WO2020032047A1 - Système de commande électronique de véhicule, dispositif central, dispositif maître de véhicule, procédé de commande de transmission d'informations de commande d'affichage, procédé de commande de réception d'informations de commande d'affichage, programme de commande de transmission d'informations de commande d'affichage et programme de commande de réception d'informations de commande d'affichage - Google Patents

Système de commande électronique de véhicule, dispositif central, dispositif maître de véhicule, procédé de commande de transmission d'informations de commande d'affichage, procédé de commande de réception d'informations de commande d'affichage, programme de commande de transmission d'informations de commande d'affichage et programme de commande de réception d'informations de commande d'affichage Download PDF

Info

Publication number
WO2020032047A1
WO2020032047A1 PCT/JP2019/030948 JP2019030948W WO2020032047A1 WO 2020032047 A1 WO2020032047 A1 WO 2020032047A1 JP 2019030948 W JP2019030948 W JP 2019030948W WO 2020032047 A1 WO2020032047 A1 WO 2020032047A1
Authority
WO
WIPO (PCT)
Prior art keywords
ecu
rewriting
information
cgw
data
Prior art date
Application number
PCT/JP2019/030948
Other languages
English (en)
Japanese (ja)
Inventor
雄三 原田
上原　一浩
卓也 河▲崎▼
充啓 夏目
真晃 安部
Original Assignee
株式会社デンソー
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from JP2019129971A external-priority patent/JP7419689B2/ja
Application filed by 株式会社デンソー filed Critical 株式会社デンソー
Priority to CN201980056957.9A priority Critical patent/CN112673360A/zh
Priority to DE112019004063.4T priority patent/DE112019004063T5/de
Publication of WO2020032047A1 publication Critical patent/WO2020032047A1/fr
Priority to US17/167,443 priority patent/US11907697B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K35/00—Instruments specially adapted for vehicles; Arrangement of instruments in or on vehicles
    • B60K35/20—Output arrangements, i.e. from vehicle to user, associated with vehicle functions or specially adapted therefor
    • B60K35/21—Output arrangements, i.e. from vehicle to user, associated with vehicle functions or specially adapted therefor using visual output, e.g. blinking lights or matrix displays
    • B60K35/22—Display screens
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K35/00—Instruments specially adapted for vehicles; Arrangement of instruments in or on vehicles
    • B60K35/20—Output arrangements, i.e. from vehicle to user, associated with vehicle functions or specially adapted therefor
    • B60K35/28—Output arrangements, i.e. from vehicle to user, associated with vehicle functions or specially adapted therefor characterised by the type of the output information, e.g. video entertainment or vehicle dynamics information; characterised by the purpose of the output information, e.g. for attracting the attention of the driver
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K35/00—Instruments specially adapted for vehicles; Arrangement of instruments in or on vehicles
    • B60K35/60—Instruments characterised by their location or relative disposition in or on vehicles
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K35/00—Instruments specially adapted for vehicles; Arrangement of instruments in or on vehicles
    • B60K35/80—Arrangements for controlling instruments
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K35/00—Instruments specially adapted for vehicles; Arrangement of instruments in or on vehicles
    • B60K35/80—Arrangements for controlling instruments
    • B60K35/81—Arrangements for controlling instruments for controlling displays
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K35/00—Instruments specially adapted for vehicles; Arrangement of instruments in or on vehicles
    • B60K35/85—Arrangements for transferring vehicle- or driver-related data
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01C—MEASURING DISTANCES, LEVELS OR BEARINGS; SURVEYING; NAVIGATION; GYROSCOPIC INSTRUMENTS; PHOTOGRAMMETRY OR VIDEOGRAMMETRY
    • G01C21/00—Navigation; Navigational instruments not provided for in groups G01C1/00 - G01C19/00
    • G01C21/26—Navigation; Navigational instruments not provided for in groups G01C1/00 - G01C19/00 specially adapted for navigation in a road network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/14—Digital output to display device ; Cooperation and interconnection of the display device with other functional units
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G—PHYSICS
    • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
    • G09G—ARRANGEMENTS OR CIRCUITS FOR CONTROL OF INDICATING DEVICES USING STATIC MEANS TO PRESENT VARIABLE INFORMATION
    • G09G5/00—Control arrangements or circuits for visual indicators common to cathode-ray tube indicators and other visual indicators
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K2360/00—Indexing scheme associated with groups B60K35/00 or B60K37/00 relating to details of instruments or dashboards
    • B60K2360/16—Type of output information
    • B60K2360/162—Visual feedback on control action
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K2360/00—Indexing scheme associated with groups B60K35/00 or B60K37/00 relating to details of instruments or dashboards
    • B60K2360/16—Type of output information
    • B60K2360/164—Infotainment
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K2360/00—Indexing scheme associated with groups B60K35/00 or B60K37/00 relating to details of instruments or dashboards
    • B60K2360/55—Remote control arrangements
    • B60K2360/56—Remote control arrangements using mobile devices
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
    • B60K2360/00—Indexing scheme associated with groups B60K35/00 or B60K37/00 relating to details of instruments or dashboards
    • B60K2360/583—Data transfer between instruments

Definitions

  • FIG. 24 is a diagram showing a mode of rewriting an application program.
  • FIG. 25 is a diagram showing a mode of rewriting an application program.
  • FIG. 26 is a timing chart showing a mode in which an application program is rewritten by power control.
  • FIG. 27 is a timing chart showing a mode of rewriting an application program by power control.
  • FIG. 28 is a timing chart showing a mode in which the application program is rewritten by self-holding of the power supply.
  • FIG. 29 is a timing chart showing a mode of rewriting an application program by self-holding of a power supply.
  • FIG. 30 is a diagram showing phases.
  • FIG. 31 is a diagram showing a screen in a normal state.
  • FIG. 32 is a diagram showing a screen when a campaign notification occurs, FIG.
  • FIG. 208 is a diagram showing a screen at the time of completion of download.
  • FIG. 209 is a diagram showing a screen when accepting the installation.
  • FIG. 210 is a diagram showing a screen when accepting the activation.
  • FIG. 211 is a functional block diagram of a program update notification control unit;
  • FIG. 212 is a flowchart showing a program update notification control process;
  • FIG. 213 is a diagram showing a notification mode of the indicator;
  • FIG. 214 is a diagram showing a transition of the notification mode when the rewrite target is a two-sided memory;
  • FIG. 215 is a diagram illustrating a transition of a notification mode when the rewrite target is a one-sided suspend memory;
  • FIG. 249 is a flowchart illustrating a process of generating an example of the specification data registered in the ECU metadata DB.
  • FIG. 250 is a diagram showing an example of the specification data.
  • FIG. 251 is a diagram illustrating an example of a bus load table.
  • FIG. 252 is a flowchart illustrating a process of generating a distribution package registered in the package DB.
  • FIG. 253 is a diagram schematically illustrating the contents of the package file
  • FIG. 254 is a sequence diagram showing a processing procedure executed between the center device and the vehicle-side system in the second embodiment
  • FIG. 255 is a flowchart illustrating processing performed by the center device.
  • FIG. 262 is a diagram schematically illustrating processing performed between the supplier, the center device, and the vehicle-side system in the fifth embodiment.
  • FIG. 263 is a sequence diagram (part 1) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system.
  • FIG. 264 is a sequence diagram (part 2) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system.
  • FIG. 265 is a sequence diagram (part 3) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system.
  • FIG. 266 is a modification (part 1) of the first embodiment, and shows a data format of a package DB in a case where a plurality of packages correspond to one campaign.
  • FIG. 1 is a sequence diagram (part 1) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system.
  • FIG. 267 is a diagram illustrating a data format of the campaign DB in a case where a plurality of packages correspond to one campaign.
  • FIG. 268 is a diagram corresponding to FIG. 242 when the specification data is generated for each group
  • FIG. 269 is a diagram corresponding to FIG. 245 when a distribution package is generated for each group.
  • FIG. 270 is a modification (part 2) of the first embodiment, and is a diagram illustrating processing contents of the package generation tool.
  • the user When the user is outside the vehicle compartment and is within the communication range of the mobile communication network, the user performs an operation input while confirming various screens involved in the rewriting of the application program with the mobile terminal 6 and performs a procedure involved in the rewriting of the application program. It is possible. In the vehicle interior, the user can perform an operation input while confirming various screens involved in rewriting the application program on the in-vehicle display 7 to perform a procedure involved in rewriting the application program. That is, the user can use the portable terminal 6 and the in-vehicle display 7 separately outside the vehicle compartment and inside the vehicle compartment, and perform a procedure involved in rewriting the application program.
  • the vehicle-side system 4 has a master device 11 (corresponding to a vehicle master device).
  • the master device 11 has a DCM (Data Communication Module) 12 (corresponding to an in-vehicle communication device) and a CGW (Central Gate Way) 13 (corresponding to a vehicle gateway device).
  • the DCM 12 and the CGW 13 are connected via a first bus 14 so that data communication is possible.
  • the DCM 12 performs data communication with the center device 3 via the communication network 2.
  • the DCM 12 downloads the distribution package from the file server 8
  • the DCM 12 extracts write data from the downloaded distribution package and transfers the extracted write data to the CGW 13.
  • the master device 11 controls the vehicle-side program update function in the vehicle program rewriting system 1 and functions as an OTA master.
  • FIG. 1 illustrates a configuration in which the DCM 12 and the vehicle-mounted display 7 are connected to the same first bus 14, a configuration in which the DCM 12 and the vehicle-mounted display 7 are connected to different buses may be used.
  • the CGW 13 may have a configuration in which some or all of the functions of the DCM 12 are provided, or a configuration in which the DCMs 12 have some or all of the functions of the CGW 13. That is, in the master device 11, the function sharing between the DCM 12 and the CGW 13 may be configured in any manner.
  • Master device 11 may be composed of two ECUs, DCM 12 and CGW 13, or may be composed of one integrated ECU having the functions of DCM 12 and CGW 13.
  • the sixth bus 21 is connected to the CGW 13 as a bus outside the vehicle.
  • the sixth bus 21 is connected to a DLC (Data @ Link @ Coupler) connector 22 to which a tool 23 (corresponding to a service tool) is detachably connected.
  • the buses 14 to 18 inside the vehicle and the bus 21 outside the vehicle are constituted by, for example, a CAN (Controller Area Network, registered trademark) bus, and the CGW 13 is a CAN data communication standard or a diagnostic communication standard (UDS (Unified Diagnosis Services). ): Data communication is performed between the DCM 12, the various ECUs 19, and the tool 23 according to ISO14229).
  • the DCM 12 and the CGW 13 may be connected by Ethernet, or the DLC connector 22 and the CGW 13 may be connected by Ethernet.
  • the rewrite target ECU 19 Upon receiving the write data from the CGW 13, the rewrite target ECU 19 writes the received write data in a flash memory (corresponding to a non-volatile memory) to rewrite the application program.
  • the CGW 13 upon receiving a write data acquisition request from the rewrite target ECU 19, the CGW 13 functions as a relog master that distributes the write data to the rewrite target ECU 19.
  • the rewrite target ECU 19 Upon receiving the write data from the CGW 13, the rewrite target ECU 19 writes the received write data into the flash memory and functions as a reprogram slave that rewrites the application program.
  • the mode in which the application program is rewritten wirelessly is a mode in which the ECU 19 to be rewritten is rewritten using an application program acquired from outside the vehicle via wireless.
  • the DCM 12 upon downloading the distribution package from the file server 8, the DCM 12 extracts write data from the downloaded distribution package and transfers the write data to the CGW 13.
  • the CGW 13 functions as a rewrite tool, instructs the rewrite target ECU 19 to write (install) the write data, and distributes the write data transferred from the DCM 12 to the rewrite target ECU 19.
  • the data transfer circuit 34 controls data communication with the buses 15 to 17 in accordance with the CAN data communication standard.
  • the power supply circuit 35 receives a + B power supply, an ACC power supply, and an IG power supply.
  • the power supply detection circuit 36 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 35, compares these detected voltage values with a predetermined voltage threshold value, and compares the detected voltage values.
  • the result is output to the microcomputer 33.
  • the microcomputer 33 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the ECU 19 are normal or abnormal, based on the comparison result input from the power supply detection circuit 27.
  • the ECUs 19 are different in the load of, for example, sensors and actuators to which they are connected, and have basically the same configuration.
  • a state in which the + B power supply, the ACC power supply, and the IG power supply are supplied to the vehicle-side system 4 is referred to as an IG power supply state.
  • a power supply state that provides a power supply suitable for wirelessly updating a program may be considered.
  • a distribution package distributed from the center device 3 to the master device 11 will be described.
  • the vehicle program rewriting system 1 write data provided from a supplier who is a provider of an application program, and rewrite specification data (equivalent to specification data) provided from an OEM.
  • Reprog data is generated from.
  • the rewrite specification data may be generated by the center device 3.
  • the write data provided by the supplier includes difference data corresponding to the difference between the old application program and the new application program, and all data corresponding to the entire new application program.
  • the difference data and all data may be compressed by a known data compression technique.
  • the connection bus indicates a bus to which the ECU 19 is connected.
  • the connection power supply indicates a power supply line to which the ECU 19 is connected.
  • the security access key information indicates key information used for authentication for the CGW 13 to access the rewrite target ECU 19, and includes a random number value or unique information, a key pattern, and a decryption operation pattern.
  • the memory type indicates whether the memory mounted on the rewrite target ECU 19 is a single-sided single memory, a single-sided suspend memory (also called a pseudo-two-sided memory), or a two-sided memory.
  • the rewriting method indicates whether rewriting is performed by self-holding of the power supply or rewriting by power supply control.
  • the DCM 12 When the DCM 12 acquires the rewrite specification data for DCM, the DCM 12 analyzes the obtained rewrite specification data for DCM. When the DCM 12 analyzes the rewrite specification data for DCM, the DCM 12 obtains write data from the address where the update program of the rewrite target ECU 19 is stored, and performs operations related to rewrite such as transferring the obtained write data to the CGW 13. Control.
  • the flash memory 33d of the ECU 19 has, according to the memory configuration, a single memory having one flash surface, a one-suspend memory having two pseudo flash surfaces, and substantially two flash surfaces. It is divided into two-sided memory.
  • the ECU 19 having the one-sided single memory is referred to as a one-sided single memory ECU
  • the ECU 19 having the one-sided suspend memory is referred to as a one-sided suspend memory ECU
  • the ECU 19 having the two-sided memory is referred to as a two-sided memory ECU. Name.
  • the single-sided memory has a single flash side, there is no concept of an operation side or a non-operation side, and the application program cannot be rewritten during the execution of the application program.
  • the one-sided suspend memory and the two-sided memory have a configuration having two flash surfaces, there is a concept of an operation side and a non-operation side, and the non-operation side application program is executed while the operation side application program is being executed. Program can be rewritten. Since the two-sided memory has a configuration in which the flash side is completely separated from the two sides, the application program can be rewritten at an arbitrary timing such as while the vehicle is running.
  • the microcomputer 33 temporarily saves the application program as old data in the difference engine work area.
  • the microcomputer 33 reads out the old data once saved in the difference engine work area, and uses the difference engine included in the replog firmware downloaded from the outside to transfer new data from the read out old data and the difference data stored in the RAM 33c. Restore.
  • the microcomputer 33 When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data and rewrites the application program.
  • the microcomputer 33 executes a boot program and executes a boot program and performs a boot surface determination function in the same manner as the built-in type.
  • the old and new sides are determined from the activation plane determination information of the sides, and which of the sides A and B is the operation side is determined.
  • the microcomputer 33 determines that the side A is the operation side, the microcomputer 33 searches for the start address with reference to the normal time vector table of the side A, and executes the application program of the side A.
  • the microcomputer 33 determines that the side B is the operation side, the microcomputer 33 refers to the normal vector table of the side B, searches for the start address, and executes the application program of the side B.
  • FIG. 22 illustrates a case where the side A is the operation side and the side B is the non-operation side.
  • the old data that is temporarily saved in the difference engine work area may be an application program on the operation side or an application program on the non-operation side.
  • the application program on the B-side can be rewritten in the background while the application program on the A-side is being executed.
  • the rewrite target ECU (ID1) and the rewrite target ECU (ID2) each determine that the transmission request of the version notification signal is received from the master device 11, for example, it determines that the transmission condition of the version notification signal is satisfied.
  • the rewrite target ECU (ID1) transmits to the master device 11 a version notification signal including the version information of the application program stored therein and the ECU (ID) capable of identifying itself. I do.
  • master device 11 transmits the received version notification signal to center device 3.
  • (A) Rewriting Application Program by Power Control A case of rewriting an application program by power control will be described with reference to FIGS. 26 and 27.
  • the rewriting of the application program by the power control means a configuration in which the rewriting operation is controlled according to the switching of the power without using the power self-holding circuit.
  • the vehicle power source is switched from the + B power source to the IG power source by the user switching the IG switch from off to on, the DCM 12, the CGW 13, the two-side memory ECU, the one-side suspend memory ECU, and the one-side single memory ECU operate normally. Is started (t1).
  • the CGW 13 When the CGW 13 starts acquiring the write data from the DCM 12, the CGW 13 shifts from the normal operation to the replog master operation, starts the replog master operation, starts the distribution of the write data to the two-side memory ECU, and instructs the writing of the write data. I do.
  • the two-sided memory ECU starts a programming phase (hereinafter, also referred to as an installation phase) in a normal operation. That is, the two-sided memory ECU performs the installation of the application program in the background while performing the normal operation.
  • the two-sided memory ECU starts writing the received write data to the flash memory, and starts rewriting the application program.
  • the DCM 12 restarts the data transfer / center communication operation
  • the CGW 13 restarts the re-log master operation
  • the two-sided memory ECU restarts the installation phase and restarts rewriting the application program (t6). That is, when the user switches the IG switch from on to off, the vehicle power is switched from the IG power to the + B power, and thereafter, when the user switches from the IG switch off to on, the vehicle power is switched from the + B power to the IG power. Instead, every time a trip occurs, the two-sided memory ECU repeats interruption and restart of rewriting of the application program (t7, t8).
  • the CGW 13 A power activation request is transmitted to the power management ECU 20.
  • the vehicle power source is switched from the + B power source to the IG power source by transmitting the power activation request to the power management ECU 20 by the CGW 13
  • the DCM 12 resumes the data transfer / center communication operation
  • the CGW 13 resumes the re-log master operation.
  • the distribution of the write data to the one-side suspend memory ECU and the one-side single memory ECU is started.
  • the one-side suspend memory ECU suspends the rewriting of the application program.
  • the one-sided suspend memory ECU returns from the non-operational side (Side B) where the rewriting of the application program has been interrupted to the operation side (Side A) as the start-up side.
  • the one-side single memory ECU continues to rewrite the application program even if the IG switch 42 is switched from off to on by a user operation before the rewriting of the application program is completed.
  • the vehicle power is switched from the IG power to the + B power by the user switching from the IG switch on to the off during the rewriting of the application program in the two-sided memory ECU (t25), the vehicle power is switched from the IG power to the + B power.
  • the DCM 12 continues the data transfer / center communication operation
  • the CGW 13 continues the re-program master operation
  • the two-sided memory ECU continues the installation phase, and continues to rewrite the application program.
  • the CGW 13 performs the following check before downloading the distribution package from the center device 3 and before distributing the write data to the rewrite target ECU 19.
  • the CGW 13 checks the radio wave environment, the remaining battery power of the vehicle battery 40, and the memory capacity of the DCM 12 so that the download can be performed normally.
  • the CGW 13 checks the presence of an intrusion sensor and checks the door lock as a check of a manned environment so as not to make the installation environment unstable so that the write data can be normally delivered.
  • Detection, curtain detection, and IG-off detection are performed, and as a check as to whether or not the rewriting target ECU 19 is writable, a version and occurrence of an abnormality are checked.
  • the CGW 13 performs a falsification check, an access authentication, a version check, and the like before starting the installation as a check of the write data to be delivered to the rewrite target ECU 19, and performs a communication interruption check, an abnormality occurrence during the installation.
  • a version check, an integrity check, a DTC (Diagnostic Trouble Code, error code) check, and the like are performed.
  • the CGW 13 switches the display from the navigation screen 501 to the installation consent screen 506, and displays the installation consent screen 506 on the in-vehicle display 7, as shown in FIG.
  • the CGW 13 informs the user of the time required for installation, restrictions and schedule settings on the installation consent screen 506, and displays an "immediate update” button 506a, a "reserve and update” button 506b, and a "return” button 506c. Wait for user operation. In this case, the user can start the installation immediately by operating the “immediate update” button 506a.
  • the CGW 13 includes a configuration for performing a characteristic process, such as a write data acquisition determination unit 76, an installation instruction determination unit 77, a security access key management unit 78, and a write data verification unit 79.
  • a characteristic process such as a write data acquisition determination unit 76, an installation instruction determination unit 77, a security access key management unit 78, and a write data verification unit 79.
  • a control unit 90, a program update notification control unit 91, and a power supply self-holding execution control unit 92 are provided. Functional blocks for performing characteristic processing will be described later.
  • the update suitability determination unit 52c determines that the license contract has been established, the vehicle position is within a predetermined range registered in advance by the user, the setting of the alarm function of the vehicle is enabled, and failure information of the ECU 19 is generated. If it is determined that the vehicle is not in the state, the vehicle state is determined to be a state suitable for updating a program or the like using the distribution package.
  • the update propriety determining unit 52c determines that the license agreement has not been established, the vehicle position is not within the predetermined range registered in advance by the user, the setting of the alarm function of the vehicle has not been enabled, and failure information of the ECU 19 has been generated. If it is determined that the vehicle state is at least one of the states, it is determined that the vehicle state is not a state suitable for updating a program or the like using the distribution package.
  • the master device 11 displays, for example, "The program cannot be updated because the license is invalid. Please consult your dealer.” As a result, it is possible to present to the user a reason that the program or the like is not suitable for updating, and it is possible to present appropriate information to the user.
  • the master device 11 When the master device 11 starts the distribution package download determination process, the master device 11 receives campaign information from the center device 3 (S201, corresponding to a campaign information receiving procedure). The master device 11 determines whether or not the vehicle state is a state in which the distribution package can be downloaded (S202, corresponding to a downloadable determination procedure). When determining that the vehicle state is such that the distribution package can be downloaded (S202: YES), master device 11 downloads the distribution package corresponding to the campaign from center device 3 (S203, corresponding to a download execution procedure). Then, the distribution package download determination processing ends. When the master device 11 determines that the vehicle state is not in a state in which the distribution package can be downloaded (S202: NO), the master device 11 does not download the distribution package from the center device 3, and ends the distribution package download determination process.
  • S202 a state in which the distribution package can be downloaded
  • the CGW 13 determines that the acquisition permission / inhibition flag is the second predetermined value (S402: YES)
  • the CGW 13 sends the write data acquisition request to the DCM 12 without determining the state of data communication between the center apparatus 3 and the DCM 12. And ends the write data acquisition determination process.
  • the installation instruction unit 77b rewrites the installation of the application program. Instruct the target ECU 19. That is, the installation instructing unit 77b has obtained the user's consent regarding the installation, the CGW 13 can perform data communication with the center device 3, the vehicle state can be installed, and the rewrite target ECU 19 can be installed.
  • the installation condition determining unit 77a determines that the write data is normal data, it instructs the rewrite target ECU 19 to install the application program.
  • the installation instruction unit 77b acquires the write data from the DCM 12, and transfers the acquired write data to the rewrite target ECU 19.
  • the CGW 13 has, for example, the remaining battery capacity of the vehicle battery 40 equal to or greater than a predetermined capacity specified by the rewrite specification data, and the vehicle state specified by the rewrite specification data (only the parking state is permitted, or only the traveling state is permitted, or the parking state is determined. If both the state and the running state match, the vehicle state is determined to be installable.
  • the CGW 13 performs the installation instruction determination process before instructing the rewriting target ECU 19 to perform the installation, whereby the first condition that the user consent regarding the installation has been obtained, the data communication with the center apparatus 3 is possible. All of the second condition, the third condition that the vehicle state can be installed, the fourth condition that the rewrite target ECU 19 can be installed, and the fifth condition that the write data is normal data are satisfied.
  • the ECU 19 is instructed to install the application program to the rewrite target ECU 19. It is possible to appropriately instruct the rewriting target ECU 19 to install the application program.
  • the key generation unit 78e searches the secure area 78a, and uses the extracted random number value as the decryption key of the security access key located in the secure area 78a. From the bundle, decryption is performed using a decryption key corresponding to the ECU (ID) to generate a security access key.
  • the key generation unit 78e specifies the key derivation value by the decryption operation pattern extracted by the decryption operation pattern extraction unit 78d using the decryption key specified by the key pattern extracted by the key pattern extraction unit 78c.
  • the decoding is performed according to the decoding operation method.
  • (6-2) Security Access Key Erasing Process Upon starting the security access key erasing process, the CGW 13 determines whether the rewriting of the application program of the ECU 19 to be rewritten has been completed (S611). When the CGW 13 determines that the rewriting of the application program of the rewriting target ECU 19 has been completed (S611: YES), the CGW 13 executes a security access key generation process to delete the generated security access key (S612), and deletes the security access key. The process ends.
  • the CGW 13 performs a security access key management process to extract a random value corresponding to the rewrite target ECU 19 from the analysis result of the rewrite specification data, and stores the random number in the secure area 78a.
  • the decryption is performed using the decryption key corresponding to the rewriting target ECU 19 to generate the security access key.
  • the center device 3 transmits a distribution package including write data and an authenticator to the master device 11 in accordance with the download request.
  • the write data transmitted from the center device 3 to the master device 11 is a ciphertext
  • the authenticator transmitted from the center device 3 to the master device 11 is also a ciphertext.
  • the authenticator transmitted from the center device 3 to the master device 11 may be plain text.
  • a decryption process described later is not necessary.
  • the CGW 13 notifies the DCM 12 of a process execution request of the decryption process, the first verification value calculation process, the second verification value calculation process, and the comparison process.
  • the DCM 12 is notified by the CGW 13 of a request to execute a decoding process, a first verification value calculation process, a second verification value calculation process, and a comparison process, the decoding process, the first verification value calculation process, and the second verification value calculation process .
  • the comparison process is sequentially performed.
  • the DCM 12 executes the processing result notification processing, and notifies the CGW 13 of the comparison result of the comparison processing as the processing result.
  • the CGW 13 notifies the DCM 12 of a process execution request of the decryption process, the first verification value calculation process, the second verification value calculation process, the comparison process, and the determination process.
  • the DCM 12 is notified by the CGW 13 of a processing execution request for the decoding processing, the first verification value calculation processing, the second verification value calculation processing, the comparison processing, and the determination processing, the decoding processing, the first verification value calculation processing, and the second verification
  • the value calculation process, the comparison process, and the determination process are sequentially performed.
  • the DCM 12 executes a process result notification process, and notifies the CGW 13 of a result of the determination process as a process result.
  • the CGW 13 In the configuration in which the CGW 13 performs the first verification value calculation process illustrated in FIG. 74, the CGW 13 holds the key (key value) and performs the verification process without transmitting the key to the DCM 12, so that the DCM 12 Security can be improved as compared with a configuration in which calculation processing is performed.
  • the first verification value calculation process may be performed using a common key (key value) common to the plurality of rewriting target ECUs 19, or different individual rewriting target ECUs 19 may be used.
  • the first verification value calculation process may be performed using a key (key value).
  • the transmission control process of data storage surface information will be described with reference to FIGS.
  • the vehicle program rewriting system 1 performs transmission control processing of data storage surface information in the CGW 13.
  • the CGW 13 includes a data storage surface information acquisition unit 80a, a data storage surface information transmission unit 80b, a rewrite method identification unit 80c, a rewrite method instruction unit 80d.
  • the data storage surface information acquisition unit 80a acquires information on hardware and software from each ECU 19 as ECU configuration information. Specifically, in the case of a two-sided memory ECU and a one-sided suspend memory ECU having a plurality of data storage surfaces, a software ID including version information of each data storage surface and information capable of specifying an operation surface are replaced with two-surface rewriting information ( Hereinafter, this is referred to as surface information).
  • the data storage surface information transmission unit 80b transmits the acquired surface information as one of the ECU configuration information from the DCM 12 to the center device 3. Send.
  • the data storage surface information transmitting unit 80b may transmit the ECU configuration information to the center device 3 every time the IG switch 42 is turned on or off, or may transmit the ECU configuration information to the center device 3 in response to a request from the center device 3. May be transmitted. Further, the data storage surface information transmitting unit 80b may transmit not only the two-surface memory ECU and the one-surface suspend memory ECU but also the one-side single memory ECU together with the ECU configuration including the surface information.
  • the CGW 13 executes a data storage surface information transmission control program, and performs a data storage surface information transmission control process.
  • the CGW 13 causes all of the ECUs (ID1), ECUs (ID2), and ECUs (ID3) to transition from the stopped state or the sleep state to the activated state.
  • the CGW 13 keeps all of the ECUs (ID1), ECUs (ID2), and ECUs (ID3) in the activated state, and distributes the write data to the ECUs (ID1).
  • the CGW 13 distributes the write data to the ECU (ID2).
  • the CGW 13 distributes the write data to the ECU (ID3).
  • the CGW 13 When the distribution of the write data to the ECU (ID3) is completed, the CGW 13 causes all of the ECUs (ID1), the ECUs (ID2), and the ECUs (ID3) to transition from the start state to the stop state or the sleep state. As described above, the CGW 13 controls all of the plurality of rewrite target ECUs 19 to be in the activated state until all the installation is completed. Here, the CGW 13 may simultaneously and concurrently distribute the write data to the ECU (ID1), the ECU (ID2), and the ECU (ID3).
  • the CGW 13 when the ECU 44 which does not need to operate while the vehicle is running is connected to the + B power supply line 37 but is not connected to the ACC power supply line 38 and the IG power supply line 39, the CGW 13 Then, the ECU 44 that does not need to operate during the traveling of the vehicle is shifted from the start state to the stop state or the sleep state.
  • the ECU 44 is, for example, an ECU having a function of preventing theft.
  • the CGW 13 causes the ECUs 44 that do not need to operate and are not to be rewritten to transition to the stop state or the sleep state. As a result, an increase in power consumption due to installation while the vehicle is running can be suppressed.
  • the CGW 13 determines that the rewriting can be interrupted (S917: YES)
  • the CGW 13 interrupts the distribution of the write data (S918).
  • the CGW 13 determines that the rewriting cannot be interrupted (S917: NO)
  • the CGW 13 causes all of the non-rewriting target ECUs 19 that can shift to the stop state or the sleep state to shift to the stop state or the sleep state (S919).
  • the CGW 13 excludes the ECU 19 having a specific function such as an alarm function from the targets to be shifted to the stop state or the sleep state, and activates the non-rewritable ECU 19 except the ECU 19 having the specific function. May be shifted to a stop state or a sleep state.
  • the CGW 13 may set the non-rewrite target ECU 19 except the ECU 19 that can communicate with the rewrite target ECU 19 to the stop state or the sleep state.
  • the CGW 13 includes a first correspondence specification unit 83a, a second correspondence specification unit 83b, an allowable transmission amount specification unit 83c, and a distribution frequency specification unit 83d. And a bus load measuring unit 83e and a distribution control unit 83f.
  • the CGW 13 determines that the measured bus load exceeds the allowable transmission amount (S1106: YES), the CGW 13 calculates an interval at which the bus load does not exceed the allowable transmission amount (S1108), and determines the distribution interval of the write data.
  • the calculated interval is set and distribution of the write data to the rewriting target ECU 19 is started as shown in FIG. 104 (S1109, corresponding to a distribution control procedure).
  • the CGW 13 determines whether the distribution of the write data to the rewrite target ECU 19 has been completed, and determines whether or not the measured bus load exceeds the allowable transmission amount. Is continuously determined (S1110, S1011). When the CGW 13 determines that the measured bus load does not exceed the transmission allowable amount (S1111: NO), the CGW 13 sets the distribution interval of the write data to the shortest interval set in advance and sends the write data to the ECU 19 to be rewritten. The distribution interval is changed (S1112).
  • the CGW 13 performs the write data distribution control process to distribute the write data to the rewrite target ECU 19 using the correspondence between the predetermined power supply state and the distribution frequency of the write data.
  • the frequency is specified, and the distribution of the write data is controlled according to the distribution frequency. Data collisions and delays during installation can be suppressed. Further, the distribution of the write data can be made to coexist without obstructing the distribution of the vehicle control data on the same bus.
  • the CGW 13 adjusts the distribution amount of the write data within a free space that does not hinder the transmission of application data such as vehicle control and diagnosis.
  • the transmission interval of the application data for vehicle control, diagnosis, and the like is increased to the maximum allowable interval.
  • the bus load may be reduced.
  • the delivery amount of the write data may be relatively increased by reducing the bus load by increasing the transmission interval of the application data by the vehicle system.
  • the vehicle program rewriting system 1 performs an activation request instruction process in the CGW 13.
  • the CGW 13 issues an activation request to the plurality of rewriting target ECUs 19 that have completed the rewriting of the application program in order to validate the rewritten program.
  • the CGW 13 analyzes the rewrite specification data for the CGW, so that the CGW 13 grasps the group of the ECU 19 to be rewritten. Note that the CGW 13 makes an activation request only during parking, and does not make an activation request while the vehicle is running.
  • the activation executable determining unit 84c determines whether the activation can be performed.
  • the activation executable determination unit 84c determines that activation can be performed when the activation is approved by the user and the vehicle is parked.
  • the activation request instructing unit 84d instructs an activation request when the activation executable determination unit 84c determines that activation can be performed. Specifically, the activation request instructing unit 84d issues an activation request by instructing a reset request, monitoring a session shift timeout, or monitoring an internal reset of the rewrite target ECU 19 after instructing a switch to a new surface. Indicate the request.
  • the application program is activated by starting up on the new side (non-operational side) in which the application program is written.
  • the one-side single memory ECU activates the application program by restarting.
  • the rewrite target ECU 19 may be configured to reset itself after receiving an instruction to switch to a new surface, without depending on the activate request.
  • the CGW 13 determines that activation can be performed on the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 starts an activation request instruction process.
  • the CGW 13 instructs the rewrite target ECU 19 to request switching to a new surface (S1204).
  • the CGW 13 requests the power management ECU 20 to switch the IG power from off to on (S1205).
  • the CGW 13 switches the IG power from off to on in order to perform activation, although the vehicle is parked and the IG switch 42 is off.
  • the CGW 13 performs activation following installation, since the IG power is on, the CGW 13 does not perform S1205, but issues a startup request (wakeup request) to the rewrite target ECU 19 in the sleep state.
  • the rewrite target ECU 19 When the rewrite target ECU 19 is a one-side suspend memory ECU or a two-side memory ECU, the rewrite target ECU 19 updates the operation surface information (side A or B) stored in the flash memory, and the new application pro program By switching the written surface to the operation surface, the old application program is switched to the new application program.
  • the operation surface information side A or B
  • the rewrite target ECU 19 corresponding to the software reset request forcibly resets itself and activates.
  • the power supply to the rewrite target ECU 19 of the ACC system or IG system ECU is forcibly stopped.
  • the rewriting target ECU 19 of the + B power supply system ECU is always supplied with power, unlike the rewriting target ECU 19 of the ACC or IG system ECU.
  • the activation method for each rewrite target ECU 19 is specified by the rewrite specification data.
  • FIG. 111 shows a case where the rewriting target ECU 19 is a two-sided memory ECU or a one-sided suspended memory ECU.
  • the CGW 13 performs the activation request instructing process, so that the plurality of rewriting target ECUs 19 that have completed the rewriting of the application program switch from the old program to the new program at their own timing. Is avoided in advance, and the timing of switching from the old program to the new program is appropriately adjusted in the plurality of rewrite target ECUs 19. That is, it is possible to avoid a situation in which the program versions of the plurality of rewriting target ECUs 19 that cooperate with each other are in an inconsistent state, thereby causing inconvenience in the cooperative processing.
  • the activation execution control process is a process performed by the rewrite target ECU 19 to which the activation request has been instructed from the CGW 13 in conjunction with the CGW 13 performing the above-described (12) activation request instructing process.
  • the rewriting target ECU 19 performs an activation execution control process.
  • the rewriting target ECU 19 has a plurality of data storage surfaces such as a one-side suspend type memory and a two-side memory.
  • the rewrite target ECU 19 has a first data storage surface and a second data storage surface, and is in a state where installation of rewrite data has been completed on a non-operation surface (new surface).
  • the ECU 19 of the activation execution control unit 107 includes an operation surface information update unit 107a, an execution condition determination unit 107b, an execution control unit 107c, and a notification unit 107d.
  • the operation surface information updating unit 107a updates the activation surface determination information (operation surface information) of the flash memory for the next restart.
  • the operation side information updating unit 107a for example, is currently running on the side A and updates the operation side information from the side A to the side B when a new program is written on the side B.
  • the rewrite target ECU 19 executes the activation execution control program, and performs the activation execution control process.
  • (13-1) Rewriting Process When the rewriting process is started, the rewriting target ECU 19 performs a process immediately before a memory deletion such as a part number reading or an authentication as a pre-rewriting process (S1301). The rewrite target ECU 19 determines whether or not rewrite surface information has been received from the center device 3 (S1302). The rewrite target ECU 19 determines whether or not the rewrite surface information has been received based on, for example, whether or not the rewrite surface information described in the rewrite specification data included in the distribution package has been acquired from the CGW 13.
  • the rewrite target ECU 19 determines that the rewrite surface information has been received from the center device 3 (S1302: YES)
  • the rewrite target ECU 19 compares the rewrite surface information with the rewrite surface information (operation surface information) managed by itself, and both of them are compared. It is determined whether they match (S1303).
  • the rewrite surface information is described in, for example, rewrite specification data transmitted from the center device 3.
  • the rewriting side information described in the rewriting specification data is the non-operation side (B)
  • the rewrite side information described in the specification data indicates the operation side (side A)
  • the rewrite process performs memory erasure, writing of write data, and verification (S1304), and ends the rewrite process. Verification is, for example, verification of the integrity of data written in a flash memory.
  • the rewrite target ECU 19 transmits a negative response to the CGW 13 (S1305), and ends the rewrite processing.
  • the rewriting target ECU 19 sets the non-operation side as a rewriting plane and determines whether or not the rewriting of the application program to the rewriting plane has been completed ( S1311).
  • the rewriting target ECU 19 determines that the rewriting of the application program on the rewriting surface has been completed (S1311: YES)
  • the rewriting target ECU 19 verifies the integrity of the application program written in the flash memory, and determines whether the data verification after the rewriting is correct or not. (S1312).
  • the rewrite target ECU 19 determines that the data verification after the rewrite is positive (S1312: YES)
  • the rewrite target ECU 19 sets the new surface rewrite completion flag to “OK” and stores it (S1313).
  • the rewrite target ECU 19 determines whether or not an activation request has been instructed by the CGW 13 (S1314).
  • the rewrite target ECU 19 determines whether the new side rewrite completion flag is “OK” (S1315), and sets the new side rewrite completion flag to “OK”.
  • the operation side information is updated (S1316, corresponding to the operation side information update procedure). That is, for example, when the operation side is the side A and the non-operation side is the side B, the rewriting target ECU 19 completes the rewriting of the application program to the rewriting side with the side B as the rewriting side.
  • the operation side information indicating that the A side and the non-operation side are the B side is updated to the operation side information indicating that the operation side is the B side and the non-operation side is the A side.
  • the rewrite target ECU 19 determines whether a software reset request has been received from the CGW 13, whether the CGW 13 has issued a power reset request to the power management ECU 20, and whether or not the software reset request has been issued. It is determined whether or not the communication with the CGW 13 has been interrupted for a predetermined time, and it is determined whether or not the activation execution condition has been satisfied (S1317, corresponding to an execution condition determination procedure).
  • the rewriting target ECU 19 is restarted when any of these activation execution conditions is satisfied, or the restart condition is determined by each ECU.
  • the rewrite target ECU 19 may be one of: a request for a software reset from the CGW 13; a request for a power reset from the CGW 13 to the power management ECU 20; Is determined (S1317: YES), restart (reset) is executed.
  • the rewriting target ECU 19 starts the new side (Side B) as a start plane according to the updated operation plane information (S1318, corresponding to a start control procedure), and executes the activation execution control processing. finish. That is, after the restart, the rewriting target ECU 19 starts on the side B on which the application program is installed.
  • the rewrite target ECU 19 determines that the rewriting of the application program to the new side has not been completed (S1311: NO), or determines that the data verification after the rewriting has not been performed (S1312: NO), the activation request is instructed. It is determined whether or not the activation has been instructed (S1319), and if it is determined that the activation request has been instructed (S1319: YES), a negative response is transmitted to CGW 13 (S1320), and the process returns to step S1311. If the rewrite target ECU 19 determines that the data verification after the rewrite is negative, the rewrite target ECU 19 may terminate the activation execution control process and perform a process such as rollback. If the rewrite target ECU 19 determines that the rewrite completion flag of the new surface is not “OK” (S1315: NO), it transmits a negative response to the CGW 13 (S1321), and returns to step S1311.
  • the rewrite target ECU 19 performs the activation execution control process, and when an activation request is instructed from the CGW 13, the operation target information is updated for the next restart, and the activation execution condition is set. Is established, after the restart, a new plane is switched to switch the boot plane from the old plane to the new plane according to the operation plane information. That is, even if the installation of the update program is completed, the rewrite target ECU 19 does not start with the update program unless the CGW 13 instructs activation. For example, even if the rewriting target ECU 19 is restarted due to the user operating the IG switch off 42 from off to on, if the activation is not instructed by the CGW 13, the ECU 19 starts up on the same operation side.
  • the CGW 13 simultaneously instructs the plurality of rewrite target ECUs 19 to activate, and then performs a restart by software reset, power supply reset, or session timeout, whereby the update programs of the plurality of rewrite target ECUs 19 can be simultaneously activated. .
  • the case where the number of data storage surfaces is two has been described, but the same applies to the case where there are three or more data storage surfaces.
  • the group management processing for rewriting will be described with reference to FIGS.
  • the vehicle program rewriting system 1 performs a group management process for rewriting in the CGW 13.
  • the CGW 13 simultaneously instructs at least one rewrite target ECU 19 belonging to the same group to activate the application program. Further, the CGW 13 performs control from installation to activation in units of groups.
  • the ECU (ID1) and the ECU (ID2) are the rewrite target ECUs 19 of the first group
  • the ECU (ID11), the ECU (ID12), and the ECU (ID13) are the rewrite target ECUs 19 of the second group. .
  • the CGW 13 When the CGW 13 determines that the rewrite target ECU 19 belonging to a different group from the previous rewrite target ECU 19 is to be rewritten (S1405: YES), the CGW 13 shifts to an activation request instruction process (S1408, corresponding to an instruction execution procedure).
  • the CGW 13 determines the rewrite timing of the next rewrite target ECU 19 (S1413, S1314). That is, the CGW 13 determines the rewrite timing of the rewrite target ECU 19 belonging to the second group. If the CGW 13 determines that the next rewrite timing of the rewrite target ECU 19 is the next switchover from the user boarding to the getting off (S1413: YES), the CGW 13 switches the IG power from on to off (S1415), and issues an activation request instruction process. Is completed, and the process returns to the group management process for rewriting.
  • the CGW 13 sets, for example, a time period in which the execution of the update of the application program is permitted by the user in advance. Installation will be performed in the parking state. In this case, the CGW 13 instructs the power management ECU 20 to turn off the IG power so as to return to the original parking state.
  • the CGW 13 determines that the next rewrite target ECU 19 does not exist (S1411: NO)
  • the CGW 13 instructs the rewrite target ECU 19 belonging to the rewrite completed group to activate (S1418), and switches the IG power supply from on to off (S1419). )
  • the activation request instructing process is terminated, and the process returns to the rewriting target group management process.
  • the CGW 13 instructs the ECU (ID11), the ECU (ID12), and the ECU (ID12) to activate the update program, and instructs the power management ECU 20 to turn off the IG power after the activation is completed.
  • the relationship between the ECU (ID1) and the ECU (ID2) is controlled in cooperation. If the ECUs (ID11), the ECUs (ID12), and the ECUs (ID13) are in a relationship of cooperative control, in the distribution package, the ECU (ID1) and the ECU (ID2) belong to the rewriting target ECU 19 as a first group. The ECU (ID11), the ECU (ID12), and the ECU (ID13) belong to two groups as the rewrite target ECU 19.
  • the CGW 13 When the ECU (ID1) and the ECU (ID2) belonging to the first group complete the rewriting of the application program, the CGW 13 simultaneously issues an activation request to the ECU (ID1) and the ECU (ID2). After that, the CGW 13 rewrites the application program in the ECU (ID11), the ECU (ID12), and the ECU (ID13) belonging to the second group, and when all are completed, the ECU (ID11), the ECU (ID12), and the ECU (ID13). ) Instruct an activation request. It should be noted that the rewriting target ECU 19, which is a single-sided memory, is instructed to be restarted to be an activation instruction.
  • the CGW 13 instructs the activation request on a group-by-group basis by performing the group management process of the ECU 19 whose activation request is rewritten. It is possible to simultaneously upgrade the versions of a plurality of ECUs that are involved in the cooperative control. In other words, it is possible to avoid a situation in which the versions of the application programs of the plurality of rewrite target ECUs 19 that are related to the cooperative control are inconsistent and the process of performing the cooperative control is inconvenient.
  • the CGW 13 performs installation in a predetermined order on a group basis. That is, the CGW 13 controls so that the process from installation to activation is performed in group units.
  • the CGW 13 refers to the memory type of the rewrite specification data, and determines the installation order according to the memory type of the ECU 19 to be rewritten. For example, a two-sided memory, a one-sided suspend memory, and a one-sided single memory are assumed. Further, the CGW 13 has in advance information as to which of the data transmission side and the data reception side as the information of the ECUs 19 that are in a cooperative relationship, and determines the installation order of the rewrite target ECUs 19 based on the information.
  • the CGW 13 instructs the first rewrite target ECU 19 and the second rewrite target ECU 19 belonging to the same group to install, the CGW 13 succeeds in installation in the first rewrite target ECU 19 and fails in installation in the second rewrite target ECU 19. Then, a rollback is instructed to the second rewrite target ECU 19 and a rollback is instructed to the first rewrite target ECU 19.
  • the CGW 13 When the CGW 13 instructs the rewrite target ECU 19 belonging to the first group and the rewrite target ECU 19 belonging to the second group to perform the installation, the CGW 13 performs the second The rewriting target ECU 19 belonging to the group is instructed. For example, in FIG. 116, when the rewriting of the second group is performed in the state where the installation failed in the rewriting target ECU 19 belonging to the first group (S1405; YES), the CGW 13 instructs the activation request to the first group (S1408). ) Is skipped, and the process proceeds to step S1407. Then, the CGW 13 returns to step S1403, starts installation of the second group, and when the installation is completed, performs an activation request instruction process for the second group (S1408). That is, the CGW 13 executes the update for the second group even if the update for the first group has failed.
  • Rollback Execution Control Process The rollback execution control process will be described with reference to FIGS. 119 to 130.
  • the vehicle program rewriting system 1 performs a rollback execution control process in the CGW 13.
  • Rollback is writing or rewriting for restoring the memory of the rewriting target ECU 19 to a predetermined state, such as returning the application program to the original version when rewriting of the application program is interrupted.
  • the purpose is to return the state of the target ECU 19 to the state before the writing of the write data is started.
  • the rollback method specifying unit 86b specifies the first rollback processing, the second rollback processing, or the third rollback processing according to the memory type and the data type.
  • the rollback execution unit 86c instructs the rewrite target ECU 19 to perform rollback according to the rollback method, and operates the rewrite target ECU 19 with the old program. That is, the rollback execution unit 86c performs a rollback to return the operation state of the rewrite target ECU 19 to a state before the start of the rewriting of the application program.
  • the rewrite target ECU 19 restores the new application program using the current application program written in the flash memory and the difference data acquired from the CGW 13, and writes the new application program. .
  • the writing target ECU 19 cannot restore the new application program from the difference data. Therefore, in the single-sided memory, a process of temporarily rewriting the new application program is required.
  • the rewrite program (rewrite data) is a difference for updating version 1.0 to version 2.0.
  • the rollback rewrite data is difference data for updating version 2.0 from version 2.0 to version 1.0.
  • the CGW 13 When the CGW 13 determines that the rollback write data is all data (S1516: YES), the CGW 13 shifts to a first rollback process (S1518, corresponding to a rollback execution procedure). Upon starting the first rollback process, the CGW 13 immediately suspends the distribution of the write data as the new program (S1531). Then, the CGW 13 acquires the rollback write data (old program), which is all data, from the DCM 12 and distributes the rollback write data to the ECU 19 to be rewritten. The rewrite target ECU 19 writes the data of the old application program acquired from the CGW 13 into the flash memory and rewrites the old application program (S1532), terminates the first rollback processing, and returns to the cancellation request determination processing.
  • S1518 corresponding to a rollback execution procedure
  • the CGW 13 determines that the rollback write data is difference data (S1517: YES)
  • the CGW 13 shifts to a second rollback process (S1519, corresponding to a rollback execution procedure).
  • the CGW 13 continues to distribute the write data as the new program (S1541), restores the difference data in the rewrite target ECU 19, writes the difference data in the flash memory, and rewrites the new application program. (S1542).
  • the CGW 13 delivers the write data of the old application program acquired from the DCM 12 to the rewriting target ECU 19 (S1543).
  • the rewrite target ECU 19 restores the difference data that is the write data of the old application program, writes the difference data in the flash memory and rewrites the old application program (S1544), ends the second rollback processing, and returns to the cancellation request determination processing.
  • the CGW 13 determines whether activation has been completed (S1522), and determines whether a cancel request has occurred. (S1523).
  • the CGW 13 determines whether a cancel request has occurred before the activation is completed, that is, if a cancel request has occurred during the activation (S1523: YES). If the CGW 13 determines whether the activation instruction has reached the ECU 19 to be rewritten. Then, it is determined whether the switching of the operation side is completed (S1524).
  • the CGW 13 performs the rollback execution control process, and when a rewrite cancellation request occurs during the rewriting of an application program, the CGW 13 checks the operation state of the rewriting target ECU 19 from the user's perspective. Is restored to the state before the start of the rewriting of. As a result, all the rewrite target ECUs 19 belonging to the same group can be simultaneously returned to the original program version. Further, even when the difference data is used in the next program update, the write data can be correctly restored.
  • the CGW 13 specifies rewriting of the application program in the rewriting target ECU 19 by specifying any of the internal state of the rewriting target ECU 19, specifying an instruction from the center device 3, and specifying a user operation.
  • the CGW 13 determines whether the rewrite is a normal rewrite (install) or a rollback rewrite (uninstall).
  • the CGW 13 specifies the internal state of the ECU 19 to be rewritten, specifies an instruction from the center device 3, or specifies a user operation.
  • the rewriting progress at the time of normal or rollback is calculated based on the result of the determination, and the display of the calculated progress is instructed to the display terminal 5.
  • the CGW 13 determines that rewriting has not been completed for all the rewriting target ECUs 19 (S1607: NO), the CGW 13 returns to step S1601, and repeats the steps from step S1601.
  • the CGW 13 displays the progress of the rewriting target ECU (ID2) to be installed next, for example, after S1601.
  • the data identification information and the data verification value are attached to the difference data and are distributed from the CGW 13 together with the difference data.
  • the data identification information and the data verification value may be attached as header information of the difference data, and the header information may be delivered to the rewrite target ECU 19 before the CGW 13 delivers the difference data to the rewrite target ECU 19.
  • the rewrite target ECU 19 determines the consistency of the difference data using the data identification information and the data verification value.
  • the rewrite target ECU 19 may acquire identification information capable of specifying an address from the CGW 13 before acquiring write data from the CGW 13.
  • the rewrite target ECU 19 may acquire identification information that can specify an address when acquiring write data from the CGW 13.
  • the rewrite target ECU 19 receives the rewrite specification data from the CGW 13 before acquiring the write data, for example, and acquires the rewrite surface information.
  • the rewritable surface information includes data that can identify which surface is the start surface and which surface is the rewritable surface. Used as
  • the CGW 13 instructs the installation while the vehicle is running.
  • the two-sided memory ECU performs the installation while the vehicle is running (corresponding to an installation execution procedure).
  • the CGW 13 instructs the installation during parking.
  • the one-side suspend memory ECU and the one-side single memory ECU perform installation during parking (corresponding to an installation execution procedure) when an installation instruction is issued from the CGW 13 during parking.
  • the rewriting target ECU 19 executes the operation rewriting program while executing the operation application program in the configuration having a plurality of data storage surfaces by performing the rewriting execution control process. And rewrite non-operational aspects.
  • the period in which the application program can be rewritten is not limited to the parking state, and the application program can be rewritten even while the vehicle is running. If the rewrite target ECU 19 is a two-sided memory ECU, the installation is instructed by the CGW 13 while the vehicle is running, so that the installation can be performed while the vehicle is running. If the rewrite target ECU 19 is a one-side suspended memory ECU or a one-side single memory ECU, the installation can be performed during parking by instructing the installation from the CGW 13 during parking.
  • the wired rewriting program has a configuration in which the wired rewriting program is arranged outside the wired diagnostic program, and the state is changed from the wired diagnostic session to the wired rewriting session during execution of the vehicle control program and the wireless diagnostic program as described later.
  • the control is performed so that the execution of the vehicle control program and the wireless diagnosis program is stopped, and the execution of the wired rewriting program is started.
  • the application execution unit 105a stops execution of the vehicle control program and the wireless diagnostic program, and starts execution of the wired rewrite program, so that the vehicle control program, the wireless diagnostic program, and the wired rewrite program cannot be simultaneously executed.
  • Only the wired rewriting program can be executed. That is, the application execution unit 105a does not allow the vehicle control, the diagnosis of the ECU 19 by wireless, and the rewriting of the application program by wire at the same time, but only the rewriting of the application program by wire. Control.
  • the application execution unit 105a includes, as the state transition of the first state, a default session capable of controlling the vehicle in accordance with the diagnostic communication standard, a wired diagnostic session capable of performing a diagnosis of the ECU 19 from outside the vehicle via a cable, A state transition is exclusively performed between a wired rewriting session in which an application program acquired from the PC and a wired rewriting session can be rewritten.
  • Exclusively performing a state transition of a session means that the session cannot be simultaneously established, and non-exclusively performing a state transition of the session means that a session can be simultaneously established.
  • the diagnostic program related to the diagnosis of the ECU 19 is a program for stopping communication, performing a diagnostic mask, driving an actuator, and the like.
  • the wire rewriting session is a mode for executing rewriting of an application program acquired from outside the vehicle via a wire.
  • the application execution unit 105a shifts from the first default session to the wire diagnostic session by a diagnostic session shift request, and then changes the wire diagnostic session from the wire diagnostic session by a rewrite session shift request. Shift to the session and execute the wire rewriting process.
  • a session return request occurs, a timeout occurs, the power is turned off, or a legal service is received in the state of the wire rewriting session
  • the application execution unit 105a shifts from the wire rewriting session to the first default session. Further, the application execution unit 105a maintains the current session without shifting the current session in response to the session maintenance request.
  • the application execution unit 105a performs, as the state transition of the second state, a default session capable of controlling the vehicle in accordance with the diagnostic communication standard and a wireless rewriting session related to rewriting the application program acquired from outside the vehicle via wireless. Make state transition exclusively.
  • the wireless rewriting session is a mode for executing rewriting of an application program acquired from outside the vehicle via wireless.
  • the application execution unit 105a manages the first state related to the special processing by wire and the second state related to the special processing by wireless while executing the vehicle control program as the first program. For example, when a wired diagnosis request occurs in the default session in both the first state and the second state, the application execution unit 105a shifts the first state to the wired diagnosis session while continuing the vehicle control program, and Start execution. In this state, when a wireless rewriting request is generated, the application executing unit 105a shifts the second state to a wireless rewriting session while continuing to execute the vehicle control program and the wired diagnostic program, and starts executing the wireless rewriting program. I do.
  • the application execution unit 105a ends, for example, execution of the wireless rewrite program, shifts the second state to the default session, ends execution of the wire diagnostic program, and terminates the first state. Is shifted to a wired rewriting session, and the execution of the wired rewriting program is started.
  • the application execution unit 105a exclusively makes a state transition so that the wired rewriting session in the first state and the wireless rewriting session in the second state are not established at the same time in order to prevent a collision in the writing process to the same memory area. (Exclusively controlled).
  • the second state may be configured to manage three states: a default session, a wireless diagnosis session, and a wireless rewrite session.
  • the wireless diagnostic session is a mode in which a wireless diagnostic program for performing a diagnosis of the ECU 19 from outside the vehicle via wireless is executed. At least when executing a wireless diagnostic program that can affect vehicle control, the process is shifted to a wireless diagnostic session.
  • the application execution unit 105a performs the state transition of the second state as follows.
  • the application execution unit 105a shifts from the second default session to the wireless diagnosis session in response to the request for shifting the diagnostic session, and executes wireless diagnosis processing.
  • a session return request occurs in the state of the wireless diagnostic session, a timeout occurs, or the power is turned off, the application execution unit 105a shifts from the wireless diagnostic session to the second default session.
  • the application execution unit 105a shifts the wireless default session from the second default session to the wireless diagnostic session by the diagnostic session shift request, and then changes the wireless diagnostic session from the wireless diagnostic session by the rewrite session shift request.
  • the session is shifted to the session or the second default session is shifted to the wireless rewriting session by the rewriting session shift request, and the wireless rewriting process is executed.
  • a session return request occurs in the state of the wireless rewrite session, a timeout occurs, or the power is turned off, the application execution unit 105a shifts from the wireless rewrite session to the second default session.
  • the application executing unit 105a ends the vehicle control program and executes only the wire-based rewriting program.
  • the application execution unit 105a ends the wireless diagnostic program and the vehicle control program, and executes only the wired rewriting program. That is, the application executing unit 105a exclusively controls the first to third programs as a dedicated mode for executing only the fourth program, that is, the wired rewriting program.
  • the arbitration of each program is partially different from that in FIG. That is, in a configuration in which the wireless rewriting program is incorporated as a part of the wireless diagnostic program and the wired rewriting program is incorporated as a part of the wired diagnostic program, the program execution in each session in the first state and the second state is performed.
  • the arbitration is as shown in FIG.
  • the application execution unit 105a executes the vehicle rewriting program while executing the vehicle control program.
  • the application execution unit 105a simultaneously executes the wired rewrite program and the wireless diagnostic program while executing the vehicle control program.
  • the microcomputer 33 When the microcomputer 33 detects and activates the power-on, the microcomputer 33 executes a session establishment program to perform a state transition management process, and manages a state transition management process for managing a first state transition and a state transition management process for managing a second state transition. And state transition management processing.
  • a state transition management process For managing a first state transition and a state transition management process for managing a second state transition.
  • state transition management processing state transition management processing.
  • each state transition management process will be described.
  • the application execution unit 105a manages the second state by the configuration shown in FIG. 158, that is, the configuration having no wireless diagnostic session.
  • the microcomputer 33 detects power-on and starts up.
  • the microcomputer 33 determines a rewrite completion flag and determines the last application program. It is determined whether the rewriting has been completed normally (S1901).
  • the microcomputer 33 determines that the rewriting completion flag is positive and determines that the previous rewriting of the application program has been completed normally (S1901: YES)
  • the microcomputer 33 shifts the first state to the default session (S1902). That is, the microcomputer 33 starts the vehicle control process by shifting the first state to the default session.
  • the microcomputer 33 determines that the completion condition of the wire diagnosis process is satisfied (S1908), and determines that the completion condition of the wire diagnosis process is satisfied (S1908: YES), ends the wire diagnosis program, and ends the wire diagnosis process. (S1909), the first state is shifted from the wired diagnostic session to the default session (S1910).
  • the microcomputer 33 determines that the wireless rewriting session priority condition is satisfied (S1924: YES)
  • the microcomputer 33 discards the wired rewriting request and continues wireless rewriting (S1927). That is, the microcomputer 33 maintains the second state in the wireless rewriting session, continues the execution of the wireless rewriting program, and specifies that the first state cannot be shifted to the wired rewriting session (S1928).
  • the microcomputer 33 ends the rewrite exclusion process when the wired rewrite request is generated, and returns to the first state transition management process.
  • the microcomputer 33 determines that the condition for completing the wire rewriting process is satisfied (S1915), and determines that the condition for completing the wire rewriting process is satisfied (S1915: YES). Is shifted from the wired rewriting session to the default session (S1917).
  • the completion condition of the wired rewriting process is, for example, a case where the writing of the application program is completely completed and the integrity verification is executed.
  • the microcomputer 33 ends the wireless rewriting program with the shift to the default session.
  • the microcomputer 33 determines that the remaining amount of unrewritten wireless rewriting is not equal to or larger than the predetermined amount (S1931: NO)
  • the microcomputer 33 discards the wired rewriting request and continues wireless rewriting (S1927). That is, the microcomputer 33 suspends the wireless rewriting session if the remaining time until the completion of the wireless rewriting is relatively long, but suspends the wireless rewriting session if the remaining time before the completion of the wireless rewriting is relatively short. To be continued.
  • the microcomputer 33 When the microcomputer 33 determines that the wireless rewriting session priority condition is satisfied (S1963: YES), the microcomputer 33 shifts the wire rewriting session to the default session by a session return request in the first state, and suspends the wire rewriting (S1966). It is specified that the second state can be shifted to the wireless rewriting session (S1962). The microcomputer 33 ends the wired rewriting program with the shift to the default session. The microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process.
  • the microcomputer 33 determines that the wired rewriting session priority condition is satisfied (S1964: YES)
  • the microcomputer 33 discards the wireless rewriting request and continues the wired rewriting (S1967). That is, the microcomputer 33 maintains the first state in the wired rewriting session, continues the execution of the wired rewriting program, and specifies that the second state cannot be shifted to the wireless rewriting session (S1968).
  • the microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process.
  • the microcomputer 33 determines that the transitional rewriting session priority condition is satisfied (S1965: YES), the microcomputer 33 also discards the wireless rewriting request and continues the wire rewriting (S1967). That is, the microcomputer 33 maintains the first state in the wired rewriting session, continues the execution of the wired rewriting program, and specifies that the second state cannot be shifted to the wireless rewriting session (S1968).
  • the microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process.
  • the microcomputer 33 executes the rewrite exclusion process when a wireless rewrite request is generated in this way, thereby exclusively controlling the wired rewrite session and the wireless rewrite session, and does not simultaneously establish a session.
  • the microcomputer 33 determines whether it is possible to shift to a wireless rewriting session as a result of the rewriting exclusion processing when a wireless rewriting request is generated (S1945).
  • the microcomputer 33 determines that transfer is possible (S1945: YES) by specifying that transfer to the wireless rewrite session is possible by rewrite exclusion processing when a wireless rewrite request occurs (S1945: YES)
  • the microcomputer 33 changes the second state from the default session to wireless rewrite.
  • the session is shifted to the session (S1946), the wireless rewriting program is executed, and the wireless rewriting process is started (S1847).
  • the application execution unit 105a includes, as states, a default state (default session), a diagnosis state (diagnosis session), a wire rewriting state (wired rewriting session), and a wireless rewriting state (wireless rewriting session). ) And the internal state of the operation.
  • the states managed here do not independently manage the wired and wireless states, but manage the states in a mixed state.
  • the application execution unit 105a starts executing the diagnostic program while executing the vehicle control program.
  • the application execution unit 105a starts executing the wireless rewriting program and the wired rewriting program while executing the vehicle control program.
  • the application execution unit 105a exclusively controls the execution of the wireless diagnostic program and the wired diagnostic program.
  • the application executing unit 105a also exclusively controls the execution of the wired diagnostic program and the wireless diagnostic program, and the execution of the wired rewrite program and the wireless rewrite program. That is, the application execution unit 105a exclusively controls the execution of each program constituting the second program.
  • the application execution unit 105a performs the vehicle control program and the diagnostic program when the state transition from the diagnostic session to the wireless rewriting session is performed during the execution of the vehicle control program and the diagnostic program. Is interrupted, and then the execution of the wireless rewriting program is started. If no session is involved, the processing can be continued.
  • the ECU 19 performs the session establishment processing to execute the first state transition management processing and the second state transition management processing, and performs each of the first state and the second state.
  • the state transition of the session is managed, and the default session or the wired diagnostic session in the first state and the wireless rewriting session in the second state are non-exclusively established.
  • the vehicle control program or the diagnostic program of the ECU 19 and the wireless rewriting program are controlled to be executed in a non-exclusive manner. It can mediate requests appropriately.
  • the wired rewriting session and the wireless rewriting session are exclusively established.
  • the wired rewriting program and the wireless rewriting program are executed exclusively.
  • the rewriting of the wired program and the rewriting of the wireless program can be appropriately arbitrated.
  • the rewriting session during transition is prioritized.
  • the rewriting session priority condition during transfer By setting the rewriting session priority condition during transfer, rewriting during transfer can be executed with priority. That is, it is possible to continue the previously started one of the wired rewriting and the wireless rewriting without interruption.
  • the rewriting program is executed by using the firmware downloaded from the outside. After the capacity of the rewriting program in the application area is reduced, the non-operational application program rewriting process can be executed.
  • the present invention can also be applied to a one-sided suspend type memory having two pseudo-sided application areas or an external memory.
  • the present invention can also be applied to the case of deleting all the old data and writing the new data.
  • the vehicle program rewriting system 1 performs a retry point specifying process in the rewriting target ECU 19.
  • the retry point is the point at which the processing is completed in order to restart the writing of the interrupted write data in the case where the writing of the write data is interrupted when writing the write data in a plurality of times. This is the information to be shown.
  • the writing of the write data is interrupted, there are, for example, a case where a cancellation by a user operation occurs, a case where an abnormality such as a communication interruption occurs, and a case where the ignition is switched from off to on in a parking state.
  • the rewriting target ECU 19 determines whether or not the pre-processing before rewriting the application program has been completed (S2001). When the rewriting target ECU 19 determines that the pre-processing before rewriting the application program is completed (S2001: YES), the rewriting target ECU 19 sets the first processing flag to “NG” and sets the second processing flag to “NG”. (S2002, corresponding to a first processing flag setting procedure and a second processing flag setting procedure).
  • the rewriting target ECU 19 When determining that the first processing flag is “NG” and the second processing flag is “OK” (S2013: YES), the rewriting target ECU 19 also specifies the retry point at the beginning of the first processing. Then, a retry request from the beginning of the first process is notified to the CGW 13 (S2017, corresponding to the retry point specifying procedure) (S2017), and the process of determining the process flag ends.
  • the rewriting target ECU 19 When determining that the first processing flag is “OK” and the second processing flag is “OK” (S2015: YES), the rewriting target ECU 19 notifies the CGW 13 of the completion of the processing related to the rewriting of the application program. (S2020), and ends the processing for determining the processing flag.
  • the CGW 13 divides and distributes the write data
  • the rewrite target ECU 19 sets the retry point described above in units of the divided write data.
  • the rewriting target ECU 19 sets the first processing flag indicating whether or not the first processing has been completed by performing the processing for specifying the retry point, and determines whether or not the second processing has been completed. Is set, and the retry point is specified according to the first processing flag and the second processing flag. For example, when the rewriting target ECU 19 is restarted in a state where the first processing is completed and the second processing is not completed, it is possible to suppress rewriting of the same write data.
  • the rewrite target ECU 19 stores the data amount of the write data that has been written, that is, how many bytes of the write data have been written. To the CGW 13 to transmit from the write data. The rewrite target ECU 19 stores how many bytes of the write data have been written, and when resuming, by requesting the CGW 13 to transmit from the byte of the write data, when restarting, , CGW 13 can avoid waste of retransmitting the transmitted write data, and the rewrite target ECU 19 can write the write data from the next write area where the writing of the write data is completed. Note that the rewrite target ECU 19 that does not have a function of storing how many bytes of the write data have been written to the CGW 13 so that the write data is transmitted from the first write data when restarting the write data. Request.
  • the first progress status transmission unit 88b transmits the determined first progress status to the center device 3 and simultaneously transmits the first progress status to the center device 3.
  • the second progress status acquisition unit 88c acquires the second progress status related to the rewriting of the program from the center device 3.
  • the first display instruction unit 88d determines the first progress status and the determined first progress status. Based on the acquired second progress status, the user instructs creation of content that can be displayed on the in-vehicle display 7.
  • the second progress status determination unit 53a performs the second progress status based on the current progress status, which is the first progress status received from the master device 11 by the first progress status acquisition unit 53c before this, and the user operation signal. Determine the status. For example, when the current progress state is the “installation waiting phase” and the user operation signal indicating “accept” is received, the second progress state determination unit 53a determines the second progress state to be the “installation executing phase”. . or,. The second progress state determination unit 53a may determine that “the user has consent in the installation waiting phase”.
  • the user operation signal in the mobile terminal 6 is transmitted from the center device 3 to the DCM 12 in an environment where the center device 3 and the DCM 12 can perform data communication. Then, by transmitting the user operation signal from the DCM 12 to the CGW 13, the CGW 13 can determine the operation performed by the user on the mobile terminal 6 and determine the progress state.
  • the mobile terminal 6 receives the SMS as the progress status signal from the center device 3, the user selects the URL described in the SMS and connects to the center device 3 to display the screen of the predetermined phase provided by the center device 3. indicate.
  • the display of the progress status of the phase on the mobile terminal 6 and the on-vehicle display 7 is synchronized.
  • the center device 3 transmits the second progress status signal to the master device 11 based on the user's consent operation on the mobile terminal 6, and if the mobile terminal 6 can access the center device 3, the mobile terminal 6 and the on-vehicle The display of the progress status of the phase on the display 7 is synchronized.
  • the master device 11 that has obtained the second progress status signal updates the first progress status, which is the current progress status, and then transmits the first progress status to each of the vehicle-mounted display devices such as the center device 3 and the vehicle-mounted display 7. good. That is, the master device 11 functions as a phase management device by transmitting the current progress status to each of the vehicle-mounted display devices such as the center device 3 and the vehicle-mounted display 7.
  • the second progress status signal transmitted from the mobile terminal 6, the in-vehicle display 7, and the center device 3 may be a notification indicating any phase, but may be a notification indicating that a user consent operation has been performed. The notification may indicate the meaning of the operated button.
  • the CGW 13 acquires, for example, from the in-vehicle display 7 or the mobile terminal 6 via the center device 3, accepting or rejecting the update of the program, and acquiring conditions such as date and time and place where execution is permitted.
  • the CGW 13 obtains from the center device 3 via the DCM 12 that the user has performed an input operation to consent on the portable terminal 6, the CGW 13 notifies the in-vehicle display 7 of the progress that the consent has been completed.
  • the CGW 13 obtains from the in-vehicle display 7 that the user has performed an input operation to consent on the in-vehicle display 7, the CGW 13 notifies the center device 3 of the progress to the effect that the consent has been completed.
  • the CGW 13 determines that it is the installation phase (S2104: YES)
  • the CGW 13 performs the processing of the installation phase (S2108), and transmits a progress signal indicating the progress of the processing of the installation phase to the in-vehicle display 7 and the DCM 12 ( S2111).
  • the process of the install phase is to calculate, for example, what percentage of the installation to the rewrite target ECU 19 has been completed.
  • the CGW 13 determines what percentage of the installation has been completed based on the notification from the rewrite target ECU 19.
  • the CGW 13 notifies the in-vehicle display 7 and the center device 3 of progress indicating what percentage of the installation has been completed.
  • the CGW 13 repeats these processes until the installation for all the rewrite target ECUs 19 is completed.
  • the CGW 13 notifies the in-vehicle display 7 and the center device 3 of the progress of the completion of the installation phase.
  • the CGW 13 determines that it is the activation phase (S2104: YES), it performs the processing of the activation phase (S2108), and transmits a progress signal indicating the progress of the processing of the activation phase to the vehicle-mounted display 7 and the DCM 12. (S2111, corresponding to a first progress status transmission procedure).
  • the processing of the activation phase is to calculate, for example, what percentage of the activation of one or more rewrite target ECUs 19 belonging to the same group has been completed.
  • the CGW 13 determines what percentage of activation has been completed based on the notification from the rewriting target ECU 19.
  • the CGW 13 notifies the in-vehicle display 7 and the center device of progress indicating what percentage of activation has been completed.
  • the CGW 13 determines whether or not the activation phase has been completed (S2112). When determining that the activation phase has been completed (S2112: YES), the CGW 13 ends the progress state synchronization control process. When the CGW 13 determines that the activation phase has not been completed (S2112: NO), the process returns to S2102. Then, the CGW 13 advances the processing of each phase and calculates what percentage of the processing has been completed (S2107 to S2110). The CGW 13 periodically transmits the completion of the phase and X% as the first progress state to the center device 3 (S2111).
  • the center device 3 When the center device 3 transmits the distribution specification data and starts the progress state synchronization control process, it monitors the reception of the first progress state signal transmitted from the DCM 12 (S2121). When the center device 3 determines that the first progress status signal has been received from the DCM 12 (S2121: YES), the center device 3 permits access from the mobile terminal 6 (S2122), and in which phase specified by the first progress status signal. It is determined whether there is (S2123 to S2126).
  • the center device 3 determines that the download phase is in progress (S2124: YES)
  • the center device 3 performs the process of the download phase (S2128). That is, the center device 3 creates a screen of the download phase and transmits a display instruction signal for instructing display of the screen of the download phase to the mobile terminal 6, and the mobile terminal 6 connects to the center device 3 to connect to the center device 3. Display the screen.
  • the center device 3 updates the screen of the download phase when notified of the progress indicating what percentage of the download has been completed from the DCM 12.
  • the center device 3 determines that the installation phase is in progress (S2125: YES)
  • the center device 3 performs the processing of the installation phase (S2129). That is, the center device 3 creates a screen of the installation phase, transmits a display instruction signal for instructing display of the screen of the installation phase to the mobile terminal 6, and connects to the center device 3 in the mobile terminal 6, thereby causing the installation of the installation phase. Display the screen.
  • the center device 3 updates the screen of the installation phase when notified of the progress indicating what percentage of the installation has been completed from the DCM 12.
  • the center device 3 determines that the activation phase is in effect (S2126: YES)
  • the center device 3 performs the processing of the activation phase (S2130). That is, the center device 3 creates a screen of the activation phase, transmits a display instruction signal for instructing display of the screen of the activation phase to the mobile terminal 6, and connects to the center device 3 in the mobile terminal 6 to activate the activation phase. Display the screen.
  • the center apparatus 3 updates the screen of the activation phase when notified of the progress indicating the activation completion percentage from the DCM 12.
  • the center device 3 transmits a second progress status signal to the master device 11 (S2131), and ends the progress status synchronization control process. I do.
  • the in-vehicle display 7 determines that it is the campaign notification phase (S2143: YES)
  • the in-vehicle display 7 displays the screen of the campaign notification phase using the text, contents, and the like included in the distribution specification data (S2147). If it is determined that the download phase is in the download phase (S2144: YES), the in-vehicle display 7 displays a screen of the download phase (S2148). The in-vehicle display 7 updates the screen of the download phase when notified from the CGW 13 of the progress indicating what percentage of the download has been completed.
  • the in-vehicle display 7 determines that the installation phase is in progress (S2145: YES), the in-vehicle display 7 displays a screen for the installation phase (S2149). The in-vehicle display 7 updates the screen of the installation phase when being notified from the CGW 13 of the progress indicating what percentage of the installation has been completed. If the in-vehicle display 7 determines that it is in the activation phase (S2146: YES), the in-vehicle display 7 displays a screen of the activation phase (S2150). The in-vehicle display 7 updates the screen of the activation phase when being notified from the CGW 13 of the progress indicating what percentage of the activation has been completed.
  • the first progress status and the second progress status are transmitted and received between the master device 11 and the center device 3. For example, even if the portable terminal 6 can access the center apparatus 3 and the in-vehicle display 7 cannot access the center apparatus 3, the first progress state and the second progress state between the master apparatus 11 and the center apparatus 3 can be obtained. By transmitting and receiving the progress status, the progress status and the like of rewriting the application program can be appropriately synchronized between the plurality of display terminals.
  • Display information is data constituting various screens (a campaign notification screen, an installation screen, etc.) involved in rewriting an application program.
  • the display control program is a program that implements a function equivalent to a web browser.
  • the property information is information that defines a display character, a display position, a color, and the like.
  • the information transmitting unit 54c transmits the write data stored in the write data storage unit 54a and the display control information stored in the display control information storage unit 54b to the master device 11.
  • the information transmitting unit 54c transmits the write data to the plurality of rewrite target ECUs 19 to the master device 11 as one package.
  • the display control information may include phase identification information indicating in which phase the information is to be displayed. For example, the phase identification information indicates which phase of the campaign notification phase, the download phase, the installation phase, and the activate phase to display.
  • the center device 3 executes a display control information transmission control program and performs a display control information transmission control process.
  • the center device 3 When the center device 3 starts the display control information transmission control process, the center device 3 transmits the distribution specification data to the CGW 13 via the DCM 12 (S2201, corresponding to a control information transmission procedure), and transmits the write data to the CGW 13 via the DCM 12. It is transmitted (S2202). The center device 3 transmits the display information to the CGW 13 via the DCM 12 (S2203, corresponding to a display information transmission procedure), and ends the display control information transmission control process. When transmitting the display control information corresponding to each of the campaign notification phase, the download phase, the install phase, and the activate phase, the center device 3 collects the display control information corresponding to each phase into one file.
  • the display control information may be transmitted to the vehicle-mounted display 7, or the display control information corresponding to the next phase may be transmitted to the vehicle-mounted display 7 each time the phase ends.
  • the timing at which the center device 3 transmits the distribution specification data may be configured to be transmitted in response to a request from the master device 11.
  • the CGW 13 includes, in the display control information reception control unit 89, an information reception unit 89a, a rewrite instruction unit 89b, and a display instruction unit 89c.
  • the information receiving unit 89a receives write data and display control information from the center device 3.
  • the rewrite instruction unit 89b instructs the rewrite target ECU 19 to write the received write data.
  • the display instruction unit 89c uses the display control information to instruct the in-vehicle display 7 to display information about the campaign before the rewrite instruction unit 89b instructs the rewrite target ECU 19 to write the write data. Note that the display instruction unit 89c may instruct to display information about the campaign as history information after all the writing of the writing data is completed.
  • the CGW 13 When the CGW 13 starts the reception control processing of the display control information, the CGW 13 receives the distribution specification data from the center device 3 via the DCM 12 (S2301, corresponding to a control information receiving procedure). Write data is received from the center device 3 via the DCM 12 (S2302). The CGW 13 receives display information from the center device 3 via the DCM 12 (S2303, corresponding to a display information receiving procedure). The CGW 13 determines whether to use the display control information included in the distribution specification data from the center device 3 (S2304). When determining that the display control information is to be used (S2304: YES), the CGW 13 instructs the in-vehicle display 7 to display the display information using the display control information (S2305).
  • the CGW 13 determines that the display control information is not used (S2304: NO)
  • the CGW 13 instructs the in-vehicle display 7 to display the display information using the content held in advance (S2306). That is, the CGW 13 instructs the in-vehicle display 7 to display a screen involved in rewriting the application program using the content held in advance.
  • the in-vehicle display 7 displays the display information using the content held in advance according to the instruction from the CGW 13.
  • the in-vehicle display 7 collects the display control information corresponding to each phase from the center device 3. Alternatively, the display control information corresponding to the next phase may be received from the center device 3 every time the phase is completed.
  • the in-vehicle display 7 does not have a web browser function, and the property information is included in the distribution specification data transmitted from the center device 3 to the in-vehicle display 7 via the DCM 12 and the CGW 13. However, if the display control program is not included, the in-vehicle display 7 displays the property information on a simple screen using the content or frame stored in advance.
  • the property information is data such as text, its display position, size, and the like, and is the same as the property information used on the screen created by the center device 3. That is, the screen image displayed by the in-vehicle display 7 is the same as the screen image created by the center device 3, although there are differences in the background, the bitmap, and the like from the screen image created by the center device 3.
  • the in-vehicle display 7 does not have a web browser function and the distribution specification data transmitted from the center device 3 to the in-vehicle display 7 via the DCM 12 and the CGW 13 includes the display control program and the property information
  • the in-vehicle display 7 displays the display information on a screen equivalent to the center device 3.
  • the display control program and the property information included in the distribution specification data are the same as those used on the screen created by the center device 3.
  • the in-vehicle display 7 displays the display information on a screen equivalent to that of the center device 3.
  • the version of the display control program held by the in-vehicle display 7 is different from the version of the display control program used on the screen created by the center device 3, for example.
  • the in-vehicle display 7 displays the display information on the same screen as the center device 3 by connecting to the center device.
  • the center device 3 transmits the display control information to the in-vehicle display 7 by performing the transmission control process of the display control information, and causes the in-vehicle display 7 to display the display information according to the display control information.
  • the CGW 13 receives the display control information from the center device 3, receives the display information from the center device 3, and displays the display information according to the display control information by performing the reception control process of the display control information.
  • the CGW 13 includes a mode determination unit 90a and a screen display instruction unit 90b in the screen display control unit 90 for progress display.
  • the mode determination unit 90a determines whether or not the customization mode is set by a user's customization operation. Further, the mode determination unit 90a determines whether or not the external mode is set from the outside based on the scene information included in the rewrite specification data. That is, the mode determination unit 90a refers to the scene information included in the rewrite specification data shown in FIG. As shown in FIGS. 8 and 187, the rewrite specification data stores scene information, expiration date information, and position information. The scene information indicates the scene (type, scene, etc.) of the main update and also specifies the screen display of the main update. Specifically, there are a recall flag, a dealer flag, a factory flag, a function update notification flag, and a forced execution flag.
  • the dealer flag is a flag for specifying a screen display when the dealer rewrites the application program.
  • the factory flag is a flag for specifying a screen display when the application program is rewritten at the factory.
  • the function update notification flag is a flag for specifying a screen display when the application program is rewritten according to the function update notification.
  • the function update notification is to update a specific function.
  • the function update notification flag is a flag that specifies a screen display in a program update for adding a new function for a fee (or free of charge).
  • the forced execution flag is a flag for specifying a screen display when the application program is rewritten according to the forced execution.
  • the forced execution means that the campaign notification is repeated a predetermined number of times, but the application program is not rewritten, thereby forcibly rewriting the application program.
  • the forced execution flag is a flag for specifying a screen display when the program is forcibly updated.
  • These flags indicating the scene information are set so that all are 0 (flag is not established) when there is no corresponding, and are set to 1 (flag is established) when there is applicable.
  • the mode determination unit 90a determines that the recall mode is set.
  • the dealer flag is established, the mode determination unit 90a determines that the dealer mode is set.
  • it is established it is determined that the factory mode is set, when the function update notification flag is established, it is determined that the function update mode is set, and when the forced execution flag is established, It is determined that the forced execution mode is set.
  • Expiration date information is information indicating an expiration date, and is information serving as a criterion for determining whether or not to rewrite an application program.
  • the CGW 13 executes rewriting of the application program if the current time is within the expiration date indicated by the expiration date information, and does not execute rewriting of the application program if the current time is outside the expiration date indicated by the expiration date information. . That is, after downloading the distribution package, the CGW 13 refers to the expiration date information when installing the program, and if the current time is outside the expiration date, the CGW 13 does not execute the program installation and discards the distribution package. .
  • the position information is information indicating a position, which is a criterion for determining whether or not to rewrite an application program, and includes a permitted area and a prohibited area.
  • the CGW 13 executes rewriting of the application program if the current position of the vehicle is within the permission area indicated by the position information, and determines whether the current position of the vehicle is based on the position information. If it is outside the indicated permission area, the application program is not rewritten.
  • the prohibited area is designated as the position information, the CGW 13 executes rewriting of the application program if the current position of the vehicle is outside the prohibited area indicated by the position information, and determines whether the current position of the vehicle is based on the position information.
  • the application program is not rewritten.
  • the CGW 13 refers to the position information when installing the program, and if the current position is outside the permitted area, the CGW 13 does not execute the program installation until the current position is within the permitted area. Wait for installation.
  • the CGW 13 displays the user registration screen 513 on the in-vehicle display 7 as shown in FIG.
  • the CGW 13 displays an input field of a mail address and VIN information (individual vehicle identification information) as personal information registration, and displays input fields of a credit card number and an expiration date as charging information registration.
  • "ON / OFF" buttons 513a to 513d for campaign notification, download, installation, and activation are displayed, and a "detailed information" button 513e is displayed, and the user waits for an operation.
  • the user may set the corresponding "on / off" buttons 513a to 513d to off. By setting it to off, the display of the content that requires the user's consent is omitted. If the user does not bother with the display of the campaign notification or the activation screen, for example, but feels that the download or the installation screen display is bothersome, the user sets the campaign notification to ON using the “ON / OFF” button 513a and turns the download “ON / OFF”.
  • the button 513b may be set to off, the installation may be set to off by the "on / off” button 513c, and the activate may be set to on by the "on / off” button 513d.
  • the display terminal 5 displays the campaign notification screen according to the rewriting phase of the application program, for example, if the campaign notification is on, the download is off, the installation is off, and the activation is on, for example.
  • the activation screen is displayed without displaying the screen and the download execution screen, and not displaying the installation approval screen and the installation execution screen. That is, if the user sets on in the campaign notification, download, installation, and activation phases, the screen of the phase set to on is displayed, and if set to off, the screen of the phase set to off is displayed. No display is made and the screen display can be customized.
  • Such on / off setting of screen display may be set individually for each phase, or may be set collectively for all phases at once.
  • the user may operate the “detailed information” button 513e to set the expiration date, the permitted area, and the prohibited area.
  • the user can customize the expiration date for permitting the rewriting of the application program as the expiration date information, and can customize the permitted area where the rewriting of the application program is permitted and the prohibited area where the rewriting of the application program is prohibited as the position information.
  • the CGW 13 executes a progress display screen display control program, and performs a progress display screen display control process.
  • the CGW 13 determines whether the scene information is stored in the rewrite specification data. Is determined (S2403). When the CGW 13 determines that the scene information is stored in the rewrite specification data (S2403: YES), it determines that the external mode is set, and shifts to a display instruction process according to the setting of the scene information ( S2404), instructs the in-vehicle display 7 to display a screen according to the rewriting of the application program in accordance with the established flag mode.
  • the CGW 13 determines whether or not the customization mode is set by the user's customization operation (S2405, corresponding to a customization mode determination procedure). Do).
  • the CGW 13 determines that the customization mode is set (S2405: YES)
  • the CGW 13 shifts to display instruction processing according to the setting content of the customization operation (S2406, corresponding to a screen display instruction procedure), and responds to the rewriting of the application program.
  • the in-vehicle display 7 is instructed to perform the screen display according to the customization mode.
  • the CGW 13 determines that the operation result information has been received from the DCM 12 by transmitting the operation result from the vehicle-mounted display 7 to the DCM 12 (S2415: YES), the CGW 13 confirms the consent based on the operation result information, and It is determined whether the rewriting of the program has been accepted (S2416).
  • the CGW 13 determines that the current position of the vehicle satisfies the position information (S2418: YES) and continues rewriting the application program. (S2419).
  • the CGW 13 determines that the current position of the vehicle does not satisfy the position information, stops the rewriting of the application program without continuing, and ends the screen display instruction process. I do. If the position information is in the prohibited area and the current position of the vehicle is outside the prohibited area, the CGW 13 determines that the current position of the vehicle satisfies the position information (S2418: YES) and continues rewriting the application program. (S2419), and terminates the screen display instruction process. If the current position of the vehicle is within the prohibited area, the CGW 13 determines that the current position of the vehicle does not satisfy the position information, stops rewriting the application program without continuing, and ends the display instruction process.
  • a screen display request notification transmitted from the CGW 13 to the DCM 12 and operation result information transmitted from the DCM 12 to the CGW 13 will be described.
  • the screen display request notification transmitted from the CGW 13 to the DCM 12 includes a phase ID, a scene ID, and screen configuration information.
  • the phase ID is an ID for identifying each phase of campaign notification, download, installation, and activation.
  • the scene ID is an ID for identifying the scene information shown in FIG. 187.
  • the operation result information transmitted from the DCM 12 to the CGW 13 includes transmission source information, a phase ID, a scene ID, an operation result, and additional information.
  • the CGW 13 checks the phase ID and the scene ID stored in the screen display request notification with the phase ID and the scene ID stored in the operation result information, and confirms a deviation or arbitration.
  • the user can select the “campaign ID ...” button 514a, the “update name A ...” button 514b, the “update name B ...” button 514c, the “detailed confirmation” button 514d, the “return” button 514e, and the “OK” button 514f. Either can be operated.
  • a “campaign ID ...” button 514a among the six items of the screen configuration information, a “campaign ID ...” button 514a, an “update name A ...” button 514b, an “update name B ...” button 514c, a “detailed information” button 514d, If the "OK” button 514f is set to “display” and the “return” button 514e is set to non-display, the "campaign ID ?” button 514a and the "update” are displayed on the activation acceptance screen 514 as shown in FIG. The name A ...
  • the “return” button 514e is not displayed. That is, the user can operate any one of the “campaign ID ...” button 514a, the “update name A ...” button 514b, the “update name B ...” button 514c, the “detailed confirmation” button 514d, and the “OK” button 514f. However, since the “return” button 514e is not displayed, the “return” button 514e cannot be operated. For example, it is not desirable to reject activation of an application program whose relevance or urgency is relatively high due to a recall or the like. Therefore, by disabling the "return” button 514e as described above, the activation is performed. Can be set so as not to reject. In this case, when the user operates the “OK” button 514f, the activation is accepted.
  • a screen display transmitted and received between the CGW 13, the DCM 12, the in-vehicle display 7, the center device 3, and the meter device 45, and a message framework related to user operations will be described.
  • the CGW 13 and the DCM 12 are connected by CAN or Ethernet, and the DCM 12 and the in-vehicle display 7 are connected by USB.
  • the CGW 13 performs data communication with the center device 3 via the DCM 12.
  • the data transmitted from the CGW 13 by the diagnostic communication is protocol-converted by the DCM 12 and received by the center device 3 from the DCM 12 by the HTTP communication.
  • the CGW 13 transmits data indicating the current progress status such as the current phase and the progress ratio to the center device 3 via the DCM 12.
  • Data transmitted from the center device 3 by HTTP communication is subjected to protocol conversion by the DCM 12 and received by the CGW 13 from the DCM 12 by diagnostic communication.
  • the CGW 13 performs data communication with the in-vehicle display 7 via the DCM 12.
  • the data transmitted by the diagnostic communication from the CGW 13 is subjected to protocol conversion by the DCM 12 and received by the in-vehicle display 7 from the DCM 12 by USB communication.
  • Data transmitted from the in-vehicle display 7 by USB communication is subjected to protocol conversion by the DCM 12 and received by the CGW 13 from the DCM 12 by diagnostic communication.
  • the CGW 13 acquires information on a user operation on the in-vehicle display 7 via the DCM 12.
  • the DCM 12 is provided with a protocol conversion function, and the portable terminal 6 and the in-vehicle display 7 can be handled by the CGW 13 similarly.
  • the CGW 13 can arbitrate the results of user operations on a plurality of operation terminals and manage the current progress.
  • phase ID is set to "03" in the campaign notification and the phase ID is set in the download. "04”, the phase ID is "05" for installation, and the phase ID is "06" for activation.
  • the order of transmitting and receiving the message frames is the same, and the phases are divided by different phase IDs.
  • FIG. 199 illustrates the campaign notification phase.
  • the CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12.
  • the DCM 12 transmits a screen display request to the in-vehicle display 7.
  • the in-vehicle display 7 displays a screen at the time of the campaign notification, and when the user performs a confirmation operation of the campaign notification, transmits the operation result to the DCM 12.
  • the DCM 12 transmits the operation result information to the CGW 13.
  • the operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information.
  • the CGW 13 updates the current progress state based on the operation result information received from the DCM 12. Here, when there is an acceptance operation in the campaign notification phase, the CGW 13 updates the current progress state to the download phase. I do.
  • FIG. 200 illustrates the download phase.
  • the CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12.
  • the DCM 12 transmits a screen display request to the vehicle-mounted display 7.
  • the in-vehicle display 7 displays a screen at the time of accepting the download, and when the user performs an operation of accepting the download, transmits the operation result to the DCM 12.
  • the DCM 12 transmits the operation result information to the CGW 13.
  • the operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information.
  • the CGW 13 updates the current progress state based on the operation result information received from the DCM 12. Here, when there is an approval operation in the download phase, the CGW 13 updates the current progress state to the install phase.
  • the operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information.
  • the CGW 13 updates the current progress state based on the operation result information received from the DCM 12. Here, when an acceptance operation is performed in the installation phase, the CGW 13 updates the current progress state to the activation phase.
  • FIG. 202 illustrates the activate phase.
  • the CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12.
  • the DCM 12 transmits a screen display request to the vehicle-mounted display 7.
  • the in-vehicle display 7 displays a screen at the time of accepting the activation, and when the user performs the act of accepting the activation, transmits the operation result to the DCM 12.
  • the DCM 12 transmits the operation result information to the CGW 13.
  • the operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information.
  • the CGW 13 updates the current progress state based on the operation result information received from the DCM 12.
  • the CGW 13 instructs the display terminal 5 to display a screen according to the rewrite of the application program in accordance with the content of the recall mode (S2404).
  • the CGW 13 does not display the “later” button 502a on the campaign notification screen 502.
  • the CGW 13 does not display the “return” button 503c on the download approval screen 503.
  • the CGW 13 does not display the “return” button 504b on the download execution screen 504.
  • the CGW 13 does not display the “return” button 505b on the installation approval screen 505.
  • the CGW 13 does not display the “return” button on the activation consent screen 518.
  • a dedicated screen display in the repair process is required in the dealer environment. It is only necessary to display a dedicated screen for use. That is, since the user does not perform the operation relating to the rewriting of the application program, but the operator of the dealer performs the operation relating to the rewriting of the application program, the "later" button and the “return” button are set to display for the operation of the dealer. By doing so, a “later” button or a “back” button may be displayed. For example, guidance such as "Please carry out rewriting at the dealer" may be displayed to prompt the dealer to enter the vehicle.
  • a screen display is required to reliably notify the user of the change even if the user has set the display to be unnecessary by customizing. Therefore, a screen for the user may be displayed regardless of the customization setting. That is, even when the user determines that the consent is unnecessary, the consent may be forcibly performed and the consent screen may be forcibly displayed.
  • the forced execution flag is set in the scene information of the rewrite specification data, the user has set the display required by customization, and even if the user does not consent, the software update of the vehicle is reliably performed Therefore, a screen for the user may be displayed regardless of the customization setting.
  • the application program is rewritten even if the user does not need to give consent even if the user determines that the consent is necessary.
  • the "" button and the "Back” button should not be displayed.
  • rewriting may be executed assuming that consent has been obtained without displaying the screen itself.
  • the CGW 13 instructs the display terminal 5 to perform the screen display according to the setting content of the customization mode when the customization mode is set. I made it.
  • the user can customize the screen display according to the progress of the rewriting.
  • the CGW 13 includes a phase identification unit 91a, a display instruction unit 91b, an indicator display control unit 91c, an icon display control unit 91d, and a detailed information display control unit in the program update notification control unit 91. 91e and an invalidation instruction section 91f.
  • the phase specifying unit 91a specifies a phase as the progress of the program update.
  • the phase specifying unit 91a specifies, as the program update phase, campaign notification, download approval, download execution, installation approval, installation execution, activation approval, activation execution, and update completion.
  • the display instructing unit 91b instructs to display the indicator in a form corresponding to the specified program update phase.
  • the indicator display control unit 91c controls the display of the indicator according to the instruction. Specifically, the indicator display control section 91c controls the lighting of the indicator 46 in the meter device 45.
  • the invalidation instructing unit 91f instructs the power management ECU 20 and the ECUs 19 related to the user operation to invalidate the reception of the user operation even when the power management ECU 20 performs the power control by performing the program update during parking. I do. For example, by instructing the engine ECU 47 (see FIG. 217) to invalidate the reception of a user operation, when the rewriting target ECU 19 has a one-sided memory structure and performs installation during parking, the user starts the engine. Even if an operation for causing the engine to be performed, the reception is invalidated and the engine is prevented from starting.
  • the memory structure of the rewrite target ECU 19 is a one-sided memory, and when the IG power is turned on during parking and installation is performed, the user turns off the IG power. Even if the operation of turning off is performed, the reception is invalidated and the IG power is suppressed so as not to be turned off.
  • the invalidation instruction unit 91f may instruct the in-vehicle display 7 to notify that the reception of the user operation has been invalidated.
  • the CGW 13 determines whether a program update campaign has occurred (S2501).
  • the CGW 13 determines that a program update campaign has occurred (S2501: YES)
  • the CGW 13 identifies a program update phase and a memory configuration (S2502, corresponding to a phase identification procedure).
  • the CGW 13 instructs the meter device 45 to display the indicator 46 in a mode according to the specified program update phase (S2503, corresponding to a display instruction procedure).
  • the in-vehicle display 7 is instructed to display an icon corresponding to the specified program update phase (S2504).
  • the CGW 13 determines whether there is a detail display request (S2505), and determines that there is a detail display request (S2505: YES), and determines whether data communication with the in-vehicle display 7 is possible (S2506). For example, when the user presses a campaign notification icon 501a shown in FIG. 32, a “confirm” button 502a shown in FIG. 33, a “details confirmation” button 503b shown in FIG. . When the CGW 13 determines that data communication with the in-vehicle display 7 is possible (S2506: YES), the CGW 13 acquires detailed information (S2507), instructs the in-vehicle display 7 to display the detailed information (S2508), and transmits the detailed information. The center device 3 is instructed to display (S2509).
  • the CGW 13 determines whether or not the program update event has ended (S2510). For example, when the user confirms that the activation has been completed and the program update has been completed, the CGW 13 determines that the event has ended. If the CGW 13 determines that the program update event has not ended (S2510: NO), the CGW 13 returns to Step S2502 and repeats Step S2502 and subsequent steps. The CGW 13 repeats step S2502 and subsequent steps in the campaign notification, download approval, download execution, installation approval, installation execution, activation approval, activation execution, and update completion phases. If the CGW 13 determines that the program update event has ended (S2510: YES), the CGW 13 ends the program update notification control process.
  • the meter device 45 has an indicator 46 disposed at a predetermined position that can be confirmed by the user, and upon receiving a notification request notification from the CGW 13, turns on or blinks the indicator 46 as notification that the application program is being rewritten.
  • a lighting display that is more emphasized than a normal lighting display such as changing the color of the indicator 46 or increasing the luminance may be used. That is, any display may be used as long as the display is emphasized more than the normal display.
  • there is one indicator 46 relating to the program update and is constituted by one design.
  • the indicator display control unit 91c blinks the indicator 46 in green, for example, in a phase in which the running of the vehicle such as installation or activation may be restricted.
  • the indicator display control unit 91c blinks only in the phase during which activation is being performed.
  • the indicator display control unit 91c blinks during the installation execution phase while the IG is off, the activation acceptance phase, and the activation execution phase.
  • the indicator display control unit 91c blinks during the phase of executing the installation, the phase of accepting the activation, and the phase of executing the activation. That is, the display of the indicator 46 in the campaign notification phase, the download phase, and the phase after the activation is completed (IG off, IG on, confirmation operation) is common regardless of the memory configuration, but in the installation phase and the activation phase.
  • the display of the indicator 46 has a different display mode depending on the memory configuration.
  • “IG off” shown in FIG. 213 is a display mode when the activation is executed during parking and the IG power is turned off upon completion of the activation, and the indicator 46 is turned off with the IG power off.
  • FIG. 214 shows the notification mode of the indicator when the memory type of the rewrite target ECU 19 is a two-sided memory.
  • the meter device 45 turns on the indicator 46 in the phase from the campaign notification to the activation consent, and blinks the indicator 46 in the phase during activation. After that, the meter device 45 turns off the indicator 46 when the IG is off, turns on the indicator 46 when the IG is on, and turns off the indicator 46 when the user performs a confirmation operation for the update completion.
  • the meter device 45 blinks the indicator 46 in the phase during the activation.
  • the indicator here is a predetermined design, and is displayed in green when progressing normally.
  • FIG. 215 shows a notification mode of the indicator when the memory type of the rewrite target ECU 19 is the one-sided suspend memory.
  • the meter device 45 turns on the indicator 46 in the phase from the campaign notification to the acceptance of the installation when the rewriting target of the application program is the one-sided suspend memory, and turns on the IG on during the execution of the installation. 46 is turned on, and the indicator 46 flashes when the IG is off. That is, the meter device 45 turns on the indicator 46 because the writing to the flash memory of the one-sided suspend memory ECU is not executed in the IG on state. However, the writing to the flash memory is executed in the IG off state. The indicator 46 flashes.
  • the meter device 45 blinks the indicator 46 in the phase from the activation acceptance to the activation execution. After that, the indicator 46 is turned off when the IG is off, the indicator 46 is turned on when the IG is on, and the indicator 46 is turned off when the user performs a confirmation operation for the update completion. That is, in the case of the one-sided suspend memory, there is a possibility that the traveling of the vehicle may be restricted during the execution of the installation with the IG off and during the execution of the activation. Therefore, the meter device 45 blinks the indicator 46 in these phases.
  • the meter device 45 blinks the indicator 46 in these phases.
  • the blinking display may be performed only during the activation in which the vehicle cannot be driven.
  • FIG. 216 shows an indicator notification mode when the memory type of the rewrite target ECU 19 is a one-sided memory.
  • the meter device 45 turns on the indicator 46 in the phase from the campaign notification to the acceptance of the installation when the rewriting target of the application program is the single-sided single memory, and during the execution from the installation to the activation.
  • the indicator 46 flashes.
  • the indicator 46 is turned off when the IG is off, the indicator 46 is turned on when the IG is on, and the indicator 46 is turned off when the user performs a confirmation operation for the update completion. That is, in the case of the one-sided memory, there is a possibility that the travel of the vehicle may be restricted during the execution of the installation to the execution of the activation. Therefore, the meter device 45 blinks the indicator 46 in these phases.
  • the meter device 45 includes a two-sided memory, a one-sided suspend memory, and a two-sided memory, a one-sided suspend memory, and a one-sided single memory ECU 19 when the program rewrite target ECU 19 includes a single-sided memory 19 in one campaign notification.
  • the application program of the ECU 19 is rewritten according to the order of the single-sided memory.
  • the CGW 13 performs the process from accepting the download to the ECU 19 in the two-sided memory until the installation is being performed, and the meter device 45 turns on the indicator 46 during this period.
  • the process from accepting the download to the ECU 19 of the one-sided suspend memory to the execution of the installation is performed, and the meter device 45 turns on the indicator 46 during this period.
  • the CGW 13 finishes the phase during the execution of the installation on the ECU 19 of the one-side suspend memory the CGW 13 performs the process from accepting the download to the ECU 19 of the one-side single memory to accepting the installation, and the meter device 45 turns on the indicator 46 during this period.
  • the meter device 45 blinks the indicator 46 from the time when the installation of the single-sided memory is being executed to the time when the activation is being executed for the three ECUs 19 having different memory types.
  • the meter device 45 turns off the indicator 46 when the IG is turned off, turns on the indicator 46 when the IG is turned on, and turns off the indicator 46 when the user performs a confirmation operation for the update completion.
  • the meter device 45 may perform the following control when the ECU 19 of the two-sided memory, the one-sided suspended memory, and the one-sided single memory is included as the program rewriting target ECU 19 in one campaign notification.
  • the meter device 45 rewrites the application program of the ECU 19 according to the order of the two-side memory, the one-side suspend memory, and the one-side single memory.
  • the CGW 13 instructs to turn on a predetermined green design as the indicator 46 indicating that the distribution package including the update data of the rewrite target ECU 19 has been approved and that the download is being executed. Thereafter, the CGW 13 instructs to turn on a predetermined green design as the installation approval indicator 46.
  • the installation consent here also serves as the activation consent because the ECU 19 of the single-sided memory is included.
  • the CGW 13 first installs the two-sided memory in the ECU 19.
  • the meter device 45 turns on the indicator 46.
  • the CGW 13 finishes the phase of the installation of the two-sided memory into the ECU 19
  • the CGW 13 executes the installation of the one-sided suspended memory on the ECU 19.
  • the meter device 45 turns on the indicator 46 while the one-side suspend memory is installed in the ECU 19.
  • the CGW 13 executes the installation of the one-sided single memory to the ECU 19 after completing the phase during the execution of the one-sided suspended memory to the ECU 19.
  • the meter device 45 causes the indicator 46 to blink while the one-sided suspend memory is installed in the ECU 19.
  • the CGW 13 executes the activation while keeping the indicator 46 blinking.
  • the CGW 13 instructs the meter device 45 to turn off the indicator 46 when the IG is turned off, and instructs the meter device 45 to turn on the indicator 46 when the IG is turned on. Is instructed to turn off the light.
  • the CGW 13 also instructs the vehicle-mounted display 7 to display an icon.
  • the CGW 13 instructs to display the campaign notification icon 501a shown in FIG.
  • the CGW 13 continues to display the campaign notification icon 501a even in the download approval phase.
  • the CGW 13 instructs to display the download execution icon 501b shown in FIG.
  • the CGW 13 may continue to display the download-in-progress icon 501b, or may instruct to display the campaign notification icon 501a again.
  • the CGW 13 instructs to display the installation execution icon 501c shown in FIG.
  • the CGW 13 may continue to display the installation-in-progress icon 501c, or may instruct the campaign notification icon 501a to be displayed again.
  • the CGW 13 does not display an icon during the activation execution phase and during the subsequent IG off.
  • the CGW 13 may instruct to display the campaign notification icon 501a again, or may display an activation completion notification screen 509 as a pop-up as shown in FIG.
  • the CGW 13 does not display an icon. It should be noted that there is only one icon display relating to the program update, and it is composed of designs corresponding to each phase.
  • the CGW 13 sets a notification mode different from the normal mode when an abnormality occurs during the rewriting of the application program.
  • the CGW 13 instructs a light-on display or blinking display in green, for example, and when an abnormality occurs, instructs a light-on display or blinking display in yellow or red, for example.
  • the CGW 13 may change the color in accordance with the degree of the abnormality. For example, when the degree of the abnormality is relatively large, the CGW 13 gives an instruction to display or blink in red when the degree of the abnormality is relatively small. Flashing display may be instructed.
  • abnormalities include a state in which the distribution package cannot be downloaded, a state in which the write data cannot be installed, a state in which the write data cannot be written in the rewrite target ECU 19, a state in which the write data is incorrect, and the like.
  • the in-vehicle display 7 has the above-described campaign notification screen 502, download approval screen 503, download execution screen 504, download completion notification screen 505, installation approval 506, installation execution screen 507, activate approval screen 508, and IG on as detailed displays.
  • a time screen 509 and a confirmation operation time screen 510 for update completion are sequentially displayed based on a user operation.
  • the same detailed display as the in-vehicle display 7 can also be displayed on the portable terminal 6 communicably connected to the center device 3.
  • the CGW 13 requests the center device 3 to perform the detailed display via the DCM 12.
  • the center device 3 creates the content of the detailed display, and the mobile terminal 6 displays the content, so that the user can check the detailed information on the mobile terminal 6.
  • the CGW 13 forcibly activates the power management ECU 20 when rewriting the application program of the one-side suspend memory or the one-side single memory of the IG ECU or the ACC ECU during parking.
  • the vehicle power is turned on.
  • the operation of the power management ECU 20 activates the meter device 45 and the in-vehicle display 7. Therefore, the CGW 13 instructs the meter device 45 and the in-vehicle display 7 to suppress notification of the program update.
  • the meter device 45 does not light or blink the indicator 46 described above when the CGW 13 instructs to suppress the notification of the program update.
  • the in-vehicle display 7 When instructed by the CGW 13 to suppress notification of the program update, the in-vehicle display 7 does not perform the detailed display described above. That is, in the installation and activation performed during parking, in the case where the user is not in the vehicle, the notification related to the program update is unnecessary, and the control is performed so that the notification is not performed.
  • the power management ECU 20 when the power management ECU 20 is forcibly activated and the vehicle power is turned on, the operation of the push switch from the user can be accepted and the engine can be controlled.
  • the CGW 13 disables the reception of the user operation. It instructs the power management ECU 20 to notify the meter device 45, the in-vehicle display 7, and the ECU 19 related to the user operation of invalidating the reception of the user operation.
  • meter device 45 invalidates the reception of the operation even if the user performs an operation on meter device 45.
  • the in-vehicle display 7 invalidates the reception of the operation even if the user operates the in-vehicle display 7. Further, when instructed by the CGW 13 to invalidate the reception of a user operation, the engine ECU 47 invalidates the reception of the operation even if the user performs an operation of starting the engine by a push switch, so that the engine is not started. Suppress.
  • the CGW 13 instructs the meter device 45 to be informed that the application program is being rewritten by performing the program update notification control process. Even in a situation where the user is not informed of the rewriting of the application program by the portable terminal 6 or the vehicle-mounted display 7, the user is properly informed of the rewriting of the application program by notifying the user of the rewriting of the application program by the meter device 45. be able to.
  • the CGW 13 may change the notification mode according to the progress of the rewriting of the application program.
  • the power supply self-holding execution control processing will be described with reference to FIGS.
  • the CGW 13, the ECU 19, the in-vehicle display 7, and the power management ECU 20 perform an execution control process of self-holding of the power.
  • the CGW 13 instructs the ECU 19, the in-vehicle display 7, and the power management ECU 20 to hold the power. That is, the CGW 13 corresponds to the vehicle master device, and the ECU 19, the in-vehicle display 7, and the power management ECU 20 correspond to the vehicle slave device.
  • the CGW 13 has a second power supply self-holding circuit, and the vehicle slave device has a first power supply self-holding circuit.
  • the CGW 13 includes a vehicle power supply determination unit 92a, a rewriting determination unit 92b, a first power supply self-holding determination unit 92c, and a power supply self-holding instruction unit 92d in the power supply self-holding execution control unit 92. And a second power supply self-holding determination unit 92e, a second power supply self-holding validation unit 92f, a second stop condition satisfaction determination unit 92g, and a second power supply self-holding stop unit 92h.
  • the vehicle power supply determination unit 92a determines whether the vehicle power supply is on or off.
  • the rewriting determination section 92b determines whether the application program is being rewritten.
  • the rewriting determination section 95b also determines which rewriting target ECU 19 is rewriting.
  • the first power supply self-holding enabling unit 92c determines whether the vehicle power supply is off by the vehicle power supply determination unit 92a, and determines that the program is being rewritten by the rewriting determination unit 92b. Determine the need to self-hold power. That is, the first power supply self-holding enabling unit 92c refers to the rewrite specification data shown in FIG.
  • the power supply 8 self-holds the power supply if the rewriting method of the ECU information of the rewrite target ECU 19 is designated as the power supply self-holding. It is determined that there is a necessity, and if it is designated for power supply control, it is determined that there is no need to hold the power supply by itself.
  • the second power supply self-holding validating unit 92f activates the second power supply self-holding circuit when the second power supply self-holding circuit is stopped, thereby enabling the second power supply self-holding circuit. .
  • the second power supply self-holding validating unit 92f extends the operation period of the second power supply self-holding circuit to enable the power supply self-holding circuit.
  • the second stop condition satisfaction determination unit 92g determines whether a stop condition for self-holding of the second power supply self-holding circuit is satisfied. Specifically, the second stop condition satisfaction determination unit 92g monitors the remaining battery level of the vehicle battery 40, occurrence of a timeout, and completion of rewriting in the rewriting target ECU 19, and when the remaining battery level of the vehicle battery 40 becomes less than the predetermined capacity. When it is determined that the rewriting target ECU 19 has completed the rewriting, that the timeout has occurred, or that the rewriting target ECU 19 has completed the rewriting, it is determined that the condition for stopping the self-holding of the second power supply self-holding circuit has been satisfied. The second power supply self-holding stop unit 92h stops the second power supply self-holding circuit when the second power supply self-holding circuit 92g determines that the power supply self-holding stop condition of the second power supply self-holding circuit is satisfied. .
  • the first power supply self-holding enabling unit 108b enables the first power supply self-holding circuit when the instruction determination unit 108a determines that the activation of the first power supply self-holding circuit has been instructed.
  • the first power supply self-holding enabling unit 108b activates the first power supply self-holding circuit until the designated completion time.
  • the first power supply self-holding validating unit 108b activates the first power supply self-holding circuit from the current time until the designated extension time elapses.
  • the first power-supply self-holding enabling unit 108b enables the first power-supply self-holding circuit as long as the self-holding request is being input.
  • the first power supply self-holding validating unit 108b activates the first power supply self-holding circuit to activate the first power supply self-holding circuit when the first power supply self-holding circuit is stopped. .
  • the first power supply self-holding validating unit 108b extends the operation period of the first power supply self-holding circuit, thereby enabling the first power supply self-holding circuit.
  • the first power supply self-holding validating unit 108b holds a default power supply self-holding time. 1. Enable the power supply self-holding circuit.
  • the first power supply self-holding validating unit 108b determines the longer of the default power supply self-holding time and the power supply self-holding time according to the instruction from the CGW 13. And the first power supply self-holding circuit is enabled.
  • the first stop condition satisfaction determination unit 108c determines whether the first power supply self-holding circuit power supply self-holding stop condition is satisfied. Specifically, if the target of the power supply self-holding is the rewrite target ECU 19, the first stop condition satisfaction determination unit 108c monitors the occurrence of a timeout, a stop instruction from the CGW 13, and generates a timeout, If it is determined that a stop instruction has been received, it is determined that the power supply self-holding stop condition of the first power supply self-holding circuit has been satisfied.
  • the first stop condition satisfaction determination unit 108c monitors the occurrence of a timeout, a user's getting off, and a stop instruction from the CGW 13 when the power source self-holding target is the in-vehicle display 7, and detects a timeout or a user's getting off. When it is determined that a stop instruction from the CGW 13 has been received or when a stop instruction from the CGW 13 has been received, it is determined that the stop condition of the first power supply self-holding circuit for self-holding power has been satisfied.
  • the first stop condition satisfaction determination unit 108 c monitors a stop instruction from the CGW 13, and if it determines that the stop instruction from the CGW 13 has been received, the first power supply self-holding circuit It is determined that the power supply self-holding stop condition is satisfied.
  • the first power supply self-holding stop unit 108d stops the first power supply self-holding circuit when the second stop condition satisfaction determination unit 108c determines that the power supply self-holding stop condition of the first power supply self-holding circuit is satisfied. .
  • the CGW 13 determines whether or not the vehicle power supply is off (S2601, corresponding to a vehicle power supply determination procedure).
  • the CGW 13 determines whether the application program is being rewritten (S2602, corresponding to a rewriting determination procedure).
  • the CGW 13 activates the second power supply self-holding circuit (S2603, corresponding to the second power supply self-holding activation procedure), and turns on the power supply in the rewriting target ECU 19.
  • the necessity of self-holding is determined (S2604, corresponding to a power self-holding determination procedure).
  • the CGW 13 determines whether or not the power supply self-holding stop condition is satisfied (S2606). If the CGW 13 determines that the power supply self-holding stop condition is satisfied (S2606: YES), the CGW 13 stops the second power supply self-holding circuit (S2606: YES). S2607), the power supply self-holding execution control process ends.
  • the configuration described above is such that the CGW 13 activates the power supply self-holding circuit when it is determined that the application program is being rewritten. If it is determined that the power supply self-holding circuit is being rewritten, the operating time of the power supply self-holding circuit during the activation may be extended.
  • the progress can be displayed on the in-vehicle display 7 instead of the portable terminal 6.
  • the CGW 13 Upon receiving the rewriting completion notification from the ECU (ID1), the CGW 13 notifies the in-vehicle display 7 of progress information on the rewriting status (S5112).
  • the in-vehicle display 7 updates and displays the progress status screen (S5113).
  • a two-sided memory configuration like the ECU (ID2) and the ECU (ID3), installation is possible even when the vehicle is running. Therefore, for example, when the vehicle is on the IG switch, the in-vehicle display 7 may display the progress.
  • the CGW 13 requests the power management ECU 20 to turn off the IG power (S5418).
  • the power management ECU 20 requests the power control circuit 43 to cut off the power supply to return to the power state in which the IG switch is turned off before the start of the installation.
  • the ECU (ID1), the ECU (ID2), the ECU (ID4), the ECU (ID5), and the ECU (ID6) And becomes a stop state.
  • the center device 3 When notified of the cancellation of the program update from the portable terminal 6, the center device 3 instructs the vehicle-side system 4 to cancel the program update (S6001). Then, the center device 3 changes the web screen to a display mode of being rolled back as the progress (S6002). The mobile terminal 6 displays a web screen indicating the progress during the rollback (S6003).
  • the CGW 13 notifies the in-vehicle display 7 of the progress for rollback (S6005).
  • the in-vehicle display 7 changes the display mode to the rollback display mode and displays the progress (S6006).
  • the in-vehicle display 7 displays, for example, "Rolling back", and displays 0% for the progress of the ECU (ID1) requiring rollback and 0% for the ECU (ID2).
  • the CGW 13 continues installing the write data as a rollback process for the ECU (ID2). Since the ECU (ID2) is a two-sided memory, it is also possible to interrupt the installation on the B-side, which is the non-operating side, halfway and continue to operate the A-side as the operating side. However, if the side B is in an incomplete state in which the installation has been performed halfway, the difference cannot be correctly restored at the next installation using the difference data. Therefore, the installation is continued to the ECU (ID2) to the end.
  • the CGW 13 requests a wake-up from the ECU (ID1) to perform a rollback process on the ECU (ID1) (S6101).
  • the CGW 13 notifies the ECU (ID1) that installation for rollback is to be started (S6102).
  • the ECU (ID1) changes the state to the wireless program update mode (S6103).
  • the CGW 13 performs access authentication with the ECU (ID1) (S6104).
  • the ECU (ID1) determines whether the rollback write data matches the own ECU (S6105). When it is determined that the rollback write data matches the own ECU, a write process to the ECU (ID1) is performed.
  • the in-vehicle display 7 updates and displays the rollback progress screen (S6114).
  • the CGW 13 Upon receiving the write completion notification from the ECU (ID1), the CGW 13 acquires the second divided file as the next write data and distributes the file to the ECU (ID1). Thereafter, the processing of S6106 to S6114 is repeated until the N-th divided file as the last write data.
  • the ECU (ID2) When the ECU (ID2) receives the rollback activation request from the CGW 13, the ECU (ID2) restarts itself without updating the stored operation surface information (S6205).
  • the ECU (ID2) When the ECU (ID2) continuously starts normally on the operation side A, the ECU (ID2) notifies the CGW 13 of the program version and operation side information together with the completion of the rollback activation (S6206).
  • the CGW 13 Upon receiving the rollback activation completion notification from the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 notifies the center device 3 of the rollback completion via the DCM 12 (S6209). Here, the CGW 13 also notifies the ECU (ID1), the ECU (ID2), and the program version and operation side information regarding the ECU (ID3).
  • the center device 3 registers the information notified from the DCM 12 in the database (S6210), and updates the web screen to a display indicating the completion of the cancellation as the progress status (S6211).
  • the mobile terminal 6 connects to the center apparatus 3 and displays a web screen indicating that the cancellation has been completed (S6212).
  • the CGW 13 upon receiving the notification of the completion of the activation for rollback from the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 notifies the in-vehicle display 7 that the rollback has been completed as a progress status (S6213). .
  • the in-vehicle display 7 displays that the rollback has been completed (S6214).
  • the CGW 13 requests the power management ECU 20 to turn off the IG power (S6215).
  • the power management ECU 20 requests the power control circuit 43 to cut off the power supply to return to the IG switch off state before the start of the installation.
  • the ECU (ID1), the ECU (ID2), the ECU (ID4), the ECU (ID5), and the ECU (ID6) And becomes a stop state.
  • the application program is rewritten with the ECU (ID1), the ECU (ID2), and the ECU (ID3) as one group.
  • the application program is rewritten for the ECU (ID6).
  • installation and activation are performed for the second group of ECUs 19.
  • the display terminal 5 is a terminal having a function of receiving an operation input from a user and a function of displaying various screens. And a vehicle-mounted display 7 such as a meter display.
  • the mobile terminal 6 can be connected to the communication network 2 within a communication range of the mobile communication network.
  • the in-vehicle display 7 is connected to the vehicle-side system 4.
  • the file server 8 has a function of managing an application program transmitted from the center device 3 to the vehicle-side system 4.
  • the file server 8 provides an ECU program provided from a supplier or the like, which is a provider of the application program, information accompanying the ECU program, and an OEM (Original). It is a server that manages distribution specification data provided from Equipment Manufacturer), vehicle status acquired from the vehicle-side system 4, and the like.
  • the file server 8 can perform data communication with the vehicle-side system 4 via the communication network 2, and when a download request of the distribution package is generated, a distribution package in which the relog data and the distribution specification data are packaged is transmitted to the vehicle side. Send to system 4.
  • the second bus 15 is, for example, a bus of a body network.
  • the ECU 19 connected to the second bus 15 includes, for example, a door ECU that controls locking / unlocking of a door, a meter ECU that controls a meter display, an air conditioner ECU that controls driving of an air conditioner, and a window ECU that controls opening and closing of a window. It is an ECU that controls the body system such as
  • the third bus 16 is, for example, a bus of a traveling system network.
  • the fourth bus 17 is, for example, a multimedia network bus.
  • the ECU 19 connected to the fourth bus 17 is an ECU that controls a multimedia system such as a navigation ECU for controlling a navigation system and an electronic toll collection system, that is, an ETC ECU for controlling an ECT system.
  • the buses 15 to 17 may be buses of a system other than the bus of the body network, the bus of the traveling network, and the bus of the multimedia network. Further, the number of buses and the number of ECUs 19 are not limited to the illustrated configuration.
  • the power management ECU 20 is an ECU having a function of performing power management of the DCM 12, the CGW 13, the various ECUs 19, and the like.
  • the sixth bus 21 is connected to the CGW 13 as a bus outside the vehicle.
  • a DLC (Data @ Link @ Coupler) connector 22 to which a tool 23 is detachably connected is connected to the sixth bus 21.
  • the buses 14 to 18 on the inside of the vehicle and the bus 21 on the outside of the vehicle are configured by, for example, a CAN (Controller Area Network, registered trademark) bus. Therefore, data communication is performed between the DCM 12, the various ECUs 19, and the tool 23.
  • the DCM 12 and the CGW 13 may be connected by Ethernet, or the DLC connector 22 and the CGW 13 may be connected by Ethernet.
  • the CGW 13 includes a microcomputer (hereinafter, referred to as a microcomputer) 24, a data transfer circuit 25, a power supply circuit 26, and a power supply detection circuit 27 as electrical functional blocks.
  • the microcomputer 24 has a CPU (Central Processing Unit) 24a, a ROM (Read Only Memory) 24b, a RAM (Random Access Memory) 24c, and a flash memory 24d.
  • the microcomputer 24 executes various control programs stored in the non-transitional substantive storage medium to perform various processes, and controls the operation of the CGW 13.
  • the data transfer circuit 25 controls data communication with the buses 14 to 18 and 21 in accordance with the CAN data communication standard and the diagnostic communication standard.
  • the power supply circuit 26 receives a battery power supply (hereinafter referred to as + B power supply), an accessory power supply (hereinafter referred to as ACC power supply), and an ignition power supply (hereinafter referred to as IG power supply).
  • the power supply detection circuit 27 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 26, compares these detected voltage values with a predetermined voltage threshold, and compares the detected voltage values. The result is output to the microcomputer 24.
  • the microcomputer 24 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the CGW 13 are normal or abnormal based on the comparison result input from the power supply detection circuit 27.
  • the ECU 19 has a microcomputer 28, a data transfer circuit 29, a power supply circuit 30, and a power supply detection circuit 31 as electrical functional blocks.
  • the microcomputer 28 has a CPU 28a, a ROM 28b, a RAM 28c, and a flash memory 28d.
  • the microcomputer 28 executes various control programs stored in the non-transitional substantive storage medium to perform various processes and controls the operation of the ECU 19.
  • the data transfer circuit 29 controls data communication with the buses 15 to 17 in accordance with the CAN data communication standard.
  • the power supply circuit 30 receives a + B power supply, an ACC power supply, and an IG power supply.
  • the power supply detection circuit 31 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 30, compares these detected voltage values with a predetermined voltage threshold value, and compares the detected voltage values.
  • the result is output to the microcomputer 28.
  • the microcomputer 28 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the ECU 19 are normal or abnormal based on the comparison result input from the power supply detection circuit 27.
  • the ECUs 19 are connected to different loads, such as sensors and actuators, and have basically the same configuration.
  • the DCM 12, the in-vehicle display 7, and the power management ECU have the same basic configuration as the ECU 19 shown in FIG.
  • the power management ECU 20, the CGW 13, and the ECU 19 are connected to the + B power line 32, the ACC power line 33, and the IG power line 34.
  • + B power supply line 32 is connected to the positive electrode of vehicle battery 35.
  • the ACC power line 33 is connected to the positive electrode of the vehicle battery 35 via the ACC switch 36.
  • the ACC switch 36 is switched from off to on, and the output voltage of the vehicle battery 35 is applied to the ACC power supply line 33.
  • both the ACC switch 36 and the IG switch 37 are off, only + B power is supplied to the vehicle-side system 4.
  • a state in which only the + B power supply is supplied to the vehicle-side system 4 is referred to as a + B power supply state.
  • ACC switch 36 is on and the IG switch 37 is off, ACC power and + B power are supplied to the vehicle-side system 4.
  • a state in which the ACC power supply and the + B power supply are supplied to the vehicle-side system 4 is referred to as an ACC power supply state.
  • the + B power, the ACC power, and the IG power are supplied to the vehicle-side system 4.
  • a state in which the + B power supply, the ACC power supply, and the IG power supply are supplied to the vehicle-side system 4 is referred to as an IG power supply state.
  • a power control circuit 38 is connected in parallel to the ACC switch 36 and the IG switch 37.
  • the CGW 13 transmits a power control request to the power management ECU 20, and causes the power management ECU 20 to control the power control circuit 38. That is, the CGW 13 transmits a power activation request as a power control request to the power management ECU 20, and connects the ACC power line 33 or the IG power line 34 to the positive electrode of the vehicle battery 35 inside the power control circuit 38. In this state, ACC power and IG power are supplied to the vehicle-side system 4 even when the ACC switch 36 and the IG switch 37 are off.
  • the CGW 13 transmits a power stop request as a power control request to the power management ECU 20, and disconnects the ACC power line 33, the IG power line 34, and the positive electrode of the vehicle battery 35 inside the power control circuit 38.
  • the DCM 12, the CGW 13, and the ECU 19 have a power supply self-holding function. That is, when the vehicle power is switched from the ACC power supply or the IG power supply to the + B power supply in the activated state, the DCM 12, the CGW 13, and the ECU 19 shift from the activated state to the sleep state or the stopped state immediately after the switching. Instead, even immediately after the switching, the driving state is maintained for a predetermined period of time and the driving power source is held by itself.
  • relog data is generated from write data provided from a supplier who is a provider of an application program and rewrite specification data mainly provided from an OEM.
  • the write data provided by the supplier includes difference data corresponding to the difference between the old application program and the new application program, and all data corresponding to the entire new application program.
  • the difference data and all data may be compressed by a known data compression technique.
  • the difference data is provided as write data from the suppliers A to C, the encrypted difference data of the ECU (ID1) provided from the supplier A and the authenticator, and the encryption of the ECU (ID2) provided from the supplier B are provided.
  • reprolog data is generated from already-acquired difference data and authenticator, encrypted difference data and authenticator of ECU (ID3) provided by supplier C, and rewrite specification data provided by OEM.
  • ID3 encrypted difference data and authenticator of ECU
  • rewrite specification data provided by OEM. I have.
  • An authenticator is provided for each write data.
  • FIG. 238 shows the difference data when updating from the old application program to the new application program. It is good also as composition which includes.
  • the rollback difference data is included in the relog data.
  • the rewrite specification data provided by the OEM includes information that can specify the rewrite target ECU 19, information that can specify the rewrite order when there are a plurality of rewrite target ECUs 19, and a role that will be described later.
  • the data includes information that can specify the backing method and the like, and defines data related to rewriting in the DCM 12, the CGW 13, and the rewriting target ECU 19.
  • the rewrite specification data is divided into rewrite specification data for DCM used by the DCM 12 and rewrite specification data for CGW used by the CGW 13.
  • the CGW rewrite specification data describes information necessary for controlling rewrite in the rewrite target ECU 19.
  • the DCM 12 When the DCM 12 acquires the rewrite specification data for DCM, the DCM 12 analyzes the rewrite specification data for DCM, and controls operations related to rewrite such as transfer of write data to the CGW 13 according to the analysis result.
  • the CGW 13 acquires the rewrite specification data for the CGW, the CGW 13 analyzes the rewrite specification data for the CGW, and obtains the write data from the DCM 12 and distributes the write data to the rewrite target ECU 19 according to the analysis result. Controls operations related to rewriting.
  • the file server 8 the above-described re-log data is registered, and the distribution specification data provided by the OEM is registered.
  • the delivery specification data provided by the OEM is data that defines an operation related to display of various screens on the display terminal 5.
  • the file server 8 may transmit the distribution specification data to the DCM 12 first and then transmit the re-log data to the DCM 12 later. Further, the file server 8 may make the reprolog data and the distribution specification data into one distribution package as one file, and transmit the distribution package and the package authenticator to the DCM 12.
  • the DCM 12 downloads the distribution package from the file server 8
  • the DCM 12 verifies the package authenticator stored in the distribution package and the encrypted replog data. If the verification result is positive, the DCM 12 deletes the encrypted replog data. Decrypt.
  • the DCM 12 decrypts the encrypted replog data
  • the DCM 12 unpackages the decrypted replog data, and encrypts the differential data and the authenticator for each ECU, the rewrite specification data for the DCM, and the rewrite data for the CGW. Generate the original data.
  • FIG. 240 is a block diagram showing a portion related to each function of the servers 8 to 10 in the center device 3.
  • FIG. 241 shows an outline of processing performed by the center device 3 for updating the program of the ECU.
  • “database” may be referred to as “DB”.
  • the center device 3 includes a package management unit 3A, a configuration information management unit 3B, an individual vehicle information management unit 3C, and a campaign management unit 3D.
  • the package management unit 3A includes a specification data generation unit 201, a package generation unit 202, and a package distribution unit 203, an ECU repro data DB 204, an ECU metadata DB 205, and a package DB 206.
  • the configuration information management unit 3B has a configuration information registration unit 207 and a configuration information DB 208.
  • the supplier registers ECU-specific data using the input unit 218 and the display unit 219, which are user interface (UI) functions of the management server 10.
  • the ECU-specific data includes a program file such as a new program and difference data, verification data and size of the program file, program file-related information such as an encryption method, and data relating to ECU attribute information such as a memory structure of the ECU 19.
  • the program file is stored in the ECU repro data DB 204.
  • the ECU attribute information is stored in the ECU metadata DB 205.
  • the program file related information may be stored in the ECU repro data DB 204 or may be stored in the ECU metadata DB 205.
  • the ECU relog data DB 204 is an example of an update data storage unit.
  • the ECU metadata DB 205 is an example of a device-related information storage unit.
  • the OEM registers the regular configuration information in the configuration information DB 208 for each vehicle model via the configuration information registration unit 207.
  • the regular configuration information is the configuration information of the vehicle that has been approved by a public organization.
  • the configuration information is identification information relating to hardware and software of the ECU 19 mounted on the vehicle, and is an example of vehicle-related information.
  • the configuration information includes identification information of a system configuration including a plurality of ECUs 19 and identification information of a vehicle configuration including a plurality of systems. Further, as the configuration information, vehicle constraint information on updating the program may be registered. For example, ECU group information, bus load table, information on battery load, and the like described in the rewrite specification data may be registered.
  • the ECU metadata DB 205 is an example of a device-related information storage unit.
  • the configuration information DB 208 is an example of a vehicle information storage unit.
  • the specification data generation unit 201 generates rewrite specification data with reference to each DB.
  • the package generation unit 202 generates a distribution package including the rewrite specification data and the re-log data, and registers the distribution package in the package DB 206.
  • the package generation unit 202 may generate a distribution package including distribution specification data.
  • the package distribution unit 203 distributes the registered distribution package to the vehicle-side system 4. A distribution package corresponds to a file.
  • the vehicle information management unit 3C includes a vehicle information registration unit 209, a configuration information confirmation unit 210, an update presence / absence confirmation unit 211, an SMS transmission control unit 212, and a vehicle information DB 213.
  • the individual vehicle information registration unit 209 registers the individual vehicle information uploaded from each individual vehicle in the individual vehicle information DB 213.
  • the private vehicle information registration unit 209 may register private vehicle information at the time of vehicle production or sale in the private vehicle information DB 213 as an initial value.
  • the configuration information confirmation unit 210 collates the individual vehicle information with the configuration information of the same model vehicle registered in the configuration information DB 208.
  • the update presence / absence confirmation unit 211 confirms whether the individual vehicle information has been updated by a new program, that is, whether there is a campaign.
  • the SMS transmission control unit 212 transmits a message related to the update to the corresponding vehicle by SMS (Short Message Service).
  • the campaign management unit 3D includes a campaign generation unit 214, a campaign distribution unit 215, an instruction notification unit 216, and a campaign DB 217.
  • the OEM generates campaign information, which is information related to program update, by the campaign generation unit 214 and registers the campaign information in the campaign DB 217.
  • the campaign information here corresponds to the above-mentioned “distribution specification data”, and is mainly information relating to the update contents displayed by the vehicle-side system 4.
  • the campaign distribution unit 215 distributes campaign information to vehicles.
  • the instruction notification unit 216 notifies the vehicle of an instruction necessary for updating the program. In the vehicle-side system 4, for example, the user determines whether to download the update program based on the campaign information transmitted from the center device 3, and downloads the update program if necessary.
  • the portions of each of the management units 3A to 3D except for the databases are functions realized by computer hardware and software.
  • the vehicle communication unit 222 is a functional block for wirelessly performing data communication between the center device 3 and the vehicle-side
  • Vehicle type indicates a vehicle type.
  • Vehicle ⁇ SW ⁇ ID is a software ID for the entire vehicle, and corresponds to a vehicle software ID. Only one "Vehicle SW ID” is given to each vehicle, and is updated as the version of the application program of one or more ECUs is updated.
  • Syns @ ID is an ID of a system when a group of a plurality of ECUs 19 mounted on each vehicle is a "system".
  • ADS automatic driving ECU
  • ENG engine ECU
  • BK brake ECU
  • EPS electric power steering ECU
  • the initial value is registered in the configuration information DB 208 at the time of production or sale of the vehicle, and thereafter, is updated as the version of the application program of one or more ECUs is updated. That is, the configuration information DB 208 indicates, for each vehicle model, configuration information that is normally present in the market.
  • FIG. 243 exemplifies an automatic driving ECU (ADS), a brake ECU (BRK), and an electric power steering ECU (EPS) as the ECUs 19 whose application programs are updated among the ECUs 19 mounted on a certain vehicle model.
  • ADS automatic driving ECU
  • BK brake ECU
  • EPS electric power steering ECU
  • the rollback data file which is also difference data, the rollback data integrity verification data, and the like are registered.
  • the integrity verification data is a hash value obtained by applying a hash function to the data value.
  • FIG. 243 shows the data structure of the latest "ECU @ SW @ ID". However, if data of the old "ECU @ SW @ ID" is stored, the old program file is replaced with the oldest "ECU @ SW @ ID”. The new program file of "ID" may be referred to. Further, each integrity verification data may be in a form in which a value calculated by the supplier is registered, or in a form in which the center device 3 calculates and registers.
  • the following ECU-specific data is registered in the ECU metadata DB 205 as an example.
  • the latest "ECU ⁇ SW ⁇ ID” when the size of the update data file, the size of the rollback data file, and the flash memory 28d included in the ECU 19 has two or more surfaces, any of the A surface, the B surface, the C surface, etc.
  • the information includes surface information indicating whether the program is a surface program, a transfer size, a program file read address, and the like. These are examples of update data related information.
  • Attribute information indicating the attributes of the ECU 19 is also registered in the ECU metadata DB 205.
  • the attribute information is information indicating a hardware attribute and a software attribute of the ECU.
  • the “transfer size” is a transfer size when dividing and transferring the rewrite data from the CGW 13 to the ECU 19, and the “key” is a key used when the CGW 13 accesses the ECU 19 securely.
  • the "vehicle model” and "ECU @ ID” also include the memory configuration of the flash memory 28d included in the ECU 19, the type of bus to which the ECU 19 is connected, the type of power supply connected to the ECU 19, and the like. These are examples of hardware attribute information.
  • the memory configuration “one side” is a single-sided memory having one flash side
  • a “two sided” is a two-sided memory having two flash sides
  • the “suspend” is a flash side.
  • This is a one-sided suspend type memory having two pseudo sides.
  • the hardware attribute information and the software attribute information are information used for rewriting control of each ECU 19 in the vehicle-side system 4.
  • the hardware attribute information can be stored in the CGW 13 in advance, but in the present embodiment, the center device 3 manages the hardware attribute information in order to reduce the management load on the vehicle-side system 4.
  • the software attribute information is data for directly specifying the rewriting operation of each ECU 19.
  • the center device 3 manages the control so that the vehicle-side system 4 can realize flexible control.
  • the following data for each individual vehicle is registered in the individual vehicle information DB 213 as an example.
  • configuration information for each individual vehicle and status information of the individual vehicle for the program update are registered. More specifically, the configuration information “Vehicle SW ID”, “Sys ID”, “ECU ID”, “ECU SW ID”, etc., for the “VIN” that is the ID of each vehicle.
  • the “Digest” value which is a hash value for these pieces of configuration information, is also calculated by the center device 3 and stored.
  • the “operation surface” is a surface in which the program currently operated by the ECU 19 is written when the memory configuration is two, and the uploaded value is registered together with the configuration information.
  • the “access log” is the date and time when the vehicle uploaded the individual vehicle information to the center device 3.
  • the “repro status” indicates the status of the reprog in the vehicle, and includes, for example, “campaign issued”, “activation completed”, “download completed”, and the like. In other words, the progress status indicates to which phase the replog in the vehicle has progressed and at which phase the stagnation has stopped.
  • configuration information and the like are uploaded from the vehicle-side system 4 to the center device 3, "VIN" of each vehicle is added to the information and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Chemical & Material Sciences (AREA)
  • Combustion & Propulsion (AREA)
  • Transportation (AREA)
  • Mechanical Engineering (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Remote Sensing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Human Computer Interaction (AREA)
  • Automation & Control Theory (AREA)
  • Stored Programmes (AREA)

Abstract

Cette invention concerne un système de commande électronique de véhicule (1), comprenant un dispositif central (3), comprenant : une unité de stockage de données de mise à jour (54a) pour établir, en tant que campagne, la réécriture d'un programme pour une pluralité de dispositifs de commande électronique pour lesquels une réécriture doit être effectuée, et stocker des données de mise à jour pour une pluralité d'objets pour lesquels une réécriture doit être effectuée ; une unité de stockage d'informations de commande d'affichage (54b) pour stocker des informations de commande d'affichage requises pour afficher des informations relatives à une campagne dans le véhicule ; et une unité de transmission d'informations (54c) pour transmettre les données de mise à jour stockées dans l'unité de stockage de données de mise à jour et les informations de commande d'affichage stockées dans l'unité de stockage d'informations de commande d'affichage à un dispositif maître de véhicule.
PCT/JP2019/030948 2018-08-10 2019-08-06 Système de commande électronique de véhicule, dispositif central, dispositif maître de véhicule, procédé de commande de transmission d'informations de commande d'affichage, procédé de commande de réception d'informations de commande d'affichage, programme de commande de transmission d'informations de commande d'affichage et programme de commande de réception d'informations de commande d'affichage WO2020032047A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN201980056957.9A CN112673360A (zh) 2018-08-10 2019-08-06 车辆用电子控制系统、中心装置、车辆用主装置、显示控制信息的发送控制方法、显示控制信息的接收控制方法、显示控制信息的发送控制程序以及显示控制信息的接收控制程序
DE112019004063.4T DE112019004063T5 (de) 2018-08-10 2019-08-06 Elektronisches fahrzeugsteuerungssystem, zentrumsvorrichtung, fahrzeug-master-vorrichtung, anzeigesteuerungsinformations-übertragungssteuerungsverfahren, anzeigesteuerungsinformations-empfangssteuerungsverfahren, anzeigesteuerungsinformations-übertragungssteuerungsprogramm und anzeigesteuerungsinformations-empfangssteuerungsprogramm
US17/167,443 US11907697B2 (en) 2018-08-10 2021-02-04 Vehicle electronic control system, center device, vehicle master device, display control information transmission control method, display control information reception control method, display control information transmission control program, and display control information reception control program

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
JP2018-151430 2018-08-10
JP2018151430 2018-08-10
JP2019129971A JP7419689B2 (ja) 2018-08-10 2019-07-12 車両用電子制御システム、センター装置、車両用マスタ装置、表示制御情報の送信制御方法、表示制御情報の受信制御方法、表示制御情報の送信制御プログラム及び表示制御情報の受信制御プログラム
JP2019-129971 2019-07-12

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/167,443 Continuation US11907697B2 (en) 2018-08-10 2021-02-04 Vehicle electronic control system, center device, vehicle master device, display control information transmission control method, display control information reception control method, display control information transmission control program, and display control information reception control program

Publications (1)

Publication Number Publication Date
WO2020032047A1 true WO2020032047A1 (fr) 2020-02-13

Family

ID=69414849

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2019/030948 WO2020032047A1 (fr) 2018-08-10 2019-08-06 Système de commande électronique de véhicule, dispositif central, dispositif maître de véhicule, procédé de commande de transmission d'informations de commande d'affichage, procédé de commande de réception d'informations de commande d'affichage, programme de commande de transmission d'informations de commande d'affichage et programme de commande de réception d'informations de commande d'affichage

Country Status (2)

Country Link
JP (1) JP7419737B2 (fr)
WO (1) WO2020032047A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7367626B2 (ja) * 2020-07-08 2023-10-24 トヨタ自動車株式会社 ソフトウェア更新装置、方法、プログラムおよび車両
JP2023148273A (ja) * 2022-03-30 2023-10-13 株式会社デンソー 車両用パーソナライズ設定システム、及び車両用パーソナライズ設定方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2017134506A (ja) * 2016-01-26 2017-08-03 株式会社日立製作所 ソフトウェア更新システム、サーバ
JP2017224047A (ja) * 2016-06-13 2017-12-21 クラリオン株式会社 ソフトウェア更新装置およびソフトウェア更新システム
JP2018037059A (ja) * 2016-08-30 2018-03-08 株式会社オートネットワーク技術研究所 車載更新装置及び車載更新システム

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2012063975A (ja) * 2010-09-16 2012-03-29 Buffalo Inc 通信装置および通信装置用ファームウェア更新システム
JP6064529B2 (ja) * 2012-11-07 2017-01-25 株式会社リコー 情報処理装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2017134506A (ja) * 2016-01-26 2017-08-03 株式会社日立製作所 ソフトウェア更新システム、サーバ
JP2017224047A (ja) * 2016-06-13 2017-12-21 クラリオン株式会社 ソフトウェア更新装置およびソフトウェア更新システム
JP2018037059A (ja) * 2016-08-30 2018-03-08 株式会社オートネットワーク技術研究所 車載更新装置及び車載更新システム

Also Published As

Publication number Publication date
JP7419737B2 (ja) 2024-01-23
JP2020027665A (ja) 2020-02-20

Similar Documents

Publication Publication Date Title
WO2020032196A1 (fr) Système de communication d'informations de véhicule
WO2020032200A1 (fr) Dispositif central, procédé de génération de données de spécifications et programme de génération de données de spécifications
JP2020027643A (ja) 車両用電子制御システム、電源自己保持の実行制御方法及び電源自己保持の実行制御プログラム
JP2020028121A (ja) 車両用マスタ装置、更新データの配信制御方法、更新データの配信制御プログラム及び諸元データのデータ構造
JP2020027631A (ja) 車両用プログラム書換えシステム、車両用マスタ装置、進捗状態の同期制御方法及び進捗状態の同期制御プログラム
WO2020032122A1 (fr) Dispositif de commande électronique, système de commande électronique de véhicule, procédé de commande d'exécution de réécriture, programme de commande d'exécution de réécriture et structure de données de spécification
JP2020027636A (ja) 車両用マスタ装置、更新データの検証方法及び更新データの検証プログラム
JP2020027628A (ja) 車両用電子制御システム、配信パッケージのダウンロード判定方法及び配信パッケージのダウンロード判定プログラム
JP2020027640A (ja) 電子制御装置、書換えの実行制御方法及び書換えの実行制御プログラム
JP2020027638A (ja) 車両用マスタ装置、車両用電子制御システム、アクティベート要求の指示方法及びアクティベート要求の指示プログラム
JP2020027629A (ja) 車両用マスタ装置、インストールの指示判定方法及びインストールの指示判定プログラム
JP2020027634A (ja) 電子制御装置、車両用電子制御システム、差分データの整合性判定方法及び差分データの整合性判定プログラム
WO2020032046A1 (fr) Système de commande électronique de véhicule, procédé de commande de transfert de fichier, programme de commande de transfert de fichier, et structure de données de données de spécification
JP2020027637A (ja) 車両用マスタ装置、非書換え対象の電源管理方法及び非書換え対象の電源管理プログラム
JP2020027630A (ja) 車両用マスタ装置、ロールバックの実行制御方法、ロールバックの実行制御プログラム及び諸元データのデータ構造
JP2020027635A (ja) 電子制御装置、リトライポイントの特定方法及びリトライポイントの特定プログラム
JP2020027633A (ja) 車両用マスタ装置、書換え対象のグループ管理方法、書換え対象のグループ管理プログラム及び諸元データのデータ構造
WO2020032043A1 (fr) Système de commande électronique de véhicule, procédé de détermination de téléchargement d'un progiciel de distribution et programme de détermination de téléchargement d'un progiciel de distribution
WO2020032047A1 (fr) Système de commande électronique de véhicule, dispositif central, dispositif maître de véhicule, procédé de commande de transmission d'informations de commande d'affichage, procédé de commande de réception d'informations de commande d'affichage, programme de commande de transmission d'informations de commande d'affichage et programme de commande de réception d'informations de commande d'affichage
WO2020032199A1 (fr) Système de communication d'informations de véhicule
JP2020028120A (ja) 車両用マスタ装置、セキュリティアクセス鍵の管理方法、セキュリティアクセス鍵の管理プログラム及び諸元データのデータ構造
JP2020027641A (ja) 車両用電子制御システム、センター装置、車両用マスタ装置、表示制御情報の送信制御方法、表示制御情報の受信制御方法、表示制御情報の送信制御プログラム及び表示制御情報の受信制御プログラム
JP2020027632A (ja) 電子制御装置、車両用電子制御システム、アクティベートの実行制御方法及びアクティベートの実行制御プログラム
WO2020032045A1 (fr) Dispositif maître de véhicule, procédé de gestion de groupe pour des objets pour lesquels une réécriture doit être effectuée, programme de gestion de groupe pour des objets pour lesquels une réécriture doit être effectuée, et structure de données de données de spécification
WO2020032201A1 (fr) Système de commande électronique de véhicule, procédé de commande d'exécution d'auto-maintien de source d'alimentation et programme de commande d'exécution d'auto-maintien de source d'alimentation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19847025

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 19847025

Country of ref document: EP

Kind code of ref document: A1