, it is preferable to spread control programs without providing an empty area in the control program area.

FIGS. 9A and 9B respectively show another example of the data rewriting process for updating a part of the control program of the flash ROM 13 of the ECU 10, in which a plurality of control programs are rewritten. Here, the case where the ENG control program of the flash ROM 13 (the ECU 10 side) before rewriting is the old version and the case where the additional ENG control program is written in the common free space is taken as an example.

First, an identification information collation request is issued from the tool 30 to the ECU 10 (step S21), and the identification information (here, software Ver: 2) stored in the storage 33 in the tool 30 and the identification stored in the flash ROM 13 in the ECU 10 The information (here, software Ver: 1) is compared by the ECU 10 (step S22). If there is a difference in the identification information, the ECU 10 sends a request for sending the ENG control program, which is the rewrite data, to the tool 30 (step S23). As a result, the erasing request for rewriting is output from the tool 30 (step S24), and the ECU 10 starts erasing the ENG control program to be rewritten (step S25). Then, when the erasing is completed, the ECU 10 notifies the tool 30 of the end of the erasing (step S26).

Next, write data (software Ver: 2 ENG control program) is transferred from the tool 30 to the ECU 10 (step S27), and this data is stored in the RAM 14 (step S28). When the writing of the data to the RAM 14 is completed (step S29), the ECU 10 determines whether there is a writing abnormality (step S30). If there is no difference in the identification information at step S22, or if it is determined at step S30 that there is no writing error, the ECU 10 notifies the tool 30 of writing completion (step S33), and the tool 30 completes writing When the notification is received, the identification information collation request is issued to the next writing object, and the rewriting operation of the common area which is the next rewriting object is started (step S35).

On the other hand, if it is determined in step S30 that "write error has occurred", the erase block (error portion) in which the write error has occurred is erased (step S31), and the data saved in the error block to the RAM 14 is deleted. Rewrite using it (step S32). That is, at the time of erase in erase block units in the flash ROM 13, data of the write block which is normally written is saved (copied) to the RAM 14 and then erased, and the remaining data which is not normally written Is received again and rewritten. During the above steps S31 and S32, the tool 30 receives and monitors the busy (BUSY) signal output from the ECU 10 (step S34), and communication timeout of the tool 30 and the ECU 10 is avoided. When the writing is completed, the ECU 10 notifies the tool 30 of the completion of the writing (step S33).

On the tool 30 side, when the write completion notification is received, the operation shifts to the rewrite operation of the common empty area (common area). That is, the identification information collation request is output from the tool 30 to the ECU 10 (step S35), and the identification information (here, software Ver: 2) stored in the storage 33 in the tool 30 and the identification stored in the flash ROM 13 in the ECU 10 The information (here, software Ver: 1) is compared by the ECU 10 (step S36). If there is a difference in the identification information, the ECU 10 makes a request to send the rewrite data to the common area on the tool 30 (step S37). As a result, the erasing request of the common area to be rewritten is output from the tool 30 (step S38). Erasure of the common area to be rewritten is started on the ECU 10 side (step S39), and when erasure is completed, the ECU 10 notifies the tool 30 side of the termination of erasure (step S40).

Subsequently, write data (an additional ENG control program) is transferred from the tool 30 to the ECU 10 (step S41), and this data is stored in the RAM 14 (step S42). When the data writing to the RAM 14 is completed, the data writing from the RAM 14 to the flash ROM 13 is performed (step S43). After that, as in step S30 and subsequent steps described above, the presence or absence of write abnormality is determined, and when write is completed, an identification information collation request is issued for the next write target, and it moves to the next rewrite target. Repeat the operation to write. When the ECU 10 notifies the tool 30 that all writing has been completed, the writing completion is displayed on the display of the input / output device 34 to notify the operator.

In the above-described steps S30 to S32, when the rewrite fails, the process does not shift to the process for the next rewrite target. This is done because, for example, if the tool 30 and the plurality of ECUs 10 are connected by wireless communication to rewrite data, the communication may be disconnected. In such a case, if blocks of the control program are classified into the same group (same control) and the same group is continuously rewritten, erroneous writing can be suppressed.
In addition, when rewriting fails a plurality of times in the same erase block of the flash ROM (nonvolatile memory), it is preferable to judge as an error and interrupt the rewriting.

FIG. 10 shows a data rewriting system in an electronic control unit for a car according to a second embodiment of the present invention. In this example, the rewriting tool 40 is mounted on the non-volatile memory (flash ROM) 45 mounted on the first ECU 43 mounted on the automobile 42 or the second ECU 44 by wireless communication using the wireless transceiver 41. The non-volatile memory (flash ROM) 46 is configured to be rewritten.

A wireless transceiver 47 and a security gateway 48 for preventing unauthorized access are mounted on the automobile 42, and the data received by the wireless transceiver 47 is transmitted from the security gateway 48 via the bus 49 to the first ECU 43 and the second ECU 44. Is configured to input. Here, for convenience, they will be referred to as the first ECU 43 and the second ECU 44, but basically the two have the same configuration, there is no relationship or priority between master and slave, and substantially the same nonvolatile memory 45, 46, eg, flash ROM, CPUs 50 and 51 are provided.

In the above configuration, assuming that the first ECU 43 controls the vehicle 42 while the vehicle 42 is traveling, the data received from the rewriting tool 40 is supplied to the non-volatile memory 46 of the second ECU 44 when the data is sent. Then, the control program is rewritten. The specific rewriting procedure is as described above. Then, switching of the first ECU 43 and the second ECU 44 is performed while the automobile 42 is stopped. That is, control of the automobile 42 is performed by the second ECU 44. Thus, the vehicle 42 is controlled by the reprogrammed new control program.

The other basic rewriting operation is the same as that of the first embodiment, so the detailed description will be omitted.
Since there is a possibility that the automobile 42 may be moved in data rewriting by wireless, it is preferable to narrow the rewriting target range and shorten the rewriting time as compared with the case of connecting by the network cable 20. That is, data to be written to the non-volatile memory may be input by wireless communication with the range to be rewritten limited.

Even with such a configuration, the control program is basically stored in the non-volatile memory for each storage area configured in units of integral multiples of the erase block, and control is performed in the same manner as in the first embodiment. Since the program allocation and the erase block correspond to each other, the rewrite target area can be set for each control program, and the data transfer amount can be reduced to shorten the software update time. Further, in response to an external rewrite request, a part of the storage area of the non-volatile memory is erased, and writing in this erase area in units of write blocks can reduce the size of the rewrite target area. The write time can be shortened to shorten the software update time. Furthermore, erroneous writing can be suppressed by preventing external communication from being interrupted during erasing and rewriting.

In the second embodiment, although the example including the first ECU 43 and the second ECU 44 has been described, the configuration may be such that one ECU switches and rewrites two flash ROMs. Of course, the present invention can be applied to a configuration in which three or more ECUs and a flash ROM are switched and used.

Furthermore, using a storage device such as a car navigation system or a hard disk of an audio system provided in the automobile 42 in advance, a semiconductor memory, etc., rewrite data transferred from the rewrite tool 40 is stored in advance in the storage device. It is also possible to configure the non-volatile memory to be rewritten using the data stored in.

DESCRIPTION OF SYMBOLS 10 ... ECU, 11 ... Processor, 12 ... Communication apparatus, 13 ... Flash ROM, 14 ... RAM, 15 ... Bus, 20 ... Network cable, 30 ... Tool, 31 ... Processor, 32 ... Communication apparatus, 33 ... Storage, 34 ... Input / output device 35: bus 40: rewriting tool 41: wireless transceiver 42: automobile 43: first ECU 44: second ECU 45, 46: non-volatile memory (flash ROM) 47: wireless transceiver , 48: security gateway, 49: bus, 50, 51: CPU, EB1 to EBq, erase block, WB1, WB2, ..., WBx, write block

Claims (20)

1. A nonvolatile memory capable of erasing data in units of erase blocks and capable of writing data in units of write blocks identical to or smaller than the erase block, and configured in units of integral multiples of the erase blocks in the nonvolatile memory An electronic control unit for a motor vehicle in which a control program is stored for each of the stored storage areas,
   When part of the data in the non-volatile memory is erased in erase block units and data is written in the non-volatile memory in write block units in response to a rewrite request from the outside, correct or incorrect for each block An electronic control unit for a motor vehicle, comprising: a processor for confirming
2. After the processor confirms rewrite correctness for each block, in the case of an error, erase the erase block including the corresponding write block of the non-volatile memory, and rewrite on a write block basis.
   The electronic control unit according to claim 1, wherein external communication is not interrupted during the erasing and rewriting.
3. 2. The vehicle electronic control device according to claim 1, wherein each control program stored in the non-volatile memory is allocated in erase block units for each control object.
4. The electronic control unit according to claim 1, wherein the processor sets in advance an erase block for executing the rewrite of the non-volatile memory and rewrites a write block in the erase block.
5. The vehicle according to claim 1, wherein the processor classifies the erase block for executing the rewriting of the non-volatile memory according to the control group, and executes the rewriting continuously for the same group. Electronic control unit.
6. The processor according to claim 1, wherein the processor compares the control program stored in the non-volatile memory with the control program to be rewritten, and rewrites only an erase block including a portion having a difference. Electronic control unit for automobiles.
7. The electronic control unit according to claim 1, wherein the processor determines that an error occurs and rewrite is interrupted when the rewrite fails a plurality of times in the same erase block of the non-volatile memory.
8. The processor saves and then erases the data of the write block which has been normally written when erasing in erase block units in the non-volatile memory, and erases the remaining data which has not been normally written. 2. The electronic control unit for a vehicle according to claim 1, wherein the electronic control unit according to claim 1, wherein the electronic control unit is rewritten using the data received again and saved and the data received again.
9. The processor is characterized by further storing identification information for identifying the control program stored and the control program to be rewritten, or identifying the respective erase blocks in the non-volatile memory. The electronic control unit for vehicles according to claim 1.
10. The electronic control unit according to claim 9, wherein the identification information is a hash value.
11. The electronic control unit according to claim 1, wherein the processor inputs data to be written to the non-volatile memory by wireless communication with a limited rewriting target range.
12. A nonvolatile memory capable of erasing data in units of erase blocks and capable of writing data in units of write blocks identical to or smaller than the erase block, and configured in units of integral multiples of the erase blocks in the nonvolatile memory A control method of an electronic control unit for a car, wherein a control program is stored for each of the stored storage areas,
    Partially erase data in the non-volatile memory in erase block units in response to an external rewrite request;
    When the data is written in the non-volatile memory in units of write blocks, correctness / incorrectness of rewriting is confirmed for each of the blocks.
13. After confirming the rewriting correctness for each block, in the case of an error, erase the erase block including the corresponding write block,
    Rewrite in write block units,
    The control method of the electronic control unit for a vehicle according to claim 12, wherein communication from the outside is not interrupted during erasing and rewriting.
14. 13. The control method according to claim 12, wherein each control program stored in the non-volatile memory is allocated in units of erase blocks for each control object.
15. The control method according to claim 12, wherein an erase block for executing rewriting of the non-volatile memory is set in advance, and a write block in the erase block is rewritten.
16. 13. The electronic control unit for automobile according to claim 12, wherein an erase block which executes rewriting of the non-volatile memory is classified according to a control group, and rewriting is continuously executed to the same group. Control method.
17. The electronic control according to claim 12, wherein the control program stored in the non-volatile memory is compared with the control program to be rewritten, and only the erase block including the portion having a difference is rewritten. Device control method.
18. 13. The control method according to claim 12, further comprising the step of judging as an error and interrupting the rewriting when the rewriting has failed a plurality of times in the same erasing block of the non-volatile memory.
19. At the time of erasing in erase block units in the non-volatile memory, the data of the normally written program block is saved and then erased, and the remaining data which has not been normally written is received again. The control method according to claim 12, wherein the data is rewritten using the saved data and the re-received data.
20. 13. The apparatus according to claim 12, wherein identification information for identifying the stored control program and the control program to be rewritten or identifying each erase block is further stored in the nonvolatile memory. Control method of an electronic control unit for automobiles.

Images